ARE YOU KIDDING ME RIGHT NOW AVIRA????

^^ 60% CPU for three file scanner instances owned by SYSTEM that I can not terminate, but that are all at 100% scanned and the files they scan don't exist anymore??

"that I can not terminate" wat, I never knew you could do that...

Also thanks for the hat tip, :)

@Vogel612 AV software is generally pretty awful in my experience.

Decades of use x millions of machines = zillions of wasted CPU cycles running antivirus software.

@Edward We use an A/V software that isn't too bad.

Best AV is none at all on a secure system, IMHO.

@Edward under the assumption that no user is acting on that system, yes.

@Vogel612 No, it's under the assumption that it employs better detection mechanisms than are typically used in antivirus software.

@Edward Ehhh...I don't think you realize the oxymoron which that statement is.

A/V is not to protect against invalid access, it's to protect against malicious software, which can get on that system through all sorts of things, like bugs in the operating system as WannaCry / NotPeyta did.

@Vogel612 Not even that - under the assumption that the system is not connected to any network or outside peripherals.

@EBrown I am pretty sure I was writing commercial antivirus software before you were born, so maybe I know what I'm saying?

No offense intended, but I am quite sure there are better preventative measures available.

@Edward Yeah I kinda don't care - having seen how even systems with extremely high-end A/V's on them have still been corrupted, and even launched crypto-lockers against our network, even with no active users I can tell you there is no security that beats an active threat-analysis by an anti-virus. So get off your high-horse and don't talk down to me like that ever again.

/BatmanOut

@EBrown Yes, I'm agreeing that "even high end AV" can let things through. What I'm saying is that rather than using techniques like signature scanning, there are better means available.

@EBrown I really do not mean to offend.

I don't assume you don't know what you're talking about, and I'd hope to be afforded the same courtesy.

@Edward That reminds me that today one of the PC's at work got locked by an anti-malware detector for encrypting too many files within X period. The encryptions were initiated by the user

@skiwi When you say "got locked" do you mean that it locked up (i.e. an error) or that it intentionally prevented a suspect action (i.e. prevented further encryption)?

@Edward Actually I think it only showed a warning, I don't know to what extent though

Yeah, it didn't get locked, my bad

It did take away write rights to that directory if I recall correctly

@skiwi That's probably about the best one would hope for in the circumstances.

It's hard enough to detect anomalous (and potentially destructive) behavior, but even harder to figure out how to react to it.

@Edward Furthermore, if you really were writing commercial anti-virus before I was born (which means pre 1990's) you were protecting against threats that were not even a reasonable threat to todays world - even the most basic script-kiddie is writing malware more dangerous than some of the more sophisticated attack vectors of the 1980's.

The A/V software we use monitors your filesystem for changes, if it detects, for example, that more than 3 files are changed to an "unreadable" (see: encrypted) format, then it shuts your network down kills that process and shows a big red alert.

So don't tell me what I do or don't know, I work in a field where users regularly infect our systems with malware, and I promise that if any server here were to not have anti-virus on it my entire company would be borked. Even the "most-secured" ones, which only do outbound network communications (and one of which was still infected recently).

@EBrown You've got it turned around. I'm not telling (or even assuming) what you do or don't know. I'm asserting what I know which is what you called into question.

FYI, look up the November 1993 issue of Virus Bulletin for an article I wrote on the now quaintly antique "Nuke Encryption Device."

@Edward @EBrown page 16

on that note... since 200 is conducting site-business and this seems to be a closed topic... does anyone mind if I move the A/V convo to the nth?

← 35 messages moved from The 2nd Monitor

@Vogel612 That's pretty neat! I didn't know it was still online after all these years.

vxheaven.org/vx.php?id=en02

^^ stuff like this is weird. ...

it looks like from the early nineties, but it has disqus, which hasn't been available before 2010...

@Vogel612 Did I get a invite cause two of my messages were moved? (It's never happened before, so it'd be nice to know) :)

@Peilonrayz yes, that's exactly why...

@Vogel612 Thanks, :) Nice to know

You can either be invited manually through the usercard or when messages get moved :)

@Vogel612: I seem to remember (but don't seem to be able to find) that there was a known issue with Avira and "ghost processes" which looks a little like what you've got. Did you solve it?

it kinda solved itself after I nuked avira

:)

took quite a while though

@Edward are you still developing A/V software? I seem to recall that you were also doing something more bare-metal, similar to Mast..

No, I haven't been involved with that for many a year. I've been mostly been doing embedded systems work of late, so your recollection is correct.

One issue of interest to me is embedded system security. Unlike desktop machines, there often is no user interface or if there is, it's likely not to be noticed.

For example, we probably don't want automotive antilock braking systems (ABS) to use AV software.

Imagine you need to stop fast in an emergency and stomp on the brake pedal, only to have a dialog box pop up on the dashboard that says, "Scanning for threats; please wait."

Unacceptable!

@Edward "Great, I still have several hours till the store closes. I can relax and drive safely" - "Please wait; your car is currently being updated…" - "..."

@Zeta Yes, you've got the idea.

Even worse if it's a critical system on which human lives may depend.

Like this:

Vogel612 vs. syb0rg: 1868 diff. Year: +815. Quarter: +82. Month: +82. Week: +26. Day: +25.

Kaz vs. Mast: 325 diff. Year: -222. Quarter: -53. Month: -53. Week: -22. Day: 0.