Windows Defender is enough, if you harden it

Re:Windows Defender is enough, if you harden it by londons_explore on Sunday March 06, 2022 @06:19PM (#30582274)

I really don't understand why the IO hit... If you're designing the OS, you can either scan a file when it's written to disk, or when it's read from disk, or sometime inbetween. when you have scanned a given file, you need not rescan it if the file hasn't changed.

These facts together mean that it should be really rare that any application needs to be waiting for any scanning - since scanning can happen anytime between a data write and a read of the same data.

[ Parent | on HN ]

Re:Windows Defender is enough, if you harden it by XorNot on Sunday March 06, 2022 @06:59PM (#30582527)

No way to tell if it's changed if you don't store a hash as metadata.

Something like ZFS where hashing is baked into the cost of the FS operation could optimise this.

[ Parent | on HN ]

Re:Windows Defender is enough, if you harden it by londons_explore on Sunday March 06, 2022 @07:14PM (#30582635)

But if you control the kernel and all the code that runs in the kernel, you know exactly who has written to disk and when. So if nobody wrote that data, then it hasn't changed.

[ Parent | on HN ]

Re:Windows Defender is enough, if you harden it by wombatpm on Sunday March 06, 2022 @08:10PM (#30583001)

Removable media, network drives, low level disk operations? I don't think you can know with 100% certainty on a window machine

[ Parent | on HN ]

Re:Windows Defender is enough, if you harden it by wingmanjd on Sunday March 06, 2022 @08:06PM (#30582960)

Would the currently running OS know if another OS changed the file?

[ Parent | on HN ]

Re:Windows Defender is enough, if you harden it by Siira on Monday March 07, 2022 @03:51AM (#30585578)

Can assume a single OS.

[ Parent | on HN ]

Re:Windows Defender is enough, if you harden it by daemin on Monday March 07, 2022 @06:56AM (#30586699)

In Windows there's a hook on file handle close which AV products use to implement their file scanning.

I know this because I did a bunch of reading on the topic after encountering catastrophic halts inside of CloseHandle, deep inside the kernel. And even with administrator privileges I could not kill the process, or the attached debugger, and the machine was unable to shutdown because even it could not kill the stuck process. I had to hard power cycle to get back to a usable system. Near as I can tell this was because of the AV product the company was using that crashed or deadlocked or something.

Note this product was not Windows Defender.

[ Parent | on HN ]

Re:Windows Defender is enough, if you harden it by netcoyote on Sunday March 06, 2022 @10:27PM (#30583914)

The virus might be discovered after the file it’s contained in is written to disk, which is why you’d need to scan when reading.

[ Parent | on HN ]

Re:Windows Defender is enough, if you harden it by ComputerGuru on Monday March 07, 2022 @12:18AM (#30584464)

Then don’t scan when writing?

[ Parent | on HN ]

Re:Windows Defender is enough, if you harden it by codeflo on Monday March 07, 2022 @04:46AM (#30585880)

The virus signatures haven’t been updated since my last recompile though.

[ Parent | on HN ]