Everytime I browse Lemmy, my Bitdefender always pops up

Should I just ignore and/or whitelist this? Gotta admit it’s a bit c/MildlyInfuriating tho…

  • Syrc@lemmy.world
    link
    fedilink
    English
    arrow-up
    4
    ·
    edit-2
    1 year ago

    My Avast doesn’t say anything when visiting those instances, although it blocks connections to derp.foo even when it’s just pictures browsing from lemmy.world. It says it’s being infected by “URL:Botnet”.

      • Syrc@lemmy.world
        link
        fedilink
        English
        arrow-up
        1
        ·
        1 year ago

        Eh, it’s kinda annoying but it does its job. Plus I hate subscriptions and the best free option I’ve found (I don’t think they do one-time payment AVs anymore?) is Avast + Malwarebytes. What do you suggest?

        • dragnet@lemmy.fmhy.ml
          link
          fedilink
          English
          arrow-up
          5
          arrow-down
          1
          ·
          1 year ago

          Just uninstall all of it and let Windows take care of itself. You don’t need antivirus. Do avoid obviously suspicious files, and you should be fine.

          • Syrc@lemmy.world
            link
            fedilink
            English
            arrow-up
            2
            ·
            1 year ago

            That’s the thing, I’m really paranoid and I don’t trust my brain alone to judge what is an “obviously suspicious file”. I might be exaggerating, but better safe than sorry.

            • dragnet@lemmy.fmhy.ml
              link
              fedilink
              English
              arrow-up
              1
              ·
              1 year ago

              Sure, but Windows Defender is built in and doesn’t suck. I have even heard security professionals make the argument that anti viruses may increase attack surface as much or more than they defend you (not necessarily asserting that is the case).

              • Anony Moose@lemmy.ca
                link
                fedilink
                English
                arrow-up
                1
                ·
                1 year ago

                Windows Defender is great, and MS has been adding really advanced protection including machine learning heuristics, etc. that make it really competitive. It is not 100% foolproof though, there’s a lot of old and new viruses it will not detect.

                Check out some of the virus gauntlets this channel runs Windows Defender (and other AVs) through: https://youtu.be/1DG3y3q8_9M. Even the latest Defender will often fail to detect a lot of threats. Of course, this channel is running known bad infected executables, and the best line of defense is just not to run executables from unknown sources. It’s possible to just visit a malicious URL and get infected through JS though, so it gets a bit trickier.

                I’m not familiar with the argument that antivirus software will increase your attack surface. That sounds interesting, do you have any links I could read up on?

                • dragnet@lemmy.fmhy.ml
                  link
                  fedilink
                  English
                  arrow-up
                  1
                  ·
                  1 year ago

                  I wish I could give you links! I think I heard it on a security focused podcast? It has been quite some time since I tried to stay current on this sort of thing in more than a casual way.

  • trouser_mouse@lemmy.world
    link
    fedilink
    English
    arrow-up
    3
    ·
    1 year ago

    Here is a log when browsing Lemmy over the last week or so, as of 10th July.

    Believe the derp.foo and .today are both federated instances. Don’t know what the other rows are.

    • trouser_mouse@lemmy.world
      link
      fedilink
      English
      arrow-up
      2
      ·
      1 year ago

      When something like these pop up, what steps can someone take to determine whether they are false positive and actually safe or a valid alert?

      • Anony Moose@lemmy.ca
        link
        fedilink
        English
        arrow-up
        3
        ·
        1 year ago

        BitDefender is actually really bad about giving you useful information to go off. Ideally it should tell you exactly what malicious action or malware it’s detecting. If your AV does this, you can see if the particular type of detection makes sense.

        For example, if it’s an executable file with a clearly displayed malware name “Trojan.BadTimes.X” or something, that’s really bad news. Same for URLs. However, sometimes AVs will flag “malicious behaviour”, which gets trickier. They will often flag qBittorrent or other legit apps that are used to download pirated software, etc.

        What you can do is to submit the file or URL that was flagged to VirusTotal. This shows you a comprehensive list of whether any other antivirus software is also marking the file/URL as infected.

        Generally though, I’d play it safe. I’d get in touch with the page owner or google around to see if this is a known issue, and unless I can be completely sure it’s actually safe, I wouldn’t use it.

    • Syrc@lemmy.world
      link
      fedilink
      English
      arrow-up
      9
      arrow-down
      1
      ·
      edit-2
      1 year ago

      Well, those are federated communities so looking into whether the threat is real or not could be useful I guess.

    • Ulu-Mulu-no-die@lemmy.world
      link
      fedilink
      English
      arrow-up
      3
      arrow-down
      1
      ·
      1 year ago

      Lemmy.world is not an island, it’s part of the fediverse as every other instance is, this case is most probably a false alarm but it doesn’t hurt to investigate anyway.