6 ms·

Very nature of this kind of software. Over years I have never seen a proper antivirus software work without coming on my way. Of course I have not used all of t

by mrath 6y ago

Very nature of this kind of software. Over years I have never seen a proper antivirus software work without coming on my way. Of course I have not used all of them but only the most popular ones. Locking files, 100 percent cpu usage, false positives are some known issues. In the last 5-6 years I have never seen it correctly report a threat, but that is just for me. I am sure it is working fine for some.

lukevp 6y ago
We use BitDefender, and it once deleted the main .exe of an internal website (after several months of no issues with the same exe) mid-day. It also flagged that exe and made it nearly impossible to restore, even with the quarantine feature.
oweiler 6y ago
> Very nature of this kind of software. Over years I have never seen a proper antivirus software work without coming on my way. Of course I have not used all of them but only the most popular ones. Locking files, 100 percent cpu usage, false positives are some known issues. In the last 5-6 years I have never seen it correctly report a threat, but that is just for me. I am sure it is working fine for some. We use https://www.crowdstrike.com/ https://www.crowdstrike.com/ and never had any issues so far. Very low CPU usage, no false positives. Not sure if it actually does anything ;).
- ubercow13 6y ago
  Does anyone know how it works with such low overhead? What's it doing differently?
nix23 6y ago
Trend Micro is really good, we had to use it and i was quite impressed on Linux and Windows (for a Antivirus), for the MS-Antivirus, just disable 'Automatic sample submission' EDIT: But to be honest, Antivirus is just Old-school protection, it never detected anything outside 'already known viruses', Snort/Suricata on the other hand detected quite often that something is going on. EDIT2: With "quite impressed" i mean, the performance was not much worse
- kchr 6y ago
  Snort/Suricata (and other IDS solutions) also depends on signatures/patterns. It's not different in that sense - you still need to define what to look for.
  - nix23 6y ago
    Yes but not file based signatures, the big difference are Network behavior analysis and Anomaly detection...and the biggest plus, its not on the device that is under attack/infected. >It's not different in that sense - you still need to define what to look for. Absolutely correct, i said nothing else, just that i found much more this way than with a locally installed Antivirus, there is just one measurement for a real secure connected computer..that is cable out ;)

by mrath 6y ago

lukevp 6y ago

We use BitDefender, and it once deleted the main .exe of an internal website (after several months of no issues with the same exe) mid-day. It also flagged that exe and made it nearly impossible to restore, even with the quarantine feature.

oweiler 6y ago

> Very nature of this kind of software. Over years I have never seen a proper antivirus software work without coming on my way. Of course I have not used all of them but only the most popular ones. Locking files, 100 percent cpu usage, false positives are some known issues. In the last 5-6 years I have never seen it correctly report a threat, but that is just for me. I am sure it is working fine for some. We use https://www.crowdstrike.com/ https://www.crowdstrike.com/ and never had any issues so far. Very low CPU usage, no false positives. Not sure if it actually does anything ;).

ubercow13 6y ago
Does anyone know how it works with such low overhead? What's it doing differently?

nix23 6y ago

Trend Micro is really good, we had to use it and i was quite impressed on Linux and Windows (for a Antivirus), for the MS-Antivirus, just disable 'Automatic sample submission' EDIT: But to be honest, Antivirus is just Old-school protection, it never detected anything outside 'already known viruses', Snort/Suricata on the other hand detected quite often that something is going on. EDIT2: With "quite impressed" i mean, the performance was not much worse

kchr 6y ago
Snort/Suricata (and other IDS solutions) also depends on signatures/patterns. It's not different in that sense - you still need to define what to look for.
- nix23 6y ago
  Yes but not file based signatures, the big difference are Network behavior analysis and Anomaly detection...and the biggest plus, its not on the device that is under attack/infected. >It's not different in that sense - you still need to define what to look for. Absolutely correct, i said nothing else, just that i found much more this way than with a locally installed Antivirus, there is just one measurement for a real secure connected computer..that is cable out ;)