Advice Request Free Antivirus is Good Enough (5 reasons why)

[EndangeredPootis]

Protect important folders from ransomware from encrypting your files with controlled folder access - Microsoft Defender for Endpoint

Files in default folders can be protected from being changed by malicious apps. Prevent ransomware from encrypting your files.

docs.microsoft.com

If malware get admin rights, it's always bad/ too late.

I am talking behavior based, not just decide which programs can access my files.

 

[Divine_Barakah]

All family devices are running AVG IS which I get for a few bucks from eBay. I have enabled hardened mode. The only issue I am having is PUPs. I have tried to use WD with HC set to high and that was catastrophic; family members were not able to update or restore firmware to iPhone unless I disabled WD’s realtime protection. I am not talking about protection capabilities, I am talking about usability and convenience. I pay to achieve convenience. Regarding the PUPs issue, i run periodic scans with ADWCleaner and EEK.

 

[SeriousHoax]

I am talking behavior based, not just decide which programs can access my files.

It has behavior monitoring (not just ATP) but not as good as the big guns.
Behavior monitoring combined with machine learning spoils a massive Dofoil coin mining campaign - Microsoft Security
There's also an ASR rule, "Use advanced protection against ransomware" and I've seen it action once.

Microsoft creates behavioral signatures regularly against all kinds of threats, not just ransomware. Check signature history here:

Antimalware updates change log - Microsoft Security Intelligence

Anyway, these are off topics so ending it here. More applicable for this thread:

Advice Request - Free Antivirus is Good Enough (5 reasons why)

This article comes from Windows Central. Source: Free antivirus software is good enough for most people, here's why To summarise: Preinstalled on Windows 10 devices. Experts and reviewers recommend them. Minimal slowdowns Feature-rich Designed to be easy to operate. (Aka You don't need to read...

malwaretips.com

Maybe an admin can move the discussion there.

 

[SeriousHoax]

I have tried to use WD with HC set to high and that was catastrophic; family members were not able to update or restore firmware to iPhone unless I disabled WD’s realtime protection.

Which app was it blocking? Can you share the details? I'll report that as false positive if you haven't yet.

 

[EndangeredPootis]

It has behavior monitoring (not just ATP) but not as good as the big guns.
Behavior monitoring combined with machine learning spoils a massive Dofoil coin mining campaign - Microsoft Security
There's also an ASR rule, "Use advanced protection against ransomware" and I've seen it action once.
View attachment 248283
Microsoft creates behavioral signatures regularly against all kinds of threats, not just ransomware. Check signature history here:

Antimalware updates change log - Microsoft Security Intelligence

Anyway, these are off topics so ending it here. More applicable for this thread:

Advice Request - Free Antivirus is Good Enough (5 reasons why)

This article comes from Windows Central. Source: Free antivirus software is good enough for most people, here's why To summarise: Preinstalled on Windows 10 devices. Experts and reviewers recommend them. Minimal slowdowns Feature-rich Designed to be easy to operate. (Aka You don't need to read...

malwaretips.com

Maybe an admin can move the discussion there.

I am talking about behavior based ransomware protection, not behavior based protection as a whole, and the Use advanced protection against ransomware is awful, it detects everything that touches your files, I tested it once in a VM, I tried using office, the window pop up, but as soon as it does WD pop up with its Your administrator blocked this action and was unable to click anything on office except click the X button.

 

[SeriousHoax]

the Use advanced protection against ransomware is awful, it detects everything that touches your files

You're confusing it with Controlled Folder Access. Which is another module.

 

[Divine_Barakah]

Which app was it blocking? Can you share the details? I'll report that as false positive if you haven't yet.

It did not block anything. We could not restore iPhone firmware (using iTunes) when WD is enabled. Itunes gets stuck at preparing restore message for eternity. Disabling WD’s realtime protection fixes the issue.

 

[Andy Ful]

Hi @EndangeredPootis,

Do you know any free AV that has a BB feature only for ransomware?
It seems that only WD has something like that (one of ASR rules), although it is not available from Security Center. We can see it working as @SeriousHoax showed in his post:

After running the file from the "Documents\test" folder (left image), another file is dropped/executed and its suspicious action is blocked by the ASR rule (right window). One can see the name of this rule: "Use advanced protection against ransomware". This rule can be activated on Windows 10 Home via ConfigureDefender or PowerShell. Furthermore, other ASR rules are also good anti-ransomware prevention.

There is also "Ransomware protection" feature available via Security Center (Controlled Folder Acces), but this is not BB, but smart-default-deny access to some folders and system protected disk locations.

WD on default settings and other free AVs can apply (for now) anti-ransomware protection only via deep learning and heuristic-based behavior detections.

 

[Andy Ful]

It did not block anything. We could not restore iPhone firmware (using iTunes) when WD is enabled. Itunes gets stuck at preparing restore message for eternity. Disabling WD’s realtime protection fixes the issue.

Did you use the ConfigureDefender Log to see the issue?

WINDOWS DEFENDER BLOCKING ITUNES & APPLE

Sure wish there was a way to talk to someone in person at MS. So frustrating. Hubby got a new iphone. His windows defender is blocking apple itunes. I and to uninstall it. It wouldnt install so I

answers.microsoft.com

It seems that it followed not from ConfigureDefender HIGH preset, but from Controlled Folder Acess which can be activated both via ConfigureDefender or Security Center.

Edit.
Controlled Folder Access (CFA) is not included in ConfigureDefender HIGH preset because it requires to make several exclusions for 3rd party applications (system optimizers, backup software, disk management, document editors, media management, etc.).

 

[upnorth]

A small friendly neighbourhood polar bear tip! Instead of risk turn this thread into a support thread and derail too much, please try use the correct section for software issues.

Hard_Configurator - Windows Hardening Configurator

Post updated in September 2024. The current version can be downloaded from GitHub or Softpedia: https://github.com/AndyFul/Hard_Configurator/raw/master/Hard_Configurator_setup_7.0.0.0.exe https://www.softpedia.com/get/Tweak/System-Tweak/Hard-Configurator.shtml WARNING! The fake domain...

malwaretips.com

 

[EndangeredPootis]

You're confusing it with Controlled Folder Access. Which is another module.

I was not confused with CFA, I was talking about the Advanced Ransomware Protection.

Edit: yo why was my comment moved here?

 

[Divine_Barakah]

Did you use the ConfigureDefender Log to see the issue?

WINDOWS DEFENDER BLOCKING ITUNES & APPLE

Sure wish there was a way to talk to someone in person at MS. So frustrating. Hubby got a new iphone. His windows defender is blocking apple itunes. I and to uninstall it. It wouldnt install so I

answers.microsoft.com

It seems that it followed not from ConfigureDefender HIGH preset, but from Controlled Folder Acess which can be activated both via ConfigureDefender or Security Center.

Edit.
Controlled Folder Access (CFA) is not included in ConfigureDefender HIGH preset because it requires to make several exclusions for 3rd party applications (system optimizers, backup software, disk management, document editors, media management, etc.).

If it was my personal device, it would have been worth the hassle. It was a family device and they don’t know how to deal with any issues. AVG is working as intended. I am sure a memeber can try to reproduce the issue if they have time.

 

[Andy Ful]

A small friendly neighbourhood polar bear tip! Instead of risk turn this thread into a support thread and derail too much, please try use the correct section for software issues.

Hard_Configurator - Windows Hardening Configurator

Post updated in September 2024. The current version can be downloaded from GitHub or Softpedia: https://github.com/AndyFul/Hard_Configurator/raw/master/Hard_Configurator_setup_7.0.0.0.exe https://www.softpedia.com/get/Tweak/System-Tweak/Hard-Configurator.shtml WARNING! The fake domain...

malwaretips.com

Advice taken. There is already an appropriate thread on MT, e.g.:

How the hell WD works on Windows Home & Pro?​

I have summarized there the WD Ransomware Protection and related problems. So, the readers of this thread can decide for themselves if WD free is good enough.

How the hell WD works on Windows Home & Pro?

They seem to work well together. :) Windows does not detect Comodo firewall, and does not turn it off automatically, which can be seen if you check in Windows Control Panel. But if you install Comodo Internet Security, which has an AV component, then Windows firewall will turn off. Thanks, and...

malwaretips.com

​

 

[ChoiceVoice]

if you deal with a lot of money online, you need more protection than a solitary free antivirus. i like WD, but it should be stacked with some form of proven banking protection. from all the testing I've seen, WD is eaten alive by zeus and other banking malware. this test is 5 years old, but WD was in the zone then with all the same supporters as it is now. high-end malware like this distinguishes the mice from the men.

https://www.mrg-effitas.com/wp-content/uploads/2015/04/MRG-Effitas-Online-Banking-Certification-2015-Q1.pdf

 

[SeriousHoax]

if you deal with a lot of money online, you need more protection than a solitary free antivirus. i like WD, but it should be stacked with some form of proven banking protection. from all the testing I've seen, WD is eaten alive by zeus and other banking malware. this test is 5 years old, but WD was in the zone then with all the same supporters as it is now. high-end malware like this distinguishes the mice from the men.

https://www.mrg-effitas.com/wp-content/uploads/2015/04/MRG-Effitas-Online-Banking-Certification-2015-Q1.pdf

Don't link an ancient test result while a more recent one is already available. WD was no way near as good as it's today and its weakness in this types of banking Botnet and Simulator test is known to most MT users by now. Here's a recent online banking test:

https://www.mrg-effitas.com/wp-content/uploads/2020/05/2020_OBQ1_v1.pdf

 

[ChoiceVoice]

Don't link an ancient test result while a more recent one is already available. WD was no way near as good as it's today and its weakness in this types of banking Botnet and Simulator test is known to most MT users by now. Here's a recent online banking test:

https://www.mrg-effitas.com/wp-content/uploads/2020/05/2020_OBQ1_v1.pdf

thank you for the newer test showing WD failing certification and supporting what I said. nothing against it, i love WD. but as i said, if you deal with large sums of money, free should be supported with something extra.

 

[monkeylove]

It's also possible that YMMV. In my case, across several machines at home, sometimes Defender doesn't affect performance and sometimes it does. Sometimes it can block malware and sometimes it can't. When I try to harden it, it may cause more problems which novice users can't understand. Meanwhile, similar problems concerning protection and performance affects third-party AVs.

Meanwhile, the cost can be high for the latter: for several machines, there's usually a promo price for the first year, but it goes up substantially by the second year. And what happens when something is changed in the AV or Windows such that it causes systems to slow down or breaks some apps?

Given that, my strategy has been to stick to free versions of AVs based on performance, system impact, and the least annoyances, and then wait for Defender to improve.