Microsoft Security Essentials, a steaming pile of sh*t

[jj2007]

OK, it's only a small part of the OS, and it has to compete with jewels like Adobe Flash and Avast, but still: MSE should receive an honourable mention :t

This is on Win7-64, and it started a few weeks ago:
- in the lower right corner, a greenish popup says that MSE is cleaning your PC
- then it says "no threats detected"
- but you may notice that something does not work any more
- so you find the icon and double-click it
- clicking your way through, you may see something like history (it's "cronologia" on my Italian OS)
- and the dangerous files section is, hooray, empty
- unless you click on the administrator only button
- and only then you will find the precious tool that doesn't work any more because it's a "serious" threat:

Code: [Select]

Category: Trojan
Description: This program is dangerous and executes commands received by the attacker.
Recommended Action: Remove this software immediately
Elements:
file: C: \ MASM32 \ JTools \ AlarmClock.exe
Great, so click on the "allow execution" button, another dark screen signalling DANGER, but since you are a) courageous and b) have assembled AlarmClock.exe yourself, you click your way through and allow execution. Job done :t
Job done ::) ??? No, a quick control reveals that the dangerous trojan has not returned to its location. Only solution: Rebuild it...

Here is Jotti's opinion about the file - 1 out of 19, only Avast believes it's dangerous:

Code: [Select]

Win32:Evo-gen [Susp] is a generic detection used by Avast Antivirus, Avast Internet Security and other antivirus products from
Avast for a file that appears to have trojan-like features or behavior.
Oops, that looks really dangerous, Avast! However, I've found a fantastic workaround: I added a manifest, and now it's clean, 0 of 19, hooray!

Fortunately, virus writers are so dumb that they have not yet detected the manifest trick

Redmond, you are pushing Hutch into the arms of Linux... I still resist but...

[anunitu]

I capped that "Feature" first thing in Win7 64,and slipped in Comodo internet free,and working fine.

Most likely MS detected your file because no one programs in assembler except the "Bad" hackers.

Grabs MS by the shoulders and shakes and shakes until I hear a VERY loud POP...

[sinsi]

Ticket raised: Y1300
Reason: Incorrect title
Recommendation: Replace "Microsoft Security Essentials" with "Any anti-virus"
Approved: yes, [signed]sinsi[/signed]


When I'm not cleaning up Windows 10 I am telling customers why Norton/AVG/McAfee/MSE/Kaspersky/... let the nasty in.
Now imagine trying to explain how your CCTV or even your light bulbs can turn into a DDOS bot  :shock:

http://www.theregister.co.uk/2016/11/10/iot_worm_can_hack_philips_hue_lightbulbs_spread_across_cities/
http://www.theregister.co.uk/2016/10/21/dyn_dns_ddos_explained/

[jj2007]

Recommendation: Replace "Microsoft Security Essentials" with "Any anti-virus"

Sinsi,

So far I've defended MSE, but that it deletes my legitimate and harmless tools and tells me lies about its actions, that is something I won't accept. Really, have a look at the steps listed above - it's plain ridiculous.

Go and look for comparison tests - MSE is always among the worst. I've uninstalled it now, and trying Bitdefender free. We'll see.

P.S.: Attention, Bitdefender deletes files without warning. So far 335 threats detected in \Masm32 ::)

[sinsi]

Er, I am not defending it, just saying that they are all crap. My browsing/downloading nowadays is from a VM.

[anunitu]

The detector programs are very afraid of our "MAGIC" assembler spells. Because you all know that assembler is a product of the devil...

[hutch--]

I found Avast dropped an error on anything that uses Pelle's linker and the place to put bad reports in this forum is the AV Sh*t List so these morons can find it. I am all in favour of giving AV vendors a hard time because their phukups trash decent well written work by experienced programmers. Anything built for Vista and later should have both a manifest and a version control block so morons like this can detect them. To put it bluntly,

AVAST is a dodgy heap of chyte.

[GuruSR]

With Sinsi on this, and MSE is among the growing list of deleting Anti-Malware/Virus apps out there.

Today I had an issue with Avast, though I am thinking it's a linking bug, did a compile again and it didn't get eaten.  Though most of the time it seems to be linked to the resources for the Application's icon.

And the biggest reason for a lot of malware getting onto your machine.  They're digitally signing them now, and have actually registered their software "legitimately" by digitally signing it and have thus told the Anti-remover companies to remove those unwanted signatures from their databases or they'll face legal battles.  So, some companies (not naming them) have a "public version" of a removal app and a "nasty version" of a removal app that does go after those "legitimately" crafted pieces of (still no crap icon).

But one thing I have noticed, that 99% of the time with Avast, it's been the resource of the AppIcon causing it to eat it, so I may delve into that to find the issue.  Could be yours too.

GuruSR.

[jj2007]

Little update: Today, I had to wait two hours for somebody, so I took my notebook with me to do some coding. No luck, folks - MsMpEng.exe at 25% cpu usage, in other words: one full core, the fan at full speed, and my battery gets sucked at an astonishing speed. And no chance to switch off this malware called "Micros**t Security Essentials" while it is "working" on my PC. Redmond, shame on you :icon_redface:

Any programmer with an IQ above 80 would give users a chance to suspend this crapware while the notebook is on battery. But it seems Redmond does not have coders with such a high IQ :icon_mrgreen:

[hutch--]

On this Win 10 Professional, I have been able to get rid of Microsoft security and install MalwareBytes with no problems. I am still stuck with the random auto-update but that's about all that is a pest at the moment. I gave up on Microsoft Security Essentials when it killed my 32 bit memory by a gigabyte.

[jj2007]

The working set is OK at 200MB, but look at the total time (circled red) - it's now beyond 7 hours cpu time. Ridiculous.

[K_F]

I've analysed BlackVipers website with a toothcomb.. and also with trial and error... only run certain services - the rest are disabled with extreme prejudice :P
I only update offline - download the stuff first.
Besides my second screen having various process/tcp/udp/etc monitors.. nothing 'unusual' has popped up so far.  :t

I could be missing something, but my backup is that my really important stuff is never connected to the network
 

[shankle]

Stats: windows 7 pro 64-bit, ESET SS, Sandboxie, Chrome browser, Wise disk cleaner,
RogueKiller, Manual switch to disconnect the internet when I don't need to be on it,
Macrium Reflect
 
My 2 cents worth.
No windows essentials on the computer. I no longer update from Microsoft.
Every time I go on the internet I am Sandboxed. Any time I go on the internet Sandboxed
somewhere from 300 to 600 files are detected by Sandboxie. This happens in seconds.
When off the internet I delete them out of Sandboxie.
All of this and Macrium REflect has kept me running windows 7 for 3 years.
Hope it lasts. As you may guess I am not a great fan of Microsoft. IMHO it is just
a great big advertising mill. Still it is the only game in town.......

[anunitu]

The free comodo free has a sandbox among more also it has a turn off internet connection and back on function,they also have a pay version with more functions. Check them out.

https://www.comodo.com/products/free-products.php