Hacker News Reader

Comment by veeti | Hacker News Reader

> Moreover, the engine runs unsandboxed and as NT Authority\SYSTEM.

Is there an antivirus that _doesn't_ parse untrusted input in a process with full system privileges? What a joke.

Already years (~7+) ago AVG introduced an out of process scanning implementation that opens the file in question with system rights however transfers the handle to a lower privileged process (restricted with ACLs) that actually performs the actual scan

That's interesting. Unfortunately, AVG has been acquired by Avast last year [1]. I already looked into the new version of AVG a few months ago, and found that they have replaced AVG's engine with Avast's engine. Since the scanner always runs as NTAuthority\SYSTEM in the current Avast version, I would assume that the same is true for the most recent AVG version. I'm not completely sure, though, so don't quote me on that.

[1]: https://press.avast.com/avast-announces-agreement-to-acquire...

Well since I am no longer involved with them for a long time, I can't really say how this all went and what is currently the state.

However this piece is realtively simple to implement on windows so I can only hope they would implement the same thing for avast eventually at least. This is IMHO the only sane way to do scanning without exposing the system to a huge risk

Having an antivirus installed has so far consistently proven to make a system vastly less secure, degrade performance and reliably break a number of applications you might actually want to use. All of them have just fallen apart at the slightest scrutiny and they are routinely programmed by the last kind of people you want to design and implement them.

The whole concept is just useless. Scanning all system IO for 20 year old BIOS viruses is a pure waste of energy.

The Windows Defender Team is working to get it sandboxed.

So now it's a 10 year race between Mozilla and Defender Team to implement a feature you'd expect them to have from day one. Amazing.

Reply on news.ycombinator.com