Hacker News Reader

I've lived through and heard about this so many times that it stopped being an anecdote for me a long time ago; it's just how hostile most of the 3rd party AV applications are.

They, IMHO, should be given no system access and should only be allowed to implement something like IsHarmful(s DataStream) (bool, string) - maybe a little more and that's it.

View on HN

The thing is, modern antiviruses rely on context to classify data as malware or not. It is fine if antivirus.exe is trying to remove itself; not so much if it is being removed by calc.exe.

It's much more useful to look for suspicious behavior than to try to classify streams of data as "harmful".

Reply on news.ycombinator.com