Question Virus application design problems?

[Charagma]

I looked at the various available discussion board and this is the closest I could think of that would work with the thread.

Everyone knows I was hit by a virus around 2 or 3 weeks ago and lost many documents and save games. This morning everything was fine till around 11am when Malwarebytes kicked up a warning with regards to SVChost.exe trying to access an IP address. Still being a bit paranoid with regards to my last experience I started looking into this and eventually ended up at Malwarebytes's blog and was a conversation between "RootAdmin" (Staff) and "Leandro" (Member) (To be explained a bit later in the thread)

First I need to VENT! For some reason (Unbeknowest to I) the virus creators find it fun and aim their "toys" at gamers. We need Fixes/hacks to run older games (includes Emu's, VM's and all kinds of oddities) and we need mods (texturings, Performance tuning etc) in current games and all of them pretty much come from not the safest sites. Many of which ends with ".RU" (most of us know about those sites. The ones where you need a translator just to know if you are clicking (a) install virus, (b) watch video or (c)next page), and usually starts with your browser telling you "ARE YOU SURE YOU WANT TO GO THERE!?.....ARE YOU REALY SURE!?" Because let's face it, it must be fun to have a gamer spend 300Hours removing a virus (and not playing a game minding his own business) because he needed a DRM removal on a game he wants to revisit just for kicks (Dawn of Magic DRM remover was one of my problems recently). If only they knew we play games to escape reality but then get forced back into reality because of them.

AAAANNNNNNnnyyyyyywaaaayyyyy ...........

So back to the aforementioned conversation. Starts of easy with scan here, check this (Note, this is all with regards to a similar warning I got) and then about halfway the whole thing just flies off the handle and I do not understand why. So, scan with Malwarebytes, get a few log files and then farbar, adware (Also malware bytes softwares), the usual SFC scans etc. So up to this point we are still from what I would say is ok and I get it. One company, several different security software's. The Admin then moves to rkill, ESET and secure check. From here I am getting confused.

I can see the ultimate goal for the procedures but why 6 to 7 different programs? Can we not just have 1 program that can do everything in one scan? We have the ability to run applications in "quiet" mode. We can download and upload software in the background in quiet mode and we can execute EXE files with switches to get them to do specific tasks and when it is all done delete in "quiet" to save disc space.

Has no one created an antivirus that can do the whole procedure just by us clicking "SCAN"? Maybe it is an opening in the market for some of you clever guys. Down load "autocleaner.exe" file. When downloaded, click run. Have coffee (or red bull) and comeback in an hour to read the final report. Click fix have another red bull and when you get back system is restarted, clean and ready to play.

But alas I am now at the Rkill point (Think it is now the 5th additional program I had to download) for one warning message from Malwarebytes.

Please clever people help the gamers out here.

 

[Zloth]

I'm not real sure on this. That whole arms race between anti-virus and virus programs became its own special corner of I.T. long ago. However, running something under your account only has certain rights. Even as an admin account, there are a few things that Windows stops from happening. For applications that are set up to run under certain system accounts that can do those special things, they won't be allowed to do lots of normal things - like get access to the network or to files under any user's account folder.

It's all designed so that no one application can do everything because, if one could, that would be where the hackers would go. When you got hacked, you would be FULLY hacked, every time. Malwarebytes wouldn't bother telling you all sorts of funky weird ways to get unhacked, it would tell you to wipe your hard drive, flash your bios in again, and then re-install Windows - because EVERYTHING on it is suspect. Every file, every driver, every bit of information in the entire box that persists after it has been turned off and on again.

 

[Pifanjr]

If there was a piece of software that cleans your PC with a single button, it would probably cost an arm and a leg. There's a good chance something like it exists for large enterprises, but isn't readily available for consumers.

 

[Charagma]

Malwarebytes wouldn't bother telling you all sorts of funky weird ways to get unhacked, it would tell you to wipe your hard drive, flash your bios in again, and then re-install Windows - because EVERYTHING on it is suspect. Every file, every driver, every bit of information in the entire box that persists after it has been turned off and on again.

LMAO, yeah kind of realised that if windows weren't the operating system, it would be a virus too (As per virus scans). Did find a neat little program out of the whole exercise though. Thingy is called Security check by glax24. You run it and it just goes through everything installed on your system and tell you if it is needed, why you might have it and or if there is an update for it. Found it pretty handy and was a 1meg download. If it needs an update actually tells you where you can get it.

Bottom part of the results windows on mine:

---------------------------- [ UnwantedApps ] -----------------------------
CCleaner v.6.38 Warning! Suspected demo version of anti-spyware, driver updater or optimizer. If this program is not familiar to you it is recommended to uninstall it and execute PC scanning using Malwarebytes Anti-Malware. Possible you became a victim of fraud or social engineering. Computer experts no longer recommend this program.
Bonjour v.3.1.0.1 Warning! Application is distributed through the partnership programs and bundle assemblies. Uninstallation recommended. Possible you became a victim of fraud or social engineering.
CCleaner Performance Optimizer Service (CCleanerPerformanceOptimizerService) - The service has stopped
----------------------------- [ End of Log ] ------------------------------

 

[Colif]

For some reason (Unbeknowest to I) the virus creators find it fun and aim their "toys" at gamers. We need Fixes/hacks to run older games (includes Emu's, VM's and all kinds of oddities) and we need mods (texturings, Performance tuning etc) in current games and all of them pretty much come from not the safest sites.

they choose things that are in high demand, its not just games. They also know that gamers after fixes might be convinced to turn off AV to install the fix. Kids are likely to do anything to play a game NOW

Helpdesk would have a standard procedure for cleaning files. Multiple programs could be standard approach until they take it to next level or fix problem. (seems I am learning something from the Cybersecurity course I doing)

Not all programs look for the same things the same ways. Not all viruses are the same so why would the solutions all be the same too?

I used to use BitDefender for years but its not perfect, I found viruses it can't see. So now I use Malwarebytes instead as I still can't trust Defender. I would use both but they both do same job and Bitdefender complains if you try to install it. I normally listened and uninstalled it right away but this time I took a different approach and removed bitdefender instead.
Running both can slow PC down as well. Two programs scanning every new file? Not a good idea, they will eventually see each other as a threat.

Can we not just have 1 program that can do everything in one scan?

if there was just one program that fixed it all, all the hackers on earth would be trying to crack into it and use it to infect all the other machines. Its better to have many tools as one might work.

I don't recommend CCleaner as it can delete files useful for interpreting errors. Also some of the things it removes can be useful. Not like windows fills up with junk anyway. Its much more efficient now than it used to be.

I also use Firefox with Ublock Origin which would probably stop me even visiting most of the RU sites you mention. Alas, it doesn't work on Chrome or Edge anymore... they out in the open to it all.

 

[mjs warlord]

Hello @Charagma ... I have used many av over the past 24 years they all have good and bad features in them , i started off by using norton av for many years and i got a lot of free years usage because the software was bugged and if you uninstalled it just before end of subscription and re-installed you got another year. I did that for about 5 years before the bug was fixed. I then moved onto norton 360 until it became a resource hogger.

I used to have webroot spysweeper that found 7 keyloggers on my pc , the pc was running so slow i could barely type anything , you cant buy it as a stand alone now as it is part of webroots av software.

I tried McAfee for about 6 months then one day a work mate gave me a copy of the companies cad software and to make sure it was safe to use i scanned it with McAfee and it found nothing but as i am a geek i ran antimalware bytes and it found a lot of genuine items that McAfee missed ???? my workmate could not report his pc was infected because the boss was a control freak and he would want to know how he found the threats.

I used Kaspersky for about 6 years until Ukraine got invaded.

I am now running paid for ESET and although i have seen postings by people saying its rubbish it is the best av i have ever used. I also used Malwarebytes and do a manual scan with defender once a week. The thing to remember about av programs and spyware type programs is that they are not always all looking for the same thing so 1 certain program might not find something.

Malwarebytes note ...... The key thing to remember about this program is that it does not always delete everything on the first pass , some nasties are made up of several segments so so need to scan , quarantine and and rescan until it finds nothing.

 

[Charagma]

Malwarebytes note ...... The key thing to remember about this program is that it does not always delete everything on the first pass , some nasties are made up of several segments so so need to scan , quarantine and and rescan until it finds nothing.

I hate AV's in general because my pc is ALWAYS old and need every bit of resource I can give it. When I work, I disconnect the internet and stop the AV just to get that bit of extra "OOOMF".

I think this is what happened in my case. Think all this is a ripple that came from the virus I removed about 2 or 3 weeks ago. With that said, I used the ESET "Free" and what I liked about it is that it has nothing but a shortcut on the PC. after the scan asked me if I liked it, said yes and then asked if I would like it to scan the system again end of the month. I agreed to this and apart from the "Task Schedule" and "Shortcut" I found nothing even showing I had used ESET. Love the Idea of having something looking after my PC without hogging my resources. I still have Malwarebytes running and have never found a way to get rid of Defender, so have those two still on my system.

How does the "Paid" ESET system work? is it like the free one that just pops up per schedule or is it a full official program? Like I said I need something that does not Hog resources. Just as an example. Cubase 14 (My main work software) standalone is fine. Loading soundbanks, Instruments and projects makes the PC work hard. So, to me, a 200Mb resource drawing application while I am working is at least an added 80 Hours added to a project (Total from start to finish)

Would be nice if it is like the free version since it does not take any resources except for the "task" scheduled.

 

[mjs warlord]

I hate AV's in general because my pc is ALWAYS old and need every bit of resource I can give it. When I work, I disconnect the internet and stop the AV just to get that bit of extra "OOOMF".

I think this is what happened in my case. Think all this is a ripple that came from the virus I removed about 2 or 3 weeks ago. With that said, I used the ESET "Free" and what I liked about it is that it has nothing but a shortcut on the PC. after the scan asked me if I liked it, said yes and then asked if I would like it to scan the system again end of the month. I agreed to this and apart from the "Task Schedule" and "Shortcut" I found nothing even showing I had used ESET. Love the Idea of having something looking after my PC without hogging my resources. I still have Malwarebytes running and have never found a way to get rid of Defender, so have those two still on my system.

How does the "Paid" ESET system work? is it like the free one that just pops up per schedule or is it a full official program? Like I said I need something that does not Hog resources. Just as an example. Cubase 14 (My main work software) standalone is fine. Loading soundbanks, Instruments and projects makes the PC work hard. So, to me, a 200Mb resource drawing application while I am working is at least an added 80 Hours added to a project (Total from start to finish)

Would be nice if it is like the free version since it does not take any resources except for the "task" scheduled.

I did not know you could get a free version of ESET till you mentioned it so i dont know what is different , btw , i dont keep defender running in the background i just turn it on once a week.

 

[Colif]

I did not know you could get a free version of ESET till you mentioned it so i dont know what is different , btw , i dont keep defender running in the background i just turn it on once a week.

https://web-assets.eset.com/fileadmin/ESET/US/B2B_Resource_centre/whitepapers/free-vs-paid.pdf

My Mum/Brother share an Eset Sub. I was never asked lol.

 

[Charagma]

i dont keep defender running in the background i just turn it on once a week.

Hahaha here I need to ask advice.

My Defender is disabled. No real-time scanning and all those funny things. Even with it being disabled, if I open up my task manager, I will find defender in there doing whatever defender does when disabled. I have searched High and low on the internet and have found nothing on how to get rid of defender.

Will go read up on the free vs paid version thank you. Might be something I would invest in. As long as it does not use my needed resources then they are off to halve a new client already.

 

[Charagma]

https://web-assets.eset.com/fileadmin/ESET/US/B2B_Resource_centre/whitepapers/free-vs-paid.pdf

My Mum/Brother share an Eset Sub. I was never asked lol.

Ok read, but not really an explanation. Just tells you why it is better to have a paid AV instead of a Free AV.

What I saw on the Free ESET (Keep in mind I saw all of this once so far) The system stopped responding for maybe 4 seconds. Then a ESET (Light blue and grey) screen came up. It then started downloading Virus files, scanned the system from a to z, closed with a report (Quarantined etc), asked me if I like it and if I ever want to see them again.

After the scan I wanted to have a look at the report again. Was clean but wanted to see if I maybe missed a PUP or something in the report. Except for Task Scheduler having a Task for ESET and a "ESET.lnk" shortcut on my desktop, I found no trace that it was even on my pc anywhere. Not even a reference of it in my Registry.

If I can have something invisible like this with Supply on demand, on permanent condition, then I will pay for it without even blinking an eye.

 

[Colif]

Defender refuses to not run unless you have another AV, then it will stop running completely. It is really hard to stop it running in background otherwise. Microsoft did that on purpose

this shows differences in the two free trial versions but you only get 30 days usage until it asks you to pay

Compare ESET's levels of protection for your devices | ESET

Try for Free ESET antivirus and internet security solutions. Secure your Windows, macOS, Android and iOS devices

www.eset.com

Maybe you had:

Free Online Virus Scan & Removal Tool | ESET Online Scanner | ESET

Scan your computer for malware for free with the ESET Online Scanner. Our free online virus scanner checks for any type of virus and helps you remove it.

www.eset.com

 

[Charagma]

Defender refuses to not run unless you have another AV, then it will stop running completely. It is really hard to stop it running in background otherwise. Microsoft did that on purpose

Even with Malwarebytes it is still running:

......Wanted to post a screenshot of it but I seem to stand corrected. Up until yesterday it was still running along with Malwarebytes. Maybe all the scans and repairs yesterday fixed that problem........

this shows differences in the two free trial versions but you only get 30 days usage until it asks you to pay

Compare ESET's levels of protection for your devices | ESET

Try for Free ESET antivirus and internet security solutions. Secure your Windows, macOS, Android and iOS devices

www.eset.com

Maybe you had:

Free Online Virus Scan & Removal Tool | ESET Online Scanner | ESET

Scan your computer for malware for free with the ESET Online Scanner. Our free online virus scanner checks for any type of virus and helps you remove it.

www.eset.com

I would assume I had the online one yes. Personally, thought it was great.

Years ago, there was an Online AV (cannot remember the name) but remember it came with a web-surfing application called chameleon. But that was still the days of US robotics dial-up modems and endless (Non-winning) arguments with your ISP. Also, those days I think it was Windows 95 (Maybe even 3.11 FWG) and you were a "Master amongst men" if you owned a XVGA monitor (Do not laugh my current monitor still only has a VGA port.......might need an upgrade sometime). With those in mind I think the only available Viruses was DOS based but for that most of us used Killer DOS v5. With that alone you could make a virus disappear. Technology and "languages" made all that change but the basics principle should still be the same. Pay for access to an online place where you download the Virus files, scan, clear and off you go. No mess no fuss and no missing resources. Unfortunately, I have a huge technology gap. I traveled a lot and never kept up with technology (Specifically AV's). To me the challenge was to have a machine that could run the latest OS.

 

[Colif]

No Defender application running with Malwarebytes.

Guess I should work out why parts of Bitdefender are working but apart from that, only some parts of defender are running on my PC. Probably part of Edge since it runs in background even though I never use it.

Almost everything has changed since 95. Before windows was based on dos... now, its long gone. Command Prompt isn't dos. Not a lot of hardware is the same anymore either.

Its possible you have an option ticked in Windows Security/Virus and threat protection that lets Defender periodically run a scan