6 ms·

Why does anyone use any third-party anti-virus programs these days? Why not just use the Microsoft ones that are free?

lqdc13 11y ago
You mean security essentials?
temp 11y ago
>Why not just use the Microsoft ones that are free? reply For one thing, last time I checked benchmarks they showed that Microsoft's anti-virus not only has worse detection results but also worse performance than some of the free alternatives.
- infogulch 11y ago
  I am very interested in seeing these benchmarks, as my anecdotal experience is the complete opposite.
  - karyon 11y ago
    On my two machines (with SSDs) I regularly find that copying lots of small files is severely slowed down by Windows Defender. It utilizes one core to the max and when disabling it, the copy operation gets a lot faster. I don't know about other antivirus software though.
    - ferongr 11y ago
      I can mirror this experience too. Properly working Intel SSD fwiw. Mine impacts not only file copys but also all small file I/O like listing directories (explorer would hang for 1 second entering a new directory) and the like.
      - versteegen 11y ago
        I've had a couple users complain that my program started running really slowly while they were using Microsoft Security Essentials. It turns out that if a file contains a "suspicious" pattern of bytes (which in these two cases were two different user-drawn bitmaps), SE will do some time consuming heuristics every time you open the file. So opening, reading, closing a file 10 times in a row is really bad.
- noja 11y ago
  I don't know why this comment is being downvoted. A quick google will show the results. Page 9 of the latest report: http://www.av-comparatives.org/summary-reports/ http://www.av-comparatives.org/summary-reports/
  - cwyers 11y ago
    Yes. Microsoft, alone among AV vendors, shares any signatures it finds with every other major AV vendor, so everyone is going to find everything Microsoft does, plus what their own research turns up. That said, I don't think it matters enough to bother with the problems for-pay anti-virus vendors bring.
    - noja 11y ago
      Did you read the document? The Microsoft product is quite good, but many of the paid ones are better. I don't know what problems you are talking about (I don't have any) - but that's a personal anecdote, we are discussing a proper comparison.
      - cwyers 11y ago
        I skimmed it, I didn't see anything I haven't seen before. Notably they aren't grading on stuff like "number of popups that I have to click through to get it to quit nagging me." There's also been privilege elevation exploits using antivirus software. EDIT: And there's anti-virus software that's messing with your system's root certificates so it can MitM all your HTTPS traffic to scan it: http://www.securityweek.com/antivirus-software-has-negative-impact-https-security-researcher http://www.securityweek.com/antivirus-software-has-negative-...
      - pilif 11y ago
        > I don't know what problems you are talking about (I don't have any) the glaring security holes opened by them month after month? The HN link you're posting a comment to is about the 5th bad exploit in third-party AV this year alone. So far nothing seems to have been found in the MS built-in one. Installing third-party AV means that you expose yourself to targeted attacks and, if this goes on like it currently does, to drive-by attacks too as by now malware authors must have gotten the hint that searching for vulnerabilities in those various AV products is a very worthwile effort. In general, AV products provide a HUGE attack surface: They don't just need to support natively many more file formats than any other piece of software, they also have to harden their support against exploit code purposefully written to be malicious. And compared to many exploitable user-space applications, these AV products normally run in kernel-space, so an attacker doesn't just gain remote code execution, they gain remote code execution with admin privileges.
- ryanlol 11y ago
  Yeah, but the detection rates suck for every single AV. Slightly better snake oil is still snake oil.
- Nutmog 11y ago
  Why is "worse" not OK but "better" is? Neither can be perfect and both will be far better than nothing. Just making up some numbers, but if the Windows AV can detect 80% of viruses and Norton can detect 90%, then you're still vulnerable to that last 10% whatever you do. You're also still protected from the majority of viruses whatever you do too.
stephengillie 11y ago
Every antivirus has exploits. Having one installed just opens more doors for attackers to hit your PC.
- ordinary 11y ago
  It closes some too. Anti-virus software does not have to be perfectly secure (not to be confused with providing perfect detection!). To have a net positive impact on computer security, all anti-virus software has to be is quite literally better than nothing. That's by no means a given, but neither is the opposite: that using anti-virus is by definition worse than not using it.
untog 11y ago
For one, because they come preinstalled. I bought a normal Windows laptop for a relative recently, it came with a 30 day trial of McAfee (I think) pre-installed. Once you install any anti-virus, the MS one is automatically disabled, so new users are given the impression that they need to fork out for a subscription once the 30 days is up, or lose virus protection. It's an utter racket.
- heywire 11y ago
  Even more, Microsoft and the OEMs don't really go out of their way to explain this choice to customers. I work with a senior software engineer who recently came to me for help with his new PC after having purchased the full version of the included anti-virus software. He seemed surprised when I asked why he wouldn't just stick with the built in software from Microsoft. So I sent him a link from Microsoft's site explaining about Windows Firewall and Defender. He later told me he felt stupid for having been convinced that he had to purchase the full version of what came on the system or else he would be unprotected. I think it is Microsoft who is stupid for not pushing this message harder, especially in light of the recent developments such as this one. In some of these cases, we're seeing that by installing a third-party anti-virus suite, you're actually reducing the security of your system. I think Microsoft should be concerned that these companies are actually hurting their reputation further.
  - PeCaN 11y ago
    I assume Microsoft couldn't push their own solution because of the anti-trust restrictions. Now that those have expired, perhaps they could unless they're afraid they'll get lawsuits against them again.
    - sbarre 11y ago
      Is the PC & OS market still as MS-centric as it was back then? I know they still own the majority of the desktop, but with OS X out there, and more fragmentation to mobile, it feels like it would be much much harder to build an anti-trust case against Microsoft.
anon4 11y ago
From what people I've talked to have told me - they don't trust Microsoft to secure the OS. Plus, e.g. Comodo gives you a firewall. While I know that Windows has a perfectly good firewall, it doesn't come with a systray icon with a button labeled "protection from active network probes: active" or whatever. Personally, I just have a router between me and the big bad internet and use Security Essentials plus Common Sense 2012.
- jmnicolas 11y ago
  Warning your Common Sense 2012 is outdated, you should buy the new 2016 version ;-)
douche 11y ago
They can't be bothered to do things that are actually effective, like reading installation dialogs fully, installing an ad-blocker, and avoiding the downloads from the sketchiest of porn and torrent sites.
- untog 11y ago
  It isn't (just) laziness. A friend of mine downloaded Google Chrome because they knew it was a secure browser to use... except that the search result page provided them with a poisoned installed full of malware. If you're not technically inclined there are minefields everywhere.
  - syntheticnature 11y ago
    I bought my father-in-law a new laptop, wiped it and installed it with just what said he needed. Only to watch him say "I want to get vlc," type vlc into Google, skip over the VideoLAN - downloads link, and click some virus-infested link further down because the title of the link was "Get vlc."
    - fixermark 11y ago
      "What's VideoLAN?" ~ The not technically-focused. This is why the scams work.
      - marvy 11y ago
        The top result for me is: VideoLAN - Official page for VLC media player, the Open ... The other results are all either directly or almost directly associated with VLC. I get no scam sites in the top 10 results. Have the search results improved? Is this the effect of search personalization? What gives?
        syntheticnature 11y ago
        That was the top result for him, but the problem was it didn't say "VLC" right up front. I believe he grabbed what looks to be the 12th link when I use a private browser, but who knows what search personalization he'd picked up along the way, since he had logged into Google. I know it was at least half-way down.
21 11y ago
I'll give you an interesting example. I was one day coding a keylogger for testing purposes. 100% original C++ code written by me based on Win32 API docs. Compiled and ran the code and immediately Bitdefender blocked the program and put up a "Keylogger detected" message. Microsoft built in antivirus doesn't have this kind of behavioral detection protections.
- throwaway2048 11y ago
  the reason this is mostly useless is malware writers can do the same test with every AV and just evade the heuristics.
  - 21 11y ago
    It does raise the bar significantly. There are 3-4 ways for system level keyboard monitoring, and all were detected. So a malware writer has to either disable the AV first, or hook individual applications one at a time instead of the whole system (and this exposes it to injection detection heuristics).
- AnthonyMouse 11y ago
  > Compiled and ran the code and immediately Bitdefender blocked the program and put up a "Keylogger detected" message. Which is quite problematic because it was a false positive. You knew and wanted that program to log key presses. That's the trouble with aggressive heuristics. Users are going to have a program that translates keyboard layouts by hooking the key presses. Or software that comes with some fancy input device. Then the antivirus says it's a keylogger even though they know it isn't and the user is taught to expect good rather than bad things when they press "allow" against a something-is-wrong prompt.
  - fphhotchips 11y ago
    That's not problematic at all. If I want the thing to run, I'll whitelist it and move on. Constant false positives would probably be a bad thing, sure, but any user advanced enough to be installing a keylogger deliberately is probably advanced enough to know the difference. The alternative is that we don't see when a keylogger is being installed non-deliberately, and that would be worse IMO.
drzaiusapelord 11y ago
MS Security Essentials detection rates are pretty poor, historically. Considering excellent products like Avast are free for the home user, I don't see why we'd recommend the MS one. To be fair, MS has recognized this and has been steadily improving detection rates. It has only recently been able to outdo Avast or AVG. Hopefully, this trend will continue. I imagine MS is under a lot of pressure to contain the Cryptolocker-type infections and the bad press of the past couple years is probably a motivator. http://www.alphr.com/security/6745/best-free-antivirus-of-2016-this-is-the-best-free-internet-security-software-you-can http://www.alphr.com/security/6745/best-free-antivirus-of-20...
- ubercow13 11y ago
  >excellent products like Avast Isn't this claim somewhat refuted by the very article you are posting against? There are other comments in this thread that explain why this doesn't make any sense eg pilif's above[1] [1] https://news.ycombinator.com/item?id=11058688 https://news.ycombinator.com/item?id=11058688
  - drzaiusapelord 11y ago
    They both have detection rates in the high 90s, which is considered excellent, in general, and certainly so for a no-cost product. MSE only just edged out Avast. The comment you listed cites nothing, not sure why its so authoritative to you. All software has vulnerabilities, but where's the big attack on AV? What CVEs are we seeing in the wild, if any?

You mean security essentials?

temp 11y ago

>Why not just use the Microsoft ones that are free? reply For one thing, last time I checked benchmarks they showed that Microsoft's anti-virus not only has worse detection results but also worse performance than some of the free alternatives.

infogulch 11y ago
I am very interested in seeing these benchmarks, as my anecdotal experience is the complete opposite.
- karyon 11y ago
  On my two machines (with SSDs) I regularly find that copying lots of small files is severely slowed down by Windows Defender. It utilizes one core to the max and when disabling it, the copy operation gets a lot faster. I don't know about other antivirus software though.
  - ferongr 11y ago
    I can mirror this experience too. Properly working Intel SSD fwiw. Mine impacts not only file copys but also all small file I/O like listing directories (explorer would hang for 1 second entering a new directory) and the like.
    - versteegen 11y ago
      I've had a couple users complain that my program started running really slowly while they were using Microsoft Security Essentials. It turns out that if a file contains a "suspicious" pattern of bytes (which in these two cases were two different user-drawn bitmaps), SE will do some time consuming heuristics every time you open the file. So opening, reading, closing a file 10 times in a row is really bad.
noja 11y ago
I don't know why this comment is being downvoted. A quick google will show the results. Page 9 of the latest report: http://www.av-comparatives.org/summary-reports/ http://www.av-comparatives.org/summary-reports/
- cwyers 11y ago
  Yes. Microsoft, alone among AV vendors, shares any signatures it finds with every other major AV vendor, so everyone is going to find everything Microsoft does, plus what their own research turns up. That said, I don't think it matters enough to bother with the problems for-pay anti-virus vendors bring.
  - noja 11y ago
    Did you read the document? The Microsoft product is quite good, but many of the paid ones are better. I don't know what problems you are talking about (I don't have any) - but that's a personal anecdote, we are discussing a proper comparison.
    - cwyers 11y ago
      I skimmed it, I didn't see anything I haven't seen before. Notably they aren't grading on stuff like "number of popups that I have to click through to get it to quit nagging me." There's also been privilege elevation exploits using antivirus software. EDIT: And there's anti-virus software that's messing with your system's root certificates so it can MitM all your HTTPS traffic to scan it: http://www.securityweek.com/antivirus-software-has-negative-impact-https-security-researcher http://www.securityweek.com/antivirus-software-has-negative-...
    - pilif 11y ago
      > I don't know what problems you are talking about (I don't have any) the glaring security holes opened by them month after month? The HN link you're posting a comment to is about the 5th bad exploit in third-party AV this year alone. So far nothing seems to have been found in the MS built-in one. Installing third-party AV means that you expose yourself to targeted attacks and, if this goes on like it currently does, to drive-by attacks too as by now malware authors must have gotten the hint that searching for vulnerabilities in those various AV products is a very worthwile effort. In general, AV products provide a HUGE attack surface: They don't just need to support natively many more file formats than any other piece of software, they also have to harden their support against exploit code purposefully written to be malicious. And compared to many exploitable user-space applications, these AV products normally run in kernel-space, so an attacker doesn't just gain remote code execution, they gain remote code execution with admin privileges.
ryanlol 11y ago
Yeah, but the detection rates suck for every single AV. Slightly better snake oil is still snake oil.
Nutmog 11y ago
Why is "worse" not OK but "better" is? Neither can be perfect and both will be far better than nothing. Just making up some numbers, but if the Windows AV can detect 80% of viruses and Norton can detect 90%, then you're still vulnerable to that last 10% whatever you do. You're also still protected from the majority of viruses whatever you do too.

stephengillie 11y ago

Every antivirus has exploits. Having one installed just opens more doors for attackers to hit your PC.

ordinary 11y ago
It closes some too. Anti-virus software does not have to be perfectly secure (not to be confused with providing perfect detection!). To have a net positive impact on computer security, all anti-virus software has to be is quite literally better than nothing. That's by no means a given, but neither is the opposite: that using anti-virus is by definition worse than not using it.

untog 11y ago

For one, because they come preinstalled. I bought a normal Windows laptop for a relative recently, it came with a 30 day trial of McAfee (I think) pre-installed. Once you install any anti-virus, the MS one is automatically disabled, so new users are given the impression that they need to fork out for a subscription once the 30 days is up, or lose virus protection. It's an utter racket.

heywire 11y ago
Even more, Microsoft and the OEMs don't really go out of their way to explain this choice to customers. I work with a senior software engineer who recently came to me for help with his new PC after having purchased the full version of the included anti-virus software. He seemed surprised when I asked why he wouldn't just stick with the built in software from Microsoft. So I sent him a link from Microsoft's site explaining about Windows Firewall and Defender. He later told me he felt stupid for having been convinced that he had to purchase the full version of what came on the system or else he would be unprotected. I think it is Microsoft who is stupid for not pushing this message harder, especially in light of the recent developments such as this one. In some of these cases, we're seeing that by installing a third-party anti-virus suite, you're actually reducing the security of your system. I think Microsoft should be concerned that these companies are actually hurting their reputation further.
- PeCaN 11y ago
  I assume Microsoft couldn't push their own solution because of the anti-trust restrictions. Now that those have expired, perhaps they could unless they're afraid they'll get lawsuits against them again.
  - sbarre 11y ago
    Is the PC & OS market still as MS-centric as it was back then? I know they still own the majority of the desktop, but with OS X out there, and more fragmentation to mobile, it feels like it would be much much harder to build an anti-trust case against Microsoft.

anon4 11y ago

From what people I've talked to have told me - they don't trust Microsoft to secure the OS. Plus, e.g. Comodo gives you a firewall. While I know that Windows has a perfectly good firewall, it doesn't come with a systray icon with a button labeled "protection from active network probes: active" or whatever. Personally, I just have a router between me and the big bad internet and use Security Essentials plus Common Sense 2012.

jmnicolas 11y ago
Warning your Common Sense 2012 is outdated, you should buy the new 2016 version ;-)

douche 11y ago

They can't be bothered to do things that are actually effective, like reading installation dialogs fully, installing an ad-blocker, and avoiding the downloads from the sketchiest of porn and torrent sites.

untog 11y ago
It isn't (just) laziness. A friend of mine downloaded Google Chrome because they knew it was a secure browser to use... except that the search result page provided them with a poisoned installed full of malware. If you're not technically inclined there are minefields everywhere.
- syntheticnature 11y ago
  I bought my father-in-law a new laptop, wiped it and installed it with just what said he needed. Only to watch him say "I want to get vlc," type vlc into Google, skip over the VideoLAN - downloads link, and click some virus-infested link further down because the title of the link was "Get vlc."
  - fixermark 11y ago
    "What's VideoLAN?" ~ The not technically-focused. This is why the scams work.
    - marvy 11y ago
      The top result for me is: VideoLAN - Official page for VLC media player, the Open ... The other results are all either directly or almost directly associated with VLC. I get no scam sites in the top 10 results. Have the search results improved? Is this the effect of search personalization? What gives?
      - syntheticnature 11y ago
        That was the top result for him, but the problem was it didn't say "VLC" right up front. I believe he grabbed what looks to be the 12th link when I use a private browser, but who knows what search personalization he'd picked up along the way, since he had logged into Google. I know it was at least half-way down.

21 11y ago

I'll give you an interesting example. I was one day coding a keylogger for testing purposes. 100% original C++ code written by me based on Win32 API docs. Compiled and ran the code and immediately Bitdefender blocked the program and put up a "Keylogger detected" message. Microsoft built in antivirus doesn't have this kind of behavioral detection protections.

throwaway2048 11y ago
the reason this is mostly useless is malware writers can do the same test with every AV and just evade the heuristics.
- 21 11y ago
  It does raise the bar significantly. There are 3-4 ways for system level keyboard monitoring, and all were detected. So a malware writer has to either disable the AV first, or hook individual applications one at a time instead of the whole system (and this exposes it to injection detection heuristics).
AnthonyMouse 11y ago
> Compiled and ran the code and immediately Bitdefender blocked the program and put up a "Keylogger detected" message. Which is quite problematic because it was a false positive. You knew and wanted that program to log key presses. That's the trouble with aggressive heuristics. Users are going to have a program that translates keyboard layouts by hooking the key presses. Or software that comes with some fancy input device. Then the antivirus says it's a keylogger even though they know it isn't and the user is taught to expect good rather than bad things when they press "allow" against a something-is-wrong prompt.
- fphhotchips 11y ago
  That's not problematic at all. If I want the thing to run, I'll whitelist it and move on. Constant false positives would probably be a bad thing, sure, but any user advanced enough to be installing a keylogger deliberately is probably advanced enough to know the difference. The alternative is that we don't see when a keylogger is being installed non-deliberately, and that would be worse IMO.

drzaiusapelord 11y ago

MS Security Essentials detection rates are pretty poor, historically. Considering excellent products like Avast are free for the home user, I don't see why we'd recommend the MS one. To be fair, MS has recognized this and has been steadily improving detection rates. It has only recently been able to outdo Avast or AVG. Hopefully, this trend will continue. I imagine MS is under a lot of pressure to contain the Cryptolocker-type infections and the bad press of the past couple years is probably a motivator. http://www.alphr.com/security/6745/best-free-antivirus-of-2016-this-is-the-best-free-internet-security-software-you-can http://www.alphr.com/security/6745/best-free-antivirus-of-20...

ubercow13 11y ago
>excellent products like Avast Isn't this claim somewhat refuted by the very article you are posting against? There are other comments in this thread that explain why this doesn't make any sense eg pilif's above[1] [1] https://news.ycombinator.com/item?id=11058688 https://news.ycombinator.com/item?id=11058688
- drzaiusapelord 11y ago
  They both have detection rates in the high 90s, which is considered excellent, in general, and certainly so for a no-cost product. MSE only just edged out Avast. The comment you listed cites nothing, not sure why its so authoritative to you. All software has vulnerabilities, but where's the big attack on AV? What CVEs are we seeing in the wild, if any?