Hi td47,
I have been meaning to respond to your last post for a few days. I can hear the intonation of your voice when I evaluate the composition of your post. I have to say that being reminded of the certificate errors made me spit out a few bees.
So a while back, my logs were overrun by a component from Symantec's AMSI (Anti-Malware Scan Interface) that used a credential that was not per Microsoft's schema. I looked at the strings in the code (symamsi.dll) and could see that there was a Microsoft cert, of at least the guts of one. Regardless, Win 10 would not load the dll. Certificate requirements are not news.
I watched the progression of code modules load prior to performing a scan, and M$ was true to their word. Symamsi.dll did not load. Now I'm not the smartest person in the world, and I know a little about software, and virii code (I played with many strains in a sandbox I built a few years ago). And I also know a little about the processes used to scan files on a HDD / SSD. My thinking is that not only are my logs plugged up, but if the dll file with the bad cert does not load, you could hypothesize that maybe the level of aggression, or sensitivity in applying heuristics will affect the results of my scan. It was only after no one in this community would even take a stab at answering my questions about AMSI, that in the several years I used the 360 model, the software found only one item, and it was a false positive. I coupled MWB with Norton because I trusted, and still do, MWB;s product. It found many items, while the bloated pig was taking inventory of every single byte on my root drive(s).
It really pissed me off. The gurus were nice, but you can tell when there is obfuscation going on. After I was told to remove and reinstall three times to solve the cert problem ( which I knew would not work, but hey ! Who am I?) and then found that all my firewall settings were gone, that was the beginning of the end.
I had to laugh when I read the end of your post. You could not be more right ! If you had a choice of doing one thing really, I mean really well, and doing ten things that suck badly, what would you do?
".... and NOT add in all sorts of "other" differentiators that I JUST DON'T WANT OR NEED!" - I love this statement. To me, it says much about you not just as a customer, but as an intelligent, critically thinking individual who is caught in the swift and unrelenting rip currents of stupidity. Sometimes you have to say what needs to be said.
My conclusion is that it is about money and marketing. You have to keep up with the piezo beepers and LED's that other vendors are loading into the the little box. When Symantec shoved a VPN into the mix, that validated my thoughts. They will not spend the few dollars for a root or trust cert, or the time to integrate it into the AMSI code, but they can put together a POS VPN and and bump up the margins. So when the talk of the town is about how Symantec is really taking the lead in protecting its customers from evil blackhats, the people who really know can see that its a case of the emperor's new clothes. I imagine they had a sales and marketing blow out to introduce, which at the time, was a real piece of work, it probably still is. Code only gets fixed on a new release cycle, depending on risk. Who knows what is really different about a new revision of code. With memory, disk space, and fast uP's s filling in 90% of the gap in AV performance, they can ride that train right to the bank.
As much as I loathe M$, I am now using stock WinDefend only one a couple machines, and the other is coupled with MWB.
I tell you the truth, when you cancel your Symantec autopay, it will feel like a massive stone was taken off your back.
It's a good feeling, when self-respect has enough inertia to turn one away from something that isn't working - anymore.
In Peace.
<>
