1

My knowledge level about OSs and security is extremely low. Is anyone willing to tell me whether it's risky for me to use an application that requires me to run it with admin permissions and to put it on my AV exception list in order to properly save files?

For background, this is a machine embroidery design package called Embird, out of Czech Republic. When my files weren't saving, support told me to run as admin and put all its EXE and DLL files in my AV exception list.

Other similar applications I have used do not require admin permissions to save files.

When I asked why admin permissions are required, I triggered a kind of fight-or-flight, abusive, kiss-off response but no actual answer (ending in "use your antivirus software to do embroidery").

I've sunk 2 years and more than $1000 in this software and I don't want to switch, with all the time costs of training on a new interface as well as the financial cost of acquiring a new application, if it's not necessary.

Thanks.

  • It sounds like support gave you a canned response that's 'known to work' but doesn't even care about customer security. Unless you've got some seriously fascist AV software or were getting notifications from it about access denials, you probably don't need to whitelist any of the application there. – Austin Hemmelgarn Dec 7 '18 at 20:04
2

It sounds like poorly designed software.

It likely needs admin permissions because it is designed to save in unexpected places. The risk here is that the software has admin permissions to do anything. If an update to this program adds nasty surprises, then it has access to everything. This is not unusual, though. There are a lot of programs that require admin permissions.

Whitelisting the EXE and DLLs in your AV is just weird. I would try to give it admin permissions to see if that solves your problem before whitelisting the program. The problem here is that if a virus gets in and infects those files, then your AV has been told to ignore them. You are unprotected even if you gave the program admin permissions. Frankly, if whitelisting in AV solved the problem, I'd be leaning towards trying different AVs than whitelisting.

With admin access and AV whitelisting, the program can do anything without any controls to limit its damage. BUT you can design your system to be ok with this, too. If your computer only runs this program, is not connected to the Internet, and you backup your design files on a separate disk (which you do not leave plugged in all the time), then if something goes wrong, your risks are contained. Not ideal, but a much lower risk.

1

The risk is that the application could be compromised by some sort of malware to wreck havoc on your computer.

The real reason that they do this is probably that they have really shitty anti-piracy measures which they don't want to (or can't) update to operate in a sensible fashion on modern systems.

Your choices are pretty limited here. You've got a serious investment in their software (both in money and time), but not enough leverage to be able to force them to fix anything. And if I understand correctly, there's not that many choices in this market anyway.

What I recommend, if you can make it work, is to get a separate computer to run this software on. Let it have whatever it wants on that machine, but don't plug that machine into any network if you can manage it. Get everything on and off that machine via USB drive, which you scan with AV software every time you plug it into your real machine. And keep all the files backed up on your main machine. This minimizes the risks by keeping the machine you don't trust away from things that could harm it.

I don't know if that's an acceptable workflow for you, and I do know that it involves an extra outlay for the extra machine. But it's one fairly sure way to let the software have the run of the machine, but keep the (potentially compromised) machine away from the rest of your stuff.

If you can't do a separate machine, then your only choice is to let Embird have run of your machine (though see schroeder's answer for some things to try short of full access). If you're going to do that, you need to be VERY careful to have FULL and FREQUENT backups, so that if Embird DOES cause problems, you can wipe and reload without losing anything. I'm no expert on backups, but you might want to spring for one of the on-line services that keep the data off-site, to minimize the possibility of a virus wiping your local backups.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.