×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Anti-Virus Effectiveness Down from Last Year

Soulskill posted more than 6 years ago | from the getting-worse-at-getting-better dept.

Security 201

juct sends us Heise Security's summary of an article detailing the abilities of 17 current anti-virus solutions. German computer magazine c't has found that, compared to last year, the virus scanners are having a more difficult time recognizing malware. Quoting Heise: "For real protection, however, in view of the flood of new malware, the way these programs cope with new and completely unfamiliar attacks is more important. And that's where almost all of the products performed significantly worse than just a year ago. The typical recognition rates of their heuristics fell from approximately 40-50 per cent in the last test - at the beginning of 2007 - to a pitiful 20-30 per cent."

cancel ×
This is a preview of your comment

No Comment Title Entered

Anonymous Coward 1 minute ago

No Comment Entered

201 comments

yeah, but.. (2, Insightful)

xubu_caapn (1086401) | more than 6 years ago | (#21776602)

do they run on Linux?

Re:yeah, but.. (5, Informative)

_merlin (160982) | more than 6 years ago | (#21776668)

Considering how few viruses run on Linux, it's not as big a deal for Linux users. However, Linux machines that deliver content to Windows users (mail servers, usenet servers, bulletin boards, etc.) are a useful application for Linux virus scanners that detect viruses for other platforms. And the big names do function in this role: Kaspersky and AVG both have products for doing just this. And there's the free ClamAV as well, of course. The Linux versions of the big name products are probably no more or less effective than the Windows versions.

Re:yeah, but.. (4, Interesting)

allcar (1111567) | more than 6 years ago | (#21776968)

You make an excellent point.
Pro Linux, as I am, I still do not feel that we can afford to be complacent about the malware issue. The reason that Linux is largely unaffected is that it is not very widely used, especially by the sort of numpties that get tempted by exciting new screensavers baring trojans.
If/when we succeed in bringing Linux to the masses, this layer of protection will be torn away. I hope and believe that Linux is more secure by design and the same is probably true of many of the apps that are popular in Linux distros - you won't find ActiveX cheerfully opeing the door to anyone. However nobody should be ignoring malware with the excuse that Linux is immune.

where are all the Linux server exploits .. (3, Insightful)

rs232 (849320) | more than 6 years ago | (#21777104)

"The reason that Linux is largely unaffected is that it is not very widely used .. If/when we succeed in bringing Linux to the masses, this layer of protection will be torn away"

If that were true, where are all the Linux server exploits being actively being used it the wild. A Linux desktop logged in as standard user is safe from the numpties and is still usable. The dangers of screensavers wouldn't even apply here; even if a user managed to run some malware script it would most probably be confined to the users home dir, the core system would remain immune.

Re:yeah, but.. (Score:5, Interesting)

Re:where are all the Linux server exploits .. (2, Informative)

keesh (202812) | more than 6 years ago | (#21777164)

Normal users on a Unix system have more than enough privileges to send out a million emails a day.

Re:where are all the Linux server exploits .. (1)

cheater512 (783349) | more than 6 years ago | (#21777494)

Granted but its significantly easier to clean such infections (they cannot hide as easily), it only affects that one user on a multi user system and it cannot infect the core system.
If the user doesnt log in, then the malware cannot run.

Re:where are all the Linux server exploits .. (3, Insightful)

jimicus (737525) | more than 6 years ago | (#21777194)

Oh, there's plenty of Linux server exploits. Most depend on specific applications (eg. bind, sendmail), misconfigurations or both.

The other thing you have to look out for is web applications - which of course tend to be exploitable regardless of what OS is running the website. These are notorious for providing holes. If you're lucky, all that happens is your website is replaced with a single page which says "pwn3d! l053rz!".

If you're unlucky, you get to announce to the world that you've lost the credit card details of 20,000 people.

(This, by the way, is not drastically different from the current state of security in Windows Server. A careless administrator is probably the biggest security hole known to IT).

Re:where are all the Linux server exploits .. (-1, Flamebait)

Anonymous Coward | more than 6 years ago | (#21777352)

Hahahaha... Thank you for giving such an honest response. Being a linux zealot - yes, I am, hate you M$ fags - I know for a fact it doesn't matter what you run, the real issue with security is the PEOPLE USING THE FUCKING SYSTEMS. Wake up world. You are the problem. Not the computer.

Install linux, I dare you, oh noes, you gotzor a virii.

If your computer was a game you would have in big red letters... PWNT!

Enjoy.

Re:where are all the Linux server exploits .. (4, Informative)

FireFury03 (653718) | more than 6 years ago | (#21777378)

If that were true, where are all the Linux server exploits being actively being used it the wild.

Linux server exploits _are_ being actively used in the wild. If you don't keep your server patched up then you stand a pretty good chance of being rootkitted. However, Linux distros tend to be pretty hot on security updates, meaning that a fully up to date system has very few known security holes. I suspect there are also more "idiot" server admins in charge of Windows servers than Linux servers (that is not to say that Windows admins are idiots, I just suspect there is a higher proportion of clued up admins in the Linux world).

However, the server world is very different from the desktop world - in the server world you can be relatively trustful that the admin won't go and install some random shiny new screensaver, etc. whereas on the desktop most people are not (and do not have access to) qualified admins.

A Linux desktop logged in as standard user is safe from the numpties and is still usable. The dangers of screensavers wouldn't even apply here; even if a user managed to run some malware script it would most probably be confined to the users home dir, the core system would remain immune.

There are a couple of important points here though:

1. Your average home user does _not_ have a dedicated sysadmin. When they want to install a package they (generally) need to become root to do it - that means that the numpties are equally capable of installing screensavers^Wmalware under Linux as they are under Windows. The thing the privilege separation gets you is that you can't _accidentally_ install something as root (e.g. via an exploit in your browser / mail client / whatever).

2. Even without root, a user still usually has plenty of permissions to do some evil things. They can't do some particularly bad things like SYN floods but they can still send out millions of emails and compromise other hosts.

3. Is the protection of the "core system" actually that important when you have a single user machine and so all the important data is owned by that user? The only thing this really gets you is the knowledge that your system binaries are probably safe (so you can trust that ps, netstat, etc are giving you accurate results rather than hiding the malware that is running).

There may be some merit in mounting all the filesystems the normal user can write to as "noexec" so that malware can't just install itself and run as the normal user. But this may place too much of a limit on usability and most distros certainly don't do this by default today.

Re:where are all the Linux server exploits .. (-1, Troll)

digitig (1056110) | more than 6 years ago | (#21777514)

A Linux desktop logged in as standard user is safe from the numpties and is still usable.
Maybe, but if Linux is adopted by the masses then the masses will run as root because it's easier.

Re:where are all the Linux server exploits .. (1)

JGJones (912150) | more than 6 years ago | (#21777556)

the core system would remain immune - true...but for a typical home user - the core system is the least of their worries - they care more about their own files - photo collection etc etc. If there's a script that basically nuke their /home - they're not gonna say "gee that's OK as long as my core system is fine..." Granted most viruses are after zombie PC's etc, in this respect I agree.

Re:where are all the Linux server exploits .. (2, Insightful)

Knuckles (8964) | more than 6 years ago | (#21777770)

Well, they should have backups. I mean really, it's the same as the hd dying or something.

The kind of targets (5, Insightful)

_merlin (160982) | more than 6 years ago | (#21777234)

I disagree. I think the reason there are fewer pieces of malware floating around for Linux is because of the kind of roles Linux machines typically serve in. Most Linux machines are servers or enterprise workstations. In the case of a server, there will be a system administrator who is responsible for configuring the server, locking it down, and keeping it up. Chances are, they'll notice malware pretty quickly, and do something about it. Enterprise workstations aren't an attractive target, either: they're usually either a shared machine that's locked down hard, and under the eye of a sysadmin, or they're the pet of a tech-savvy user who wants his box in top condition so s/he can get stuff done.

Malware is all about money these days, whether it's herding bots so you can sell spamming services, or getting paid to DDoS someone's competitor, sniffing credit card numbers to buy stuff, or sniffing personal details for identity theft. Remember that your attack isn't 100% reliable, so you want as many potential targets as possible, and you want to attack weak targets so as to get the highest possible success rate. All so you can make as much money as possible, of course.

And what's the best target? Home Windows PCs, of course. No vigilant sysadmin monitoring the system; average Joe user doesn't grasp the concept of locking his box down, let alone have the m4d skillz to do it; Joe doesn't install patches regularly because he sees the downloads and restarts as nothing more than an annoyance; Joe doesn't really understand his computer, so he doesn't know how to look for the telltale signs of malware; Joe doesn't understand that he has to keep his virus scanner's definitions up to date, and turned off the annoying prompts; Joe doesn't understand a firewall, so he just clicks "Allow" to get rid of the warning message; the list goes on forever...

Now that MacOSX is becoming more popular, we're seeing a bit of malware for it, too. Example, that thing that claimed to be a video codec, but was really a DNS redirector. Now this one is a very good example of how malware authors target uninformed users: in the standard OSX installer program, there is an option to show the files that will be installed; if you or I (as /. geeks) looked at the files that this "codec" was installing, we would see that it couldn't be a real codec at all, and we could cancel the install; but an uninformed user won't know to look at file listings, and won't know what looks right, and what doesn't. It wasn't a failing of the OS: it was a valid installer package that prompted for authorisation to run; it was all about users who don't know how to administer a system.

Until Linux is popular in the hands of inexperienced, non-tech-savvy home users (as opposed to enterprise), it won't be an attractive target for malware authors, and we won't see its security put to the test. When it does become popular, I expect we will see Linux malware, and I expect it will be like OSX malware, in that it relies on failings of the user, rather than the system itself.

For the record, I use OSX and Solaris at home, and develop for whatever I'm paid to develop for at work (which was, until recently, Windows, Linux, Solaris and OSX - looks like it will be just Solaris soon).

Re:The kind of targets (1)

arminw (717974) | more than 6 years ago | (#21777360)

..... in that it relies on failings of the user, rather than the system itself..........

Most users, will give the password if prompted. We mitigate these user failings here by not letting them know the administrator password. Then if they want to install something that asks for this, they are stuck. This works poorly for Windows because there are still many legit programs that will not work unless the user has admin rights over the whole system.

Mac users have no real reason to know the system password for everyday use. Of course malware can still run in user space and possibly get around such protections. It does make it a lot harder for the virus writers if they cannot simply social engineer their way into the heart of the OS. Most of the malware authors assume that they can trick users into installing anything at all on the system.

This is a bit more work for us, if users do have install something that requires the admin password, but cleaning crap software out of computers is even more work.

Re:The kind of targets (0, Redundant)

heinousjay (683506) | more than 6 years ago | (#21777512)

Mac users have no real reason to know the system password for everyday use

Sure they do, they generally have to administer their own box.

There could be a few bucks in doing a remote admin service for home users who have neither the skills nor the inclination to use them. I'd google to see if someone does that already, but I'm feeling lazy.

Re:The kind of targets (3, Informative)

gzipped_tar (1151931) | more than 6 years ago | (#21777826)

Surely the weakest part is between the chair and the keybord.

A search on secunia [secunia.com] tells a story of an old Linux virus (or rather, a piece of malware). The virus comes from a phishing mail in C sourcecode. Unless the luser has root privilege and is nuts, nothing could happen at all.

Consider one day M$ is dead and every luser in the corner of the world runs a Linux desktop. Then the luser happily su and make install, without even a single glance at the sourcecode.

Re:yeah, but.. (1)

ccs.gott (1144593) | more than 6 years ago | (#21777416)

You make an excellent point.
Pro Linux, as I am, I still do not feel that we can afford to be complacent about the malware issue. The reason that Linux is largely unaffected is that it is not very widely used, especially by the sort of numpties that get tempted by exciting new screensavers baring trojans.
If/when we succeed in bringing Linux to the masses, this layer of protection will be torn away. I hope and believe that Linux is more secure by design and the same is probably true of many of the apps that are popular in Linux distros - you won't find ActiveX cheerfully opeing the door to anyone. However nobody should be ignoring malware with the excuse that Linux is immune.

The reason linux is largely unaffected is because it was designed better than its unworking counterpart. Weather or not it is installed on more machines matters not, as the default user does not have administrator privileges (root) while M$ does.

Re:yeah, but.. (1)

stirz (839003) | more than 6 years ago | (#21776970)

If you run many windows-applications under linux via wine, the (windows-)virus threat surely matters. As you usually don't launch wine as root, $malware will only have limited system access, but write access for a wine-run virus on /home/$user can a real pain in the ass :-) [ubuntuforums.org]

Re:yeah, but.. (1)

FudRucker (866063) | more than 6 years ago | (#21777126)

i agree, windows is such as vulnerable & fragile mess i refuse to use it anymore, continuing to use windows knowing this is about like refusing to get off the railroad tracks knowing a freight train is coming to run you over...

smitFraud (4, Interesting)

Freaky Spook (811861) | more than 6 years ago | (#21776618)


I've had a lot of people bring me infected PC's with smitFraud, that the big AV's have not even recognised or been able to properly remove, they have been pretty angry that the $90 or so they paid for a complete Internet Security product was not able to protect them.

It causes windows to pretty much choak and die as it just consumes so many resources and provides so much irritation, but major products like Trend or Symantec have not been able to successfully protect or remove them, I have had to use custom written tools that you get off the net for free. They really dropped the ball with that one.

Re:smitFraud (1)

yoyhed (651244) | more than 6 years ago | (#21776820)

I know - you'd think they'd have figured it out by now since it's so easy for someone like you or me to identify it with a cursory look at the machine - although SmitFraudFix in safe mode works fine, you're right about the angry customer thing.

Re:smitFraud (1)

lukesky321 (1092369) | more than 6 years ago | (#21776884)

Funny you mention this. I was fixing some guys computer today and it was infected with smitFraud. Holy cow, I looked at how much memory was being used used and only 10 mb of ram was free. I ended up booting into safe-mode and removing it with smitFraud which dare I say works miracles. He had McAffe which didn't do shit.

Re:smitFraud (3, Interesting)

Barny (103770) | more than 6 years ago | (#21776938)

Been getting this one a lot, the fix is usually fine for older varients but new versions and revisions spring up that it just seems to miss. The system seems clean at first, but usually about a month later it is all back.

I usually tell customers this, and tell them they have two choices:
1 we can try smittfraud fix and who knows, it might be lucky, but if they have to bring it back in a month we will charge them again.
2 we can backup all their data, format, reinstall and remove any executable files from their backup.

The second always works, have never had a re-infection (well, have, but that is usually thanks to someone surfing porn regularly, proven to the customer by showing them the browse history) with it.

Best protection for it, firefox + no-script, which I tell the customer and offer to install for no extra cost of course :)

Only problem is, my boss kinda hates me, we don't get the same people bringing their machines in every 2 months anymore needing a software clean done :P

I don't have to worry about viruses on the web (-1, Redundant)

Scoldog (875927) | more than 6 years ago | (#21776620)

I simply use a Morse code key hard wired into a dial up modem and tap binary into it.
 
Still get RSI though.

Re:I don't have to worry about viruses on the web (2, Funny)

Valdrax (32670) | more than 6 years ago | (#21776932)

Still get RSI though.

That's 'cause you got arrogant and didn't properly firewall your hand before connecting it to the net.

after the ffact (3, Insightful)

wizardforce (1005805) | more than 6 years ago | (#21776648)

I think the real problem with malware is that by the time an antivirus/antispyware program is needed IT IS TOO LATE. you have already been infected, antivirus software is for after the fact, cleaning up the files that were installed or warning you of their presence in a file atatchment etc.. The real defense here is preventing this from happening in the first place. That is, educating users not to click haphazerdly at anything that they feel like and that is a heck of a challenge. most users do not understand what can happen and many likely do not really care, they just want their new screensaver or whatever to work [bundled with spyware of course] and when their bad habits finally catch up with them when their computer slows to a virtual crawl, they go out and buy a new one thinking computers decay over time or something.

Re:after the ffact (1)

arotenbe (1203922) | more than 6 years ago | (#21776728)

The problem is that computers DO decay over time, or at least Windows systems do. Unless you reinstall Windows frequently (which, of course, the uneducated masses never do), most systems will grind to a halt in a few years from the accumulation of registry keys and can't-uninstall software, not to mention the 2-4 simultaneous "security" programs typical computers have installed. Viruses and spyware only help to put these computers out of their misery.

Re:after the ffact (1)

wizardforce (1005805) | more than 6 years ago | (#21776766)

most systems will grind to a halt in a few years from the accumulation of registry keys and can't-uninstall software
yes, eventually thi is true but malware does a fine job of speeding up the process by a good 10 fold or more. winboxes will work for a pretty long time if they are not constantly installing and uninstalling software- the old compaq still has win95 on it and works fine- it just wasn't constantly burdened by a bunch of garbage accumulating over time. if a winbox like that is taken care of it can last well over a decade quite nicely. if it isn't well... there's always upgrading to one of the penguins :)

Re:after the ffact (1)

Tim C (15259) | more than 6 years ago | (#21777116)

Oh rubbish. In more than a decade of Windows PC ownership and use I've not had a single machine grind to a halt in this manner. The machine I'm typing this on now I've had for 3+ years without ever reinstalling it.

I'm not saying that it can't happen, but it most definitely is not inevitable.

Re:after the ffact (1)

Ajehals (947354) | more than 6 years ago | (#21777204)

You are right, a well managed Windows environment can be perfectly stable for long periods (assuming you carry out the usual maintenance tasks as required). The problem is that well managed generally means that you are not installing little bits of software whenever the need strikes you, you don't grab a copy of Windows Weekly with £500 worth of free ware, trial ware and demo's every other week and install them all and then remove most of them again. Most people (tm) do, and as such most windows installs degrade over time, and therefore for most people it *is* inevitable, but a consequence of usage not the OS itself*.

*Saying that I don't think I have ever seen a Linux box suffer in this way even after it has had X thousands of applications installed and removed, I have no clue about how OSX or Apple OS's fare but I havent heard any complaints...

Re:after the ffact (1)

Opportunist (166417) | more than 6 years ago | (#21777560)

Well, it doesn't have to be that way. One could argue that if you install software bundled with questionable drivers (aka "copy protection mechanisms"), with strange install and uninstall routines (staple with certain "freeware", that would be more correctly be labeled adware) or from questionable sources, you're prone to ending up with software that doesn't cooperate properly with your OS.

I don't even want to give MS the blame here. When you load your machine with drivers that hog more system resources than they should (and Securom for example is very well known for doing just that, especially when you happen to have a few different versions on your system), your system will degenerate.

Re:after the ffact (1)

RAMMS+EIN (578166) | more than 6 years ago | (#21777068)

``The real defense here is preventing this from happening in the first place.''

Yes.

``That is, educating users not to click haphazerdly at anything that they feel like''

No [ranum.com] .

Because, as you yourself point out,

``and that is a heck of a challenge. most users do not understand what can happen and many likely do not really care'' ...and they shouldn't have to. You open these attachments (etc.) because you think they will do something good. You don't expect them to mess up your computer. Without support from the operating system and other legit software on the computer, attachments _couldn't_ mess up your computer. The only reason they can is that the software people use to open them is insecure. It allows (through design, sloppiness, or bugs) arbitrary code execution where all it _should_ allow is viewing images and perhaps movies and sound. Proper sandboxing and safe code (which is easy to write in all but a handful of commonly used programming languages) will solve this problem.

As an example of the above, I am working on a programming language, and one thing this programming language will feature is different subsets for different niches. One such subset will allow any program to be written, so long as it doesn't change the state of anything outside the program that was not passed into it as a modifiable data structure. That means no interaction with any files on your system, no popup windows, no phoning home, no sending spam, etc. If you give it a file to read and an area of the screen to draw on, these are the only things it will be able to do.

Re:after the ffact (1)

kvezach (1199717) | more than 6 years ago | (#21777278)

As an example of the above, I am working on a programming language, and one thing this programming language will feature is different subsets for different niches. One such subset will allow any program to be written, so long as it doesn't change the state of anything outside the program that was not passed into it as a modifiable data structure.

That sounds a lot like capabilities [wikipedia.org] , which is a very good idea. It's just too bad none of the larger OSes support them by default, which means we're stuck with having to add compartmentalization explicitly.

Re:after the ffact (1)

Opportunist (166417) | more than 6 years ago | (#21777592)

But that would have to be a feature of the OS, not the program. That your program "behaves" is nice, but that doesn't keep another program (i.e. malware) from being not nice.

Now, if the OS takes good care of security, a lot of things that can actually be a security risk or a feature won't be possible anymore. Certain tools require you to be able to tap into another processes memory or network traffic to be useful. Also, plugins and the like (the dreaded BHO security hole in IE, which is actually meant as a feature, and can be used as such) won't be possible.

That's a problem that won't go away. More security also means more limitation. For you, and for the programs you want to use. Now, of course one COULD implement decent security, but that would first of all require the OS to let you work and play with an account that doesn't need administrator privileges to work at all...

Re:after the ffact (0)

Anonymous Coward | more than 6 years ago | (#21777594)

As an example of the above, I am working on a programming language, and one thing this programming language will feature is different subsets for different niches. One such subset will allow any program to be written, so long as it doesn't change the state of anything outside the program that was not passed into it as a modifiable data structure. That means no interaction with any files on your system, no popup windows, no phoning home, no sending spam, etc. If you give it a file to read and an area of the screen to draw on, these are the only things it will be able to do.

Wait, you're working on Java and their applet security sandbox system? Wow, blast from the past. You think I could borrow your time machine for a while? I wouldn't mind visiting, say, 1920s New York. Or does it even let you go back to the past? Maybe all it can do is instantaneously transport you forward in time 17 years?

Re:after the ffact (2, Interesting)

Suddenly_Dead (656421) | more than 6 years ago | (#21777128)

I think the real problem with malware is that by the time an antivirus/antispyware program is needed IT IS TOO LATE. you have already been infected, antivirus software is for after the fact, cleaning up the files that were installed or warning you of their presence in a file atatchment etc


There's this not-too-recent development in Antivirus programs where they actually scan executables before and as you execute them, preventing the infection.

Of course it's not perfect, but it's probably the reason most people have virus scanners. Once a system is infected it's useless to most users who will simply bring it into a shop or trash it because "it's too slow", and even many experienced users would simply give up a reinstall Windows at that point.

Re:after the ffact (1)

Opportunist (166417) | more than 6 years ago | (#21777604)

Not-too-recent is good. That feature is a few decades old.

The problem is that you have to know a virus to detect it. Welcome to the arms race! That's why heuristics have been the way to go for a while now, because that way you can at least flag something as suspicious if you don't know it. But ... well, the drugs don't work anymore.

Re:after the ffact (1)

Tony Hoyle (11698) | more than 6 years ago | (#21777858)

The problem with that is badly implemented versions (*cough* Norton *cough*) that scan everything..executable or not, and slow the machine down so much that the cure is worse than the disease - I've had machine to sort out that have been using 80% of their cycles just scanning text files over and over again.

My expectations are not that high... (4, Informative)

RuBLed (995686) | more than 6 years ago | (#21776658)

I always assume an antivirus is only as good as its current signatures. Heuristics are good but nowadays, I could literally count with my fingers the number of times it did the job. The best defense is still knowing what you are running with or without an antivirus. Most of the annoyances I see are done by the local script / virus kiddies, their work rarely make it outside the country so the signatures against those are not a priority. (Although what I hate is that most of this local scripts/virii are just copycats of popular ones, yet popular AV's rarely detects them...)

Re:My expectations are not that high... (2, Interesting)

Opportunist (166417) | more than 6 years ago | (#21777666)

That's maybe the most insightful I've read in this thread so far.

I work for an AV company. Our focus lies on "local threats". Not necessarily the local scriptkiddy community, more the phishing and ID fraud thing.

For about a year now, those things have been "localized". I'm not joking when I say that, depending on the country you're in, you get different versions of a certain trojan, targeting exactly YOUR banks, YOUR finance services, YOUR online stores. They actually go to the lengths of recreating the local bank pages down to the links. And then this malware is spread very, very well targeted on your country or state, or even only your county. They noticed that AV vendors do actually work together and something that spreads globally is easily detected within a second, not an hour later every AV vendor has a signature update that finds it.

With a very narrowly targeted release, you can stay "under the radar" and go undetected by most AV vendors who don't have any information gathering tools in that local area.

In short, don't buy the "best" AV tool. If there is one local company, buy theirs! They have the highest chance to find the local threats fastest, while still getting the global threats. Local threats, though, are the (IMO) more serious ones, not only making you a spam box or trashing your system, but they steal your ID, loot your account and destroy your credit rating!

Now, in turn I also get a fair deal of machines on my desk that have been affected by those ID problems (take a wild guess who's interested in finding out what's cooking). Most of those machines were not protected at all (or by Windows Defender, which is no protection. No MS bashing, but it can't be when you think about it), some were protected by global players in the AV field (most of them by a certain company with a capital N in their name), but none by local companies that DID actually find the threat.

You can test it yourself. Should you happen to get one of those targeted malware, send it to virustotal and look for yourself. Local companies will find it. Larger companies will find it much later, or not at all, because the spread is so tiny (thus the perceived threat so small) that it doesn't matter to them.

AV's??? (1, Redundant)

flakron (1146337) | more than 6 years ago | (#21776660)

when you have an AV you have viruses, no AV no viruses

hmm.... (-1, Troll)

Anonymous Coward | more than 6 years ago | (#21776672)

"The beta version of Windows Live OneCare 1.5 was released in early October 2006 by Microsoft. Version 1.5 was released to manufacturing on January 3, 2007 and was made available to the public on January 30, 2007." - wikipedia.org

Who says correlation doesn't necessarily indicate causation?

A matter of principle (0)

Anonymous Coward | more than 6 years ago | (#21776708)

It's almost as if systems require genuine integrated security, rather than an anti-virus afterthought. Perish the thought.

running multiple antiviruses (4, Insightful)

improfane (855034) | more than 6 years ago | (#21776732)

No one company has the resources to be aware of every virus. The standard advice is to run more than one.

In Windows, if you wanna run more than one, you can only have the real time protection of a single anti-virus enabled or you get conflicts.

Meaning you rely on the on-demand protection of every other anti-virus and have to manually run them regularly OR set up schedules. What kind of user will do that?

Re:running multiple antiviruses (1)

allcar (1111567) | more than 6 years ago | (#21776920)

Even if you could run more than one in real time, on normal hardware, it would be insane. I am forced to use McAfee at work and the delay in opening even moderate sized files is really noticable. For large files, it's really intrusive. When a I make a large EAR file for deploying to an application server, it can take several minutes. Much of that delay is due to the AV. Performing a similar operation at home on comparable hardware running Linux without AV if much faster. If two virus checkers insisted on inspecting every file I accessed it would absolutely become necessary to upgrade the hardware. It's a sad fact that the hardware industry is being driven by bloatware and anti malware.

Re:running multiple antiviruses (2, Funny)

MrMr (219533) | more than 6 years ago | (#21777132)

It's a sad fact that the hardware industry is being driven by bloatware and anti malware
You should look on the bright side: Since everybody has to buy high-end hardware, it also becomes much cheaper for people who need it for more interesting stuff.
(I would for instance very much like to see the next main-stream OS requiring 16 cores or more to run a simple email client on a desktop machine...)
 

Re:running multiple antiviruses (1)

martin-boundary (547041) | more than 6 years ago | (#21777210)

Nice theory. In practice though, you'll be using 15 cores just to draw fancy menus and bouncing icons. The 16th one will be shared between your app and the system sound effects manager.

User friendlyness is the worst idea since the mouse.

Re:running multiple antiviruses (1)

MrMr (219533) | more than 6 years ago | (#21777280)

You miss my point: I wouldn't run a gui on such a 16-core desktop box.

Re:running multiple antiviruses (1)

martin-boundary (547041) | more than 6 years ago | (#21777696)

You'd have to run a custom stripped down OS with only the processes you're sure you want running. That would rock. Of course, it could be _always_ cheaper to run a Beowulf cluster, eg when 16 processor desktop systems are standard, just get two 8 processor systems without the redundant monitors etc.

Re:running multiple antiviruses (1)

brunde (1206322) | more than 6 years ago | (#21777532)

A windows program I'm remarkably happy using is Eset's NOD32 (or even it's Security Suite). Very little in terms of resource footprint and very fast. It gets pretty decent writeups too. Best I've found so far (and I've used quite a few - and beta tested more....)

Re:running multiple antiviruses (1)

Tony Hoyle (11698) | more than 6 years ago | (#21777908)

The problem with nod32 is it interferes with the tcp/ip stack and stops lots of programs working.

What the hell it's doing even hooking into it is beyond me.. it's just feature creep.. it should be checking opened files only.

Re:running multiple antiviruses (1)

jonbryce (703250) | more than 6 years ago | (#21777558)

Not only that, but the two virus checkers would insist on scanning each other before letting the other scan the file, and probably before allowing each other to scan each other.

Standard advice? Ouch. (1)

Xest (935314) | more than 6 years ago | (#21777374)

That's some pretty poor advice to run multiple anti-virus apps. other than AV vendors who all want a piece of the pie where is this being suggested? Initially there's the fact many conflict in their tasks and implementation to the point where having multiple AV software will sometimes goes as far as giving you a nice BSOD each time you boot up until you can mangle one AV app out of your system using recovery console or safe mode (Some versions of Symantec and McAfee for example). Ignoring that however there's the most prominent problem of the ridiculous drain in system resources you'll suffer from having one, let alone 2 AV apps - even worse if you stick an anti-spyware app. in also! I've yet to see any enterprise network deploying multiple AV solutions to the same machines and the only place I could see this being advised is the likes of Futureshop, PC World or whatever big chain wants to make as much money as possible selling useless apps in your particular country.

The best way to protect yourself from viruses or spyware is to not get them in the first place. That requires educating users to avoid sites that appear dodgy, to not download anything that isn't from a reputable publisher and to not open attachments unless you're expecting them and trust the source fully.

Current AV systems are flawed, malware has evolved but AV software really hasn't. It's still following the paradigm of reactive action which is hopeless in today's world because by the time AV software has acted the malware has already had chance to embed itself and potentially even disable or remove the AV in question.

It's only going to get worse also, I'm not entirely sure why we haven't seen extremely vicious viruses yet but I'd like to think that it's because anyone competent enough to writing such a virus would be intelligent enough to put their efforts elsewhere for good use. Looking forwards for example with advances in AI we might encounter viruses that can mutate to use new security holes, viruses that work as P2P networks to distribute virus updates and hence become as difficult to shut down as the file sharing phenomenon and so on. The current AV market is both a sham and a scam, to suggest that much of the AV software out there really protects people is a lie, it doesn't. The times I've seen AV programs out there detect stuff it all too often can't clean it and so manual removal ends up being the only solution anyway.

Viruses need to be stopped at the borders, but the difficulty is simply the amount and type of borders (Internet - various services, floppy, USB, CD, etc.). We can of course follow the trusted computing route but that's not ideal either because companies don't trust us to use our computers so we lose a massive amount of freedom which to many of us makes computing great. There's no easy solution to the problem but the current option offered by AV vendors isn't even a viable start to the solution now, let alone in the future, it's like trying to save a decapitated person by sticking bandage on their neck when the only way to save them was to prevent such an accident in the first place. Sticking multiple bandages on that neck still isn't going to save that person!

Just dont do it... (4, Interesting)

Dishevel (1105119) | more than 6 years ago | (#21776762)

Just don't have AV's installed at all. Not having AV installed on my system keeps me from even thinking of trying anything stupid. every month or so I download a free trial of a Non Norton / Non Mcaffee AV program, update it and run a full scan. Then I do the same with a different one. Then I repeat with Spyware/malware programs. All that has ever been found is a few cookies. Safety through not doing stupid shit.

Re:Just dont do it... (1)

jimicus (737525) | more than 6 years ago | (#21777146)

That might work for the average /.'er on a single PC on its own.

It doesn't work in an office full of people, and it doesn't work with the average /.'ers grandma.

Re:Just dont do it... (1)

Tony Hoyle (11698) | more than 6 years ago | (#21777920)

In an office full of people they won't have admin rights and the system policies would have locked down any ability to install anything.. so AV isn't an issue there either. All it'll do is slow them down and cause random BSODs, program failures etc.

Re:Just dont do it... (0)

Anonymous Coward | more than 6 years ago | (#21777526)

Too much like rock climbing with no safety line.

What happens when you want to examine that xxx.jpg.vbs file on your friend's ipod, but accidentally run it instead of opening it..? You're screwed and have to reinstall, while any decent antivirus package would have kept it from running.

Common sense is the first, best, line of defense, but putting all your eggs in one basket isn't such a great idea.

Re:Just dont do it... (1)

Opportunist (166417) | more than 6 years ago | (#21777692)

Now, of course I have an ulterior motiv for saying that, but I wouldn't want to see what happens when the general population follows that advice (not only because it would most likely mean I have to find me a job where I actually have to work for my money).

You might not need an AV tool. You don't click every stupid button, open every attachment labeled "important info from your bank" or "last reminder", but you'd be amazed how many do.

The glass is half-empty? (1, Interesting)

Anonymous Coward | more than 6 years ago | (#21776764)

An optimist would say that virus effectiveness has gone up.

Re:The glass is half-empty? (1)

Opportunist (166417) | more than 6 years ago | (#21777706)

An Opportunist would say that heuristics are overrated and that he told you all so for years, and that he decided years ago already to move away from a dated way of detecting malware.

Mostly because the heuristics in his tool really sucked to begin with. :)

User awareness is key (1, Interesting)

Anonymous Coward | more than 6 years ago | (#21776802)

The main reason for virus infections, as far as I can see, is because of people simply executing untrusted programs: downloading rubbish toolbars, screen savers and opening e-mail attachments which say "Pam Anderson Naked.exe". I think more "sophisticated" means of infection, such as buffer-overflows or browser bugs are relatively less prevalent than the simple act of directly executing a trojan program and infecting yourself (not that I have statistics to back me up).

Personally, I don't use an anti-virus product (at least, I don't have one running continously, bogging the system down). My protection mechanism is to simply not run programs I don't trust and also have the latest updates installed. In the rare event that I do need to run an untrusted executable, I run a manual scan on it.

After giving up the temptation to run these rubbish programs, I haven't been infected by a virus in years.

Re:User awareness is key (1)

stonedcat (80201) | more than 6 years ago | (#21776862)

The sad thing is that you can find Pamela Anderson naked with a simple google search. Those poor poor ***dows using fools.

Virus? (1)

hax0r_this (1073148) | more than 6 years ago | (#21776896)

Are viruses really still a big deal? My impression for the last few years has been that even windows has gotten to the point where you basically have to grant a virus permission at some point along the line. I haven't used an anti virus in years and to my knowledge my windows installations are all clean (I do check them periodically with that Trend Micro online scanner dealie).

Re:Virus? (3, Informative)

Barny (103770) | more than 6 years ago | (#21776960)

Yeah, now that world + dog uses a NAT router for their broadband and the lack of kazaa, virus' and worms are a dieing breed. We swapped them for intrusive spyware and identity theft-ware that is much harder to get rid of and, thanks to the wonders of social engineering, much harder to stop joe-sixpack from getting :/

Re:Virus? (1)

ConceptJunkie (24823) | more than 6 years ago | (#21777304)

If you're using Vista, that's probably true, but after the first thousand times, giving a program permission to run becomes a reflex and no one will pay attention to it any more, and the one thing Microsoft actually seems to have accomplished with Vista, improved security, becomes moot. Thanks, Microsoft, you managed to invest about as much time and energy into Vista as the entire Apollo program and have nothing to show for it.

Re:Virus? (1)

jonbryce (703250) | more than 6 years ago | (#21777578)

Yes, but given that you need to give the computer permission to delete a desktop icon (if it is in the "all users" folder), most users will just grant permission whenever it is requested.

Simple Reason (-1, Troll)

LaskoVortex (1153471) | more than 6 years ago | (#21776926)

This is no doubt because of the rise of Macs and Linux. If people stuck to a good operating system, then we wouldn't have viruses. I mean, look at the numbers. The correlation is undeniable.

Consider Application and Device White-listing (1, Insightful)

Anonymous Coward | more than 6 years ago | (#21776980)

Increasingly I'm recommending Application White-listing [wikipedia.org] as a way to lift oneself out of the never-ending struggle against viruses and malware. Now there are several companies offering solutions to the problem (personal favorite is Trinamo [trinamo-solutions.com] ). It wont suit every company or user since it requires an IT security function with some power and an understanding user community, but white-listing is more and more becoming an accepted method [exaprotect.com] for dealing with some of ITs unsolved problems.

AG

F-Secure Deepguard 2.0 (1)

Dtyst (790737) | more than 6 years ago | (#21776994)

I'm not surprised that F-secure did so well in behavioural blocking test, F-Secure Deepguard [f-secure.com] is amazing in recognizing malware application behavior even if it's not a know virus. Truly a nice advancement in virus prevention. Let's hope the competition gets as good as well.

Antivirus is just bandaid. (2, Insightful)

miffo.swe (547642) | more than 6 years ago | (#21777010)

The real problem is that its possible to just click on random stuff from mail, on the web and in IM clients and it gets installed. Because its such a big source of malware it shouldnt be done at all really. Many malware uses defects in browsers and OS and Antivirus is not a solution at all to those problems. Its not even bandaid then.

What i would like to see is Microsoft shipping a Windows version thats fairly secure out of the box. Then and only then Antivirus becomes something useful as a second added security layer. As it is now when it is the only security layer it doesnt work. Shipping Antivirus with Windows as Microsoft does is not a good solution but rather a recognition that they are not capable of delivering a fairly secure OS at all.

If users gets infected a lot by clicking the wrong things the sane thing would be to disable that function or atleast make it more safe. Like demand for example that a site that installs software is trusted by a third party.

read Ranum on enumerating badness .. (3, Informative)

rs232 (849320) | more than 6 years ago | (#21777042)

Why are we still talking about this in late 2007. What have the supreme innovators being doing the past decade. Ranum laid out the solution here:

"if I were to simply track the 30 pieces of Goodness on my machine, and allow nothing else to run, I would have simultaneously solved [ranum.com] the following problems":

* Spyware
* Viruses
* Remote Control Trojans
* Exploits that involve executing pre-installed code that you don't use regularly

Re:read Ranum on enumerating badness .. (1)

QuantumG (50515) | more than 6 years ago | (#21777202)

Blah, the real solution is to have open software that you can trust because everyone knows you could look inside it so they don't try to sneak something past. If you can't have that, at least run every program in a separate virtual machine and only allow a program access to the documents it requires to have access to instead of giving it full control to do anything on the system, including modifying the kernel, which is what 99% of Windows users do.

Re:read Ranum on enumerating badness .. (1)

darthflo (1095225) | more than 6 years ago | (#21777580)

Open software is fine and all, but would you mind finally giving up the "I can look inside, so it's secure" bull?
In theory it works, but it's not practically employable. Most mainstream distros install binary packages. Even if source packages are available, did you check each and every changed line after each and every security update? Simple answer: Either you don't or your software's very outdated and thus probably vulnerable.
Even given the benefit of the doubt (imagining you've got a whole team of people following the development process of every single program you use, closely monitoring each and every code check-in and the state of your respective distro's packages) your solution's not as secure as it may seem. Remember SquirrelMail [slashdot.org] ?

Re:read Ranum on enumerating badness .. (3, Informative)

QuantumG (50515) | more than 6 years ago | (#21777618)

Meh, people can so you'll be leaving your big fat paw prints on it if you try. See, that's the cool bit. I can say "on line 2105 of blah.c in package foo version 4.321 I found that some fucker had tried to put in a backdoor.. can you guys check your revision control to see where this came from?" and there's this public audit trail. If I managed to find something in a binary that isn't in the source I can easily find out who made the package and where they got the binaries from. That's what security is.. it's people and accountability.

solution for real protection .. (1)

rs232 (849320) | more than 6 years ago | (#21777062)

Use a Linux desktop distro [distrowatch.com] , disable exec on the /home and /tmp directories, don't allow users to install software, case closed ..

Yes, I know what you're going to say, there aren't any Linux viruses because there aren't many Linux desktops out there. But where are all the server exploits out there being actively used in the wild. I'm talking about commercial servers being hacked not some msging board ..

Re:solution for real protection .. (1)

QuantumG (50515) | more than 6 years ago | (#21777268)

If you honestly think that servers don't get hacked then you probably should go talk to a security sysadmin or two.

The trade in zero day exploits is alive and well.. the only difference between today and 10 years ago is that the sale of zero day exploits has become slightly more legitimized. i.e., the "good guys" will now buy an zero day exploit off anyone selling, not just the "bad guys".

But getting back to the topic, you don't need exploits to write a virus. What you need is an infection vector, the user will do the rest. Thankfully, Linux users don't tend to download "warez" or open executable email attachments or even have software that requires you to install a "plugin" before you can view porn. What you said about disabling exec on /home and /tmp is a good way to remove those first two infection vectors. It's even practical - if you have virtualization software installed on the machine. Someone complains they can't run random shit they downloaded or the internet? (or wrote themselves) Tell them to run it in a virtual machine.

Re:solution for real protection .. (1)

rs232 (849320) | more than 6 years ago | (#21777782)

"If you honestly think that servers don't get hacked then you probably should go talk to a security sysadmin or two"

Can I have some real world examples, not some home box, but commercial servers being hacked and customer records stolen, like the TJ Maxx [bbc.co.uk] case ..

Re:solution for real protection .. (1)

darthflo (1095225) | more than 6 years ago | (#21777616)

Use Windows, only allow the programs* needed to be run (via GPO), case closed ..

* An execution white- or blacklist can be created with hashes or executable file names. Obviously don't use the latter possibility.

It's time to lock auto-run (1)

Krneki (1192201) | more than 6 years ago | (#21777154)

Bloatware, spyware, viruses, .... For me they are all the same in the end they slow down your work. I like Linux repositories, because those packages aren't controlled by sales department. Each time I install a program on windows I have to run HiJackThis.exe to check it didn't put itself in the auto-run. The same is valid for 99% viruses, they use auto-run "features" to enable them to run each time you start your OS or application.

Class Action risk from using Microsoft's Products (-1, Flamebait)

NZheretic (23872) | more than 6 years ago | (#21777162)

What of the risk to Microsoft's own customers from continuing to use Microsoft's demonstratively more insecure products?

If a business or government body is not taking due care with the private information they hold on the public which could lead to identity theft then they are at risk of being sued.

Get copies of the antivirus scanner logs from any business or governmental for their desktops and laptops. You will have a large list of all the malware that was cleaned up post infection. That malware was actually executed and run on the same computers handling your sensitive data. Some of that malware even exploited vulnerabilities in Microsoft applications and operating system prior to an update fix being made available by Microsoft.

In comparison to any MacOSX or Linux based desktop, Microsoft's desktop operating systems and Microsoft's desktop applications face a disproportionate higher risk of being "infected" with hostile malware. Just relying on third party antivirus software to prop up a Microsoft flagging security record in no way puts you any closer to the level of security that a switch to another vendors desktop platform can provide. ( Just updating to Vista is no guarantee of better security in comparison to another vendors platform )

A business or government body is not taking due care with the private information they hold on the public if they continue to use Microsoft desktop OS environments or Microsoft desktop applications. That is your credit card data, banking details , health care info and social security information. If switching to Linux or MacOSX based desktops would greatly reduce the risk of further intrusion why should not organizations be "encouraged" to make the move.

If anyones customers are at greater risk of being sued for using a product it is Microsoft's own customers.

Heuristics in "easily defeated" shock (1)

Cheesey (70139) | more than 6 years ago | (#21777206)

The funny thing is that AV software has been almost totally useless ever since we moved from floppy disks to Net connections - long before they started whitelisting malware from major corporations. As soon as it became possible to distribute malware more quickly than AV updates, AV software was dead in the water. And even before then, the writing was on the wall: the problem of detecting a virus is undecidable [all.net] and you can't change the laws of math.

Good luck convincing your boss that AV software is snake-oil though. Best carry on paying and taking a performance hit every time you open a file.

Re:Heuristics in "easily defeated" shock (2, Interesting)

kongit (758125) | more than 6 years ago | (#21777388)

I wouldn't say it is pointless. However, overusing an AV is pointless. Scanning a file every time it is accessed is pointless, as it should of been checked before it was allowed permanently on the machine. If that file has not been modified since the last AV check it should not be scanned. Additionally scanning files you create is rather pointless because if you are putting a virus in your files either a) you know what you are doing or b) you have another virus or trojan somewhere else putting that virus in your file so any action on the created file would not fix the problem. There are many viruses out in the wild and most AV software can check for many of them. Not only are new viruses a threat but older ones can still cause large problems. So AV software does have a place in modern computing, but many developers of AV software make it do more then it needs to and use way too much overhead and time to do it.

Using the internet is like sex. The only way to completely avoid viruses is abstinence. It is almost always safe if you do it with somebody you know to be safe like a spouse. If you are dealing with the unknown or unreliable, protection is your best bet. While AV software isn't as reliable as a condom (which isn't 100% reliable) it is better then nothing.

Re:Heuristics in "easily defeated" shock (1)

Opportunist (166417) | more than 6 years ago | (#21777784)

Take that tin foil hat off for a moment to vent some hot air, please.

Could you first of all please inform us what has been whitelisted? Aside of copy protection mechanisms (which should be classified malware, but guess what: PEOPLE WANT TO BE ABLE TO PLAY THEIR GAMES!), I'm not aware of any whitelisting taking place. At least in the more reputable companies in the biz.

Second, yes, with networking it's easy to distribute malware quickly. But the other way around is true too, AV vendors get new samples much more quickly, too. What is true is that the spreading cycle changed from a few months to a few hours, but so did the detection and prevention systems. It is no longer an issue to push a critical update to your client in time. Of course, if your customer insists in updating once a week, he's underprotected. But that's not the AV manufacturer's fault.

The paper you quote is well known in AV circles. I have a copy of it hanging on my wall. Yes, I have a fairly twisted sense of humor. Mostly, I enjoy to see that something doesn't instantly become truth just because you wrap it up in formulas so people have a hard time understanding it. But it's math, so it's proven, so it has to be right. I give you that much that heuristics cannot detect a virus flawlessly. That has never been the aim nor has anyone (reputable) ever claimed it is. When you talk about snake oil, talk about those virus vendors that claim their heuristics can catch anything there is out there. It cannot, and it never will be able to.

The virus-antivirus battle is an arms race, nothing more, nothing less. "Evolving" and "morphing" viruses are a tiny minority, mostly consisting of POC and "look, I can do it!" projects. The main threat today are commercially created malware kits targeting you to get you as a spamming platform or to steal your ID to harvest you for money. Creating a morphing trojan is far too expensive when a non-morphing can do the job just fine. This might change, but so far there is simply no reason to change anything. Virus writing has become a business, not more, not less. It's a matter of investment and return thereof.

So please, before jumping to conclusions, just take a look at the whole picture. Yes, it's impossible to determine whether something is a virus or not by "just looking" at it. But that doesn't mean AV tools are pointless. It means heuristics are.

There are just too many false positives (2, Interesting)

someone1234 (830754) | more than 6 years ago | (#21777262)

AVG for example shows nwn2main.exe (Neverwinter Nights 2 from Obsidian) as false positive.
Sure, it is partly because of the inane copy protection, but AVG should make some tests before issuing such a crap.

Luckily the 'infected exe' is recoverable, and after disabling the resident shield it will run. But then, why do you have AV in the first place?

Last years was better? (1)

Oktober Sunset (838224) | more than 6 years ago | (#21777318)

So what I need to do is uninstall my current anti virus and install one from last year, and not update it to the new less effective version from this year?

Useless (3, Insightful)

Jessta (666101) | more than 6 years ago | (#21777344)

Antivirus has always been useless. It's not proper security.
Imagine having a door man that has a list of everyone you hate and everyone on that list is not allowed in your house. An enemy is prevented access but a stranger can still walk away with your TV. Wouldn't it be better to give the door man a list of all your friends instead.

Blacklisting is a really bad way to prevent unwanted activity. Whitelisting is much better.

Re:Useless (3, Informative)

ledow (319597) | more than 6 years ago | (#21777796)

The trouble with antivirus is that the doorman is actually sitting upstairs with a note on the front door that says "Report to the doorman upstairs, please." By the time AV spots a virus it's usually already far too late and the first thing that any virus does is to turn off AV, usually in such a way that the user doesn't notice (the equivalent of swapping your doorman for a clone).

AV is good only as a system check. It is no good as a frontline defence. It can't spot viruses until they are either already in memory or sitting on your disk. Some of the time it will spot them before they get executed but most of the time not. When I used to use Windows at home (I only use it on school networks now, I work as a tech in schools) the one way to "tell" that you had something dodgy going on was when Zonealarm went ape. Even the integrated Zonealarm Security Suite, AVG etc. didn't detect the stuff that I was testing. But when something starts asking for Internet access out-of-turn, you know something's wrong. And when your AV is less use than a freeware firewall that bothered to ask you, you know it's a waste of time.

AV-scanning-proxies : excellent idea
AV scans of networks: good idea
AV scans of home machines: pointless and doesn't tell you what you can't find out in ten seconds of using the machine as an IT professional.
AV "real-time scanners": Well, yes, if you must, have CPU to spare and ignorant users using the machine. Otherwise, they're pointless.

Most AV solutions (1)

Mgns (934567) | more than 6 years ago | (#21777402)

really just make my machine choke and die. I run an ancient computer with only 256 RAM, more than enough for my use, but not long ago I knew I'd been infected. So I HAD to install something.

I ended up installing the free 30 day trial from Norman. Long story short, it's the only AV I've ever tried that I didn't positivly hate.

The Real Reason (1)

LaskoVortex (1153471) | more than 6 years ago | (#21777510)

The real reason for massive viruses is windows. I know all of the "unbiased" people will mod this down, but you are fooling yourselves think windows is a legitimate operating system. I set my brother and uncle up with ubuntu boxes last summer and they haven't needed to reboot yet! No viruses. Top speed. Both of them previously had windows machines that took all of about 2 weeks to get so loaded with viruses, it was silly. They haven't had a problem with this since May. Windows isn't going away, you say, but it friggin' should. You probably want to call me a "fan boy", but you have chosen and/or support the wrong operating system, plain and simple. Every time I set someone up with a Linux box, their virus problems go away and their machines (ancient) purr. Am I biased? Confused? Its friggin' results people. I tell you what, if you've done the work to convert four *real* people away from that shit operating system windows and still disagree, mod this down. If you haven't then you have no business having an opinion. I speak from the trenches--real users with *no* savvy, personal computers, home use, no VM. I set them up and they fly. Convert some of these people and see how they begin loving their PCs. Don't mod this if you don't have the cred. Mod it up if you know what I'm saying.

AV software causes more problems then it solves (2, Interesting)

Tridus (79566) | more than 6 years ago | (#21777762)

I've known that AV software doesn't work very well for quite a while. Its really nothing new. It is nice to have someone doing tests that I can shove in peoples faces, though.

This isn't the biggest problem though. AV software is actively harmful. Aside from dramatically slowing down EVERYTHING, it can flat out break stuff. Norton in particular is notorious for screwing things up, to the point that if someone asks me about a problem with their computer now, my first answer is always "uninstall Norton."

Running the gambit from games being intolerably slow to programs crashing to drivers inexplicably failing to install (even after turning Norton off), to date "uninstall Norton" has never failed to fix the problem.

(Really, Norton and the virus makers themselves aren't much different, in that both of them prey on the computer illiterate.)

Of course effectiveness is falling... (3, Insightful)

A Pressbutton (252219) | more than 6 years ago | (#21777830)

And it will fall still further.
Time was a virus would either just pop up an annoying message or delete random data or reformat your PC. Effectively viruses and virus writers were hunters and once they had got the target they had no further interest.

Virus writers have now become 'civilised' farmers. They now get paid for their efforts.
The writers have a tame herd (of infected PCs). They will spend their time trying to make sure the AV software will not interfere (to them these things are the infection). They spend their time tending their herd and catching 'wild' examples - other peoples virii (?) so they cross-breed.

One consquence of this (if correct) is that viruses may well start to remove other infections, and generally tune up your PC. After all, if your PC is working just fine, why would you bother keeping the AV scanner up to date?

Load More Comments
Slashdot Account

Need an Account?

Forgot your password?

Don't worry, we never post anything without your permission.

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>
Sign up for Slashdot Newsletters
Create a Slashdot Account

Loading...