Advice Request Is the improved performance of Microsoft Defender a myth? Should we necessarily be using a 3rd party AV?

Please provide comments and solutions that are helpful to the author of this topic.

Arequire

Level 29
Verified
Top Poster
Content Creator
Feb 10, 2017
1,823
The question is, do you really know there is no infection... 🤔
EXACTLY! With dwell times of 30-240 days, NO ONE knows they are infected... including the cybersecurity provider.

It's like saying "I do not know anyone with a serious covid issue, so covid must not be a problem".

Private equity and venture capital firms do not invest billions on a non-issue.
"I've seen no evidence that my system is infected and have yet to suffer any negative consequences if it is."

Better way of putting it?
 

show-Zi

Level 36
Verified
Top Poster
Well-known
Jan 28, 2018
2,463
"I've seen no evidence that my system is infected and have yet to suffer any negative consequences if it is."

Better way of putting it?
If the system is infected with an unknown threat, I think only the attacker knows it. Perhaps we can only doubt the sign by behavior.

I think the threat side is in an advantageous position. The best defense is possible, but the perfect defense is not possible. Users who seek extreme perfection can embark on the path to paranoids.
 
F

ForgottenSeer 92963

It's like saying "I do not know anyone with a serious covid issue, so covid must not be a problem".
That is not what I posted: "How many people you know have had NO infection and how many have had an INFECTION in 2021?"

I did not add a conclusion and it was in relation to a previous post where I was questioning the claim that it is so easy to write malware code which can't be detected by Microsoft Defender. When it would be so easy more than 50% of the Windows PC's should be infected (because that is the marketshare of Microsoft Defender). Hence the question to the poster.
 

wat0114

Level 12
Verified
Top Poster
Well-known
Apr 5, 2021
575
I personally think that you can't go wrong with Microsoft Defender (MD) as your standalone security solution. If you don't shut down your head completely while browsing there is nothing to be afraid of. There are also tools like ConfigureDefender or DefenderUI that can improve the protection of MD by enabling protections that are disabled by default and mostly can't be accessed easily by the average user.

For a typical home user with some common sense and basic smarts about cyber and email threats, using a browser with a good ad blocker and moderate security and privacy settings enabled, in addition to the above suggestions, I see no reason to pay for a 3rd-party security solution. Out of curiosity I checked out Kaspersky's Internet security solution, which is no doubt an excellent product, and there is a 50% sale, but even that is more than twice what I pay for OSArmor at $20/yr, which I admit is probably overkill on my setup (Defender bolstered with H_C), but I like the security it provides for the nominal yearly fee.
BTW, if there is any doubts about the scan results from Defender of a downloaded file or email attachment, there is Virustotal or other free, 3rd-party solutions.


Screenshot 2021-12-14 132341.png
 
L

Local Host

When it is so easy to write malware code which passes Microsoft Defender, with the market share Defender has, it would be hard to find a not-infected PC. So when your claim is true more than half of the Windows PC's would be infected.
Your logic makes no sense, users are protected by their habits, not their AVs. I run around with no AV and don't get infected, and you don't see me claiming there's no malware for Windows.

Those who get infected, simply get infected, WD won't do nothing to protect them unless they facing an old and basic variant. While if you using something like Kaspersky, rest assured it will take care of the infection.

Most malware is ready to tackle WD defenses since it's present on every Windows setup. Honestly if you want a good way to bypass WD, use a ZIP file, even a known variant like Zbot will show you how useless WD is.

And as I already stated before, WD also has no defenses for browser hijackers, which is a common threat among Home users.
 

wat0114

Level 12
Verified
Top Poster
Well-known
Apr 5, 2021
575
And as I already stated before, WD also has no defenses for browser hijackers, which is a common threat among Home users.

It looks like the user typically plays a vital role in getting hit with these:


How does browser hijacking work?

Browser hijackers can infect devices through malicious email attachments, by downloading infected files or by visiting infected websites. The browser hijacking software could be bundled with a browser extension or be part of the software. Browser hijackers can also originate from shareware, freeware, adware and spyware infections.

Browser hijackers are likely to be downloaded unintentionally by the user. The user may be tricked into agreeing to an additional download in the terms and conditions to install software. The victim may also be fooled after being offered the option to decline the installation of the browser hijacker software, but the query is worded in a way that deliberately confuses the user into downloading the software. Once installed by the user, malicious code embedded in the software begins altering the activity of the user's browser.






If this is the case ( by no means am I expert on this), then some basic cyber security knowledge, common sense, and resisting the click happy urge should go a long way in avoiding them, so there doesn't have to be 100% reliance on the antivirus to come to the rescue.

 
Last edited:

Andy Ful

From Hard_Configurator Tools
Verified
Honorary Member
Top Poster
Developer
Well-known
Dec 23, 2014
8,155
I am afraid that this thread has turned in the wrong direction. It is now a place where opinions matter more than solid arguments based on well-accepted sources. Some reliable sources have been presented here that can show the Defender's improvements. There were no reliable sources presented that could show the opposite. If one thinks that Defender did not improve enough, then it is a time to be more concrete. (y)
 
Last edited:
L

Local Host

It looks like the user typically plays a vital role in getting hit with these:











If this is the case ( by no means am I expert on this), then some basic cyber security knowledge, common sense, and resisting the click happy urge should go a long way in avoiding them, so there doesn't have to be 100% reliance on the antivirus to come to the rescue.
That applies to each and every malware.
 

wat0114

Level 12
Verified
Top Poster
Well-known
Apr 5, 2021
575
That applies to each and every malware.
Mostly I agree with you, but I'm not so sure about drive by downloads, the type where no user intervention is needed. Maybe Stored XSS could be an exception as well, although I rarely see news on these attacks these days.
I am afraid that this thread has turned in the wrong direction. It is now a place where opinions matter more than solid arguments based on well-accepted sources. Some reliable sources have been presented here that can show the Defender's improvements. There were no reliable sources presented that could show the opposite. If one thinks that Defender did not improve enough, then it is a time to be more concrete. (y)
Trouble is, not all these reliable sources you mention are going to be perceived by everyone as reliable. My comments were based on my own experience over the many years. I also deliberately quoted @SecureKongo 's post, because I think he nails it.
 

Andy Ful

From Hard_Configurator Tools
Verified
Honorary Member
Top Poster
Developer
Well-known
Dec 23, 2014
8,155
...
Trouble is, not all these reliable sources you mention are going to be perceived by everyone as reliable. My comments were based on my own experience over the many years. I also deliberately quoted @SecureKongo 's post, because I think he nails it.
Yes, I know. We tried logically explain something, but this did not work. So, there is a time for the other side to present reliable sources. I do not think that you are on the other side. :)

Edit.
We know that Defender free on default settings is not a top AV, but when supported by Edge (SmartScreen + PUA) is not far behind a few top AVs (home versions). But, some people claim that Defender is still crap. I would like to see something reliable that could support such claims.
 
Last edited:

wat0114

Level 12
Verified
Top Poster
Well-known
Apr 5, 2021
575
Yes, I know. We tried logically explain something, but this did not work. So, there is a time for the other side to present reliable sources. I do not think that you are on the other side. :)

Edit.
We know that Defender free on default settings is not a top AV, but when supported by Edge (SmartScreen + PUA) is not far behind a few top AVs (home versions). But, some people claim that Defender is still crap. I would like to see something reliable that could support such claims.

Right, I'm not on the other side :)

And yes, with supporting mechanisms as you and others mention, Defender seems perfectly fine, which is why I see no need personally to pay for an AV.

I can tell you for a fact this is not a good idea. For instance, I have checked files on VT only to show clean but manually checking with say Malwarebytes, Dr Web will flag them as bad. I am not sure why. Maybe VT does not get updates as fast?

I just mentioned it off the top of my head, but of course there are other freebies as well. I've seen VT flag infected files appropriately as malicious, so it's not always unreliable, at least in my limited experience using it as a second opinion.
 

Arequire

Level 29
Verified
Top Poster
Content Creator
Feb 10, 2017
1,823
right-click > scan the downloads folder with Defender

not to say that any file executed within the downloads folder will be checked upon execution
I wouldn't even bother scanning it with Defender beforehand. Defender's on-demand scans only use local signatures (which aren't updated very often), while on-access scanning leverages cloud protection data. So if it's going to be detected by the on-demand scan, it's certainly going to be detected upon execution.
 

monkeylove

Level 11
Verified
Top Poster
Well-known
Mar 9, 2014
545
Check out the test results here and sort by value:


Windows Security is generally middling. Meanwhile, third-party AVs may be expensive, especially when out of promo and if you need to buy several copies.

Given that, consider any free versions of the best AVs, preferably with no nag screens. If you want paid versions, subscribe for a year in case you have to switch. Then go back to Windows Security when it gets better.
 
  • Like
Reactions: zoran popovic

ScandinavianFish

Level 7
Verified
Dec 12, 2021
319
Check out the test results here and sort by value:


Windows Security is generally middling. Meanwhile, third-party AVs may be expensive, especially when out of promo and if you need to buy several copies.

Given that, consider any free versions of the best AVs, preferably with no nag screens. If you want paid versions, subscribe for a year in case you have to switch. Then go back to Windows Security when it gets better.
If the result is to be believed, its detection ratio is the same as Bitdefender, VIPRE, and better than Malwarebytes, G Data, ESET and Avira, so its not "middling", of course, thats what they claim, you cant do anything but take their word for it, they are also litteraly comparing paid products to free ones.
 
Last edited:

motox781

Level 10
Verified
Well-known
Apr 1, 2015
483
Check out the test results here and sort by value:


Windows Security is generally middling. Meanwhile, third-party AVs may be expensive, especially when out of promo and if you need to buy several copies.

Given that, consider any free versions of the best AVs, preferably with no nag screens. If you want paid versions, subscribe for a year in case you have to switch. Then go back to Windows Security when it gets better.

For me, they all have great percentage rates. Very little difference between the best and the worst.
 
Last edited:
  • Like
Reactions: zoran popovic

monkeylove

Level 11
Verified
Top Poster
Well-known
Mar 9, 2014
545
If the result is to be believed, its detection ratio is the same as Bitdefender, VIPRE, and better than Malwarebytes, G Data, ESET and Avira, so its not "middling", of course, thats what they claim, you cant do anything but take their word for it, they are also litteraly comparing paid products to free ones.

It's middling because it's in the middle, and it doesn't do well when it comes to system impact. I also tried the same by installing various AVs and running benchmarks plus through feel, i.e., browsing folders with different content and loading apps, and only because I notice that's what slow for one user is fast for another, and dependent on the type of hardware, usage, etc.

I have to take their word for it in the same way I have to take anyone's word on this forum for such. In which case, I'll focus on these sites with details on methodologies and results, as well as those that present tests on video given various testing methods.

I welcome comparisons between free and paid products because I'm not very keen on spending more on AVs, especially given the point that I want to buy other things. In one case, I calculated for paying for AVs for at least nine computers (yes, I've a nice, big family), and even with volume purchase and discounts for the first year only (!), I felt like it was buying a new hard drive every year.

In which case, I really do want Windows Security to work, but what happens if it doesn't detect some new ransomware, and all machines at home are infected. I'll be sent to the doghouse for that!
 

monkeylove

Level 11
Verified
Top Poster
Well-known
Mar 9, 2014
545
For me, they all have great percentage rates. Very little difference between the best and the worst.

I read somewhere that you only need that small percentage for mayhem to take place, so if there's anything even slightly better, I'll take it if it's free. But if system impact is too high, then I'll have to switch again.
 
  • Like
Reactions: oldschool

About us

  • MalwareTips is a community-driven platform providing the latest information and resources on malware and cyber threats. Our team of experienced professionals and passionate volunteers work to keep the internet safe and secure. We provide accurate, up-to-date information and strive to build a strong and supportive community dedicated to cybersecurity.

User Menu

Follow us

Follow us on Facebook or Twitter to know first about the latest cybersecurity incidents and malware threats.

Top