TR Forums

I base my decisions and opinions on the data that shows how breaches occur, how malware is used in the real world, how crypting and zero days get past ANY software based solution.

This is a thread about Windows 10, which is the first Windows that HAS HARDWARE based security built in. Its called Device Guard and its entirely within the scope of this discussion.

I dont know who has the best polymorphic malware detection. Probably one that costs thousands of dollars a month and is outside the scope of this discussion. Probably whoever uses the best machine learning algorithms.

My point with pointing out that Bitdefender got hacked is that they STORED USER PASSWORDS UNENCRYPTED. Thats a pretty basic mistake for a security company.

Also that antiviruses can be a security risk if theyre not using exploit mitigation themselves.

And that exploit mitigations are infinitely more important than a standard antivirus.

just brew it! wrote:

ozzuneoj wrote:

*Don't go to pr0n sites.

...but even more importantly, don't go to religious sites!

http://www.pcmag.com/article2/0,2817,2403960,00.asp

pffffffff

Go to both to field test how good your protection is!!!

well, I'm using the free version of Bitdefender on my 2 Windows 10 PCs along with Malwarebytes. The free version of Bitdefender is pretty much invisible so you really cant tell if its really doing it job or not. Plus it doesn't use too many resources. I'm using the paid version of Bitdefender on my Yoga 2 Pro(Bitdefender gave out free 9 month keys) and it definitely is noticeable while running in the background and uses more resources. Plus Windows firewall stays on with the free version of Bitdefender. I had to turn the Bitdefender firewall OFF on the paid version of Bitdefender because it was giving me simple internet connectivity issues. Go figure. Honestly I don't believe its really any better than the free version.

Malwarebytes now is a must have because it will block bad webpages that pop-up much more reliably than any antivirus software out there even if it says its defends against malware. I have been running Malwarebytes for years now; Ive seen it at work. If you P2P, then you know what I'm talking about. I have used it religiously over the years now and recommend it to everyone regardless.

If you use Malwarebytes Anti Malware go get their Anti Exploit. Its infinitely more useful than their malicious website blocking. I think you can get it to shield Edge but i use Chrome on my one Windows 10 test system.

Kougar wrote:

Honestly, it's silly to tout near-perfect detection rates of a personal AV and at the same time tout uber safe browsing habits. If ya have uber safe browsing habits then why do you need the most-aggressive virus catching, system-hogging, user nagging AV too?

I've seen people get infected by compromised Ad servers on very benign sites, so safe browsing habits aren't necessarily that safe.

just brew it! wrote:

ozzuneoj wrote:

*Don't go to pr0n sites.

...but even more importantly, don't go to religious sites!

http://www.pcmag.com/article2/0,2817,2403960,00.asp

There's a joke about abstinence only computer education here some where.

BlackDove wrote:

Those "real world" tests are useless because they arent real world at all and they SHOULD be ignored because theyre meaningless.

They test against KNOWN malware samples, which is pointless. Most antivirus software offers nothing but a false sense of security and some of the ones that do well in those meaningless antivirus comparisons are the worst.

They aren't pointless. That's like saying I shouldn't get a flu shot because they don't really know how the flu virus is going to mutate this year, or not getting vaccinated because it doesn't matter. The odds are pretty good they're going make the right call, and it's about not getting other people sick since you could be a carrier and not know it.

More over, very few people have the skill and intelligence to actually find exploits, and most people copy what other people have done. AV is not to necessarily catch the 0-day exploits since signatures do lag behind, it's to catch the dozens of copy cats and derivatives that are going to be circulating. AV is basically a way to monkey patch the OS since certain OS vendors won't lock their stuff down.

Actually flu shots are a good analogy. Theyre pointless and often detrimental just like a lot of antivirus software.

The real world tests are pointless because they test against known malware. Try a well crypted RAT and it will get by almost any normal antivirus. Try zero day exploits and theyll get past most antiviruses because most antiviruses dont even look for the behaviors that exploits use.

Thats why you lock down your own operating system and minimize your attack surface. Windows 10 increases attack surface dramatically: torrenting updates, sending all your passwords over the internet to the cloud, connecting to random wifi hotspots by default.

If you want real security you have to educate yourself. Trusting that "they" know best when it comes to computer security or your health is extremely dangerous.

And the idea that security software is a supplement for operating system patches or to catch old malware is ridiculous.

I've been using Eset's NOD32 for years and it's worked great! I get just the plain anti-virus package not the all in one. Best of all it doesn't destroy your computers performance!

For the record, the only time I've been infected in the last 10 years, I was using ESET NOD32, it walked right through it... I did clean everything out manually, half by an RDP session remotely since I wasn't living at home at the time. That was a pita.

Having decent equipment outside, good firewall that is outside of your computer is a very decent way to get extra protection, since that is separate and not subject to your direct behavior for it's filtering.

I've never had any problems with just using whatever stock antivirus software microsoft has to offer, as long as you stay away from porn and illegal torrents.

At work we use Kaspersky for our paid antivirus. It seems to do alright. It has developed the annoyance of asking you to register, so we may move away from it.

For a free AV, we've moved away from AVG due to annoying pop up ads, and problems with some of the crap it does. AVG just doesn't seem very effective anymore.
Tried BitDefender free, but it had a tendency to crash and again asking for you to register is an annoyance. Avast seems to have similar annoyances.

I don't mind Panda Free Could AV, but the constant pop ups and interface that uses annoying live tiles is...hard to tolerate.

I've been looking into 360 total security. It seems to have a decent feature set for a free av. Also includes both bit defender and avira virus databases. Seems low impact, and easy to use ( good when you are installing it on machines used by...laymen )

I'm still investigating it, but it may be one that I'd put on a machine that didn't want to pay for an AV.

confusedpenguin wrote:

I've never had any problems with just using whatever stock antivirus software microsoft has to offer, as long as you stay away from porn and illegal torrents.

And Youtube and all the other big websites that have served malware recently? You probably have plenty of malware and dont even know it. If all you check with is Microsoft youd never know until all your data is stolen or encrypted by ransomware.

Max the limit

Learn about those products before you use them. You sure you want to trust a Chinese back door like Qihoo to protect your computer lol?

All the other ones you mentioned are also useless.

If you want a free security setup that actually works use Malwarebytes Anti Exploit free, Microsoft Security Essentials, and use the tools i mentioned before to check for malware(Malwarebytes Anti Malware free with rootkit scanning enabled, Adwcleaner, Junkware Removal Tool). Youd be better off also having real time protection with MBAM premium and its dirt cheap($25 a year for 3 PCs).

Setting up Windows correctly and having two factor authentication using a separate device(locked down phone) is more important than any antivirus. You need to assume you will get malware no matter what.

For your iOS or Android phone use Lookout Mobile Security and do not enable unknown sources or jailbreak it. Disable the "connect to random wifi hotspot" features too.

Windows 10 is far and away the most secure OS MSFT has ever produced. Its core files and even active memory are insulated from any kind of tampering.

However the most interesting thing about windows 10 is the system refresh. You can, at any time re-download and install a completely fresh copy of windows in about the same amount of time it takes to run a traditional heuristic virus scan. This is the killer feature that, imho makes 10+defender a viable option. The question is, is anyone willing to go the "nuke it from space route" as a simple matter of regular security? Because if you aren't, you probably want a real virus scanner, and not just defender (and honestly, it still has bugs, I wouldn't rely on refreshing).

0.02

Windows 10 has so many invasive and insecure internet facing features that it increases your attack surface dramatically as ive been saying. Its default settings even warn that theyre insecure lol. Its set to torrent updates and connect to ANY open wifi by default. Microsoft also included tons of spying features that a criminal could easily use to exfiltrate the most sensitive user data.

It is the least secure Windows yet and it seems like it was designed that way on purpose.

All those refresh features do nothing if you get a bootkit.

BlackDove wrote:

Max the limit

Learn about those products before you use them. You sure you want to trust a Chinese back door like Qihoo to protect your computer lol?

I don't speak to repute of Qihoo, and at this point I'm only introducing it to machines that are isolated using a cloned install image. I'm aware of the concerns of privacy of data being used by the company and I've started looking into how it operates. Again, I'm just getting started working with it. Trust isn't the word I'd use. Curious, and a bit interested. I haven't heard much from the company since their apps were removed from the Apple store. I'm not entirely sure I trust a lot of security software makers. The whole Kaspersky situation recently is a good example. I'm not going to hold their Chinese origins against them, but I tend to suspect first and build trust later.

BlackDove wrote:

All the other ones you mentioned are also useless.

I'm not sure you are using the term 'useless' correctly here, as many recent tests indicate higher hit rates than Windows Defender by several of the applications I mentioned. In an environment of day to day users who manage to find their way into risky security areas ( through clicking on links their friends send them on facebook or though an email for example ), the additional protection could be helpful.

BlackDove wrote:

If you want a free security setup that actually works use Malwarebytes Anti Exploit free, Microsoft Security Essentials, and use the tools i mentioned before to check for malware(Malwarebytes Anti Malware free with rootkit scanning enabled, Adwcleaner, Junkware Removal Tool). Youd be better off also having real time protection with MBAM premium and its dirt cheap($25 a year for 3 PCs).

Detection rates for MSE makes its ability as an in place AV solution for an everyday user suspect, in my opinion. I've had a lot of positive experience with MBAR, and MBAM. Very useful tools. ADWcleaner, less so. Often creates more annoyances than it does fix any troubles. I've found that McAfee Stinger has been helpful at times, and will sometimes pick up rootkit infections MBAR misses. I've also found Rkill, TDSS killer, and Hitman Pro ( kick starter for machines with ucash style zero access infections ) particularly helpful. Moved away from Comodo CCE recently because their scans take so damned long.

BlackDove wrote:

Setting up Windows correctly and having two factor authentication using a separate device(locked down phone) is more important than any antivirus. You need to assume you will get malware no matter what.

For your iOS or Android phone use Lookout Mobile Security and do not enable unknown sources or jailbreak it. Disable the "connect to random wifi hotspot" features too.

Multiple step verification isn't really practical for the average user, sadly. They find it annoying. Despite any explanation provided, a typical user will often demand simpler options. Unless you are in a situation where you can oversee the activities of users, all this will do is create complaints.

I would never put Chinese software on my PC. Especially an antivirus.

TDSSKiller and HMP are both excellent and HMP uses Kasperskys engine.

I say the tests are useless because most antiviruses are useless. Viruses arent the problem and antiviruses are now trying to be more complete but they fail because they largely rely on signatures and they cant block exploits.

If you reduce your attack surface by effectively hardening the browser and all internet facing applications, then youll probably only encounter malware that you install yourself.

Those tests dont usually include a lot of exploits because there are like 3 or 4 anti exploit products for consumers. If you block the exploit that was going to install whatever malware youd normally rely on to protect you then it doesnt matter if your antivirus does well in those meaningless tests.

Having to enter a code sent to you in a text message is not too difficult and if it is you shouldnt be using a computer. Two factor authentication is pretty much mandatory and Hotmail, Gmail and just about everything makes it really easy to set up. Most people have phones.

Even if you have Skyport and Bromium and spend thousands a month on security you should still use two factor.

MB Anti-Exploit does a few similar things to the Microsoft EMET, which is really something you need to get on your machine. But not as fully featured and not as configurable. I've had bad luck with the Anti-Exploit and compatibility with IE on several setups, where EMET has worked much better in general, but even EMET have some trouble running ASR and EAF on some setups, depending on the OS configuration, plugins, etc. Still, it's free and usefull.


As for the AV tests... the problem today is that AV is a very very small part of what is a threat, so while MSE get lower detections, the other suites just as well as MSE might not protect or even be designed to target the threats that are most likely today, and that is the point of why pure AV suites are basically a dead thing.

just brew it! wrote:

I would go with Windows Defender + periodic MBAM scans.

Yes, its what I also do. From time to time I also scan using ClamAV for windows.
No conflicts whatsoever since only the Defender stays resident. The MBAB and ClamAV are on demand.

Also, I might just throw this out there...
http://www.mnemonic.no/en/Blog/Free-and ... S-service/
Don't know how the latency will be from the states but we(I work for mnemonic) do offer it as a free service for the public. As far as not getting malware at all, having it blocked before it even gets to your computer is way preferably compared to having something preventing it locally. And considering web-content being one of the major infection routes everything extra helps.