One Blink and you're infected

I listened to a recent Security Now interview with one of the founders of eEye Security. Mark Maiffret mentioned the Blink Personal Security product, and that it was an all-in-one security solution for individual users. I decided to try it. What a fool I was.
I first tried to download the free "Blink Neighbourhood Watch" version, which requires you to run it without any other antivirus product installed, even though it doesn't have its own antivirus engine. I guess that's why it's free: anyone nutty enough to run Windows without an antivirus program is unlikely to be interested in protection against other unknown vulnerabilities. Blink won't install if you have NOD32 istalled.
I should have stopped there; I didn't. Instead, I paid real money for the Blink Personal Edition because I don't live in North America, where the product is free for the time being. But I was nervous about no antivirus protection on my machine.
I won't bore you with the hassles I had replacing the free serial number with the paid one, other than to say that it required a reinstall, and was a warning of further hassles to come.
I noticed that when using Blink my machine's performance was sluggish, but I foolishly decided that the "extra protection" I was getting was worth it. It isn't. I noticed that the ePower_DMC service was running at a consistent 15%-20% CPU utilisation, unless I turned off the "Application Protection" service. I also found that if I disabled checking on some large data file types, such as *.mdb, *.mdf and *.ldf (SQL data files) then my Access programming work was not too badly affected.
Then, last night I was infected with a Trojan. I admit I was a fool to download it in the first place, but I was used to NOD32 being able to warn me about dodgy web sites and dodgy files. I should have double-checked by using NOD32 on Penny's laptop, but she was asleep already.
Obviously the Norman antivirus engine is brain-dead compared to NOD32, and it let this one through. The image at the top of this article shows the results of a "Full Malware Scan": two false positives, one for BearShare, that has never been installed, and one for riched32.dll, which is a Microsoft file that I wasted considerable time checking.
Also, the support forum is a joke. Anyone can post anything without even registering, so today there was a spam posting about Cialis, FFS! There is no way you can track replies to the posts, or even do a search on previous posts. This is not a good way to treat a paying customer.
The software is klunky: you can look at the names of the Malware enties in quarantine, but you can't get any details about them, such as the file name, file size, version number, etc. You have to look through the logs. And you can't search the logs unless you export them to a text file and use notepad.
There is no right-click option to scan a directory or file for malware or viruses, you only have the option of a scan of the entire machine. You can't find out the date of your virus definitions, unless you find the relevant log entry. I found an entry telling me the virus definition date was 05/07/2007. Either that's two weeks old or it thinks the definitions are dated for July.
There is an "Application Firewall" that monitors activity of installed apps (unless its a trojan like mine) and pops up and asks all kinds of dumb questions. For the first few days this is quite disruptive, especially if you give the wrong answer and disable the clock, Hamachi, SQL Server or whatever. I guess this limits the appeal of the product to techies, but I doubt whether techies will put up with the rubbish I had to. I'm also fed up because when I reported the problem on their forum, the post got deleted.
Blink has been downloaded 13000 times since the Security Now podcast. I wonder whether the average experience has been good or bad. I hope for eEye's sake it is better than mine. Their slogan "Vulnerability is Over™" should read "Vulnerability is Over Here". They claim to be able to detect 90% of all malware. Condoms have a better success rate than that!
I have been spoilt by NOD32, which is lightning fast and super-accurate. In the last few years I have used it I have not been infected with any viruses or trojans, which has saved me a lot of hassle and time. Now NOD32 won't install because it picks up the infection, and the Symantec Security check thinks everything is fine, except for Remote Administrator, which it thinks is malware. The Trend Micro Housecall scan detected part of it, but picked up some false positives as well. I suspect it won't be able to remove it, which means I have to reinstall everything.

digg story | eEye forum post