[Closed] Windows Virus Protection - is Windows Defender enough?

Not had anything but the built in since I got w10, the day after it come out. Not have any viruses.

Used to run malwarebytes periodically but there not really any point.

From advice given by Cougar on here we ditched Norton which was needing constant reinstallation and all sorts of other sling down problems and went for Windows Defender...

Its been fine on a W10 machine (as far as its possible for me to know), no issues and speed and stability have improved.

Plus, its free.

Yep been using it for years now with no issues. Wouldn't bother with anything else at the moment.

Thanks. It's some of the scaremongering ads from AVG that are the worst. I get they need to make money from upgrades, but that's not the way to do it.

Not have any viruses.

I think you mean that "windows defender" has not detected any viruses.

I use it, but sometimes I would like it to remind me that it is actually protecting me, no notifications since I switched to it is as worrying as getting lots.

It's some of the [s]scaremongering ads[/s] marketing from AVG

FIFY

Call that marketing...

yeah. used only windows defender for 10 years after crap like AVG crippling the system. Tons of porn viewed. No viruses. (on the computer)

Yes.

Does the job. Isn't bloated. Doesn't slow the system down. Unlike 99% of commercial (inc "free" versions of commercial) AV products.

It's not a full on system that gets its hooks into everything and nags you that this or that is potentially bad while browsing web sites. It just catches stuff at the point of download or execution mainly. Which is all you need.

MSP - Member 
sometimes I would like it to remind me that it is actually protecting me, no notifications since I switched to it is as worrying as getting lots.

I get a regular pop up saying it's working and found nothing. That's in Windows 10.

Just use Defender, having just got back from Ignite in Florida, I can happily say what MS is doing with their antimalware and threat detection stuff is absolutely class leading and only getting better.

Random point all of their definitions are written by Machine learning (AI) now, this is so effective it can even create an on the fly definition just for you when needed.

If anyone cares watch this

Defender and no dodgy browsing habits / clicky on spammy email to quickly.

It's not the best protection or the fastest, but it's pretty good.

https://chart.av-comparatives.org/chart1.php

I use a mix of MS Defender BitDefender Free for those reasons. Only one annoyance is that you need to sign up for an account otherwise it nags once a week or so.

Thanks guys, AVG uninstalled.

I can see the appeal of using Defender. But most viruses rely on using bugs in the operating system - seems a little perverse to expect the company that wrote those bugs to provide a solid defence against them. 😀

Also my feeling is that Defender is widely used, so consequently it is widely targeted by viruses trying to fool the AV.

For those reasons I tend to use Avast which is free, performs well, and is only [i]mildly[/i] irritating once you turn off all the notifications.

Ditched all AV a while back. Never had anything except false positives from one.

I've never been burgled, so I took all the locks off my house and car. 😀

1) Remove Adobe Flash and Oracle Java if you have them installed
2) Run Windows updates frequently (or respond positively to it when it - not some scam popup) says so
3) Keep Defender up to date if it needs baby sitting (haven't used it)
4) Don't click on stupid stuff in email particularly unsolicited or suspicious attachments
5) Don't click on stupid stuff in web pages where you are prompted to improve the security or performance of your computer. You can click on pictures you might find appealing however you might go blind
6) Be careful where you install stuff from - the producers own website is the most trustworthy rather than a third party site, however even then they might not be fully trusted but you can't do much about that. Don't install software that pops up to be installed when browsing the web as per 5.
7) Backup stuff that you can't afford to lose on the off chance you have to nuke your computer, it gets ransomwared, or you get robbed
8) Don't run your normal computer browsing / document editing / photo sorting as an administrative user. Not sure how W10 does all that but save adminstrator accounts for when you are administerising rather than browserising

Follow the advice on https://decentsecurity.com/ - particularly around setting UAC to the highest level.

No need for 3rd party AV, it causes far more problems than it solves.

I've never been burgled, so I took all the locks off my house and car.

It's more like having a burglar alarm that only ever goes off when you unlock your door.

AV has never been anything other than an annoyance for me, with the performance impact and constant nagging.

On a computer where someone's likely to open weird email attachments, click ads and install software from unknown places it makes sense.

TBH most AV systems are as good as each other - keeping your OS updated is far better protection than having this or that AV on an outdated version.

The only real value to paying for AV is the support offered if things go wrong.

I use ESET, partly because I believe it's the best commercial available provider but mostly because as a reseller I don't have to pay for it - their support team are the best we've ever worked with, AVG are the worst - I'll give you an example if you like.

Windows Defender is now, a very good AV for most users - higher risk users tend to know what they're doing and pay for AV with support.

The absolute worst users are kids/teenager (and sometimes older people who trust everyone and everything it seems) if you're letting your kids use your machine, give them their own account, without admin rights and if they're younger use Microsoft Family to stop them downloading crap (note, it's features can be beaten if you allow them to use a non-MS browser, sorry kids, you're stuck with Edge or WE until you're big enough to stop downloading virus riddled Minecraft skins and plug-ins).

AV has never been anything other than an annoyance for me, with the performance impact and constant nagging.

That's why you pick a one from that AV Comparatives report that doesn't impact performance too badly.

On a computer where someone's likely to open weird email attachments, click ads and install software from unknown places it makes sense.

Anything connected to the internet, especially a Windows PC, is a virus/*ware target. Browser and plug-in exploits, poisoned auto-updates, operating system holes etc mean you don't have to be a naive user clicking cute_kittenz_pictures.exe to get infected.

Put it this way, I'm a senior software engineer and fairly familiar with these computery doodads. No way I'd leave a Windows PC unprotected whilst connected to the net.

(and yes I have seen [i]true[/i]-positive detections from the AV)

Don't use Kapersky - the Soviet state will use it to spy on you.

Put it this way, I'm a senior software engineer and fairly familiar with these computery doodads. No way I'd leave a Windows PC unprotected whilst connected to the net.

Oh god. There needs to be a thing like Godwins Law but for when someone drops their job title in a related debate.

I've used Microsoft Security Essentials (Which is now Defender) for years with an occasional Malware Bytes scan (which is always empty) without issue.

Your biggest defence is common sense, and not clicking "OK" to everything that pops up.

Oh god. There needs to be a thing like Godwins Law but for when someone drops their job title in a related debate.

I know - but I felt it was relevant as the argument was basically that only IT-illiterate or technically naive users actually need virus protection.

Your biggest defence is common sense, and not clicking "OK" to everything that pops up.

That's true - but it won't protect you from browser/OS exploits.

And sometimes you can click OK on something that IS 100% legit and still get infected (e.g. [url= https://www.theregister.co.uk/2017/09/18/tainted_ccleaner_downloads/ ]the recent CCleaner infection[/url] where a legitimate, digitally-signed, well-known application, distributed by an antivirus firm, contained a malware payload).

a legitimate, digitally-signed, well-known application, [b]distributed by an antivirus firm[/b], contained a malware payload

Some of the paid ones offer online protection to avoid you typing stuff into phishing sites. Chrome/Edge also watch for those sites but aren't proactive in what you type (afaik)

However I still just use Windows AV at home as it doesn't get in the way and works

At work I use eSet in all our machines because I can centrally manage it

for non-commercial home users you can get a free download of the Sophos AV suite, better than AVG etc

also good advice from Scuttler

@wwaswas

Philosophical one for you - Who would you rather have spying on you

Mr Putin and his crones at the Soviet Ministry for Corruption and Embezzlement
The Chinese premier and his million strong hacker army
The fat kid with the nukes
Crazy Donald
GCHQ
Mrs May
The power-crazed muppet in charge of your local council to whom you complained about his liberal use of resident's parking permits

plyphon - Member
Your biggest defence is common sense, and not clicking "OK" to everything that pops up.

True dat dat but there are still things out there which work with no user intervention.

Somebody at my office got owned by one the other week. They were browsing the web, then their machine 'went slow'. We could then see in the firewall log that it was trying to punt out billions of emails.

Even on my Mac at home I once had a terminal window pop up and start executing a load of commands, and I was just browsing the web, I didn't click any ads or anything.

GrahamS - Member
That's true - but it won't protect you from browser/OS exploits.

And sometimes you can click OK on something that IS 100% legit and still get infected (e.g. the recent CCleaner infection where a legitimate, digitally-signed, well-known application, distributed by an antivirus firm, contained a malware payload).

Aye, but if someone is that determined to infect you paying £19.99 a month to John McAfee isn't going to do owt.

retro83 - Member

Even on my Mac at home I once had a terminal window pop up and start executing a load of commands, and I was just browsing the web, I didn't click any ads or anything.

If that had happened to me I wouldn't be able to stop until I knew exactly what happened. Computers just follow instructions given to them, it never "just happens" - so you just got to find out how someone is feeding your computer instructions. Maybe via that connected toaster you didn't change the default password for...

Aye, but if someone is that determined to infect you paying £19.99 a month to John McAfee isn't going to do owt.

I wouldn't touch McAfee or Norton these days. Windows Defender is free, as is Avast that I was recommending.

They might not stop a targeted contract attack by an elite band of black hat ultra hackers, but they'll stave of the majority of attacks a home-gamer will face and are considerably better than kelron's suggestion of just going naked and hoping for the best.

speaking of windows security, this is new...

[url= https://www.bleepingcomputer.com/news/security/microsoft-office-attack-runs-malware-without-needing-macros/ ]https://www.bleepingcomputer.com/news/security/microsoft-office-attack-runs-malware-without-needing-macros/[/url]

I'm a senior software engineer and fairly familiar with these computery doodads. No way I'd leave a Windows PC unprotected whilst connected to the net.

I've worked in various roles around tech support and PC / server / network infrastructure since 1992. Up until recently I've specnt most of my adult life repairing and maintaining this stuff, from home PCs to enterprise-grade server clusters worth a quarter of a million quid. I've successfully disinfected more PC malware infections than I care to recall. Yet I'm increasingly of the opinion that, with a few caveats, AV on modern Windows is becoming [i]almost[/i] unnecessary.

If we ignore services that home users aren't likely to be running, then the vast majority of infections come from two sources:

1) Folk clicking on stupid shit. Desist with your index finger and you shouldn't get a self-inflicted infection.

2) When I last looked at statistics a couple of years back, the single biggest point of injection for driveby malware by a country mile were exploits in out-of-date Flash and Java clients. Update your software - have a look at [url= https://secuniaresearch.flexerasoftware.com/support/download/ ]PSI[/url] - (or as scuttler suggested, remove it) and you shouldn't get a driveby infection.

Windows 10 now updates itself by default, so unless you're one of those halfwits who have knobbled it because you're not happy with rebooting a PC once a month, you shouldn't get an infection via an OS vulnerability which has been patched for months.

So what does that leave us? Zero-day attacks perhaps, where something's so new that no-one's had time to respond (and where AV is of questionable help for the same reason). Ironically on here perhaps, rogue adverts' browser redirection (I suspect this is on the rise relatively speaking, as other methods will have fallen). Maybe a few other edge cases, maybe with the best will in the world you do happen to misclick on something. EDIT: the ccleaner issue is a good example here.

When did you last see your AV solution actually catch a virus under normal usage? Bonus points for one that wasn't hidden in some dodgy .torrent file or a link in an email from President Mbuka. For me it must be pushing ten years now.

10-15 years ago AV was your first line of defence; these days, it's a safety net. Home hardware firewalls becoming ubiquitous over directly connected modems has probably helped a lot with that. I'm not saying we should all run out and uninstall all your security; rather that gone are the days where you could hook up XP SP2 to the Internet, go make a brew, then come back and count the viruses.

Cougar: I don't disagree. It is [i]almost[/i] unnecessary. But I have my doubts we'll ever get to the stage where that "almost" can be removed.

So what does that leave us? Zero-day attacks perhaps,

WannaCry spread via that SMB/EternalBlue exploit that has been out there since XP days and apparently known about in some circles for a long time.

Now you might say, "ahhh.. but you can't catch that at home because the NAT/firewall on your router means the SMB port isn't internet facing."

Which is fine.

But then some enterprising hacker discovers that your PC is secure but they [i]can[/i] execute code on your poorly secured internet-connected lightbulb/toaster/fridge/vibrator and since that's on the same wifi network as your PC it can be used to access that SMB port from the "safe" side of your firewall or perhaps prompt your router to open the port up.

When did you last see your AV solution actually catch a virus under normal usage? Bonus points for one that wasn't hidden in some dodgy .torrent file or a link in an email from President Mbuka. For me it must be pushing ten years now.

I see a fair number per year, but yes a lot of them are pre-emptive from email or web-links that I probably wouldn't have opened anyway.
Genuine, "phew lucky I had AV running" incidents, maybe once a year at most.

One attack vector you missed is good old shared files. You may be very diligent about what you click on, but that doesn't help when dearest Aunt Agatha sends you over a file from her infested machine.

Or, as I have had more than once, your wife brings a virus home on a USB stick that she had plugged into infected PCs at work!

10-15 years ago AV was your first line of defence; these days, it's a safety net.

Agreed absolutely.

Yup, well said.

It seems Flash and Java exploits are declining these days. Hurrah for automatic updates.

Interesting reading, if you're into that sort of thing:
https://securelist.com/it-threat-evolution-q2-2017-statistics/79432/

plyphon - Member
If that had happened to me I wouldn't be able to stop until I knew exactly what happened. Computers just follow instructions given to them, it never "just happens" - so you just got to find out how someone is feeding your computer instructions. Maybe via that connected toaster you didn't change the default password for...

TBH I think I pulled the powerlead out as I was worried it was nuke my time machine backups.

More likely to be an advert exploiting a zeroday than the toaster I should have thought. 🙂

From what I saw on the screen it downloaded a few scripts and executed them.

I could never trust it again, so I just nuked the box and restored the data from the TM backup.

Some good advice on here as normal for STW. If you’d still feel happier having another AV offering as well as Defender then it’s another vote for ESET from me - the best corporate AV solution I’ve used in 15 years, currently in use on a large multi-site corporate network together with their management console. Lightweight and effective, it might cost you a few pennies but it’ll look after you.

WannaCry spread via that SMB/EternalBlue exploit that has been out there since XP days and apparently known about in some circles for a long time.

That one required a meatware start before it could rampage through SMB. Don't click on suspect links or get a grown up to check them for you. We get fewer of these in the office now that I've turned in-line viewing off for email. (I have pretensions to being a grown up, but checking email addresses and a healthy scepticism has worked so far).

This.

For me, ESET's USP is that they have an online scanner. It's utterly brilliant for when a system is so hosed that you can't actually install any tools.

(Though at that point you should probably be flattening it and starting again...)

That one required a meatware start before it could rampage through SMB.

I don't think we actually know what the initial infection vector was for WannaCry. [url= https://nakedsecurity.sophos.com/2017/05/17/wannacry-the-ransomware-worm-that-didnt-arrive-on-a-phishing-hook/ ]Sophos Labs say[/url] it probably [b]wasn't[/b] via a phishing email and [url= https://www.symantec.com/security_response/writeup.jsp?docid=2017-051310-3522-99 ]Symantec said[/url] email was unconfirmed. The [url= https://www.enisa.europa.eu/publications/info-notes/wannacry-ransomware-outburst ]ENISA said[/url] email was possible but the most probable scenario was [i]"Internet scanning for systems vulnerable to a Microsoft Windows vulnerability and remote exploitation of the vulnerable systems."[/i] (e.g. finding badly configured firewalls that allowed internet-facing SMB ports).

Not used one for over six years, Windows Defender is switched off. Suppose it's not really viable for your average multi user system in it's default state and depends very much on the kind of interaction and web services you use.

This is good to know, I've always recommended Avast, but having come back to Windows after 3 years with a Chromebook (a decision I now regret) I have found Avast is beyond marketing, it is intrusive.

Having a popup every 48 hours starting from an upgrade invite that is now progressing to scare tactics by listing all the security gaps (cookies) firewalls and other nonsense '4,800' vulnerabilities on my PC' statements, to the point last week where Chrome advised it had installed an add-on automatically and did I want to remove it...

Sandwich - Member
That one required a meatware start before it could rampage through SMB. Don't click on suspect links or get a grown up to check them for you.

Tell you what though, the phishing emails on some of these are bloody hard to spot now.

We had some with the from address of one of our legit customers, email all correctly spelled, looked like a legit autogenerated invoice, correct logos, no weird links/domains, just a CSV file attached.

Apparently for whatever reason, CSV files in Excel are able to exec stuff using DDE. 😯

Yeah a properly custom targeted mail (spearphish) is a lot less obvious than the usual badly spelt money transfers from Nigerian princes.