Hacker News Reader

Comment by temp | Hacker News Reader

>Why not just use the Microsoft ones that are free? reply

For one thing, last time I checked benchmarks they showed that Microsoft's anti-virus not only has worse detection results but also worse performance than some of the free alternatives.

View on HN

I am very interested in seeing these benchmarks, as my anecdotal experience is the complete opposite.

On my two machines (with SSDs) I regularly find that copying lots of small files is severely slowed down by Windows Defender. It utilizes one core to the max and when disabling it, the copy operation gets a lot faster.

I don't know about other antivirus software though.

I can mirror this experience too. Properly working Intel SSD fwiw. Mine impacts not only file copys but also all small file I/O like listing directories (explorer would hang for 1 second entering a new directory) and the like.

I've had a couple users complain that my program started running really slowly while they were using Microsoft Security Essentials. It turns out that if a file contains a "suspicious" pattern of bytes (which in these two cases were two different user-drawn bitmaps), SE will do some time consuming heuristics every time you open the file. So opening, reading, closing a file 10 times in a row is really bad.

I don't know why this comment is being downvoted. A quick google will show the results.

Page 9 of the latest report: http://www.av-comparatives.org/summary-reports/

Yes. Microsoft, alone among AV vendors, shares any signatures it finds with every other major AV vendor, so everyone is going to find everything Microsoft does, plus what their own research turns up. That said, I don't think it matters enough to bother with the problems for-pay anti-virus vendors bring.

Did you read the document? The Microsoft product is quite good, but many of the paid ones are better. I don't know what problems you are talking about (I don't have any) - but that's a personal anecdote, we are discussing a proper comparison.

I skimmed it, I didn't see anything I haven't seen before. Notably they aren't grading on stuff like "number of popups that I have to click through to get it to quit nagging me." There's also been privilege elevation exploits using antivirus software.

EDIT: And there's anti-virus software that's messing with your system's root certificates so it can MitM all your HTTPS traffic to scan it:

http://www.securityweek.com/antivirus-software-has-negative-...

> I don't know what problems you are talking about (I don't have any)

the glaring security holes opened by them month after month? The HN link you're posting a comment to is about the 5th bad exploit in third-party AV this year alone.

So far nothing seems to have been found in the MS built-in one.

Installing third-party AV means that you expose yourself to targeted attacks and, if this goes on like it currently does, to drive-by attacks too as by now malware authors must have gotten the hint that searching for vulnerabilities in those various AV products is a very worthwile effort.

In general, AV products provide a HUGE attack surface: They don't just need to support natively many more file formats than any other piece of software, they also have to harden their support against exploit code purposefully written to be malicious.

And compared to many exploitable user-space applications, these AV products normally run in kernel-space, so an attacker doesn't just gain remote code execution, they gain remote code execution with admin privileges.

Yeah, but the detection rates suck for every single AV.

Slightly better snake oil is still snake oil.

Why is "worse" not OK but "better" is? Neither can be perfect and both will be far better than nothing. Just making up some numbers, but if the Windows AV can detect 80% of viruses and Norton can detect 90%, then you're still vulnerable to that last 10% whatever you do. You're also still protected from the majority of viruses whatever you do too.

Reply on news.ycombinator.com