3 ms·
> I'd say the driver definitely should be alerted that that PDF they opened was infected When you actively open an infected or malicious file you do get alerte
by happyopossum 4y ago
> I'd say the driver definitely should be alerted that that PDF they opened was infected
When you actively open an infected or malicious file you do get alerted - those are the alerts shown in TFA.
- akersten 4y agoHasty example on my part but point stands when scenario is replaced by "background virus" (i.e. detected by Remediator as an active threat, instead of being preemptively blocked when opening a file). Could be the PDF example still too, if XProtect misses it on initial file scan, but then Remediator picks it up later. Not sure if they use different detection engines (database matching on the file vs active process heuristics)?