Microsoft Defender Considered Malware

7 points by brookritz 4 years ago | 5 comments

All Linux machines at work now run "Microsoft Defender Advanced Threat Protection" (mdatp).

We have seen software crashing because files that were expected to be there were suddenly moved to "quarantine" by mdatp. On another occasion a job that moves thousands of small files to another directory took hours instead of seconds to complete. The mdatp daemon was running at 100% CPU and scanning all files for "threats". The "solution" IT Operations implemented was that they added the affected directories to some ignore-list in the mdatp configuration.

Yesterday, a shell script that uses sort just crashed because it was missing /tmp/sortFhe4A. It turned out that MDATP moved the file while the sort process was running. The file contained alphanumeric identifiers. Some combination of bytes in on of sort's tempfiles apparently resembled the signature of some stupid vbscript malware. In all cases it was false alarm. Duh..

Lessons learned: Microsoft Defender renders Linux machines unusable. Instead of protecting against threats this piece of junk is outright malware.

agiacalone 4 years ago |

Um...it's obviously telling you that Linux is just very unsafe. Every MSDN knows this: it's one of the first things they read when opening up the Tome of Knowledge.

Best to re-install Windows 11. Be sure to beg forgiveness of the Microsoft gods by secure-deleting a copy of the Halloween Documents while chanting the true name of the Great Bill over the chorus of Bing bells.

hulitu 4 years ago |

Are you using MS Defender on Linux ? If yes, good luck. The last time i saw an antivirus catch a virus was about 20 years ago. Since then i had to clean up my work computers a couple of times, by hand, with the antivirus happily running.

naikrovek 4 years ago |

90-100% of your complaints are going to be due to misconfiguration by the administrators of the system, I bet. and architectural differences of the EXT4 filesystem compared to NTFS and the nature of locking files on Linux.

you probably want to head over to Slashdot if you want to rant, as well. plenty of MS bashing here, but complaint for complaint's sake isn't really the style here like it is in other places. or maybe it is, I don't know. I could be reading everything wrong.

Shadonototra 4 years ago |

the problem is not "Microsoft Defender Advanced Threat Protection" (what a stupid name btw)

the problem is the people who said "let's install this"

clueless people became manager

trasz 4 years ago |

Why would anyone use it?