Again and Again and Again, Windows is a Threat

[marcL]

Today I wanted to check the versions of some plugins on my laptop. I was shocked because when I clicked the check version Windows Defender reported a severe threat. First I thought that this vendor really had some virus issues in its plugins. But when I tried with another vendor's plugin the same thing happened again.

Googling for "Win32/Hive.ZY" threat listed the following interesting article that mentions this as a new Microsoft issue:

https://www.windowslatest.com/2022/09/05/microsoft-confirms-behaviorwin32-hive-zy-false-error-bug-in-windows-defender/

It is unbelievable how Microsoft is the worst threat in always stealing my time and my precious hardware capacity! And this for years! ?

This is the reason why I don't want to have my DAW pcs always online (for authorization and cloud stuff), because it exposes your pc for the MS Update threat! ?

[Jeremy Oakes]

Yes you’ve made that very clear in other posts you’ve made.

Some of us don’t have several PC’s, so we have to keep our DAW on line.

If you are careful, you’ll not have issues. As least I don’t.

And, after all, you can exclude your VST  and Cakewalk files from being scanned by Defender……….

J

[daveiv]

I use a Linux PC for banking, email, etc. serious matters. Two laptops stacked today are thinner and lighter than a single laptop from 15 years ago.

[marcL]

1 hour ago, Jeremy Oakes said:

And, after all, you can exclude your VST  and Cakewalk files from being scanned by Defender……….

Thanks, I had already done this before. But in the special case above it does even not work, i.e. Windows complains anyway! ?

[fret_man]

All of a sudden I'm getting malicous detections in some old Line6 and Log drivers, as well as a few others I haven't yet identified. I sure hope I don't lose connetivity to my POD HD500.

[bitflipper]

False-positives have been an annoyance for as long as there have been malware scanners. Anti-malware has gotten more sophisticated over the years, but it often still relies on "signatures", meaning a (hopefully) unique string of binary values that can identify a bad actor. But of course any random string of bits can occur that do not necessarily represent a signature. Developers use common libraries, so it's to be expected that innocuous software A might be using the same library as malicious software B. Software installers in particular are notorious for being flagged as malware, just because of the nature of what they do.

The good news is that no audio plugin has ever been identified as a virus. Which makes sense; what mischief could an evil delay plugin really do? It's just not an attack vector that bad guys would be attracted to. Can you really picture a North Korean hacker gleefully informing his boss that "here's the thing - he he - they'll dial in a quarter-note delay but really get an eighth note"?

It's one more reason to keep your VSTs well-organized: makes it easier to whitelist them from your virus scanner.

[Old Joad]

I was getting that yesterday. updated this morning and all is well.

[abacab]

This is one time that I'm thankful to be using Firefox as my default browser. Haven't opened anything Chrome based today!

[antler]

If you can, I'd recommend using a third-party AV instead of the built in one. The built in one is fast, but it's usually one of the most unreliable in AV comparisons.

[Doug Rintoul]

13 minutes ago, antler said:

If you can, I'd recommend using a third-party AV instead of the built in one. The built in one is fast, but it's usually one of the most unreliable in AV comparisons.

I can't stand third party AVs. I have had more problems with them than I ever had with Windows Defender. So much bloatware and so intrusive. Can  you recommend a third party AV that does not block your every move and is a light as WD?

[kitekrazy1]

20 minutes ago, antler said:

If you can, I'd recommend using a third-party AV instead of the built in one. The built in one is fast, but it's usually one of the most unreliable in AV comparisons.

Never had an issue with built in.

[marcL]

1 hour ago, bitflipper said:

The good news is that no audio plugin has ever been identified as a virus.

But it is! Selecting the update check in some VST plugins caused Win-Doof(german) to signal a severe threat! 

[antler]

1 minute ago, Doug Rintoul said:

I can't stand third party AVs. I have had more problems with them than I ever had with Windows Defender. So much bloatware and so intrusive. Can  you recommend a third party AV that does not block your every move and is a light as WD?

I can't really think of any that are as light as WD. That said, in the last AV comparison I looked at (which admittedly was a while ago), there weren't that many that performed worse.

Don't get me wrong, it's better than nothing. Just that there are better alternatives; they might just be heavier. It might be better to look at more up-to-date info:

https://uk.pcmag.com/antivirus/8141/the-best-antivirus-protection

[daveiv]

My first-hand experience with Linux audio:

OS: Ubuntu, Fedora, OpenSUSE, Debian
DAW: Ardour / Mixbus / Reaper / Waveform
DAW (WINE): Mixcraft, FL Studio
VI (Native): Surge / Vital / OB-Xd / Dexed / u-he Diva, Hive, Zebra 2 / TAL J8, UNO LX, BassLine 101 / Tracktion F.'em, BioTek, Collective / Ugritone Drums / Pianoteq
VI (WINE): AIR Music Tech everything / Sonivox everything / IK Miroslav Philharmonik 2, Sampletank / UVI Workstation, Kontakt
FX (native/WINE): So many to type here...

Everything above works like a charm.

[Promidi]

This is why I disable Windows defender and use a third party solution instead (Malwarebytes Premium)

My PC stay on , and connected to the internet 24/7 (been that way for decades with a reboot ever now and then) - no issues so far.

[abacab]

Microsoft Defender in its Win10 & Win11 incarnations is the most compatible real-time AV that you can run on your PC. It also allows you to set exclusions for files, folders, or processes that you do not wish to be scanned. I have all of my audio stuff excluded.

Defender now scores competitively in "Real World Protection" comparison tests with paid AV products. It scored 99% in the most recent test, and actually tied for top place with zero false positives!  https://www.av-comparatives.org/tests/real-world-protection-test-february-may-2022/

https://www.av-comparatives.org/real-world-protection-test-methodology/

The old Microsoft Security Essentials for WinXP & Win7 were bottom of the barrel on detection, false positives, and performance. So bad, it was almost a joke! 3rd party AV used to be mandatory, but no longer.

Just don't click willy-nilly on everything you see, download unknown files, or open unsolicited attachments and you will be fine.

Edited September 5, 2022 by abacab

[Jim Roseberry]

FWIW, My DAWs are all connected to the Internet... and most run 24/7.

Never a problem...

First, make sure you have proper backup.

Next, make sure you're running Win10x64 Pro... so you can fully disable all automatic updates.

Not a fan of any 3rd-party AV application on any high-performance machine...

[abacab]

3 minutes ago, Jim Roseberry said:

First, make sure you have proper backup.

That right there is the best malware protection! ?

And there are some good free solutions out there! No excuse not to be doing that for your valuable DAW!

I'm not sure that I would ever trust a machine that actually got infected to be "clean" after removing the malware. I would just rather nuke and restore the entire system drive from a backup image made prior to the infection.

[daveiv]

34 minutes ago, Jim Roseberry said:

First, make sure you have proper backup.

Burning optical discs (DVD, Blu-ray, CD) is a good way to backup. They last long, and they can't be erased by ransomware attacks.

[Doug Rintoul]

4 hours ago, antler said:

I can't really think of any that are as light as WD. That said, in the last AV comparison I looked at (which admittedly was a while ago), there weren't that many that performed worse.

Don't get me wrong, it's better than nothing. Just that there are better alternatives; they might just be heavier. It might be better to look at more up-to-date info:

https://uk.pcmag.com/antivirus/8141/the-best-antivirus-protection

I use AVG on some of my company computers. Every time I ran a new program, it flagged it as suspicious and would not let me run it until it had uploaded some sort of signature to its website. Terrible behaviour IMHO.

Edited September 5, 2022 by Doug Rintoul