AVG evaluation after trial on Windows 7 machines

[Jeff Barnett]

A while ago I inquired, in this forum, for an anti-virus solution for
machines still running Windows 7. I was motivated to do so because ESET,
my then AV solution, said they would no longer support Win7. Several of
you were kind enough to recommend AVG which I downloaded and installed
after excising ESET. The purpose of this email is to pass on my
evaluation of AVG. I am now running paid copies on one Windows 10 laptop
and two Windows 7 desktops. Since this is not a mystery story I will
give you my conclusion upfront: AVG stinks.

AD SPAMMING
-----------
AVG has a free version that I tried first. It was so infested with ads
to purchase various versions of AVG that using it was like wading
through molasses. Well you can't blame someone giving you a freebie from
trying to sell something can you? So I bought a 10-license deal for what
is called "AVG Internet Security". However that did not stop mixing spam
and sales pitches into every interaction with the product. This is bad
enough to drop star ratings to three even if every other aspect of AVG
was perfect.

NETWORK TRUST
-------------
On the Windows 10 and only one of 2 Windows 7 machine installations was
I ask if the network (my LAN) should be trusted. I answered yes when
asked. (Wired network with wireless mesh components in through router.
Wireless demands password. Guest network not enabled.) On third machine
poked around and found a place to set network as trusted. Found "Network
Inspector" in interface that proclaimed network was Public and not
trusted, i.e., ignoring the setting. Incessant email back and forth with
Support and usual unhelpful suggestions, e.g., uninstall and completely
reinstall, etc. No help. Promise to escalate, etc., about a week ago.
Haven't heard from them. Yesterday, a popup that pronounced network
trusted. Presume there was a bug fix included in regular update. So why
not tell me that were working on it and save me the torture of following
their useless instructions??

CONNECTION TRUST
----------------
One of AVG's most popular and frequent popups is the one that asks you
if you want to block or allow a connection and whether this
specification is temporary, one time, or forever. Unfortunately the
question says something like "app.exe is attempting to connect to URL
x.y.z.w". Examples of app are node and svchost. The problem with node is
there is a half dozen of them on my C disk and I am not told which one
it is talking about. An additional problem with svchost is that there
are approximately 20 active processes that are supervised by svchost on
my computer and I'm not told its arguments. So asking such questions is
a shifting of responsibility from AVG to the user: if you don't answer
or answer incorrectly it is your fault if a danger survives or a vital
computation is denied resources. If some net traffic is blocked because
you have answered an AVG query improperly, there is no reasonable way to
find out what the block is an reconsider your (not AVG's) decision. So
some computation is now stuck in the mud and no inspection tools are
available.

PERIODIC SCANS
--------------
During installation you will be encouraged to set up a periodic malware
scan. If you don't do it then, you will be occasionally nagged until you
do. There is a note in small type where you set the periodicity and
start date of the scan that says approximately "Scan will not be run
unless your computer is on." but I think "is on" might mean "is awake".
Further, there is no offer to run scan at earliest available time if
computer is "off" at scheduled time. No log is made unless you check the
last option in a very long list of options and if you do select logging,
the logs are left in "Program Data" on the system disk so users can play
around in that directory! Though it isn't quite enough I do have some
control over what will be scanned. Example, I have a choice (among hard
disks) to scan system disk or all disks. It so happens that besides my
system disk (an SSD) I have two 4TB spinners: one to hold backup files
and the other is my main data repository. I'm not able to schedule a
scan of the system and data disks without including the terabytes on the
backup disk. Ridiculous.

FREEBIE SERVICES
----------------
Occasional during installation or after scans you will be informed that
there are myriad problems but you will not be told enough to decide if
you care. For examples: You have a whole bunch of backups (restore
points), would like them deleted? Since you are not shown a list with
dates and given options as to what will be deleted, this is utter
nonsense. There are other let Papa AVG decide what's important to you
without any visibility to user of what will be done or user controlled
selections. There is an app that scans for sensitive documents that
might contain passwords, etc., and you are ask if you want to protect
all of them. I got tired of looking through the list but I think it
mostly consisted of every pdf document on the computer. There was no
attempt to find the few documents that might actually benefit from some
sort of protection.

BLING IS THE THING
------------------
An examination of the above list should show two trends: The first is to
assume the user is an idiot and will be impressed by copious amounts of
GUI bling with no substance whatsoever behind it. The second is that
they ask users questions that they can't possibly answer with the
information provided, probably so that if anything goes wrong the user
can be blamed.

QUESTION
--------
Any suggestions of a reasonable AV product for a couple of Windows 7
machines?

[s***@home.net]

Post by Jeff Barnett
A while ago I inquired, in this forum, for an anti-virus solution for
machines still running Windows 7. I was motivated to do so because ESET,
my then AV solution, said they would no longer support Win7. Several of
you were kind enough to recommend AVG which I downloaded and installed
after excising ESET. The purpose of this email is to pass on my
evaluation of AVG. I am now running paid copies on one Windows 10 laptop
and two Windows 7 desktops. Since this is not a mystery story I will
give you my conclusion upfront: AVG stinks.
AD SPAMMING
-----------
AVG has a free version that I tried first. It was so infested with ads
to purchase various versions of AVG that using it was like wading
through molasses. Well you can't blame someone giving you a freebie from
trying to sell something can you? So I bought a 10-license deal for what
is called "AVG Internet Security". However that did not stop mixing spam
and sales pitches into every interaction with the product. This is bad
enough to drop star ratings to three even if every other aspect of AVG
was perfect.
NETWORK TRUST
-------------
On the Windows 10 and only one of 2 Windows 7 machine installations was
I ask if the network (my LAN) should be trusted. I answered yes when
asked. (Wired network with wireless mesh components in through router.
Wireless demands password. Guest network not enabled.) On third machine
poked around and found a place to set network as trusted. Found "Network
Inspector" in interface that proclaimed network was Public and not
trusted, i.e., ignoring the setting. Incessant email back and forth with
Support and usual unhelpful suggestions, e.g., uninstall and completely
reinstall, etc. No help. Promise to escalate, etc., about a week ago.
Haven't heard from them. Yesterday, a popup that pronounced network
trusted. Presume there was a bug fix included in regular update. So why
not tell me that were working on it and save me the torture of following
their useless instructions??
CONNECTION TRUST
----------------
One of AVG's most popular and frequent popups is the one that asks you
if you want to block or allow a connection and whether this
specification is temporary, one time, or forever. Unfortunately the
question says something like "app.exe is attempting to connect to URL
x.y.z.w". Examples of app are node and svchost. The problem with node is
there is a half dozen of them on my C disk and I am not told which one
it is talking about. An additional problem with svchost is that there
are approximately 20 active processes that are supervised by svchost on
my computer and I'm not told its arguments. So asking such questions is
a shifting of responsibility from AVG to the user: if you don't answer
or answer incorrectly it is your fault if a danger survives or a vital
computation is denied resources. If some net traffic is blocked because
you have answered an AVG query improperly, there is no reasonable way to
find out what the block is an reconsider your (not AVG's) decision. So
some computation is now stuck in the mud and no inspection tools are
available.
PERIODIC SCANS
--------------
During installation you will be encouraged to set up a periodic malware
scan. If you don't do it then, you will be occasionally nagged until you
do. There is a note in small type where you set the periodicity and
start date of the scan that says approximately "Scan will not be run
unless your computer is on." but I think "is on" might mean "is awake".
Further, there is no offer to run scan at earliest available time if
computer is "off" at scheduled time. No log is made unless you check the
last option in a very long list of options and if you do select logging,
the logs are left in "Program Data" on the system disk so users can play
around in that directory! Though it isn't quite enough I do have some
control over what will be scanned. Example, I have a choice (among hard
disks) to scan system disk or all disks. It so happens that besides my
system disk (an SSD) I have two 4TB spinners: one to hold backup files
and the other is my main data repository. I'm not able to schedule a
scan of the system and data disks without including the terabytes on the
backup disk. Ridiculous.
FREEBIE SERVICES
----------------
Occasional during installation or after scans you will be informed that
there are myriad problems but you will not be told enough to decide if
you care. For examples: You have a whole bunch of backups (restore
points), would like them deleted? Since you are not shown a list with
dates and given options as to what will be deleted, this is utter
nonsense. There are other let Papa AVG decide what's important to you
without any visibility to user of what will be done or user controlled
selections. There is an app that scans for sensitive documents that
might contain passwords, etc., and you are ask if you want to protect
all of them. I got tired of looking through the list but I think it
mostly consisted of every pdf document on the computer. There was no
attempt to find the few documents that might actually benefit from some
sort of protection.
BLING IS THE THING
------------------
An examination of the above list should show two trends: The first is to
assume the user is an idiot and will be impressed by copious amounts of
GUI bling with no substance whatsoever behind it. The second is that
they ask users questions that they can't possibly answer with the
information provided, probably so that if anything goes wrong the user
can be blamed.
QUESTION
--------
Any suggestions of a reasonable AV product for a couple of Windows 7
machines?
--
Jeff Barnett

That is exactly why I stopped using any of those costly by the year
AVs and other junk calling themselves Security Suites.

For quite a few years I've used the following program without any
other "security" program on my C:

https://www.majorgeeks.com/files/details/toolwiz_time_freeze.html
(The Author's site is no longer functioning. Download from MajorGeek
site.)

"Toolwiz Time Freeze is a free instant system protection tool that
will protect your system from any unwanted changes and malicious
activity in low disk level.

With a simple click, it puts your actual system under virtual
protection on the fly and creates a virtual environment as a copy of
the real system, on which you can evaluate applications, watch movies,
and perform online activities. It provides higher-level security to
computer protection, and greatly improves the efficiency of virtual
system"

Nothing that goes wrong stays on your C: drive when rebooted. If you
want to make changes to your C:, just click on the menu choice to
reboot with Time Freeze and you can then add to the C:. Clicking on
an item in the Time Freeze menu will again set C: into virtual mode on
reboot.

It's so simple. Just make sure before adding something to the C: that
you check it with -

https://www.virustotal.com/old-browsers/
and
https://virusscan.jotti.org/

Many programs will install without having to reboot. This let's you
run them safely in Time Freeze in virtual mode to see if they are
worth keeping.

Time Freeze has performed perfectly over quite a few years for me
despite being dropped by it's author. It is so simple there is no need
for any support.

Anyway, hope someone tries it and kisses all that security garbage
goodbye. But I do use my Windows 7 firewall to keep certain programs
from calling home.

[Newyana2]

Post by Jeff Barnett
Any suggestions of a reasonable AV product for a couple of Windows 7
machines?

I don't normally use AV, but I have occasionally run scans. I've used
Clamwin on XP and recently used it on Win10. No nonsense. Portable.
Free. Seems to work fine. Clamwin is OSS.

I also downloaded and ran Emsisoft "Emergency Kit". That seemed OK.
But the scan was a quickie and it found one malware file: A copy of a
program executable that I've been working on! My own software. It even
had a name for it. Some kind of known trojan. Stranger still, there were 2
copies of the file on C drive. Every time I recompile I copy it to a desktop
folder for testing. Emsisoft only flagged one copy. A second run yielded
the same result.

This kind of false positive has happened to me before. At one point Avira
was finding one of my programs to also be a known, named malware. I
experimented with recompiling it and found that if I recompiled with
different
parameters then the file scanned clean. I had a similar experience once with
Malwarebytes, as well. It flagged my boot manager as malware and told me
that I had 10 serious problems. Every fix it suggested would have broken
something. Deleting my boot manager EXE would have rendered Windows
unbootable. Fortunately I knew what they were, so I didn't let it act. But
MB offered no explanations with its warnings and offers to "clean up".

With Avira I wrote to them. No answer. No one was minding the store.
And didn't Avira buy AVG, or vice versa? So you're talking about
ad-infested
software, of dubious value, with no way to contact the maker. In the real
world that would be called a fly-by-night operation.

Karl Peterson, a Microsoft MVP, once wrote an article about how he
had a program getting flagged and finally discovered that it was due to a
hardcoded Registry path. So when it comes to non-techie people one
has to wonder whether these products so more harm than good.

My own approach, over the years, has been to avoid AV. It's very bloated,
and based on an outdated system of looking at specific byte patterns in
a file.
20+ years ago, AV was updated once a month with a 1 MB file. It was
trained to recognize a handful of known viruses. Today they update
multiple times daily and the definitions are 100s of MB. Even with all that,
it's not likely to detect 0-days, which are common. Meanwhile, they drag
on the system.

So my approach is that if I get suspicious I download a portable version,
usually Clamwin, and do a scan. Aside from that I'm careful online,
especially
with script. I'm also good at recognizing rigged email. I've never had any
kind of infection.

I definitely would not use the big names. Avira, AVG, MB,
Norton/Symantec.
They used to offer free products as a loss-leader sales method. But the
intrusions and bloat have become excessive. (Norton System Works was the
first program I ever caught trying to call home without asking, in 2004
or 2005.)
And the functionality is questionable. AV used to be low level geek
software.
Now it's wildly bloated and gets full access to your whole system, at a time
when more and more software is using spyware as a business model.

[Jeff Barnett]

Post by Jeff Barnett
Any suggestions of a reasonable AV product for a couple of Windows 7
machines?

  I don't normally use AV, but I have occasionally run scans. I've used
Clamwin on XP and recently used it on Win10. No nonsense. Portable.
Free. Seems to work fine. Clamwin is OSS.
  I also downloaded and ran Emsisoft "Emergency Kit". That seemed OK.
But the scan was a quickie and it found one malware file: A copy of a
program executable that I've been working on! My own software. It even
had a name for it. Some kind of known trojan. Stranger still, there were 2
copies of the file on C drive. Every time I recompile I copy it to a desktop
folder for testing. Emsisoft only flagged one copy. A second run yielded
the same result.
  This kind of false positive has happened to me before. At one point
Avira
was finding one of my programs to also be a known, named malware. I
experimented with recompiling it and found that if I recompiled with
different
parameters then the file scanned clean. I had a similar experience once with
Malwarebytes, as well. It flagged my boot manager as malware and told me
that I had 10 serious problems. Every fix it suggested would have broken
something. Deleting my boot manager EXE would have rendered Windows
unbootable. Fortunately I knew what they were, so I didn't let it act. But
MB offered no explanations with its warnings and offers to "clean up".
   With Avira I wrote to them. No answer. No one was minding the store.
And didn't Avira buy AVG, or vice versa? So you're talking about
ad-infested
software, of dubious value, with no way to contact the maker. In the real
world that would be called a fly-by-night operation.
  Karl Peterson, a Microsoft MVP, once wrote an article about how he
had a program getting flagged and finally discovered that it was due to a
hardcoded Registry path. So when it comes to non-techie people one
has to wonder whether these products so more harm than good.
 My own approach, over the years, has been to avoid AV. It's very bloated,
and based on an outdated system of looking at specific byte patterns in
a file.
20+ years ago, AV was updated once a month with a 1 MB file. It was
trained to recognize a handful of known viruses. Today they update
multiple times daily and the definitions are 100s of MB. Even with all that,
it's not likely to detect 0-days, which are common. Meanwhile, they drag
on the system.
  So my approach is that if I get suspicious I download a portable
version,
usually Clamwin, and do a scan. Aside from that I'm careful online,
especially
with script. I'm also good at recognizing rigged email. I've never had any
kind of infection.
  I definitely would not use the big names. Avira, AVG, MB,
Norton/Symantec.
They used to offer free products as a loss-leader sales method. But the
intrusions and bloat have become excessive. (Norton System Works was the
first program I ever caught trying to call home without asking, in 2004
or 2005.)
And the functionality is questionable. AV used to be low level geek
software.
Now it's wildly bloated and gets full access to your whole system, at a time
when more and more software is using spyware as a business model.

Thanks for the info. I have been happy with ESET for years an would
still be using them if they supported Windows 7. We plan to build some
new machines and I'll return to their care then. You are right in the
assessments of products above. Norton went south and actually became
dangerous years ago. Malware Bytes became a joke when they started
claiming AV protection - at that time I tested them with known
pseudo-virus test files and they failed every test. And so on.
--
Jeff Barnett



--
This email has been checked for viruses by AVG ant

[Paul]

Any suggestions of a reasonable AV product for a couple of Windows 7 machines?

  I don't normally use AV, but I have occasionally run scans. I've used
Clamwin on XP and recently used it on Win10. No nonsense. Portable.
Free. Seems to work fine. Clamwin is OSS.
  I also downloaded and ran Emsisoft "Emergency Kit". That seemed OK.
But the scan was a quickie and it found one malware file: A copy of a
program executable that I've been working on! My own software. It even
had a name for it. Some kind of known trojan. Stranger still, there were 2
copies of the file on C drive. Every time I recompile I copy it to a desktop
folder for testing. Emsisoft only flagged one copy. A second run yielded
the same result.
  This kind of false positive has happened to me before. At one point Avira
was finding one of my programs to also be a known, named malware. I
experimented with recompiling it and found that if I recompiled with different
parameters then the file scanned clean. I had a similar experience once with
Malwarebytes, as well. It flagged my boot manager as malware and told me
that I had 10 serious problems. Every fix it suggested would have broken
something. Deleting my boot manager EXE would have rendered Windows
unbootable. Fortunately I knew what they were, so I didn't let it act. But
MB offered no explanations with its warnings and offers to "clean up".
   With Avira I wrote to them. No answer. No one was minding the store.
And didn't Avira buy AVG, or vice versa? So you're talking about ad-infested
software, of dubious value, with no way to contact the maker. In the real
world that would be called a fly-by-night operation.
  Karl Peterson, a Microsoft MVP, once wrote an article about how he
had a program getting flagged and finally discovered that it was due to a
hardcoded Registry path. So when it comes to non-techie people one
has to wonder whether these products so more harm than good.
 My own approach, over the years, has been to avoid AV. It's very bloated,
and based on an outdated system of looking at specific byte patterns in a file.
20+ years ago, AV was updated once a month with a 1 MB file. It was
trained to recognize a handful of known viruses. Today they update
multiple times daily and the definitions are 100s of MB. Even with all that,
it's not likely to detect 0-days, which are common. Meanwhile, they drag
on the system.
  So my approach is that if I get suspicious I download a portable version,
usually Clamwin, and do a scan. Aside from that I'm careful online, especially
with script. I'm also good at recognizing rigged email. I've never had any
kind of infection.
  I definitely would not use the big names. Avira, AVG, MB, Norton/Symantec.
They used to offer free products as a loss-leader sales method. But the
intrusions and bloat have become excessive. (Norton System Works was the
first program I ever caught trying to call home without asking, in 2004 or 2005.)
And the functionality is questionable. AV used to be low level geek software.
Now it's wildly bloated and gets full access to your whole system, at a time
when more and more software is using spyware as a business model.

Lesser products use "reputational analysis" to scare you.

When you write your own program and make an EXE, they first
calculate a checksum. If the checksum is not found in the Big Table
Of Checksums, then "oh, that's malware". Well, it isn't. It means
not a lot of people have downloaded the file (yet), and we don't
know whether it has malware or not.

This is a dishonest way of vetting content. Yet, if we just
signature scan the user PC, we may get no hits at all, and
then the product looks pretty lame, if it can't find *something*
to complain about.

That's why AVG will tell you that you have "8000 problems".
Because 8000 is more than zero problems. And it looks
like a powerful tool, for having dug up a lot of silly shit.

The top tier of products would have "heuristic protection",
which means they recognize certain patterns ("stack smashing")
as they happen, and try to stop it. Other products don't
have significant heuristic (new malware) protections and
they aren't as good.

All products have their ups and downs. At one time, ESET
would have been at the top of the list, but when AV-Comparatives
does repeated analysis, some years they have done better than
other years. And this is normal. Just as some years,
Microsoft had kinda forgotten about security and attack
surfaces, and every once in a while, a dumpster fire
reminds them about it.

It's Windows 7, and your choices are between "scum" and "villainy"
for AV products. Maybe a CLAM scan is about all you're getting
for your money. Cisco TALOS does basic maintenance on the free database.
A person can write their own program and use that database,
and start their own AV company :-)

https://en.wikipedia.org/wiki/ClamAV

Paul

[Newyana2]

Post by Paul
Lesser products use "reputational analysis" to scare you.
When you write your own program and make an EXE, they first
calculate a checksum. If the checksum is not found in the Big Table
Of Checksums, then "oh, that's malware". Well, it isn't. It means
not a lot of people have downloaded the file (yet), and we don't
know whether it has malware or not.

I hadn't thought of that, but I guess it makes sense. That's
the same thing companies try to do with drivers and software.
Various methods to manufacture some kind of officiality. I suppose
that's a weak point with tech altogether. Reputation depends
on human connections. The value of human judgement depends
on the value of other people with a good reputation. Co-signing loans,
letters of reference... All of that is about human relationship in the
final analysis. Even credit scores. But with tech the aim is to eliminate
the human factor. Companies make money by automating their
operations. So we have a no-win sitation.

I remember a few years ago people were getting attacked by
driveby downloads at nytimes.com. NYT has a solid reputation in
the human world. Their news may all be skewed left, but at least
they don't lie outright. Yet their site was spreading malware. Why?

It turned out that Russian hackers were buying ad space from
Google. That was all automated. Google didn't care who bought
ad space, so long as they got paid. NYT didn't care whose
ads showed with their articles, so long as they got paid and the
ads were not "in conflict with the high standards to which the
New York Times holds itself." No one was minding the store. No
one is ever minding the store. Too much overhead having humans
involved. We're overdue for an unimaginable calamity.

There must also be other factors, though. One EXE was flagged.
An identical one was not. When Avira flagged an EXE I was able
tpo stop the alarm by recompiling with different parameters. (I don't
remember now what I changed.)

But I think you're right that these programs try to find something.
They "sing for their supper". Their reputation is also at much less
risk from false positives than the possibility that something might
get by them.

[Mark Lloyd]

On Sat, 7 Sep 2024 02:45:14 -0400, Paul wrote:

[snip]

Post by Paul
This is a dishonest way of vetting content.

I never liked that kind of thin, that equates "unknown" with "very bad".

Post by Paul
Yet, if we just signature
scan the user PC, we may get no hits at all, and then the product looks
pretty lame, if it can't find *something*
to complain about.

[sni]

Post by Paul
Paul

--
110 days until the winter celebration (Wednesday, December 25, 2024
12:00 AM for 1 day).

Mark Lloyd
http://notstupid.us/

"They call them extremists. We have our own names. We call them
senators, congressman, governors, mayors, state legislators" [Ralph
Reed, Christian Coalition Executive Direct

[Sam E]

[snip]

QUESTION --------
Any suggestions of a reasonable AV product for a couple of Windows 7
machines?
--
Jeff Barnett

Maybe one that doesn't add SPAM to your messages?