App Review Windows Defender vs Top 100 Infostealers

[lokamoka820]

Not entirely surprised with the outcome, no wonder kids keep getting their Roblox accounts hacked, lol.

MS Defender doesn't have web protection, so it is not responsible for phishing and credentials hacking attack, the problem here is between the chair and the keyboard.

 

[simmerskool]

It's a test. One test. Machine gun approach. MS Defender didn't do too bad, all things considered. Encountering even one of these, let alone 100, would be highly dependent on user behavior. In the end, brain.exe is still the best 1st line of defense. Stay safe, not paranoid. Word.

...also at the beginning of video he says "default" Defender. Later in the video he says you can add some additional Defender protections but he doubted they give more protection. IIRC this was recently discussed here with @danb (DefenderUI) and @Andy Ful (ConfigureDefender) and others.

 

[monkeylove]

MS Defender doesn't have web protection, so it is not responsible for phishing and credentials hacking attack, the problem here is between the chair and the keyboard.

I read that there are now more malware that can hide in legitimate software, that are part of legitimate websites, and that can run without user interaction.

 

[Andy Ful]

Leo tested the detection of AV1 against 100 samples and 22 samples were undetected. Next, he used AV2, AV3, ... on undetected samples and we could see that those AVs detected a few samples from those undetected samples. He forgot that AV2, AV3, ... could also miss a few samples that were already detected by AV1. But, we did not have a chance to see if it could be true or not, due to an invalid procedure applied in the Leo test. The only useful information from the video is that the Norton Power Eraser tool (not an AV) is very efficient.

This is a good example of when the initial assumption about AV1 makes the test results irrelevant.

 

[Vitali Ortzi]

Leo tested the detection of AV1 against 100 samples and 22 samples were undetected. Next, he used AV2, AV3, ... on undetected samples and we could see that those AVs detected a few samples from those undetected samples. He forgot that AV2, AV3, ... could also miss a few samples that were already detected by AV1. But, we did not have a chance to see if it could be true or not, due to an invalid procedure applied in the Leo test. The only useful information from the video is that the Norton Power Eraser tool (not an AV) is very efficient.

This is a good example of when the initial assumption about AV1 makes the test results irrelevant.

The av used for detection are more aggressive
Norton power eraser uses more aggressive huristics then max settings on Symantec and uses some that are exclusive to the scanner (Symantec diagnostics , Norton power eraser is on purpose built to find as much malware as possible)
Hitman pro is far more aggressive then sophos too
Obviously they would detect more and have more false positives then defender
With 100 samples I'm sure the super aggressive scanners would get better results so what as they aren't a realtime av for obvious reasons and if he tested sophos , Norton consumer products on default settings they should miss some samples just like defender



"Power Eraser scans and virus and spyware scans both run an active scan and a full scan.
However, Power Eraser uses the more aggressive High Intensity Detection (HID) scans that employ advanced machine learning (AML) techniques. The AML engine determines if a file is good or bad through a learning process.
The AML engine recognizes malicious attributes and defines the rules that the AML engine uses to make detectio
ns."
Source

What you should know before you run Symantec Power Eraser from the Symantec Endpoint Protection Manager console

Symantec Power Eraser is a free virus removal tool to remove malware and threats from your computer. Power Eraser is provided with the product and does not need to be installed.

techdocs.broadcom.com

 

[Andy Ful]

It is probably true that Hitman Pro and EEK scanners are more aggressive and can detect more, but one cannot conclude this from Leo's video due to an invalid testing procedure.

Of course, we can also treat the video as a presentation (not a true test) of the author's beliefs based on his experience. It would be better if he would mention that generally, the detection of infostealers is a challenge for all AVs and about 20% of such malware can be undetected in the wild (by malware scanning).

 

[simmerskool]

The av used for detection are more aggressive
Norton power eraser
Source

What you should know before you run Symantec Power Eraser from the Symantec Endpoint Protection Manager console

Symantec Power Eraser is a free virus removal tool to remove malware and threats from your computer. Power Eraser is provided with the product and does not need to be installed.

techdocs.broadcom.com

Is Norton Power Eraser (NPE) the same as Symantec Power Eraser? My version of NPE has a version date of 2022. It used to update fairly often but it hasn't updated itself in quite awhile. If there is a Symantec PE, is free and where can it be downloaded, or is it only a component of Symantc endpoint av??

 

[Vitali Ortzi]

Is Norton Power Eraser (NPE) the same as Symantec Power Eraser? My version of NPE has a version date of 2022. It used to update fairly often but it hasn't updated itself in quite awhile. If there is a Symantec PE, is free and where can it be downloaded, or is it only a component of Symantc endpoint av??

I always use Symantec diagnostic tool instead it's more advanced version of power eraser then the Norton one and is free as well

Download SymDiag to detect product issues

knowledge.broadcom.com

"Symantec Endpoint Protection does not include an option to launch Power Eraser directly from the client. However, a user on the client computer can download the SymDiag tool and run Power Eraser from the tool."

 

[Szellem]

It is probably true that Hitman Pro and EEK scanners are more aggressive and can detect more, but one cannot conclude this from Leo's video due to an invalid testing procedure.

Of course, we can also treat the video as a presentation (not a true test) of the author's beliefs based on his experience. It would be better if he would mention that generally, the detection of infostealers is a challenge for all AVs and about 20% of such malware can be undetected in the wild (by malware scanning).

I always appreciate your answers. They are informative and open people's eyes. Thanks, and I look forward to reading more.

 

[tofargone]

MS Defender doesn't have web protection, so it is not responsible for phishing and credentials hacking attack, the problem here is between the chair and the keyboard.

You mean the problem is my arms?

 

[tofargone]

Is Norton Power Eraser (NPE) the same as Symantec Power Eraser? My version of NPE has a version date of 2022. It used to update fairly often but it hasn't updated itself in quite awhile. If there is a Symantec PE, is free and where can it be downloaded, or is it only a component of Symantc endpoint av??

ignore the version date, mine updates every time I run it, but that about / version date strays the same

 

[KnownStormChaser]

MS Defender doesn't have web protection, so it is not responsible for phishing and credentials hacking attack, the problem here is between the chair and the keyboard.

That's not the question though, he was testing for infostealers, which is not the same as phishing. Defender should have detected that.

 

[Andy Ful]

Yes, phishing cannot be an excuse for not detecting infostealers. Simply, AVs on default settings did not develop efficient methods to fight infostealers.

 

[simmerskool]

ignore the version date, mine updates every time I run it, but that about / version date strays the same

I used to see my NPE update (ie be aware it was updating) but have not seen it do that in a long time

 

[lokamoka820]

That's not the question though, he was testing for infostealers, which is not the same as phishing. Defender should have detected that.

Does Roblox have a window's client? Because I was pointing about hacking Roblox accounts, not on the video contents.

 

[lokamoka820]

You mean the problem is my arms?

No, I mean the kids whose their Roblox account hacked.

 

[mlnevese]

Does Roblox have a window's client? Because I was pointing about hacking Roblox accounts, not on the video contents.

Yes. It has a Windows client. Two actually, both official. One you can download from their page and the other from Microsoft Store.

 

[lokamoka820]

Yes. It has a Windows client. Two actually, both official. One you can download from their page and the other from Microsoft Store.

Thanks for clarifying this, so infostealers can hack those clients when using MS Defender?

 

[Andy Ful]

..., so infostealers can hack those clients when using MS Defender?

Yes, with any AV. The recent campaign was active for over a year.

 

[Szellem]

Yes, with any AV. The recent campaign was active for over a year.

Andy! I would like to ask you. Are the tests on the av-comparatives and av-test sites relevant? Are these sites reliable?If not, what is the problem with them?