101–110 of 196 posts
The most invasive but effective way I've found to disable Defender is to boot into a live Linux USB, rename "C:\ProgramData\Microsoft\Windows Defender", and create an empty file in its place.
That is basically how a popular product does it,while taking down about 25% of the entire internet...
Earlier quoted context omitted.
Is there a more performant, less resource-crippling, antivirus for Windows?
A skilled user. I understand and mostly support the idea of mandatory AV for the people who can barely handle the concept of a file system. There is also a class of user forged in the fires of the primordial internet who would never in a trillion years be tricked into clicking a fake explorer.exe window in their browser. Giving users choice is the best option. Certainly, make it very hard to disable the AV. But, don'…
Until they've had a couple drinks. Might still need a more sophisticated fake than that, but they exist. I'm with you on the disabling part though: I think Apple gets it right with SIP, it takes a reboot in recovery mode to disable it temporarily and a single command while in recovery mode to make it permanent.
Earlier quoted context omitted.
Well this is a straightforward sentiment with a real "my body, my choice" ring to it, isn't it? Until it isn't. Perhaps your hardware, when connected to a network, has real effects on the rest of that network. What if your system joined a botnet and began DDOS activities for payment? What if your system was part of a residential proxy network, and could be rented in the grey market for any kind of use or abuse of oth…
Geez what a cluster* of a comment. You mix in a bunch of theoreticals you came up with in 5 seconds that cover different domains and then don't actually go to the effort of critically examining your own statements, which is appreciated and makes for much higher quality comments. > Perhaps your hardware, when connected to a network, has real effects on the rest of that network. What if your system joined a botnet and…
Earlier quoted context omitted.
I tried UTM and it's unusable for x86 Windows. Maybe command line Linux would be acceptably slow, but anything with a GUI isn't. You can run arm64 Windows pretty well, but that's not x86 Windows and won't help with reverse engineering an x86 system component.
I hadn’t tried it myself I just knew it could run it, sucks to hear it’s so unusable.
I set up a windows arm inside an UTM VM as a test, then installed visual studio (not code!) which is an x86 application and it was pretty much usable.
The codebase i was working on was complaining about missing some OpenGL parts so I stopped and haven't investigated further (I have x86 boxes for working on it). But depending on your requirements the above setup may be just fine(tm).
Earlier quoted context omitted.
Geez what a cluster* of a comment. You mix in a bunch of theoreticals you came up with in 5 seconds that cover different domains and then don't actually go to the effort of critically examining your own statements, which is appreciated and makes for much higher quality comments. > Perhaps your hardware, when connected to a network, has real effects on the rest of that network. What if your system joined a botnet and…
[flagged]
learned a lot of interesting thing, namely there is an undocumented messaging underlying the RPC in windows: https://csandker.io/2022/05/24/Offensive-Windows-IPC-3-ALPC....
Earlier quoted context omitted.
But disabling updates on the system connected to the Internet is a terrible idea. How do you update that afterwards?
Since the rest of the world updates their PC's, malware authors rarely focus on exploiting older versions. Both Chrome and Windows are now in that position. Basically, unless you are of interest to state level attackers, in 2025 even unpatched Chrome/Windows wont get drive by exploited.
Earlier quoted context omitted.
Performance reasons? Malware development? Hacking?
Is there a more performant, less resource-crippling, antivirus for Windows?
In what universe is windows defender “resource-crippling?” There are windows laptops that will sip battery for an entire workday plus extra hours while running defender the entire time. So clearly it’s not “resource-crippling” if it can run on a laptop with a single digit wattage power draw.
And then we’ve got the “I need to control my system I’m too smart for antivirus” folks all over this thread.
Well, if you’re so smart why are you using a consumer OS designed for idiots?
(I like OP’s tongue-in-cheek work and post a whole lot better than the neckbeard army describing how Windows is broken and totally doesn’t work and how we have to disable updates and antivirus because we are power users I guess so we just do that for no reason)
Earlier quoted context omitted.
Since the rest of the world updates their PC's, malware authors rarely focus on exploiting older versions. Both Chrome and Windows are now in that position. Basically, unless you are of interest to state level attackers, in 2025 even unpatched Chrome/Windows wont get drive by exploited.
There are still active attacks against DOS and Win98. Automated driveby attacks, just looking to increase the size of a bot farm. There are still new exploits being released against rather old systems.
Earlier quoted context omitted.
can someone well versed in explaining CPP magic explain what is going on and why it is cursed?
We're starting with this code: defer->void { CoUninitialize(); }; Using the macros in the second linked file, this expands to: auto _defer_instance_1234 = Defer{} % [&]()->void { CoUninitialize(); }; * The 1234 is whatever the line number is, which makes the variable name unique. * auto means infer the type of this local variable from the expression after the =. * Defer{} means default construct a Defer instance. Def…
Would it have looked any less cursed if it just read `defer { CoUninitialize(); };`?
Agreed that the simplest "fix" would be to just rename the macro to be all-caps.