7 ms·

Previous startup I was at had deployed the MacOS version of this and the entire Eng department had to petition to get it removed. It randomly picks files to se

by ecf 6y ago

Previous startup I was at had deployed the MacOS version of this and the entire Eng department had to petition to get it removed. It randomly picks files to send to MS for analysis and hijacks 50%+ of the CPU to do it. I legitimately don’t understand what it’s trying to accomplish other than another being a telemetry vacuum for MS.

mrath 6y ago
Very nature of this kind of software. Over years I have never seen a proper antivirus software work without coming on my way. Of course I have not used all of them but only the most popular ones. Locking files, 100 percent cpu usage, false positives are some known issues. In the last 5-6 years I have never seen it correctly report a threat, but that is just for me. I am sure it is working fine for some.
- lukevp 6y ago
  We use BitDefender, and it once deleted the main .exe of an internal website (after several months of no issues with the same exe) mid-day. It also flagged that exe and made it nearly impossible to restore, even with the quarantine feature.
- oweiler 6y ago
  > Very nature of this kind of software. Over years I have never seen a proper antivirus software work without coming on my way. Of course I have not used all of them but only the most popular ones. Locking files, 100 percent cpu usage, false positives are some known issues. In the last 5-6 years I have never seen it correctly report a threat, but that is just for me. I am sure it is working fine for some. We use https://www.crowdstrike.com/ https://www.crowdstrike.com/ and never had any issues so far. Very low CPU usage, no false positives. Not sure if it actually does anything ;).
  - ubercow13 6y ago
    Does anyone know how it works with such low overhead? What's it doing differently?
- nix23 6y ago
  Trend Micro is really good, we had to use it and i was quite impressed on Linux and Windows (for a Antivirus), for the MS-Antivirus, just disable 'Automatic sample submission' EDIT: But to be honest, Antivirus is just Old-school protection, it never detected anything outside 'already known viruses', Snort/Suricata on the other hand detected quite often that something is going on. EDIT2: With "quite impressed" i mean, the performance was not much worse
  - kchr 6y ago
    Snort/Suricata (and other IDS solutions) also depends on signatures/patterns. It's not different in that sense - you still need to define what to look for.
    - nix23 6y ago
      Yes but not file based signatures, the big difference are Network behavior analysis and Anomaly detection...and the biggest plus, its not on the device that is under attack/infected. >It's not different in that sense - you still need to define what to look for. Absolutely correct, i said nothing else, just that i found much more this way than with a locally installed Antivirus, there is just one measurement for a real secure connected computer..that is cable out ;)
mc32 6y ago
They pretty much all do that if you want the full functionality. They’ll tell you if you disable that that you’re little better than having no product at all.
m0xte 6y ago
It deleted my freshly code signed MSI the other day as well. This is irritating but as mentioned a not unusual side effect. A good thing is they have sample submission that was fast and efficient.
- nix23 6y ago
  >A good thing is they have sample submission Wait...you think that is something good, they criticized Kaspersky exactly for that.
  - mynameisvlad 6y ago
    Being able to submit samples and have them verified as known good or bad seems like a fantastic thing, especially when the default is reputation-based and not based on the code signing itself. Why do you think it's not?
    - nix23 6y ago
      Because you upload files (maybe private ones) to a 3rd party?
      - mynameisvlad 6y ago
        I mean, you don't have to if you don't want to. Disable automatic uploads, and don't upload them yourself. There, your problem is solved. Those that want to contribute their samples in order to have them white/blacklisted can, but just because a feature is there doesn't mean somebody is forcing you to do it, nor that it's inherently bad because you're willingly uploading files to a 3rd party. How, exactly, would you expect AV/security companies to be able to analyze samples that are actually relevant to their customers if they're not submitted? They would never be able to find nearly as much malware on their own.

by ecf 6y ago

mrath 6y ago

Very nature of this kind of software. Over years I have never seen a proper antivirus software work without coming on my way. Of course I have not used all of them but only the most popular ones. Locking files, 100 percent cpu usage, false positives are some known issues. In the last 5-6 years I have never seen it correctly report a threat, but that is just for me. I am sure it is working fine for some.

lukevp 6y ago
We use BitDefender, and it once deleted the main .exe of an internal website (after several months of no issues with the same exe) mid-day. It also flagged that exe and made it nearly impossible to restore, even with the quarantine feature.
oweiler 6y ago
> Very nature of this kind of software. Over years I have never seen a proper antivirus software work without coming on my way. Of course I have not used all of them but only the most popular ones. Locking files, 100 percent cpu usage, false positives are some known issues. In the last 5-6 years I have never seen it correctly report a threat, but that is just for me. I am sure it is working fine for some. We use https://www.crowdstrike.com/ https://www.crowdstrike.com/ and never had any issues so far. Very low CPU usage, no false positives. Not sure if it actually does anything ;).
- ubercow13 6y ago
  Does anyone know how it works with such low overhead? What's it doing differently?
nix23 6y ago
Trend Micro is really good, we had to use it and i was quite impressed on Linux and Windows (for a Antivirus), for the MS-Antivirus, just disable 'Automatic sample submission' EDIT: But to be honest, Antivirus is just Old-school protection, it never detected anything outside 'already known viruses', Snort/Suricata on the other hand detected quite often that something is going on. EDIT2: With "quite impressed" i mean, the performance was not much worse
- kchr 6y ago
  Snort/Suricata (and other IDS solutions) also depends on signatures/patterns. It's not different in that sense - you still need to define what to look for.
  - nix23 6y ago
    Yes but not file based signatures, the big difference are Network behavior analysis and Anomaly detection...and the biggest plus, its not on the device that is under attack/infected. >It's not different in that sense - you still need to define what to look for. Absolutely correct, i said nothing else, just that i found much more this way than with a locally installed Antivirus, there is just one measurement for a real secure connected computer..that is cable out ;)

mc32 6y ago

They pretty much all do that if you want the full functionality. They’ll tell you if you disable that that you’re little better than having no product at all.

m0xte 6y ago

It deleted my freshly code signed MSI the other day as well. This is irritating but as mentioned a not unusual side effect. A good thing is they have sample submission that was fast and efficient.

nix23 6y ago
>A good thing is they have sample submission Wait...you think that is something good, they criticized Kaspersky exactly for that.
- mynameisvlad 6y ago
  Being able to submit samples and have them verified as known good or bad seems like a fantastic thing, especially when the default is reputation-based and not based on the code signing itself. Why do you think it's not?
  - nix23 6y ago
    Because you upload files (maybe private ones) to a 3rd party?
    - mynameisvlad 6y ago
      I mean, you don't have to if you don't want to. Disable automatic uploads, and don't upload them yourself. There, your problem is solved. Those that want to contribute their samples in order to have them white/blacklisted can, but just because a feature is there doesn't mean somebody is forcing you to do it, nor that it's inherently bad because you're willingly uploading files to a 3rd party. How, exactly, would you expect AV/security companies to be able to analyze samples that are actually relevant to their customers if they're not submitted? They would never be able to find nearly as much malware on their own.