5 ms·

Windows Defender is on every machine, so what would be the point of writing a virus that is detected by it? The same for Kaspersky. These programs are easy to t

Windows Defender is on every machine, so what would be the point of writing a virus that is detected by it? The same for Kaspersky. These programs are easy to test against and well-known. They are designed to work against old viruses that have already been detected and analyzed. It's better to use lesser known antivirus products with good heuristic detection. I will not mention names but there are a number of products out there, including ones that block every executable not on a whitelist.

zaarn 7y ago
A lesser known anti-virus will also be from a smaller vendor with less resources to get 0day malware into their signature databases or maintain a good heuristic detection. A lesser-known AV with a good signature DB and heuristic engine is a unicorn.
GordonS 7y ago
They will not only detect existing viruses. AV software has used heuristics to detect viruses for decades, and more recently ML is being used. Microsoft has really been investing in Defender and Defender ATP recently and there have been several Twitter and blog posts about the successes their ML approach is yielding, including for new viruses.
- 420codebro 7y ago
  Very interesting. I am guessing there is a common set of access / instruction patterns (N number of virus samples) that they build models from?
ziddoap 7y ago
You can't just wave your hand and say that some lesser known "no names mentioned" product is better than Defender because you want it to be. If you have evidence that some AV product is out-performing Defender, it's extremely selfish and negligent to keep that information to yourself. I'd much rather trust MS with Defender over some lesser known AV product which likely doesn't have billions of dollars, unfathomably large samples/datasets, and extensive experience with APT's. As pointed out, no one really has a better incentive to detect and eliminate virus's than MS does in an effort to make their OS virus free.
- JohnStrangeII 7y ago
  Fair enough, but I did give a concrete reason why I believe some "no name mentioned" products may be better than Defender and other common antivirus products.

zaarn 7y ago

A lesser known anti-virus will also be from a smaller vendor with less resources to get 0day malware into their signature databases or maintain a good heuristic detection. A lesser-known AV with a good signature DB and heuristic engine is a unicorn.

GordonS 7y ago

They will not only detect existing viruses. AV software has used heuristics to detect viruses for decades, and more recently ML is being used. Microsoft has really been investing in Defender and Defender ATP recently and there have been several Twitter and blog posts about the successes their ML approach is yielding, including for new viruses.

420codebro 7y ago
Very interesting. I am guessing there is a common set of access / instruction patterns (N number of virus samples) that they build models from?

ziddoap 7y ago

You can't just wave your hand and say that some lesser known "no names mentioned" product is better than Defender because you want it to be. If you have evidence that some AV product is out-performing Defender, it's extremely selfish and negligent to keep that information to yourself. I'd much rather trust MS with Defender over some lesser known AV product which likely doesn't have billions of dollars, unfathomably large samples/datasets, and extensive experience with APT's. As pointed out, no one really has a better incentive to detect and eliminate virus's than MS does in an effort to make their OS virus free.

JohnStrangeII 7y ago
Fair enough, but I did give a concrete reason why I believe some "no name mentioned" products may be better than Defender and other common antivirus products.