Operating memory in Startup scan

[rockman61 0]

If I turn off working memory in startup scan, what will not be detected?
For example, fileless malware, powershell scripting, DLL injection, etc.

。

Edited December 7, 2021 by rockman61

[Marcos 5,259]

Operating memory won't be scanned so any malware in memory won't be detected, only in other objects that are scanned.

[rockman61 0]

Thank you for reply.
Let me clarify.
You mean that these can not be detect. it is correct?
・fileless malware
・Powershell scripting
・DLL injection

[Marcos 5,259]

ESET can detect any kind of malware either on pre-execution or post-execution, e.g. via the registry scanner, Advanced memory scanner, script scanner, Deep Behavior Inspection, etc.

[rockman61 0]

I'm sorry, I didn't communicate well.
I understand that any malware in memory won't be detected when I turn off the operating memory in startup scan.

However, I would like to know more about the effect of turning off the operating memory in startup scan.
For example, ESET can not detect suspicious Powershell Scripting when turning off the operating memory in startup scan.

Please tell me more about the effect of turning off the operating memory.

Edited December 8, 2021 by rockman61

[Marcos 5,259]

Probably it depends on a particular malware how it works. However, with other pre and post-execution protection modules enabled it's unlikely that malware would be running in memory. Still, we don't recommend disabling memory scanning. It should be quick and virtually unnoticeable.

[itman 1,746]

Examples of malware Eset can detect during the startup memory scan are MBR and UEFI based malware. Whereas these might be detected and execution blocked by Eset, they must be manually removed.

Edited December 8, 2021 by itman

[rockman61 0]

noted, thanks!