MS Windows Defender and DeCSS
arch13.com
MS Windows Defender and DeCSS
1–10 of 211 posts
Re: MS Windows Defender and DeCSS
#215 years ago, often you found infected binaries on keygens and cracking tools.
On DeCSS, that made me nostalgic ahout DVDCSS and cracking a DVD movie in "just" 20 minutes with MPlayer. The key was cached, luckily.
Re: MS Windows Defender and DeCSS
#3I wonder when Anti-Virus will start deleting files that express opinions they don't like.
Reminds me of the famous Earworm https://www.youtube.com/watch?v=-JlxuQ7tPgQ
Re: MS Windows Defender and DeCSS
#415 years ago, often you found infected binaries on keygens and cracking tools. On DeCSS, that made me nostalgic ahout DVDCSS and cracking a DVD movie in "just" 20 minutes with MPlayer. The key was cached, luckily.
My coworker and i worked at PayPal back then and we both got portable hard drives and ripped DVDs we got at the local libraries during lunch time and from Netflix on PayPal computers. Good times to be had. My wife threw out our 12 dvd binders just a year or two ago once we went full IPTV.
Re: MS Windows Defender and DeCSS
#5Firefox 90.0b12 on Linux also reports that file as a virus/threat, and warns on download
Re: MS Windows Defender and DeCSS
#6It's packed, which for some reason that tends to trigger a lot of AVs... although the fact that it's a packer from roughly 2 decades ago and one that any respectable AV should be able to easily unpack by now certainly doesn't inspire confidence.
Then again, AVs detecting things as innocent as freshly-compiled "Hello World" programs is not new, and certainly makes one wonder just what exactly they are trying to detect.
Re: MS Windows Defender and DeCSS
#7His comment in /r/sysadmin:
"Setting a Windows Defender exception to the folder does not prevent the quarantine from occurring. I re-ran this test three times trying exceptions and even the entire NAS drive as on the excluded list."
Windows Defender is overriding the user whitelist?
Re: MS Windows Defender and DeCSS
#8Do tech aware people like nearly everyone in this forum, need Defender (or another AV) to run at all? How many people here completely or partially stop it from running?
Re: MS Windows Defender and DeCSS
#9To be fair, this does look like a false positive.
In general, the desktop antivirus space in 2021 is a mess. Because of the sheer number of malware, and some obfuscation techniques used by some of it, antivirus software has to use very broad regular expressions for describing the malware, counterbalanced by huge whitelists of known mainstream software.
If you don't qualify as a "mainstream software vendor", simply building a random piece of code into an exe file will get you about 10% chance of getting flagged by one of the "heuristic engines" if you upload it to VirusTotal.
You can contact the A/V vendor and they will usually add it to the whitelist, but it only lasts until the next rebuild. Or you can rebuild it a couple of times with different optimization levels, and the detection sometimes goes away.
Re: MS Windows Defender and DeCSS
#10His comment in /r/sysadmin: "Setting a Windows Defender exception to the folder does not prevent the quarantine from occurring. I re-ran this test three times trying exceptions and even the entire NAS drive as on the excluded list." Windows Defender is overriding the user whitelist?
from that forum it also seems like Windows Defender is deleting a .txt file containing the source code.