3 ms·

> the products they release just don't have the same effectiveness they used to. If sales of antivirus is dropping, where will they get their funding from? Ant

by sebcat 8y ago

> the products they release just don't have the same effectiveness they used to. If sales of antivirus is dropping, where will they get their funding from? Anti-virus software was very easy to circumvent in the past. Getting the kernel32 address from the PEB, having your own PE loader and having most code xored with the Mersenne twister output in the data segment for obfuscation, as well as some runtime is_sandbox() heuristics and no AV would detect anything malicious. Don't know if it got better or worse, but AV software was not very good at finding malicious code explicitly written to not run in plain sight in the past.

dogma1138 8y ago
AV isn’t good at finding malicious code that hasn’t been discovered and classified but it’s also pretty unlikely that you’ll encounter one unless you are a high value target which is being actively targeted. Having Windows Defender on is sufficient for the casual threats most people would encounter.
- chrisper 8y ago
  I thought Windows Defender detection is abysmal? Not the case anymore?
  - dogma1138 8y ago
    It never really had detection issues unless you count the very first versions for Windows XP https://www.av-test.org/en/antivirus/business-windows-client/ https://www.av-test.org/en/antivirus/business-windows-client... And for many things WD is simply much better than any solution this includes offline removal of rootkits (it can boot into a WinPE environment for a scan) and Ransomware protection where Windows Defender can restrict apps from accessing folders that tend to keep user data: https://cloudblogs.microsoft.com/microsoftsecure/2017/10/23/stopping-ransomware-where-it-counts-protecting-your-data-with-controlled-folder-access/ https://cloudblogs.microsoft.com/microsoftsecure/2017/10/23/... Basically if you have Windows 7, 8 or 10 keep Windows Defender on it actually does work.
- inetknght 8y ago
  > it’s also pretty unlikely that you’ll encounter [malicious code that hasn’t been discovered and classified] unless you are a high value target which is being actively targeted. This sounds much like survivorship bias to me.
  - dogma1138 8y ago
    No this is simply what they are good at it's like a vaccine it won't help you against mutations or something that was engineered but it's not a reason to not vaccinate when it's does cover a large number of other infectious diseases. So unless you going to say that vaccination is survivorship bias because we don't have them against some diseases I really don't see your point. Windows Defender will block virtually every common infection these are what most people get hit by, it will also block virtually all ransomware and you can see just how much the ransomware "market" got hit once they implemented it to see that it is effective. Yes it won't protect you against NSA or some high end hacking group that writes completely custom malware to target single individuals but you are also not likely being the target of these. But you are likely be target of the 1000's of known threats that are spread through driveby attacks, infected media and pretty old stuff you'll be surprised just how common 5 year old infections still are.

by sebcat 8y ago

dogma1138 8y ago

AV isn’t good at finding malicious code that hasn’t been discovered and classified but it’s also pretty unlikely that you’ll encounter one unless you are a high value target which is being actively targeted. Having Windows Defender on is sufficient for the casual threats most people would encounter.

chrisper 8y ago
I thought Windows Defender detection is abysmal? Not the case anymore?
- dogma1138 8y ago
  It never really had detection issues unless you count the very first versions for Windows XP https://www.av-test.org/en/antivirus/business-windows-client/ https://www.av-test.org/en/antivirus/business-windows-client... And for many things WD is simply much better than any solution this includes offline removal of rootkits (it can boot into a WinPE environment for a scan) and Ransomware protection where Windows Defender can restrict apps from accessing folders that tend to keep user data: https://cloudblogs.microsoft.com/microsoftsecure/2017/10/23/stopping-ransomware-where-it-counts-protecting-your-data-with-controlled-folder-access/ https://cloudblogs.microsoft.com/microsoftsecure/2017/10/23/... Basically if you have Windows 7, 8 or 10 keep Windows Defender on it actually does work.
inetknght 8y ago
> it’s also pretty unlikely that you’ll encounter [malicious code that hasn’t been discovered and classified] unless you are a high value target which is being actively targeted. This sounds much like survivorship bias to me.
- dogma1138 8y ago
  No this is simply what they are good at it's like a vaccine it won't help you against mutations or something that was engineered but it's not a reason to not vaccinate when it's does cover a large number of other infectious diseases. So unless you going to say that vaccination is survivorship bias because we don't have them against some diseases I really don't see your point. Windows Defender will block virtually every common infection these are what most people get hit by, it will also block virtually all ransomware and you can see just how much the ransomware "market" got hit once they implemented it to see that it is effective. Yes it won't protect you against NSA or some high end hacking group that writes completely custom malware to target single individuals but you are also not likely being the target of these. But you are likely be target of the 1000's of known threats that are spread through driveby attacks, infected media and pretty old stuff you'll be surprised just how common 5 year old infections still are.