3 ms·
the reason this is mostly useless is malware writers can do the same test with every AV and just evade the heuristics.
by throwaway2048 11y ago
the reason this is mostly useless is malware writers can do the same test with every AV and just evade the heuristics.
- 21 11y agoIt does raise the bar significantly. There are 3-4 ways for system level keyboard monitoring, and all were detected. So a malware writer has to either disable the AV first, or hook individual applications one at a time instead of the whole system (and this exposes it to injection detection heuristics).