5 ms·

I have personally watched Windows Defender fail to notice a real virus infection from a USB flash drive. The USB flash drive was plugged in and instantly Window

I have personally watched Windows Defender fail to notice a real virus infection from a USB flash drive. The USB flash drive was plugged in and instantly Windows was infected - Windows Defender did nothing. You could then manually run a Windows Defender scan and it would find the infection but it would not prevent the infection. I think one's need for a security product should match one's exposure to issues - it depends on your org. For a very long time I was not a fan of anti-virus, in 2022 I'm back to liking anti-virus (more like EDR these days).

3np 5y ago
Would one of the commercial antivirus products have caught it, though? Did you check?
- annoyingnoob 5y ago
  Yes. It was not a current virus, came from an old UEB flash drive that had been lying around for years. GravityZone noticed it and prevented it, which is why I knew to go look at the Win10 box the flash drive was last plugged into. Windows Defender's silence would have left us with the virus installed because it was not periodically scanning on its own.
gamblor956 5y ago
MS Defender used to automatically scan USB devices when plugged in but that's not the default anymore (and AFAIK hasn't been for a few years since one of the major updates); you now have to enable it somewhere non-intuitive (like the Policy Editor?).
- ridgered4 5y ago
  That's a really bizarre choice of default setting.
  - gamblor956 5y ago
    Not really, when you consider that there are tens of thousands of USB devices that work with Windows, many of which can operate like a flash drive even though they aren't (like cameras). I can imagine MS disabling this feature by default due to the headaches involved. Notably, autolaunching USB drives is also no longer the default option for USB devices. The user has to specifically choose what action happens when the device is first plugged in (and by default, that choice only applies to the current instance; the user must manually choose to have the choice apply the next time the device is plugged in).
- annoyingnoob 5y ago
  My point is that people thinking that Windows 10 comes with Windows Defender, and that Windows Defender will protect them by default, are in for a surprise. Defender probably is not doing anything you might think it should, by default.
RadixDLT 5y ago
dont confuse BitDefender with Windows Defender, not the same thing
- annoyingnoob 5y ago
  I did not confuse them. Yes, I mentioned GravityZone in a follow - which is a BitDefender product, and is the product that found the issue when Windows Defender did not.
driverdan 5y ago
What mechanism would a flash drive use to infect a modern version of Windows by only being plugged in?

3np 5y ago

Would one of the commercial antivirus products have caught it, though? Did you check?

annoyingnoob 5y ago
Yes. It was not a current virus, came from an old UEB flash drive that had been lying around for years. GravityZone noticed it and prevented it, which is why I knew to go look at the Win10 box the flash drive was last plugged into. Windows Defender's silence would have left us with the virus installed because it was not periodically scanning on its own.

gamblor956 5y ago

MS Defender used to automatically scan USB devices when plugged in but that's not the default anymore (and AFAIK hasn't been for a few years since one of the major updates); you now have to enable it somewhere non-intuitive (like the Policy Editor?).

ridgered4 5y ago
That's a really bizarre choice of default setting.
- gamblor956 5y ago
  Not really, when you consider that there are tens of thousands of USB devices that work with Windows, many of which can operate like a flash drive even though they aren't (like cameras). I can imagine MS disabling this feature by default due to the headaches involved. Notably, autolaunching USB drives is also no longer the default option for USB devices. The user has to specifically choose what action happens when the device is first plugged in (and by default, that choice only applies to the current instance; the user must manually choose to have the choice apply the next time the device is plugged in).
annoyingnoob 5y ago
My point is that people thinking that Windows 10 comes with Windows Defender, and that Windows Defender will protect them by default, are in for a surprise. Defender probably is not doing anything you might think it should, by default.

RadixDLT 5y ago

dont confuse BitDefender with Windows Defender, not the same thing

annoyingnoob 5y ago
I did not confuse them. Yes, I mentioned GravityZone in a follow - which is a BitDefender product, and is the product that found the issue when Windows Defender did not.

driverdan 5y ago

What mechanism would a flash drive use to infect a modern version of Windows by only being plugged in?