Disable Your Antivirus Software (Except Microsoft's)

mrk said:
I know my own system isn't weakened thanks very much.
Click to expand...

Stoner81 said:
Never used it and never will, it has ALWAYS caused me more problems than it is worth. People will just click yes to everything to get on with things if it mithers them so it might as well not be there in the first freaking place.
Click to expand...

It's about reducing the attack surface. UAC is much more than a simple yes/no pop-up box.

https://insights.sei.cmu.edu/cert/2015/07/the-risks-of-disabling-the-windows-uac.html

The system is weakened because you are giving everything on your system, including malicious code, the ability to elevate privileges. How is anti-virus meant to fight malware when the malware can level the playing field with no questions asked? The browser is the Window to the web and you're doing it a disservice by hamstringing its defences.

What is the Windows Integrity Mechanism?

90 percent of Windows 7 flaws fixed by removing admin rights
 
This is a done to death argument and never gets anywhere. UAC will never be turned on for my own machine. It will also never get compromised because of the way I use it and common sense and vigilance.

I've read all those articles and others like it all before and my conclusion has always been the same, that I don't need/want it as other security measures that are less annoying (OS firewall, Defender resident shield, Google DNS, router firewall and AI protection on the router that scans all web traffic etc) have done, and still do, an ample job of protecting the system.

And most important of all, making sure that all software and services that connect to the net are always up to date.

But I agree with others that it's insane to think that everyday users can go by the same notion as well, because we all know they can't..
 
mrk said:
This is a done to death argument and never gets anywhere. UAC will never be turned on for my own machine. It will also never get compromised because of the way I use it and common sense and vigilance.
Click to expand...

I respect your decision, but never is a strong word. ;)

Happy to be corrected on this, but this is my understanding... Take that SVG exploit in Firefox I mentioned earlier. It was possible (until they patched it) for a specially crafted graphic in a browser to run arbitrary code on the user's PC, i.e. you simply browse a web page with this graphic in and the browser automatically runs some code payload. If that payload were a virus, there's no way (AFAIK) for your antivirus to catch it - the antivirus isn't monitoring the inner workings of the browser. In that case your only hope is that UAC notices firefox attempting to do 'bad stuff' to your system (something requiring admin privileges). Without UAC it's carte blanche, bang, virus is in.

It's not perfect all the time - I've seen ransomware that can encrypt your files without triggering UAC - but it's a lot better than not having it. As I wrote earlier turning it off is akin to having no root password in Unix-like OSs, and you'd be ridiculed for life for doing that.
 
Last edited:
Acme said:
Its like taking the airbags out of your car and saying "its OK, I'm a careful driver" :D
Click to expand...

:D Must admit, as a user since win 98 (when Norton was pretty much the comman mans only choice) it would be easy of me to ignorantly say I dont use one as I am a tech god. :rolleyes:

After regular business of a steady client base over the years not only have I used quite a few AV toolkits but also offline scanners and general malware detectors.

There is no one product that keeps you secure.

To finish off, I have scanned old drives some years later and the newer AV brands find the odd file and flag them as 'trojan' or similar and know full well they are safe files just false positives.
 
That's why you need to run manual scans with more than one product before each backup schedule, just for piece of mind. Like an MOT for the computer. Rubbish analogy I suppose, but it's valid :p

My PC has had the same Windows install since 2009, yet it still runs and at a skim of all the folders and their structures, seems to be as if it were a recent install of a clean OS.

I don't know about anyone else, but I am very particular about virtually everything, and I prefer maintaining things manually. I have even posted the how and the why in other threads over the years, but I digress.

On the point of AV, whilst I agree UAC will detect unusual behaviour from say a browser trying to modify system contents, it is also the job of the resident AV shield to detect that attempt before the culprit even tries to touch the system file.

For that purpose, all of the AV suites (mentioned earlier in this thread) I have used over the years have been able to do exactly that, and Defender in 10 Anniversary appears to continue doing that.

Still, doesn't stop me from still doing all those manual scans and upkeep before each monthly backup run!
 
Psycho Sonny said:
Nobody else can infect your computer apart from you.
Click to expand...

Other people can infect your computer without using it, and it is incredibly naive to think that is not the case... Of course depending on what you get up to online, it may be unlikely.

Alternatively as has been mentioned, you could click a site which has been hijacked, or someone could unwittingly send you an infected file without knowing. There are loads of possibilities. No matter how vigilant you think you are, there will be something that could easily catch you out.

Some of the reasoning is desperate at best. "It will wear out my hard drive!" for example... Anyway, if you don't want it to run periodic scans, you can usually schedule them yourself, or disable them... Modern AV doesn't make a noticeable difference to system performance either.
 
Last edited:
Unfortunately that link is a bit out of date and misses out malware spread through ads:
https://arstechnica.com/security/20...of-malicious-ads-spreading-crypto-ransomware/

The cryptolocker malware was served by ads on the New York Times, BBC, MSN and AOL websites.

I tend to keep Windows Defender on at all times and run weekly scans with MalwareBytes. What i find most useful is using a normal (not Administrator) account on my PC. Not visiting potentially rogue websites goes without saying but, as the article above shows, it's not fool proof.
 
^ Great example of why it's important to
  1. Remove unneeded plugins (particularly flash, silverlight, and java if possible) or at least keep them right up to date
  2. Keep the browser up to date
  3. Keep UAC on to make it harder for an exploited browser/plugin to modify the system
Note there's no mention at all of antivirus being useful in this case.

Adblockers are good for this particular vector but the principal could just as well apply to a cracked or intentionally malicious web page.
 
I use a 3rd party AV, Windows defender is crap and slow. It impacts cpu performance, loading speeds, IOPS and even download speed in some siituations (for example, avast is bad for steam download speeds, crappy 15mb/sec instead of 25+ and taking up a whole thread of cpu time scanning your game download.



I only use an A/V because disabling all A/V and notifications is a pain in Win10, I ran win 7 without any Realtime Antivirus for years.
 
KIA said:
The system is weakened because you are giving everything on your system, including malicious code, the ability to elevate privileges. How is anti-virus meant to fight malware when the malware can level the playing field with no questions asked? The browser is the Window to the web and you're doing it a disservice by hamstringing its defences.
Click to expand...

Any malicious code worth its salt will elevate itself to Admin levels regardless of UAC, the bit in bold above is the biggest issue I have in that malware SHOULD NOT EVEN REACH YOUR SYSTEM! You state my system is weakened yet I have not had a single infection in over 10 years (probably longer).

Preventing malware from reaching a computer system is better than curing it by removing it.

Stoner81.
 
Malicious software always counts on one thing "the human factor". Humans have neither the brainpower nor the physical endurance to keep up with the overwhelming volume and sophistication of modern threats.

There are also big issues with the standard end point protection, because it uses as simple “detect and respond” strategies that allow threats to execute and large agents that suck up vast amounts of endpoint resources, but there is one vulnerability that often goes unnoticed – the weaknesses of the antivirus engines that drives these traditional products.

There are simple changes you can make

Backup regularly and keep a recent backup copy off-site. There are dozens of ways other than malware that files can suddenly vanish, such as fire, flood, theft, a dropped laptop or even an accidental delete. Encrypt your backup and you won’t have to worry about the backup device falling into the wrong hands.

Don’t enable macros in document attachments received via email. Many threats arrive in documents, and rely on persuading you to enable macros (embedded document scripts). Don’t do it: Microsoft deliberately turned off auto-execution of macros by default many years ago as a security measure.

Be cautious about unsolicited attachments. Crooks who send malware in documents are relying on the dilemma that you shouldn’t open a document until you are sure it’s one you want, but you can’t tell if it’s one you want until you open it. If in doubt, leave it out.

Don’t give yourself more login power than you need. Most importantly, don’t stay logged in as an administrator any longer than is strictly necessary, and avoid browsing, opening documents or other “regular work” activities while you have administrator rights.

Patch early, patch often. Malware that doesn’t come in via document macros often relies on security bugs in popular applications, including Office, your browser, Flash and more. The sooner you patch, the fewer open holes remain for the crooks to exploit.
 
^ The discomfort in private environment, especially for a hardware enthousiast that uses a lot of hardware tools, is far greater running all that security crap than from removing a piece of malware once per 5 years or restoring an image if infected.

I absolutely loathe the whole rights things, and UAC, I always used the hidden administrator account in win7, the only reason I don't in 10, is because Metro apps (which I use to watch tv for example from my cable provider), don't allow running with UAC disabled or using the hidden admin account.

Otherwise, the hassle with all the prompts, running stuff elevated, etc, is far greater, than restoring an image or cleaning a piece of malware in a few years if something gets through. I hate the fact that Microsoft is shoving all that security crap down our throats.

Screw updates, screw using crappy user accounts without rights, screw all those unnecessary prompts and extra user actions.


Your whole advice can be stripped down to: keep offline backup images that can be restored in less than 30 mins if required. The rest is unnecessary, especially for multimedia/game/home users.

I've recently created a bootable usb stick with clonezilla, this makes an image of my ssd fully unattended to my nas. When I go somewhere and don't need pc remote access, about once per 1-2 months, I put the stick in, reboot pc, and bam, new image -just in case-. The only reason I use an AV is because there's so much hassle to get rid of all the crappy messages and prompts if you disable all antiviri in win10.

Win 10 is fine for ''home users'' like grandma or granps.
Win 10 is absolute **** for pc enthousiasts imo.
 
Last edited:
Stoner81 said:
Any malicious code worth its salt will elevate itself to Admin levels regardless of UAC
Click to expand...

Don't buy it. Please provide a source to backup your claim.

Stoner81 said:
the bit in bold above is the biggest issue I have in that malware SHOULD NOT EVEN REACH YOUR SYSTEM! You state my system is weakened yet I have not had a single infection in over 10 years (probably longer).
Click to expand...

If you would care to read the links provided above, you'll see that running as a standard user reduces the chance of malware reaching the system.

No infection ≠ secure system.

Stoner81 said:
Preventing malware from reaching a computer system is better than curing it by removing it.
Click to expand...

I agree, which is why I want to make my system as secure as possible. Reducing privileges has been shown to help with this. Ultimately, you are putting a minor convenience before improving system security.
 
i don't know.. i appreciate the extra effort MS is putting into security. I remember when the Blaster worm first appeared... one person with an infected laptop gets in to work or on your uni network and that's everyone's computers infected, just by virtue of being on the network.
 
james.miller said:
We got hit with a crypto virus at work. All it took was one person to open an email and despite having enterprise AV it caused complete havoc.
Click to expand...

I'm not surprised, it not only encrypts the users hard drive it will encrypt any shares the user has admin access.

You either need to stop users logging in with admin accounts, or use a software restriction policy, that stops executable's/ scripts running in folders like temp etc..

This is also where having lots of backups comes in extremely useful in these situations.
 
I appreciate that Windows Defender has come a long way from the days of yore, and I don't run a third party antivirus on my HTPC (though I do have Glasswire firewall installed), I still have a third party AV on my main rig, just in case.
 
KIA said:
Don't buy it. Please provide a source to backup your claim.
Click to expand...

To be fair it is possible. I shared this capture a while back of a 'test' of various ransomwares (in Win 7). Note that some are caught by UAC, but some are not. Maybe the ones that were caught didn't do as much damage though, I do not know.

https://www.youtube.com/watch?v=9VhZGa-NP0w

Edit: though as mentioned above, ransomwares aren't really interested in admin-land data, just userland as that's the irreplaceable stuff. So nvm.
 
Last edited:
You must log in or register to reply here.
Back
Top Bottom