MS Windows Defender is generally good (I actually prefer it and preferred its SecurityEssentials predecessor to all the other antiviruses) but seems really notorious in removing non-virus "threats". It also removes NirSoft (and some Sysinternals IIRC) utilities regularly. Yesterday, trying to download the recent version of LibreOffice, I have even found found out I have no qBitTorrent installed any more - it killed it also. I really wish I could just put a regex filter to bulk-allow some classes of "threats" ("HackTool:" and "PUA:") permanently.
MS Windows Defender and DeCSS
61–70 of 211 posts
Re: MS Windows Defender and DeCSS
#62I'm so happy to see a thread on Windows Defender, because my org recently switched antivirus software and I can't wait to tell you how bad it is ! There's a hidden feature in Defender, that will delight any user : it can turn your 15" MacBook Pro into a full breakfast machine. Want pancakes ? Start a zoom call. While you wait for your favorite video conference app to start, don't hope to finish your docker pull/save/…
We are using Defender at work, too. There is a group policy that lets Defender do a full system scan once a week.
To not interfere with the user there allegedly is a group policy setting to limit the CPU usage and it is set to 15%. The thing is, it simply does not work. Every week my fans spin up to max, Defender hogs all my CPU cores, 25% of my GPU according to the Task Manager. Even typing becomes laggy.
The only way to stop it is to open Task Scheduler and end the scheduled task from there.
Re: MS Windows Defender and DeCSS
#63Earlier quoted context omitted.
Why not? I.e. is that from experience on working on anti malware remediation systems?
What would it match against? ASCII strings? Add a whitelisted string and make your malware pass. The heuristics are much more complex than that, cf. spamassassin rules.
Opcode sequences. Regular expressions may be applied to any formal language, not just ones based on human-readable alphabets.
Re: MS Windows Defender and DeCSS
#64To be fair, this does look like a false positive. In general, the desktop antivirus space in 2021 is a mess. Because of the sheer number of malware, and some obfuscation techniques used by some of it, antivirus software has to use very broad regular expressions for describing the malware, counterbalanced by huge whitelists of known mainstream software. If you don't qualify as a "mainstream software vendor", simply bu…
> In general, the desktop antivirus space in 2021 is a mess. Because of the sheer number of malware, and some obfuscation techniques used by some of it, antivirus software has to use very broad regular expressions for describing the malware, counterbalanced by huge whitelists of known mainstream software. Why do they have to use regular expressions?
"Regular expressions" as a concept, not PCRE regex.
Re: MS Windows Defender and DeCSS
#65MS Windows Defender is generally good (I actually prefer it and preferred its SecurityEssentials predecessor to all the other antiviruses) but seems really notorious in removing non-virus "threats". It also removes NirSoft (and some Sysinternals IIRC) utilities regularly. Yesterday, trying to download the recent version of LibreOffice, I have even found found out I have no qBitTorrent installed any more - it killed i…
Use Deluge. The best IMO.
Re: MS Windows Defender and DeCSS
#66Defender, as per Windows 10 philosophy, is extremely annoying to use with its UI and behavior that makes you feel every setting and button you press is entirely useless and nothing will change. A shame the old Security Essentials UI was removed entirely, it was the only bearable hack-y way to use it. I just disable it permanently on every machine. The anti-malware service likes to eat disk activity when you're working, and most importantly, exceptions handling is useless: I've seen it delete or quarantine (and then delete) files put into exceptions multiple times, repeatedly, as if the exception list was getting reset, or expired. This kind of software behavior is unacceptable in any way or form.
Re: MS Windows Defender and DeCSS
#67Earlier quoted context omitted.
I don't care how broad your definition is, it shouldn't include the mp4 files in my hard drive.
Er, doesn't that assume that the mp4 files on your hard drive can't genuinely be infected with viruses? Why is that assumption true?
Especially given how common media files are as an attack vector.
Re: MS Windows Defender and DeCSS
#68I'm so happy to see a thread on Windows Defender, because my org recently switched antivirus software and I can't wait to tell you how bad it is ! There's a hidden feature in Defender, that will delight any user : it can turn your 15" MacBook Pro into a full breakfast machine. Want pancakes ? Start a zoom call. While you wait for your favorite video conference app to start, don't hope to finish your docker pull/save/…
Oh man....a mac with antivirus software...is your IT's mindset from the 90s?
Re: MS Windows Defender and DeCSS
#69MS Windows Defender is generally good (I actually prefer it and preferred its SecurityEssentials predecessor to all the other antiviruses) but seems really notorious in removing non-virus "threats". It also removes NirSoft (and some Sysinternals IIRC) utilities regularly. Yesterday, trying to download the recent version of LibreOffice, I have even found found out I have no qBitTorrent installed any more - it killed i…
I disagree that it is good. It was good. But now it is indistinguishable from a malware. It regularly takes 100% CPU, it prevents many of my own apps from running, and if you switch off real-time protection it switches itself back on like any respectable rootkit.
Re: MS Windows Defender and DeCSS
#70I'm so happy to see a thread on Windows Defender, because my org recently switched antivirus software and I can't wait to tell you how bad it is ! There's a hidden feature in Defender, that will delight any user : it can turn your 15" MacBook Pro into a full breakfast machine. Want pancakes ? Start a zoom call. While you wait for your favorite video conference app to start, don't hope to finish your docker pull/save/…
Oh man....a mac with antivirus software...is your IT's mindset from the 90s?
Google, Amazon and Facebook do that as well (at least if you include Santa as antivirus).