Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Avoid Non-Microsoft Antivirus Software

robert.ocallahan.org

Post reply on HN
Print view View original

361–370 of 388 posts

Re: Avoid Non-Microsoft Antivirus Software

#361

Post by ivan_gammel »

lmm wrote: post #325
ivan_gammel wrote: post #306

Earlier quoted context omitted.

Example with .exe files isn't good one. Modern AVs may do better job than just blocking them. I use Norton AV, which shows a report summary on new downloaded files, based on which I can make informed decision on whether to launch it or not (I personally launch immediately only trusted executables and google for any issues of the rest). The same can be done with all threats: AVs warn, provide some details and let user…

> I use Norton AV, which shows a report summary on new downloaded files, based on which I can make informed decision on whether to launch it or not (I personally launch immediately only trusted executables and google for any issues of the rest). Trusted in what sense? Does Norton maintain their own whitelist? Is there any reason to believe that whitelist would be any better than the digital signature check that's bui…

For apps looks like they have a whitelist based on usage statistics, so it's basically vetting by other users of NAV. It does not replace digital signature check, but it's a good addition to it.

For other threats it can be similar solution.

Re: Avoid Non-Microsoft Antivirus Software

#362

Post by chime »

emodendroket wrote: post #264
spinsser wrote: post #20

Earlier quoted context omitted.

It is a feature [0]. Microsoft office products allow for "macros" which are Visual Basic code embedded within a document or a worksheet that can be used by developers to add extra functionalities to their MS files (e.g. validate all data in a work sheet after a user clicks a specific button in the worksheet). Just like any programming language, it could be used maliciously, and there is no easy way to distinguish whi…

For this exact reason docx macros are disabled by default and you have to do some enabling. Presumably there are also more sophisticated exploits that don't rely on the user dismissing multiple security warnings.

These viruses show a blank docx file in macro-disabled mode with only one image, which says "Enable macros to view secure invoice" and shows a picture guide on how to enable macros. Some of them have better instructions than the user guides I write for my users.

Re: Avoid Non-Microsoft Antivirus Software

#363

Post by exadeci »

yrio wrote: post #101

What about open source antivirus software like ClamAV?

It's perfect!

I use http://www.clamwin.com/ which is just an easy way to install it.

There was a pdf about antiviruses that was posted a few month ago IIRC and they all had huge flaws except surprisingly ClamAv which had minor ones.

Re: Avoid Non-Microsoft Antivirus Software

#364

Post by summarite »

Const-me wrote: post #118
neko_koneko wrote: post #76

Ok, disclaimer first: I've previously worked at Kaspersky Lab (incident response division). Now, I want to say that many of the incidents that we have investigated, would have been prevented by anti-virus software (in many cases AV software was deliberately disabled by user). And I'm talking about incidents that resulted in million-dollar thefts - not just cases of some user getting cryptolocker on their home compute…

Kaspersky is the worst of them: https://www.bloomberg.com/news/articles/2015-03-19/cybersecu...

Sounds like they're choosing their battles just like the US ones.

My takeaway here is not to trust either Russia or US based companies, as none of them will escape working with the secret services. China and India have plenty of exploitative AV like software as well, mainly for mobile.

Are there any European AV? Or Japanese? Or South African? I'd love to have something that has an eye eg on Microsoft's products, because there's no doubt that they have backdoors and report home.

Re: Avoid Non-Microsoft Antivirus Software

#365

Post by mherrmann »

pacifika wrote: post #296
mherrmann wrote: post #25

As someone who develops a (PyQt-based) desktop app [1], I can confirm this: My app has so far falsely been put into quarantine by Avira and McAffee. It's a pain... [1]: https://fman.io

Could you blog / expand on the packaging story for your product please?

If we're only talking about packaging, I recommend you search for "PyInstaller" on the blog [1]. For auto updates, search "Sparkle"/"Omaha".

1: https://fman.io/blog

Re: Avoid Non-Microsoft Antivirus Software

#366

Post by romanovcode »

EvilTerran wrote: post #59
romanovcode wrote: post #42

Earlier quoted context omitted.

It sucks that you cannot reset your Windows to MS-Vendor settings. For example if you get some Acer laptop and reset it using windows built-in functionality it'll still reset it with all the bloatware - including AV.

This should do it: https://www.microsoft.com/en-us/software-download/windows10s... They've had similar tools since at least Windows 7 IIRC, if not XP - you've just always had to download them separately, and they've never been advertised with much enthusiasm. Probably trying to strike a balance between pleasing power-users and keeping the bundled-bloatware ecosystem happy, seeing as MS benefit financially from both.

Interesting, I will try this on my laptop this week and will report if it will work.

Re: Avoid Non-Microsoft Antivirus Software

#367

Post by romanovcode »

microtonal wrote: post #86
romanovcode wrote: post #42

Earlier quoted context omitted.

It sucks that you cannot reset your Windows to MS-Vendor settings. For example if you get some Acer laptop and reset it using windows built-in functionality it'll still reset it with all the bloatware - including AV.

Can't you just download a pristine Windows 10 ISO from Microsoft's website and install from that? I've done that on my Dell Precision and it works great.

The problem is that if it's not the same edition as is pre-installed you will lose your OEM license.

Re: Avoid Non-Microsoft Antivirus Software

#368

Post by romanovcode »

i_live_there wrote: post #214
romanovcode wrote: post #42

Earlier quoted context omitted.

It sucks that you cannot reset your Windows to MS-Vendor settings. For example if you get some Acer laptop and reset it using windows built-in functionality it'll still reset it with all the bloatware - including AV.

Uh, yes you can. Couple weeks ago I reset my Windows 10 MSI laptop to a clean state using nothing but Windows itself. Somewhere in Windows 10 restore options there's an option to format your HD and install only Windows and nothing else. You don't need a DVD nor a USB drive. A click of a button and off you go.

Didn't work for me.

Re: Avoid Non-Microsoft Antivirus Software

#369

Post by lmm »

lmm wrote: post #352
ChoGGi wrote: post #350

Earlier quoted context omitted.

I've heard if you disable the service directly, then the "Windows Defender reports that the service is turned off" message stops happening. sc.exe config "WinDefend" start= disabled sc.exe stop "WinDefend"

No good I'm afraid, gave me: [SC] OpenService FAILED 5: Access is denied. (this is from an administrator command prompt)

For the record: you can turn it off using the group policy editor.

Re: Avoid Non-Microsoft Antivirus Software

#370

Post by emodendroket »

Const-me wrote: post #346
emodendroket wrote: post #339

Earlier quoted context omitted.

> “the fact” and “probably” are mutually exclusive. I don't see how; statements about probability can be factual and we have plenty of evidence that Google, Microsoft, and US telcos do; why should AV vendors be different? As far as companies usually following the letter of the law... do they? What makes you so sure?

> statements about probability can be factual Depends. In natural science or in medicine you can estimate that probability (because control groups, multiple experiments, statistical methods, etc). In such context, a statement about probability can indeed be factual. In general conversation or in legal context they can’t. If you have facts, there’s no “probably” because you know for sure. And if you don’t, it can be y…

Bit strange to go from a hyper-rational scientific stance on one point to using anecdotal evidence for another.
Post reply on HN