HN Explorer

Ask HN: Is there “non-evil” antivirus software besides Windows Defender?

2 points by currysausage ↗ HN
We've read a lot lately about evil things that AV programs do, MITM'ing TLS connections, breaking browser defense mechanisms by inserting DLLs [1], shipping horribly insecure browser extensions (just look at all the vulnerabilities discovered by Tavis Ormandy), and, of course, making your whole computer crawl.

Is Windows Defender actually the only AV software that doesn't to most of these things, or are there other AV programs (with better detection rates) that don't do more harm than good? Can you name specific examples?

[1] http://robert.ocallahan.org/2017/01/disable-your-antivirus-software-except.html

7 comments

[ 3.0 ms ] story [ 28.2 ms ] thread
ramtatatam
On one security seminar lecturer claimed antivirus software stops max. 40% of threats, remaining 60% goes unnoticed (as per 3 years ago, it might be even worse today)... So I'm not sure if there is any antivirus software that can really help if user won't take time to educate and stop doing things that introduce those threats.
savethefuture
A large portion of AV malware detection is by blacklist from previously encountered samples then uses signature scanning to catch it. So if someone creates a brand new malware it is generally undetected unless they trip other detectors like in a sandbox or memory manipulation, or remote call/exec.
savethefuture
Forgot to add, but you are totally correct if more people were educated on the potential and where/how to get malware, you would be much safer. I don't use an av and dont get malware.
currysausage
> I don't use an av and dont get malware.

Neither do I. There are however users who firmly believe that they need AV, and in some cases, I might even tend to agree; hence my question.

savethefuture
Oh yeah, I would never let my parents go without an AV, they would never stop calling me otherwise. Back to your question though, are you running into any problems with existing products, which ones are you having trouble with.
currysausage
Kaspersky MITM's TLS connections by default and inserts JavaScript into sites that you visit. It installs its own root cert even if you disable TLS interception.

Are there free AV products that simply offer a good file scanner, no TLS interception, no broken browser extensions, etc.?

ramtatatam
Indeed, there is no antivirus that would sit on our arm (or within our ear) and whisper "don't do this, it's risky" ;-) In my brain it's paranoia and sometimes it goes too far, but I'm gatekeeper so I must be a bit... paranoid.