3 ms·

The name of the .exe certainly matters. When going through airport security, do you think it matters at all if your name is Osama Bin Laden? Such a person is g

by jgmmo 15y ago

The name of the .exe certainly matters. When going through airport security, do you think it matters at all if your name is Osama Bin Laden? Such a person is going to experience a much larger degree of scrutiny from TSA then a person named John Smith.

SomeOtherGuy 15y ago
That's a great example, as it shows anti-virus scammers are just as bad as the airport security scammers. Someone being named Osama Bin Laden has no bearing on their likelihood of hijacking a plane.
drucken 15y ago
If a mere name alone is enough to create a false positive and changing this is a living nightmare, why are you in the least bit surprised that customers and developers are livid at having to deal or workaround the closed and disparate world of AV? Neither is it the least bit surprising that support personnel and developers consider the shear number and consistency of false positives as "fear-mongering". It would only take a further small step to then consider, what is the point of having AV at all in the first place since the best it can do is fill an increasingly small hole in prevention for ordinary user behaviour and a static role for precursor forensics (actual forensics would not need the service). TL;DR. AV industry has a LOT to answer for, to the point where it maybe should not exist in its current form.
- jgmmo 15y ago
  I think it can be justified. It's not common, it's known as being one of the more crude methods of detecting malware -- but hey -- we use what works and what fixes peoples machines. That is why it is in use by some vendors today. Here's an example: Some companies block anything named 'svchost.exe' that isn't in system32. Create a txt doc and name it svchost.exe and drop it on your desktop and some antivirus software will detect and remove that item. Why? Because there is no good reason for someone to have svchost.exe anywhere other than SYSTEM32 and also because svchost.exe is one of the top 10 most common names for malware. So, at risk of some FP's -- some companies have a rule that simply removes these if found anywhere else.
pnathan 15y ago
If I'm a 6 foot white guy with blond hair and blue eyes with the name bin Laden, I would expect some funny looks and nothing more. Names - particalarly short ones - are not what you might call unique identifiers. It's idiotic to match on names like rte.exe.
- jgmmo 15y ago
  Of course it is. No legit anitvirus company is blocking all files named rte.exe. That's insanity. I am just saying in some circumstances, the name of a file can be a huge help in indicating that maybe you should take a closer look.

by jgmmo 15y ago

SomeOtherGuy 15y ago

That's a great example, as it shows anti-virus scammers are just as bad as the airport security scammers. Someone being named Osama Bin Laden has no bearing on their likelihood of hijacking a plane.

drucken 15y ago

If a mere name alone is enough to create a false positive and changing this is a living nightmare, why are you in the least bit surprised that customers and developers are livid at having to deal or workaround the closed and disparate world of AV? Neither is it the least bit surprising that support personnel and developers consider the shear number and consistency of false positives as "fear-mongering". It would only take a further small step to then consider, what is the point of having AV at all in the first place since the best it can do is fill an increasingly small hole in prevention for ordinary user behaviour and a static role for precursor forensics (actual forensics would not need the service). TL;DR. AV industry has a LOT to answer for, to the point where it maybe should not exist in its current form.

jgmmo 15y ago
I think it can be justified. It's not common, it's known as being one of the more crude methods of detecting malware -- but hey -- we use what works and what fixes peoples machines. That is why it is in use by some vendors today. Here's an example: Some companies block anything named 'svchost.exe' that isn't in system32. Create a txt doc and name it svchost.exe and drop it on your desktop and some antivirus software will detect and remove that item. Why? Because there is no good reason for someone to have svchost.exe anywhere other than SYSTEM32 and also because svchost.exe is one of the top 10 most common names for malware. So, at risk of some FP's -- some companies have a rule that simply removes these if found anywhere else.

pnathan 15y ago

If I'm a 6 foot white guy with blond hair and blue eyes with the name bin Laden, I would expect some funny looks and nothing more. Names - particalarly short ones - are not what you might call unique identifiers. It's idiotic to match on names like rte.exe.

jgmmo 15y ago
Of course it is. No legit anitvirus company is blocking all files named rte.exe. That's insanity. I am just saying in some circumstances, the name of a file can be a huge help in indicating that maybe you should take a closer look.