Jump to content

Marcos

Administrators
  • Posts

    36,228
  • Joined

  • Last visited

  • Days Won

    1,441

Everything posted by Marcos

  1. Please contact your local distributor. I have no clue where you found the key; if you purchased a license you should have a registration email with your license details. If you lost it, it's possible to retrieve it, e.g. through your local distributor if you purchased the license from him.
  2. Please refer to tests performed by prestigious testing organizations that adhere to AMTSO principles, such as www.av-comparatives.org, SE Labs (selabs.uk), www.av-test.org, Virus Bulletin, etc. As I have proved above, removing even one protection layer may lead to incorrect and skewed results. I showed where ESET detected a fresh Filecoder Crysis ransomware which was missed by all other well-known AVs but in fact that didn't tell anything about if they would protect users from the ransomware upon download or execution.
  3. I'm sorry, I don't understand. Each vendor uses its own mechanisms to detect and get suspicious files. There are many ways how vendors get samples but the quickest way to learn about new malware is via feedback systems which is ESET LiveGrid in our products. What matters is how quickly a particular vendor can identify new malware and respond to it by adding recognition. The problem with script malware is that scripts can be modified easily even by people with little knowledge (e.g. by kids or students) until they become undetected by the vendor that they focus on. No matter what vendor it is, detection of scripts can be relatively easily circumvented. The only 100% protection against script malware is blocking the script interpreter from interpreting scripts, e.g. which are placed outside of a folder in which execution of (legitimate) scripts is allowed. And that is also why we recommend applying HIPS anti-ransomware policies to improve protection even more.
  4. If I was to perform a quick on-demand test of very fresh malware detection: Fresh Filecoder.Crysis: A clean S clean ESET Win32/GenKryptik.CTAZ A clean M clean D clean B clean K clean Fresh Dridex trojan: A clean ESET Win32/Dridex.U S clean A clean M clean B clean K clean D clean M clean And I could continue like that with any fresh malware sample but there's no sense in it. The point is bypassing a single protection layer obviously skews results as we all know that at least some of the above AVs would detect the malware upon download or execution.
  5. If you really think that other AVs outperform ESET, then why you are still using it? Just a rhetorical question.
  6. If you deploy an installer with AV Remover, then the previous AV should be uninstalled provided that it's supported by AV Remover.
  7. I'd like to bring the following write-up by AV-Comparatives into your attention which clarifies why unprofessional tests are flawed: https://www.av-comparatives.org/spotlight-on-security-why-do-av-products-score-so-highly-in-professional-tests/ Compare the methodology used in this "test" with what AV-Comparatives wrote:
  8. Please contact your local distributor to answer questions re. licenses.
  9. I'm unable to install the extension to reproduce the issue. Getting the error below:
  10. Personally I haven't come across such issue yet. Please contact your local customer care so that the case is properly tracked and communicated with developers.
  11. Egui should be started via ecmds. During installation the following value is added to the run key: "C:\Program Files\ESET\ESET Security\ecmds.exe" /launch /hide
  12. I strongly disagree with this accusation. Itman is not an employee of ESET and has no other relation to the company. He's become an active user in our forum and is a person who 's always willing to help the other with issues they have for no profit.
  13. Below find my personal comments that may not represent an official response of the company on this test. 1, It's not a real world test and it appears that some protection layers were bypassed (e.g. web protection with more aggressive detection and url blocking), ie. the results might not reflect how ESET would protect users in real life. Also the question is if the missed sample was actual or synthetic threat. Since we didn't get missed samples for verification, we don't know how prevalent in the world they are. 2, A false positive test was not a part of the test. It's easy to detect 100% of malware if also clean files are detected. 3, The author works for Emsisoft. Despite the claims of being independent, it's hard to believe that this did not affect the test in any way. It's also interesting that Bitdefender got best results and Emsisoft uses its engine as well. Employees of AV companies should not perform tests that they proclaim to be independent and unbiased. Only prestigious and respectful AV testing organizations should do that where independence is ensured. It would not be too difficult to make a test where an AV scoring 100% in other tests would get 0% if the "right" samples were picked in the test set. 4, "If a sample successfully makes it to memory and begins execution, it is considered a miss." This is a flawed methodology. A file has to be first unpacked in memory before it is executed. Advanced memory scanner triggers a scan only after a file has been executed and unpacked in memory. I strongly recommend taking tests from youtube or performed by other than non-professional testers with a pinch of salt. One must consider and understand all aspects of how a test was performed in order to take the results seriously.
  14. Please provide a handful of screen shots to illustrate what kind of status notifications you are seeing that you'd prefer not to be reported in the console.
  15. I will check with my colleagues if we are aware of this test and if was performed according to AMTSO standards (https://www.amtso.org/wp-content/uploads/2018/11/AMTSO-Testing-Protocol-Standard-for-the-Testing-of-Anti-Malware-Solutions-v1.1.pdf), especially with regard to
  16. Haven't tried it but the following might work: MSIEXEC /x %GUID% /qb REBOOT="ReallySuppress" PASSWORD="password" Find the appropriate GUID under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall.
  17. One cannot satisfy 100% of users. Some people like gui, some not. If we changed it, the others would like it but the rest would not. People generally like the granularity of settings but obviously some don't. If we reduced the settings to the bare minimum, some people would like like it but the majority wouldn't.
  18. It looks like PowerShell was dropping a bunch of old malware plus Python was accessing it somehow. Doesn't look like a common infection scenario at all. Please provide the exact methodology how the test was performed and provide undetected files for verification so that we can check if they should be detected or not.
  19. If it's possible to uninstall it in a standard way via Add and remove programs, maybe this would work unless the settings are password protected: (Get-WmiObject -Class Win32_Product -Filter "Name='ESET Endpoint Security'" -ComputerName . ).Uninstall()
  20. Currently you need to re-deploy agent twice. The first time it will upgrade agent to the latest version and the second time certificates and connection settings will be updated.
  21. Are you prompted for an action even if you delete all existing webcam protection rules and choose to remember the action again? Does the problem persist even after uninstalling v12.0.27 and installing it from scratch?
  22. You can exclude the appropriate SSL/TLS communication here: Also you can switch the SSL/TLS filtering mode from automatic to interactive so that you are prompted for an action when a secure communication is detected. After excluding the communication based on the particular certificate you can switch back to automatic mode.
  23. You'll need to uninstall it manually in safe mode using the Uninstall tool.
  24. Of course, it's possible to exclude the url at the cost of a risk of getting infected. I would recommend to avoid visiting websites where ESET detects a threat until an administrator of the website resolves the issue.
  25. Although That's because you were mixing apples with oranges. URL blocking is a different thing than scanning the website's html content.
×
×
  • Create New...