3 ms·
Yeah but isnt MSE definition based? How is there a hash collision between the zbot exe and chrome? Its very odd. Or maybe MSE has started doing heuristics, but
by drzaiusapelord 15y ago
Yeah but isnt MSE definition based? How is there a hash collision between the zbot exe and chrome? Its very odd. Or maybe MSE has started doing heuristics, but if so, I don't see it in any menu.
- someone13 15y agoNearly EVERY modern antivirus uses heuristics, and all of them use more complex signatures than simple hashes. It's quite possible that some byte signature that was added to catch some sort of malware is also present in Google Chrome.
- drzaiusapelord 15y agoI found the setting. MSE calls it "behavior monitoring."
- cube13 15y agoThis is probably a false positive from the file scanner portion of MSE. I'm pretty sure those are purely hash based, because it usually happens without executing any code. We've had a few internal executable test applications get flagged(and then nuked from orbit) by Trend's virus scanner before while the compiler was finishing the linking step.