8 ms·

At this point I'm convinced that the entire antivirus industry is a scam scheme for the most part. They make everyone suffer for their own profit. Users are sc

At this point I'm convinced that the entire antivirus industry is a scam scheme for the most part. They make everyone suffer for their own profit. Users are scared into installing this crap and paying recurring payments for it, and then the performance of their computer goes to shit. Developers are given nightmares by having their software misdetected as a virus or broken by the antivirus changing the OS behavior in unexpected ways.

Terry_Roll 5y ago
Its certainly a legal way to spy on many users and businesses to extract secrets thats for sure!
- blacksmith_tb 5y ago
  It could be used for that obviously, though do we have any evidence? Who would the AV vendors sell the secrets to, and how? (I guess it's not a surprise I wouldn't be in those meetings, but you'd think there be a whistleblower somewhere?)
  - buran77 5y ago
    The feature that automatically submits samples for further analysis has been known to catch proprietary executable code, send it to the AV manufacturer's sandbox where it was promptly executed and leaked data from inside that infrastructure (MS), or give away some complex hacking campaign before the attackers have the chance to use the tools (Kaspersky).
  - bigodbiel 5y ago
    There was that Kaspersky incident. TL;DR Kaspersky inadvertently acquired confidential NSA hacking tools from an NSA employee home computer with their AV product installed in it.
    - simonh 5y ago
      So Kaspersky flagged the hacking tools as a virus and sent it to Kaspersky for investigation? Nice!
frozenport 5y ago
Actually its an advertised feature and you keep most of the ETH you mined: https://community.norton.com/en/blogs/product-service-announcements/introducing-norton-crypto https://community.norton.com/en/blogs/product-service-announ...
- SketchySeaBeast 5y ago
  > Norton Crypto is included as part of Norton 360 subscriptions. However, there are coin mining fees as well as transaction costs to transfer Ethereum. The coin mining fee is currently 15% of the crypto allocated to the miner. So I have to pay money to subscribe to mine Norton Crypto and then pay a mining fee on top of that? That's amazing. Are they going to partner with QuickBooks so that I can subscribe to that as well and for a low 15% transaction fee they'll handling filing the taxes for me?
  - ljm 5y ago
    If it's installed without warning, I'm sure you'll also get a lovely surprise on your electricity bill when it turns out your laptop has been mining crypto when you thought it was sleeping. They're basically turning their installed user base into a botnet and charging customers money for the pleasure. I hope they get taken to court over it.
    - jallen_dot_dev 5y ago
      Your electricity bill is $10.00 higher this month. But don't worry! You earned $8.50 in your Norton Crypto wallet.
      - kingcharles 5y ago
        Congratulations! This month you have earned 8 "dollars" and 50 "cents" in NortCoin(tm).
      - michaelmrose 5y ago
        That you now have to pay $5 in fees to extract from said wallet.
hericium 5y ago
> At this point I'm convinced that the entire antivirus industry is a scam scheme for the most part. I was always under the impression that Microsoft does not fix or is extremely slow at fixing particular virus-allowing bugs due to their business model of licensing access to system features, you have to access to be able to build an antivirus software. I don't know Windows internals but I imagine that your usual game or text editor does not have and cannot gain access to kernel, bootloader etc, that AVs have.
- grishka 5y ago
  I don't know much about more modern Windows, but I'm fairly certain that on XP and earlier anything that ran on behalf of the administrator (the only user on most home installations) could trivially load arbitrary code into the kernel. I'm not sure how UAC affects this on Vista and newer.
  - muricula 5y ago
    These days you need to have your kernel driver signed by Microsoft or edit your boot config options to put the machine in an insecure state mostly useful for testing. To get it signed you need to pass a basic test suite which MS provides (and can be gamed). https://docs.microsoft.com/en-us/windows-hardware/drivers/install/driver-signing https://docs.microsoft.com/en-us/windows-hardware/drivers/in...
    - mananaysiempre 5y ago
      > These days you need to have your kernel driver signed by Microsoft However, this is required only for a “proper” kernel driver specifically; kernel code execution can still be accomplished without any signing at all using /dev/kmem-like mechanisms, which Microsoft explicitly does not consider a bug[1]. > or edit your boot config options to put the machine in an insecure state mostly useful for testing. Or fiddle with undocumented registry settings (used, among other things, to support upgrades from Windows 7 installations with unsigned drivers) and suppress signing checks for your driver even outside of testing mode[2]. > To get it signed you need to pass a basic test suite which MS provides [...]. You also need to register a business entity and cough up upwards of 300 USD/yr for a Microsoft-approved EV code signing cert[3] before that, which is the biggest hurdle for me at least. I have to say, even if this new Microsoft is not the same as old Microsoft, it sure looks very similar from some angles. [1] https://github.com/ionescu007/r0ak#is-this-a-bugvulnerability-in-windows https://github.com/ionescu007/r0ak#is-this-a-bugvulnerabilit... [2] https://geoffchappell.com/notes/security/whqlsettings/index.htm https://geoffchappell.com/notes/security/whqlsettings/index.... [3] https://docs.microsoft.com/en-us/windows-hardware/drivers/dashboard/get-a-code-signing-certificate https://docs.microsoft.com/en-us/windows-hardware/drivers/da...
cm2187 5y ago
At this point windows defender is the principal threat to the normal functioning of my computer. It takes 100% CPU frequently, blocks my own programs based on some obscure ML rules, it re-enables itself when you disable it. It is indistinguishable from a virus.
- zamalek 5y ago
  I'm not making excuses for it, just trying to help. Try and infer what it's scanning. If you're coding, then that directory. If you're doing video editing, then that program. Set up exclusions for things that your PC should be doing. Heuristics could be used to infer that stuff, so it's not ideal that we have to do it manually.
  - cm2187 5y ago
    Oh I know what it is doing. My deployment mechanism on my home computers is that when it launches one of my apps, it checks first if there isn’t a new version stored on a private cloud repository, and if there is, downloads it, and runs it. The apps aren’t signed. And I am pretty sure that triggers defender’s malware downloading binaries from c&c network logic, so it randomly deletes the executable. Also when I want to scan all the video files in a folder I run ffprobe hundreds of times pretty much in parallel and defender will want to inspect each instance of the same ffprobe exe independently, resulting in a 100% cpu usage and slow scan. I solved the issue by defining folders exclusions but I don’t believe it can be scripted and it is a pain in the ass. All of the above is unwanted behaviour of an antivirus working against me.
    - unionpivo 5y ago
      Move most of the things(programs, data) on other drive and exclude whole drive. EDIT: I have 4 drives on my C machine: Every disk but C is excluded. - C - as little stuff as possible, does not exclude - D - programming and misc utilities (everything from browsers to total commander, editors, programming languges is here) - E - Gaming - F - network share - media That said my primary workstation is linux, htat just backup/gaming/windows programming one
MetaWhirledPeas 5y ago
It has been this way since the 90s, sadly. As a bonus you don't even need to be scared into installing it because it was already there when you bought your prebuilt PC. Instead you'll be scared into not removing it.
Cosmin_C 5y ago
A while ago I caved in and purchased and installed Bitdefender, which I knew was all right. It wasn't. I didn't renew the license and uninstalled it. FFWD a couple years and my best friend upgrades his PC. Threadripper Zen 2, 128GB RAM, 2x NVME RAID 0 for the system, another NVME for stuff and HDDs for backups. System was incredibly sluggish and unresponsive and his extra NVME was sometimes dropping from the list of drives shown by explorer. Uninstalled his Bitdefender and all the issues disappeared. It's just complete robbery at this point. Malwarebytes is a good product for example and Windows Defender is enough. But the best stuff is disabling all of these and just use script blockers and safe browsing practices and you get to keep all the processing power you paid for.
- meibo 5y ago
  BitDefender is one of the bigger scams out there. I wholly believe that they operate based on a "blacklist everything first" policy, because that lets them tout their 99,99% detection rate. I run a big open source project and the amount of people that complain to us about BitDefender deleting our software is staggering.
  - schleck8 5y ago
    Bitdefender has a good false positive rate though according to av comparatives, in contrast to norton which has the most https://www.av-comparatives.org/tests/real-world-protection-test-july-october-2021/ https://www.av-comparatives.org/tests/real-world-protection-...
- mrjin 5y ago
  Well, let's take it from a different angle: We don't need malwares but AV vendors do. If there were no malwares, there would be no AV vendors too.
  - lordnacho 5y ago
    Not sure this is true. Just the fear should be enough to get people to buy. Look at organised religion.
mrjin 5y ago
I really thought antivirus software was helpful and was naively reporting samples of malwares I found on my machine to one of the vendor I trusted. Things like that went on for years until one day I found something suspicious on my machine again: self-extracted other binaries, stealthily registered auto-start on boot, listening on some port, contacting some servers etc.. The most important thing was that I did not install it not it was a part of anything I accidentally installed. So I reported again and well to my surprise, they told me nah, it's not malicious. Huh? Their response raised a bigger question mark in my head as I already spent hours trying and managed to disable it from my system and I was pretty sure it actually was malicious. I wasn't sure what was going on then, so I replied that I was not comfortable with the sample, could you test again etc. without providing evidences I found deliberately. And the feedback from them was: we've tested it and it was not malicious. Okay, so I was convinced that: either they were lousy enough and unable to figure out what was going on or it was created by them. The behaviors were so obvious and thus it's very unlikely the could not find it out, I was inclined to believe they were the one created it. So I immediately uninstalled their products from all my machines and now the very first thing I do when I receive a new machine is to remove pre-installed antivirus software and disable the damn Windows Defender. M$ now makes it really hard to disable Windows Defender completely...
qwerty456127 5y ago
Yet incidents of viruses/ransomware infecting PCs after clicking attachments/links exist so we need at least a purely functional (file/link in - risk guess out) antiviruses. I generally use VirusTotal but I it doesn't seem reasonable to use it for checking potentially confidential files.
- grishka 5y ago
  Except when something says "please disable your antivirus before opening this", many people would gladly do so. IMO at this point, it's a social problem, not a technical one. People need to be taught about this stuff.
  - qwerty456127 5y ago
    > Except when something says "please disable your antivirus before opening this", many people would gladly do so. Unless you plug it right into your company e-mail server or just hide it well enough to keep vulnerably-unadvanced users away - e.g. my elderly mother would hardly disable her antivirus if that required editing the registry or entering a long terminal command.
wiseleo 5y ago
I have a priceless screenshot from TrendMicro acting like malware. https://imgur.com/a/ZgLIRLF https://imgur.com/a/ZgLIRLF The “error” message tells the user the machine is being protected by Windows Defender…
Abishek_Muthian 5y ago
At this point an AV with real-time scanning is only useful to a computer user who doesn't know or care about operational security and plugs in random flash drives (or) clicks on everything they see; And since they form the average customer profile of these AV makers they continue to thrive. For the rest, AV software results in diminishing returns.
- dorgo 5y ago
  > and plugs in random flash drives Is this still a problem? I thought OSs don't execute stuff from flash drives automatically any more.
  - Abishek_Muthian 5y ago
    That could be a valid question, But I haven't used Windows for over a decade as the main OS but I presume there could be many who would click 'MakeMoneyFromCrypto.exe' on their flash drive without thinking where it came from twice.
timbit42 5y ago
I agree it largely is a scam but I still find a few avs to be better than Windows Defender. Perhaps if more people did some real research, instead of asking their friend who has no better idea than they have, before purchasing, it would knock some of the bad apples off the tree and boost the better ones, hopefully encouraging them to get better. Of course, the concept of av is flawed because it takes them a few days to get new signatures out. I'd like to see more avs implement whitelists.

Terry_Roll 5y ago

Its certainly a legal way to spy on many users and businesses to extract secrets thats for sure!

blacksmith_tb 5y ago
It could be used for that obviously, though do we have any evidence? Who would the AV vendors sell the secrets to, and how? (I guess it's not a surprise I wouldn't be in those meetings, but you'd think there be a whistleblower somewhere?)
- buran77 5y ago
  The feature that automatically submits samples for further analysis has been known to catch proprietary executable code, send it to the AV manufacturer's sandbox where it was promptly executed and leaked data from inside that infrastructure (MS), or give away some complex hacking campaign before the attackers have the chance to use the tools (Kaspersky).
- bigodbiel 5y ago
  There was that Kaspersky incident. TL;DR Kaspersky inadvertently acquired confidential NSA hacking tools from an NSA employee home computer with their AV product installed in it.
  - simonh 5y ago
    So Kaspersky flagged the hacking tools as a virus and sent it to Kaspersky for investigation? Nice!

frozenport 5y ago

Actually its an advertised feature and you keep most of the ETH you mined: https://community.norton.com/en/blogs/product-service-announcements/introducing-norton-crypto https://community.norton.com/en/blogs/product-service-announ...

SketchySeaBeast 5y ago
> Norton Crypto is included as part of Norton 360 subscriptions. However, there are coin mining fees as well as transaction costs to transfer Ethereum. The coin mining fee is currently 15% of the crypto allocated to the miner. So I have to pay money to subscribe to mine Norton Crypto and then pay a mining fee on top of that? That's amazing. Are they going to partner with QuickBooks so that I can subscribe to that as well and for a low 15% transaction fee they'll handling filing the taxes for me?
- ljm 5y ago
  If it's installed without warning, I'm sure you'll also get a lovely surprise on your electricity bill when it turns out your laptop has been mining crypto when you thought it was sleeping. They're basically turning their installed user base into a botnet and charging customers money for the pleasure. I hope they get taken to court over it.
  - jallen_dot_dev 5y ago
    Your electricity bill is $10.00 higher this month. But don't worry! You earned $8.50 in your Norton Crypto wallet.
    - kingcharles 5y ago
      Congratulations! This month you have earned 8 "dollars" and 50 "cents" in NortCoin(tm).
    - michaelmrose 5y ago
      That you now have to pay $5 in fees to extract from said wallet.

hericium 5y ago

> At this point I'm convinced that the entire antivirus industry is a scam scheme for the most part. I was always under the impression that Microsoft does not fix or is extremely slow at fixing particular virus-allowing bugs due to their business model of licensing access to system features, you have to access to be able to build an antivirus software. I don't know Windows internals but I imagine that your usual game or text editor does not have and cannot gain access to kernel, bootloader etc, that AVs have.

grishka 5y ago
I don't know much about more modern Windows, but I'm fairly certain that on XP and earlier anything that ran on behalf of the administrator (the only user on most home installations) could trivially load arbitrary code into the kernel. I'm not sure how UAC affects this on Vista and newer.
- muricula 5y ago
  These days you need to have your kernel driver signed by Microsoft or edit your boot config options to put the machine in an insecure state mostly useful for testing. To get it signed you need to pass a basic test suite which MS provides (and can be gamed). https://docs.microsoft.com/en-us/windows-hardware/drivers/install/driver-signing https://docs.microsoft.com/en-us/windows-hardware/drivers/in...
  - mananaysiempre 5y ago
    > These days you need to have your kernel driver signed by Microsoft However, this is required only for a “proper” kernel driver specifically; kernel code execution can still be accomplished without any signing at all using /dev/kmem-like mechanisms, which Microsoft explicitly does not consider a bug[1]. > or edit your boot config options to put the machine in an insecure state mostly useful for testing. Or fiddle with undocumented registry settings (used, among other things, to support upgrades from Windows 7 installations with unsigned drivers) and suppress signing checks for your driver even outside of testing mode[2]. > To get it signed you need to pass a basic test suite which MS provides [...]. You also need to register a business entity and cough up upwards of 300 USD/yr for a Microsoft-approved EV code signing cert[3] before that, which is the biggest hurdle for me at least. I have to say, even if this new Microsoft is not the same as old Microsoft, it sure looks very similar from some angles. [1] https://github.com/ionescu007/r0ak#is-this-a-bugvulnerability-in-windows https://github.com/ionescu007/r0ak#is-this-a-bugvulnerabilit... [2] https://geoffchappell.com/notes/security/whqlsettings/index.htm https://geoffchappell.com/notes/security/whqlsettings/index.... [3] https://docs.microsoft.com/en-us/windows-hardware/drivers/dashboard/get-a-code-signing-certificate https://docs.microsoft.com/en-us/windows-hardware/drivers/da...

cm2187 5y ago

At this point windows defender is the principal threat to the normal functioning of my computer. It takes 100% CPU frequently, blocks my own programs based on some obscure ML rules, it re-enables itself when you disable it. It is indistinguishable from a virus.

zamalek 5y ago
I'm not making excuses for it, just trying to help. Try and infer what it's scanning. If you're coding, then that directory. If you're doing video editing, then that program. Set up exclusions for things that your PC should be doing. Heuristics could be used to infer that stuff, so it's not ideal that we have to do it manually.
- cm2187 5y ago
  Oh I know what it is doing. My deployment mechanism on my home computers is that when it launches one of my apps, it checks first if there isn’t a new version stored on a private cloud repository, and if there is, downloads it, and runs it. The apps aren’t signed. And I am pretty sure that triggers defender’s malware downloading binaries from c&c network logic, so it randomly deletes the executable. Also when I want to scan all the video files in a folder I run ffprobe hundreds of times pretty much in parallel and defender will want to inspect each instance of the same ffprobe exe independently, resulting in a 100% cpu usage and slow scan. I solved the issue by defining folders exclusions but I don’t believe it can be scripted and it is a pain in the ass. All of the above is unwanted behaviour of an antivirus working against me.
  - unionpivo 5y ago
    Move most of the things(programs, data) on other drive and exclude whole drive. EDIT: I have 4 drives on my C machine: Every disk but C is excluded. - C - as little stuff as possible, does not exclude - D - programming and misc utilities (everything from browsers to total commander, editors, programming languges is here) - E - Gaming - F - network share - media That said my primary workstation is linux, htat just backup/gaming/windows programming one

MetaWhirledPeas 5y ago

It has been this way since the 90s, sadly. As a bonus you don't even need to be scared into installing it because it was already there when you bought your prebuilt PC. Instead you'll be scared into not removing it.

Cosmin_C 5y ago

A while ago I caved in and purchased and installed Bitdefender, which I knew was all right. It wasn't. I didn't renew the license and uninstalled it. FFWD a couple years and my best friend upgrades his PC. Threadripper Zen 2, 128GB RAM, 2x NVME RAID 0 for the system, another NVME for stuff and HDDs for backups. System was incredibly sluggish and unresponsive and his extra NVME was sometimes dropping from the list of drives shown by explorer. Uninstalled his Bitdefender and all the issues disappeared. It's just complete robbery at this point. Malwarebytes is a good product for example and Windows Defender is enough. But the best stuff is disabling all of these and just use script blockers and safe browsing practices and you get to keep all the processing power you paid for.

meibo 5y ago
BitDefender is one of the bigger scams out there. I wholly believe that they operate based on a "blacklist everything first" policy, because that lets them tout their 99,99% detection rate. I run a big open source project and the amount of people that complain to us about BitDefender deleting our software is staggering.
- schleck8 5y ago
  Bitdefender has a good false positive rate though according to av comparatives, in contrast to norton which has the most https://www.av-comparatives.org/tests/real-world-protection-test-july-october-2021/ https://www.av-comparatives.org/tests/real-world-protection-...
mrjin 5y ago
Well, let's take it from a different angle: We don't need malwares but AV vendors do. If there were no malwares, there would be no AV vendors too.
- lordnacho 5y ago
  Not sure this is true. Just the fear should be enough to get people to buy. Look at organised religion.

mrjin 5y ago

I really thought antivirus software was helpful and was naively reporting samples of malwares I found on my machine to one of the vendor I trusted. Things like that went on for years until one day I found something suspicious on my machine again: self-extracted other binaries, stealthily registered auto-start on boot, listening on some port, contacting some servers etc.. The most important thing was that I did not install it not it was a part of anything I accidentally installed. So I reported again and well to my surprise, they told me nah, it's not malicious. Huh? Their response raised a bigger question mark in my head as I already spent hours trying and managed to disable it from my system and I was pretty sure it actually was malicious. I wasn't sure what was going on then, so I replied that I was not comfortable with the sample, could you test again etc. without providing evidences I found deliberately. And the feedback from them was: we've tested it and it was not malicious. Okay, so I was convinced that: either they were lousy enough and unable to figure out what was going on or it was created by them. The behaviors were so obvious and thus it's very unlikely the could not find it out, I was inclined to believe they were the one created it. So I immediately uninstalled their products from all my machines and now the very first thing I do when I receive a new machine is to remove pre-installed antivirus software and disable the damn Windows Defender. M$ now makes it really hard to disable Windows Defender completely...

qwerty456127 5y ago

Yet incidents of viruses/ransomware infecting PCs after clicking attachments/links exist so we need at least a purely functional (file/link in - risk guess out) antiviruses. I generally use VirusTotal but I it doesn't seem reasonable to use it for checking potentially confidential files.

grishka 5y ago
Except when something says "please disable your antivirus before opening this", many people would gladly do so. IMO at this point, it's a social problem, not a technical one. People need to be taught about this stuff.
- qwerty456127 5y ago
  > Except when something says "please disable your antivirus before opening this", many people would gladly do so. Unless you plug it right into your company e-mail server or just hide it well enough to keep vulnerably-unadvanced users away - e.g. my elderly mother would hardly disable her antivirus if that required editing the registry or entering a long terminal command.

wiseleo 5y ago

I have a priceless screenshot from TrendMicro acting like malware. https://imgur.com/a/ZgLIRLF https://imgur.com/a/ZgLIRLF The “error” message tells the user the machine is being protected by Windows Defender…

Abishek_Muthian 5y ago

At this point an AV with real-time scanning is only useful to a computer user who doesn't know or care about operational security and plugs in random flash drives (or) clicks on everything they see; And since they form the average customer profile of these AV makers they continue to thrive. For the rest, AV software results in diminishing returns.

dorgo 5y ago
> and plugs in random flash drives Is this still a problem? I thought OSs don't execute stuff from flash drives automatically any more.
- Abishek_Muthian 5y ago
  That could be a valid question, But I haven't used Windows for over a decade as the main OS but I presume there could be many who would click 'MakeMoneyFromCrypto.exe' on their flash drive without thinking where it came from twice.

timbit42 5y ago

I agree it largely is a scam but I still find a few avs to be better than Windows Defender. Perhaps if more people did some real research, instead of asking their friend who has no better idea than they have, before purchasing, it would knock some of the bad apples off the tree and boost the better ones, hopefully encouraging them to get better. Of course, the concept of av is flawed because it takes them a few days to get new signatures out. I'd like to see more avs implement whitelists.