Anti-Virus Software and application development

[bwolfsohn]

Just wondering what everyone (well, not all 6 billion of you in the world) out there is using for anti-virus software ? We've been using vipre for years and have been satisfied.. it's had a light footprint and good performance.. But, that seems to be decreasing...

My top priority is lack of impact on working environment. With their latest version, vipre will bring my system to a eventually non-responsive halt when i'm doing development and accessing other machines on our network that also have vipre scanning at the same time.. (usually when working very late).


what are ya'll using for yourselves ???

[bwolfsohn]

I decided to try kapersky 2016 anti-virus.. we've had some difficulties with clients running kapersky in previous years..

So far, the performance impact has been minimal. running full scans while working has not been an issue (so far).. and the scans have been much quicker than vipre...

The difference in the UI is also significant.. Vipre went to a new ui this year, and it sucks... kapersky's is clean and intuitive..

[sdenjupol148]

Hey Brian,

I have been using Norton Internet Security for years.
It's also what we use at every client installation.
I like that fact that it only does background tasks when the computer has been idle for 5 minutes or more.
In addition, it's highly configurable and it has a good UI.

Haven't had a compelling reason to switch in years.

Bobby

[c-tec]

Hello,
maybe this could be interesting for others, recently I had problems with AVAST on several computers. I use it many years without problems, suddenly programs did not start after compiling, also other programs were hanging on start. I did not find them in taskmanager and also not in tools that are showing what service this program locks. Stopping AVAST did not help, so I wasted a lot of time to find the problem. After complete uninstall and install of the latest version the problem was solved. And it is nerving that every new exe is stoped bevor execution and checked from AVAST. So I think I will take a look on other solutions.
regards
Rudolf

[rdonnay]

Someone told me that McAfee is one of the lower rated AV products, yet I have been using it for many years with never a problem. I have it on my workstation and my server.

[Tom]

Anti-Virus-Software is a f*cking mess. What runs today may kill you system tomorrow, since all the damned heuristics (= software is just guessing - and it may guess your app is a virus) change in short periods. On the other hand, "99 percent security" means: "From 1,000 trojans, we only catch 990. The other then, that may crash your system today, maybe caught tomorrow. Sorry for that this is too late for your." We had a customer with 6 (!) AV-systems running, and all his data (including office documents, sql databases, photos and music) was encoded by a new version of the "CryptoWall" virus. Why? All the bad guys creating ransomware and other shit have all the AV-systems aswell. One day is enough to infiltrate thousands of computers.

Kaspersky is one of the worst, since "process monitoring" can slow down dialog creation by 500 percent. Avira may delete your app since the heuristics finds out it may be a trojan horse. And so on.

We created a handout instructing our customers how to deal with AV software: Ensure the data path and the software path is an exception (no scanning). Just scan mobile devices, mail and web traffic. Use Chrome our other sandbox browsers. We sign our software since four years now (Symantec), which reduced AV problems by about 80 percent. The rest is support.

[rdonnay]

Ensure the data path and the software path is an exception (no scanning).

Good idea. Is it possible to share the document that you send to your users?

[skiman]

We sign our software since four years now (Symantec)

Hi Tom,

Can you give some more info about this signing? I checked the Symantec website, and it is not very clear to me. Do you need a certificate for each installation?

[bwolfsohn]

Kaspersky is one of the worst, since "process monitoring" can slow down dialog creation by 500 percent.

Interesting...

i did some timing with and without kapersky, with and without excluding the directories that our app runs in (exe and data)..

I noticed very little difference in load times both for loading the app, as well as opening our main dialogs.
This is for a stand alone desktop.

One area that Karpesky injected itself into is the browser... It locked out google searches due to "old security certificates" until i unchecked "scan encrypted connections" in settings > advanced >network

I'm using the trial version right now, but amazon has a 3 computer bundle for $28!! under $10 per computer per year.

Don't know yet if it will install on a server.. vipre will..

[Tom]

Hi, Chris.

Can you give some more info about this signing?

The Symantec website is a little confusing, right. What we do is "code signing". We bought a certificate (four years) from Symantec (around $ 400 per year, others may be a little cheaper) and use the MS-"signtool" (download needed) to sign the software itself and the update-bundles. This includes authentification, so there's no need to "whitelist" the software for the AV-programs anymore. All the stuff is bound to a single computer and, to be honest, it's a little hard to update the certificates if they run out (IE in compatibility mode needed). On the good side, the updates (using Innosetup) and the software itself don't show "Unknown source" or so anymore, and they are passed by the scanners. And it makes a good impression to the customers.

@Roger: The documents are in german and hard to translate. And they change about once in a month, since all the AV-programs do. At least, they say: Exclude our software and all data pathes from scanning. Switch off "process control" and stuff like this. Be careful when opening mails. Use AV-software with your browser, your mail client, for mobile storages, but not "on demand"-scan for all data. Use Chrome as a browser if possible, although it's from Google and Google is: Google. Don't do double scanning (on the client and on the server). Use a good online scanner (like Bit Defender) at least once a week to double-check your system. Make backups once a day. Store one backup for every week in a safe.

Edit: I forgot the most important thing: Don't believe in security! Be aware that there's still a high risk, no matter what AV-software you use. Be careful at any time. Damage comes fast, restoring all your work takes days and weeks.