5 ms·

>Why not just use the Microsoft ones that are free? reply For one thing, last time I checked benchmarks they showed that Microsoft's anti-virus not only has wo

by temp 11y ago

>Why not just use the Microsoft ones that are free? reply For one thing, last time I checked benchmarks they showed that Microsoft's anti-virus not only has worse detection results but also worse performance than some of the free alternatives.

infogulch 11y ago
I am very interested in seeing these benchmarks, as my anecdotal experience is the complete opposite.
- karyon 11y ago
  On my two machines (with SSDs) I regularly find that copying lots of small files is severely slowed down by Windows Defender. It utilizes one core to the max and when disabling it, the copy operation gets a lot faster. I don't know about other antivirus software though.
  - ferongr 11y ago
    I can mirror this experience too. Properly working Intel SSD fwiw. Mine impacts not only file copys but also all small file I/O like listing directories (explorer would hang for 1 second entering a new directory) and the like.
    - versteegen 11y ago
      I've had a couple users complain that my program started running really slowly while they were using Microsoft Security Essentials. It turns out that if a file contains a "suspicious" pattern of bytes (which in these two cases were two different user-drawn bitmaps), SE will do some time consuming heuristics every time you open the file. So opening, reading, closing a file 10 times in a row is really bad.
noja 11y ago
I don't know why this comment is being downvoted. A quick google will show the results. Page 9 of the latest report: http://www.av-comparatives.org/summary-reports/ http://www.av-comparatives.org/summary-reports/
- cwyers 11y ago
  Yes. Microsoft, alone among AV vendors, shares any signatures it finds with every other major AV vendor, so everyone is going to find everything Microsoft does, plus what their own research turns up. That said, I don't think it matters enough to bother with the problems for-pay anti-virus vendors bring.
  - noja 11y ago
    Did you read the document? The Microsoft product is quite good, but many of the paid ones are better. I don't know what problems you are talking about (I don't have any) - but that's a personal anecdote, we are discussing a proper comparison.
    - cwyers 11y ago
      I skimmed it, I didn't see anything I haven't seen before. Notably they aren't grading on stuff like "number of popups that I have to click through to get it to quit nagging me." There's also been privilege elevation exploits using antivirus software. EDIT: And there's anti-virus software that's messing with your system's root certificates so it can MitM all your HTTPS traffic to scan it: http://www.securityweek.com/antivirus-software-has-negative-impact-https-security-researcher http://www.securityweek.com/antivirus-software-has-negative-...
    - pilif 11y ago
      > I don't know what problems you are talking about (I don't have any) the glaring security holes opened by them month after month? The HN link you're posting a comment to is about the 5th bad exploit in third-party AV this year alone. So far nothing seems to have been found in the MS built-in one. Installing third-party AV means that you expose yourself to targeted attacks and, if this goes on like it currently does, to drive-by attacks too as by now malware authors must have gotten the hint that searching for vulnerabilities in those various AV products is a very worthwile effort. In general, AV products provide a HUGE attack surface: They don't just need to support natively many more file formats than any other piece of software, they also have to harden their support against exploit code purposefully written to be malicious. And compared to many exploitable user-space applications, these AV products normally run in kernel-space, so an attacker doesn't just gain remote code execution, they gain remote code execution with admin privileges.
ryanlol 11y ago
Yeah, but the detection rates suck for every single AV. Slightly better snake oil is still snake oil.
Nutmog 11y ago
Why is "worse" not OK but "better" is? Neither can be perfect and both will be far better than nothing. Just making up some numbers, but if the Windows AV can detect 80% of viruses and Norton can detect 90%, then you're still vulnerable to that last 10% whatever you do. You're also still protected from the majority of viruses whatever you do too.

by temp 11y ago

infogulch 11y ago

I am very interested in seeing these benchmarks, as my anecdotal experience is the complete opposite.

karyon 11y ago
On my two machines (with SSDs) I regularly find that copying lots of small files is severely slowed down by Windows Defender. It utilizes one core to the max and when disabling it, the copy operation gets a lot faster. I don't know about other antivirus software though.
- ferongr 11y ago
  I can mirror this experience too. Properly working Intel SSD fwiw. Mine impacts not only file copys but also all small file I/O like listing directories (explorer would hang for 1 second entering a new directory) and the like.
  - versteegen 11y ago
    I've had a couple users complain that my program started running really slowly while they were using Microsoft Security Essentials. It turns out that if a file contains a "suspicious" pattern of bytes (which in these two cases were two different user-drawn bitmaps), SE will do some time consuming heuristics every time you open the file. So opening, reading, closing a file 10 times in a row is really bad.

noja 11y ago

I don't know why this comment is being downvoted. A quick google will show the results. Page 9 of the latest report: http://www.av-comparatives.org/summary-reports/ http://www.av-comparatives.org/summary-reports/

cwyers 11y ago
Yes. Microsoft, alone among AV vendors, shares any signatures it finds with every other major AV vendor, so everyone is going to find everything Microsoft does, plus what their own research turns up. That said, I don't think it matters enough to bother with the problems for-pay anti-virus vendors bring.
- noja 11y ago
  Did you read the document? The Microsoft product is quite good, but many of the paid ones are better. I don't know what problems you are talking about (I don't have any) - but that's a personal anecdote, we are discussing a proper comparison.
  - cwyers 11y ago
    I skimmed it, I didn't see anything I haven't seen before. Notably they aren't grading on stuff like "number of popups that I have to click through to get it to quit nagging me." There's also been privilege elevation exploits using antivirus software. EDIT: And there's anti-virus software that's messing with your system's root certificates so it can MitM all your HTTPS traffic to scan it: http://www.securityweek.com/antivirus-software-has-negative-impact-https-security-researcher http://www.securityweek.com/antivirus-software-has-negative-...
  - pilif 11y ago
    > I don't know what problems you are talking about (I don't have any) the glaring security holes opened by them month after month? The HN link you're posting a comment to is about the 5th bad exploit in third-party AV this year alone. So far nothing seems to have been found in the MS built-in one. Installing third-party AV means that you expose yourself to targeted attacks and, if this goes on like it currently does, to drive-by attacks too as by now malware authors must have gotten the hint that searching for vulnerabilities in those various AV products is a very worthwile effort. In general, AV products provide a HUGE attack surface: They don't just need to support natively many more file formats than any other piece of software, they also have to harden their support against exploit code purposefully written to be malicious. And compared to many exploitable user-space applications, these AV products normally run in kernel-space, so an attacker doesn't just gain remote code execution, they gain remote code execution with admin privileges.

ryanlol 11y ago

Yeah, but the detection rates suck for every single AV. Slightly better snake oil is still snake oil.

Nutmog 11y ago

Why is "worse" not OK but "better" is? Neither can be perfect and both will be far better than nothing. Just making up some numbers, but if the Windows AV can detect 80% of viruses and Norton can detect 90%, then you're still vulnerable to that last 10% whatever you do. You're also still protected from the majority of viruses whatever you do too.