Hacker News Reader

Comment by cm2187 | Hacker News Reader

At this point windows defender is the principal threat to the normal functioning of my computer. It takes 100% CPU frequently, blocks my own programs based on some obscure ML rules, it re-enables itself when you disable it. It is indistinguishable from a virus.

View on HN

I have had the opposite experience. I've found windows defender to be basically the only AV you really need. I had a single occurrence where it flagged software I was writing as potentially malicious, but I was able to add an exception for my project and not think about it again. I've never noticed it clocking my CPU at any noticeable levels. For comparison, my work computer requires McAfee and at least once a day it clocks my CPU at 65% or more.

Windows Defender is the only antivirus I have used on my personal machines since it first launch and I have never had an issue, though I suspect most of my good fortune is good internet habits.

I wonder how much modern windows really requires an anti-virus. During the Windows XP days it felt vital, but since then it has felt more like something everyone just does out of caution.

I've been relying exclusively on Windows Defender since before it was called Windows Defender. I view third-party antivirus software as pointless at best, and actively harmful at worst.

>> I've found windows defender to be basically the only AV you really need.

Microsoft has no reason to load crapware along with Defender, they just ship that stuff with Windows itself.

Same here. Love the thing.

By “love it” I mean I never have to think about it or acknowledge it’s existence.

Which is the exact opposite of how the word “love” is generally used.

But I still love it.

> By "love it" I mean <insert highest possible praise software can receive here>

Seems like a normal thing to say to me. :)

A few months ago, I was playing with msfvenom and wanted to experiment with making a payload designed to bypass the antivirus of both Windows Defender and an antivirus that my work uses(with my boss's permission). I worked on it all day, but I could not get around internet-connected Windows Defender. Any time a port was bound or web connection was attempted, it shut me down.

It made way more impressed with Defender. I was always told it's inferior, but its sandboxing and heuristics scanning are quite good.

Not infrequently I have a client bring in a system without aftermarket antivirus that got hacked. It is ten times rarer that I get a hacked system with an aftermarket antivirus. I still recommend people use an aftermarket antivirus.

Regarding you being required to use McAfee, I've found it no better than Windows Defender, so I don't know why people pay for it. It doesn't even rate well in detection tests like av-test or av-comparatives.

I'm not making excuses for it, just trying to help. Try and infer what it's scanning. If you're coding, then that directory. If you're doing video editing, then that program. Set up exclusions for things that your PC should be doing.

Heuristics could be used to infer that stuff, so it's not ideal that we have to do it manually.

Oh I know what it is doing. My deployment mechanism on my home computers is that when it launches one of my apps, it checks first if there isn’t a new version stored on a private cloud repository, and if there is, downloads it, and runs it. The apps aren’t signed. And I am pretty sure that triggers defender’s malware downloading binaries from c&c network logic, so it randomly deletes the executable.

Also when I want to scan all the video files in a folder I run ffprobe hundreds of times pretty much in parallel and defender will want to inspect each instance of the same ffprobe exe independently, resulting in a 100% cpu usage and slow scan.

I solved the issue by defining folders exclusions but I don’t believe it can be scripted and it is a pain in the ass. All of the above is unwanted behaviour of an antivirus working against me.

Move most of the things(programs, data) on other drive and exclude whole drive.

EDIT: I have 4 drives on my C machine: Every disk but C is excluded.

  - C - as little stuff as possible, does not exclude
  - D - programming and misc utilities (everything from browsers to total commander, editors, programming languges is here)
  - E - Gaming
  - F - network share - media

That said my primary workstation is linux, htat just backup/gaming/windows programming one

The way I have dealt with it is that, I just keep my main os on C:

and install almost everything else on other drive , that I put in excluded folders in settings.

It is especially important if you are programming in rust or golang, that produce fat binaries, because its scans and uploads them.

What happens if you delete its main executable?

I don't think there is a concept of "main executable". There may be an executable that shows a GUI for the user, but most of the antivirus is probably implemented in the kernel, file system filter drivers, etc.

Even then, I doubt it's statically linked into the kernel or any other core component. It still must be some kind of separate loadable module that would most probably be stored as a separate file.

MsMpEng.exe is the core component, not sure if you can just delete it. There's group policy setting for disabling it (and corresponding registry key, HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware), but I think it only sticks in Enterprise versions.

Reply on news.ycombinator.com