MS Security Essentials reporting false positives in the Bitcoin blockchain

Post by aw3c2 » Fri, May 16, 2014, 11:32 AM UTC

afreak wrote: post #3

The simple solution is to not allow your anti-virus software to scan anything that cannot malware. There are exceptions to the rule of course such as MP3s that had executable code, but why does it need to scan every single file on your system? Full disclosure: I used to work for an AV software company and personally think that AV is a dead technology.

Post by hosay123 » Fri, May 16, 2014, 12:20 PM UTC

thristian wrote: post #70

JimDabell wrote: post #48

Earlier quoted context omitted.

If I remember correctly, it used to be the case that if you could get the string +++ATH0 transmitted to somebody in the clear, you could hang up their dialup connection because it was a control code for Hayes modems that ended up being standardised on. Badly written firmware in modems meant that this was often interpreted even when it wasn't transmitted in a control code context.

Actually, it wasn't "badly written firmware". Hayes modems actually looked for "+++", then a second or so of no traffic, before they would switch into command-mode, and that delay was patented. So "Hayes-compatible" modems would implement the system without the delay, and as a result were vulnerable to remote DoS.

Post by maxerickson » Fri, May 16, 2014, 1:20 PM UTC

kijin wrote: post #32

spain wrote: post #18

Earlier quoted context omitted.

It's sad. However instead of ditching it entirely I have moved to a combination of MSE for real-time protection and Malwarebytes as backup, which I run every month or so to get anything that might manage to slip through.

I've been doing exactly that, but by the time Malwarebytes catches the virus, the damage might already be done. So even if you use Malwarebytes for occasional scans, there is legitimate need for better realtime protection. Maybe I should get the paid version of Malwarebytes that can also do realtime scans?

Post by munin » Fri, May 16, 2014, 1:29 PM UTC

jacobwcarlson wrote: post #13

afreak wrote: post #3

The simple solution is to not allow your anti-virus software to scan anything that cannot malware. There are exceptions to the rule of course such as MP3s that had executable code, but why does it need to scan every single file on your system? Full disclosure: I used to work for an AV software company and personally think that AV is a dead technology.

Given your background it's surprising you don't realize how many file formats are Turing-complete and thus capable of mischief.

Post by ryanburk » Fri, May 16, 2014, 1:52 PM UTC

frik wrote: post #40

kijin wrote: post #6

MSE was top-notch when it was first released. It aced all the malware detection benchmarks, not to mention it was completely ad-free and extremely lightweight, which was unheard of in the free antivirus market. The high detection rate and low performance impact made lots of Windows users flock to MSE, myself included. Nowadays, MSE is still lightweight, but it sits at the bottom of every malware detection benchmark.…

I noticed the same. MSE is generally great, but it feels like IE 6 back in 2005 (no investment in years)... :( Running a multi GB backup with Microsoft's robocopy cmd utility crashes the MSE service. That's really annoying. Given that "Microsoft Forefront" is a rebranded MSE (it can be controlled over the network), I wonder why its real-time scanner can't handle ~100MB/s IO for several hours.