Do AV companies check each definition update against windows?


Recommended Posts

Do AV companies check each definition update against windows?

Every now and then an antivirus company releases a definition update which brings Windows to its knees. ( Example: When Webroot recently released an update which locked people out of their windows 8 machines) The AV accidentally flags a crucial system file as malicious and deletes it. How does this happen? I realize there are 100,000?s of thousands of different windows applications which could accidentally be flagged, thus they can?t test each one, but windows?

I don?t know how they check each definition update, but to me it doesn?t sound that hard. Wouldn?t it be easy to setup a few quad core machines with 2+ SSD?s in raid 0. Then each computer would contain a different bare-bones version of windows, starting with a machine that has all the latest updates. Then before the update is released they scan each machine. Because the computer is a bare install and because it?s running on an SSD raid 0 setup, the scan should only take a few minutes. If they did this before they released each update I don?t see how they could accidentally release an update that kills thousands of machines.

That's just my 2 cents.

When I said Service pack 2 I meant to say Service pack 3!

DO you pay for the AV?

NO: not hey don't check and AVG, Avira, Webroot and camp have all had issues several times where they have broken windows

YES: they generally test every update, unless it's McAffee or Panda or F-Prot which are all pretty terrible at checking. and also suffer from pretty bad coding and performance in general.

Or they could take the easier route and automatically white-list any application that is digitally signed by Microsoft. All Windows files are digitally signed by MS.

  • Like 2

Also you have to remember that it's not about just scanning windows.

you have to scan windows XP, Vista, 7 and 8. on top of that, EACH individual update to windows have to be tested as well as some of them change system files, and while it won't break one windows 7 SP1 system, it could break another one that has a different set of updates applied.

DO you pay for the AV?

NO: not hey don't check and AVG, Avira, Webroot and camp have all had issues several times where they have broken windows

YES: they generally test every update, unless it's McAffee or Panda or F-Prot which are all pretty terrible at checking. and also suffer from pretty bad coding and performance in general.

But the Free versions of the AV also use the same definitions of their paid counterparts. Example AVG free Vs AVG paid. ... I doubt even if that wasn't the case, that because they were giving it away for free that they wouldn't care to check.

Or they could take the easier route and automatically white-list any application that is digitally signed by Microsoft. All Windows files are digitally signed by MS.

that's not how it works... AV scanners break windows because they falsely flag and remove system files. these need to be scanned as well.

But the Free versions of the AV also use the same definitions of their paid counterparts. Example AVG free Vs AVG paid. ... I doubt even if that wasn't the case, that because they were giving it away for free that they wouldn't care to check.

yeah, but AVG is horrible across the board. and they are able to give the free version away free because they don't spend as much resources on checking it.

Also you have to remember that it's not about just scanning windows.

you have to scan windows XP, Vista, 7 and 8. on top of that, EACH individual update to windows have to be tested as well as some of them change system files, and while it won't break one windows 7 SP1 system, it could break another one that has a different set of updates applied.

Microsoft has been digital signing since Windows XP...

Using the digital signature check is a safe bet as any modification will result in the file no longer being signed...

that's not how it works... AV scanners break windows because they falsely flag and remove system files. these need to be scanned as well.

Well yes, right now they don't do it right hence the thread ;)

My point was a way they could stop breaking Windows with definition updates. There is no need to scan a Windows system file that has not changed and was published officially by Microsoft. They should save the resources and just skip scanning it altogether (I'm not talking about scanning the state of the application in memory, but the actual file on disk).

Or they could take the easier route and automatically white-list any application that is digitally signed by Microsoft. All Windows files are digitally signed by MS.

Recently i have come across infections that are able to look digitally signed, so that would automatically see them as clean

No AV company is going to trust anyone elses security measures, it goes against their very purpose.

If they have problems with the way Digital Signatures work in Windows it would be beneficial to everyone if they publicized the problem and encouraged Microsoft to fix them.

If they are truly as scared as you claim then they should, at least, SHA256 hash all of the Windows files and compare against those to see if the content has changed. The point is, they need to whitelist the OS and report any security problems in unaltered OS files to Microsoft directly. They can't remove Windows security vulnerabilities and just removing a core OS file could lead to users being unable to use their machines. To me, killing a user's computer is a stupid end result for these products.

Recently i have come across infections that are able to look digitally signed, so that would automatically see them as clean

Yes, there are ways to try and spoof the name of the company signing the file to look at like like "Microsoft Corporation" or whatever, but the AV company should be using Microsoft's public key to compare against and not the name displayed to the user. A scammer can fake the name and anything else, but he can't fake the Microsoft public key without having the corresponding private key. This hasn't yet been cracked as the foundation for this is what all of our eCommerce transactions (and more) depend on daily to remain safe.

  • Like 2

That's why I use an MS antivirus with my MS operating system, plus its free and came with W8 so I had no need to install anything.

The point isn't how secure thir digital signatures is. the point is that they are AV companies and their livelihood is guaranteeing security. No matter how secure another system is, they cannot trust someone elses systems to be secure, they need to scan everything for infections

Look at the past history of security and how much worse a lot of infections would have been if every security company and AV company where to trust others security systems to be secure.

The point isn't how secure thir digital signatures is. the point is that they are AV companies and their livelihood is guaranteeing security. No matter how secure another system is, they cannot trust someone elses systems to be secure, they need to scan everything for infections

Look at the past history of security and how much worse a lot of infections would have been if every security company and AV company where to trust others security systems to be secure.

You don't seem to understand what he's saying. A file signed by Microsoft will not be of any sort of security concern. Microsoft isn't going to slipstream a virus into it's OS, so there's no point at all in scanning those core files. It's a waste of time and it leaves the door open for critical mistakes. As was already said, scan the state in memory or the hash, and that's all that will ever be needed.

  • Like 3

Look at the past history of security and how much worse a lot of infections would have been if every security company and AV company where to trust others security systems to be secure.

Give me an example in the case of Microsoft and signed files. We are talking about Microsoft and not the security of 3rd party applcations.

From experience at work at least, I do not think they test the updates before they push them each day, i have seen to many episodes where computers are crippled by a bad update.

Give me an example in the case of Microsoft and signed files. We are talking about Microsoft and not the security of 3rd party applcations.

The example doesn't have to be specifically about MS and signed files.

you're still asking a company who's primary job it is to provide security to lay their trust in a third party and not go all the way in providing security.

Imagine if big security firms when hired for huge contracts went ahead and just said "ok so you already installed door locks and alarms yourself ? ok, we'll just trust that those locks and alarms work fine, and provide you with some guards in case something should happen." Think about it.

The signed files may and probably is fine and would prevent any undetected changes, BUT the AV company CANNOT guarantee that, they CANNOT trust that.

The example doesn't have to be specifically about MS and signed files.

you're still asking a company who's primary job it is to provide security to lay their trust in a third party and not go all the way in providing security.

Imagine if big security firms when hired for huge contracts went ahead and just said "ok so you already installed door locks and alarms yourself ? ok, we'll just trust that those locks and alarms work fine, and provide you with some guards in case something should happen." Think about it.

The signed files may and probably is fine and would prevent any undetected changes, BUT the AV company CANNOT guarantee that, they CANNOT trust that.

But no AV program is 100% successful anyway, so they cannot really guarantee that your system is 100% perfectly clean.

oh, so they should just not bother then :facepalm:

seriously, that's your argument ?

and use a quality AV, which pretty much excludes all the free ones and you're pretty damn close to 100%, even on zero day viruses if you keep the heuristics on and at a decent setting

The example doesn't have to be specifically about MS and signed files.

you're still asking a company who's primary job it is to provide security to lay their trust in a third party and not go all the way in providing security.

Imagine if big security firms when hired for huge contracts went ahead and just said "ok so you already installed door locks and alarms yourself ? ok, we'll just trust that those locks and alarms work fine, and provide you with some guards in case something should happen." Think about it.

The signed files may and probably is fine and would prevent any undetected changes, BUT the AV company CANNOT guarantee that, they CANNOT trust that.

Again, you're missing the context here. We are talking about files signed by Microsoft. Unless there is a disgruntled employee writing Windows, there is a 0% chance a stock Microsoft signed file will be infected with something. I see no reason why Microsoft couldn't be trusted for publishing clean files in their OS. There's no logic in believing this would be a security risk. Scanning these files only adds unnecessary reliability risks.

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • Why it's almost impossible to produce a smartphone in the United States by Hamid Ganji If you look at the back of some Apple products, you can see the famous phrase “Designed by Apple in California, Assembled in China.” This phrase appears on products from one of the largest smartphone brands in the United States. These products are designed in the U.S., but their manufacturing takes place in China, India, Vietnam, or even Brazil. But why can’t Apple, as one of the largest American tech companies, produce its iPhones on U.S. soil? The idea for this topic came to me after the Trump Foundation launched a smartphone called the T1 and claimed that it was designed and built with American values in mind. However, this claim did not last long, as it was revealed that Trump’s phone was actually a rebranded HTC U24 Pro, with only a gold case and minor internal component changes. You see? Even a phone that is supposed to represent American values is manufactured in China. With a gross domestic product (GDP) exceeding $32 trillion, the United States is currently the world’s largest economy, while China ranks second with around $20 trillion. On the other hand, the United States is by a wide margin the global leader in various technological fields, and American companies spend hundreds of billions of dollars annually on research and development. From Apple and Google to Microsoft, Lockheed Martin, Boeing, and others, American tech and industrial giants lead their foreign competitors in many sectors. The United States also has no shortage of smartphone brands. Apple, Google, and Motorola are among the major brands in the smartphone market, collectively holding a significant share. However, the vast majority of their products are manufactured outside the United States. So why is it that the world’s largest economy, home to the most advanced technology companies and industrial powers, cannot produce a smartphone on its own soil? Let’s explore this question together. Even threats to impose tariffs won’t work After Trump entered the White House as the 47th President of the United States, his administration adopted strict tariff policies. One of these policies was the imposition of a 25% tariff on smartphones manufactured outside the United States. Trump said he “had a little problem” with Apple CEO Tim Cook over producing smartphones outside the U.S. So he thought that threatening a 25% tax on imported phones might force Apple to bring manufacturing back to the United States. “I have long ago informed Tim Cook of Apple that I expect their iPhones that will be sold in the United States of America will be manufactured and built in the United States, not India, or anyplace else,” Trump wrote on Truth Social. Image via The White House Although Apple currently manufactures some of the iPhone’s chips in the United States with TSMC's help, it still shows no willingness to shift full iPhone production to the country. At the time, renowned Apple supply chain analyst Ming-Chi Kuo wrote on X, “In terms of profitability, it’s way better for Apple to take the hit of a 25% tariff on iPhones sold in the US market than to move iPhone assembly lines back to the US.” However, manufacturing a smartphone in the United States is not as easy as it might seem, and many technical and economic barriers are involved. The lack of necessary manufacturing hubs There is a clear reason why many companies prefer to manufacture their products in China. China has established itself as the main global manufacturing hub for international companies, and over the past few decades, large contract manufacturers have emerged there, allowing companies like Apple to outsource production. One such example is Foxconn, which also manufactures some Apple products in India. Building the infrastructure required to produce smartphones in the United States would require tens of billions of dollars in new investment. Factories would need to be built, essential manufacturing equipment would have to be installed, and, most importantly, a skilled workforce capable of operating these systems would need to be recruited and trained. The United States currently lacks the core infrastructure needed to manufacture smartphones, and for this reason, many companies prefer to outsource production to Chinese contractors rather than spend tens of billions of dollars to build that infrastructure, which is significantly more economically efficient. Additionally, building such infrastructure in the United States could take up to a decade, ultimately leading to a significant increase in the product's final price for consumers. Shortage of trained labor in the U.S. compared to China Decades of serving as a global manufacturing hub have allowed China to build a massive talent pool in the production sector that is almost unmatched worldwide. Today, if a company chooses to manufacture its products in China, it can be confident that the workers involved in production have years of experience in their respective roles and are capable of producing high-quality goods with minimal errors. Even if we assume that tens of billions of dollars were invested in building smartphone manufacturing infrastructure in the United States, finding skilled workers would remain highly challenging. Apple CEO Tim Cook visiting the iPhone 6 assembly line in China in 2014. Image: Tim Cook on X In a 2015 interview on CBS’s 60 Minutes, Tim Cook said the main reason Apple isn’t producing in the US is a lack of skills. "China put an enormous focus on manufacturing, in what you and I would call vocational kind of skills. The US over time began to stop having as many vocational kinds of skills. I mean you could take every tool and die maker in the United States and probably put them in the room that we're currently sitting in. In China you would have to have multiple football fields,” Cook said. Also, in 2017, at the Fortune Global Forum in Guangzhou, Cook once again emphasized the importance of highly skilled Chinese workers. “China has moved into very advanced manufacturing, so you find in China the intersection of craftsman kind of skill, and sophisticated robotics and the computer science world. That intersection, which is very rare to find anywhere, that kind of skill, is very important to our business because of the precision and quality level that we like. The thing that most people focus on if they’re a foreigner coming to China is the size of the market, and obviously, it’s the biggest market in the world in so many areas. But for us, the number one attraction is the quality of the people,” Apple CEO said. Higher labor costs in the United States Producing almost any product in the United States is more expensive than in many other countries, and one of the main reasons is the higher cost of labor in the U.S. According to the Bureau of Labor Statistics, median weekly earnings of full-time workers in the United States were $1,235 in the first quarter of 2026. Meanwhile, the average annual salary in China's private sector in 2025 was RMB 71,590 (US$9,961). In many parts of the world, the weekly wage of an American worker is equivalent to several months of income. Another important factor to consider is that in the United States, the workforce capable of working on a smartphone assembly line is highly specialized and therefore commands higher-than-average wages. According to an estimate by Bank of America, producing an iPhone in the U.S. is technically possible, but “iPhone cost can increase 25% purely on higher labor cost in the U.S.” However, this 25% increase applies only if final assembly is performed in the United States while components are still sourced from China or elsewhere. In this case, the price of a base iPhone would rise from $799 to around $1,000. But in another scenario, if Apple were to produce the required components for the iPhone within the United States, production costs could increase by more than 90%. Trump’s dream for a “Made in the USA” iPhone might never come true In a free-market capitalist economy, one of the primary responsibilities of any CEO is to maximize profit. Using Apple as an example, Tim Cook’s role is to maximize the company’s profits so that it can fund research and development for new products and invest in areas such as artificial intelligence, while also keeping shareholders satisfied. Therefore, it is entirely understandable that Apple would choose not to bring its manufacturing back to the United States and instead keep production in countries where labor is cheaper, and products can be manufactured at a lower cost, thereby maximizing its profit margins. What is your opinion about manufacturing smartphones in the United States? If you are an American citizen, would you be willing to pay hundreds of dollars more for a smartphone made domestically in the USA? Let us know in the comments.
    • Cheers everyone for the replies. It's been very useful. 👍
    • Compared to the 7735HS it is around 25-30% slower in multi-threaded tasks (according to Google search) I did a review of the 7735HS Beelink SER6 Max in 2023, but thinking about it, it's not comparable to the 7730U. For the example you gave about how it will be used, the 7730U is actually an excellent choice for its power and battery efficiency.
  • Recent Achievements

    • Reacting Well
      JuvenileDelinquent earned a badge
      Reacting Well
    • One Month Later
      Excellence2025 earned a badge
      One Month Later
    • Week One Done
      Excellence2025 earned a badge
      Week One Done
    • Week One Done
      flexorcist earned a badge
      Week One Done
    • Week One Done
      Woland13 earned a badge
      Week One Done
  • Popular Contributors

    1. 1
      +primortal
      503
    2. 2
      +Edouard
      194
    3. 3
      PsYcHoKiLLa
      151
    4. 4
      Steven P.
      71
    5. 5
      FloatingFatMan
      67
  • Tell a friend

    Love Neowin? Tell a friend!