Can You Trust Anti-Virus Rankings?

Slatterz writes "It seems nobody can agree on a universal set of tests for rating anti-virus software, with Eugene Kaspersky the latest to weigh in on the topic, criticizing the well-known Virus Bulletin 100. Kaspersky is one of several big anti-virus brands to fall foul of the VB100 tests, reportedly failing to pass a recent test of security software on Windows Server 2008, along with F-Secure and Computer Associates. At Kaspersky, bloggers have pointed out that they don't focus on detecting PoCs, calling it a 'dead end,' and saying their anti-virus database focuses on 'real threats and exploits.' 'I don't want to say it's rubbish,' Kaspersky told PC Authority. 'But the security experts don't pay attention to these tests. It doesn't reflect the real level of protection.'"

Comments

No.

[Anonymous Coward]

Next Question

Re:No.

[A non-mouse Coward]

Anti-Virus is outsourcing the problem of deciding what is good to execute on your computer to a vendor who works backwards and blind.

It's "backwards", in that you don't tell them what is "good". They try to guess what would be on your "bad" list. As everyone here knows, it turns out that the "bad" list is much, much longer than the "good" list. In 2007 alone, F-Secure added more virus sigs to their products than the totality of sigs accumulated from the previous 20 years! And last I heard from them, 2008 was projected to double 2007. That sounds almost like quadratic growth to me ... and keeping up with that growth rate is not a game I'd want to play! My list of "good" software doesn't increase on a quadratic growth rate, does yours? If this were any other field of computation, the signature approach would have been laughed off the planet by now.

It's "blind" in that they aren't seeing what is actually running on your computer. For privacy (and performance) reasons, nobody provides metrics back to AV vendors about all of the executables that weren't labeled "bad", and rarely do the metrics about what is labeled "OK" actually go back to them. The AV vendors have to take a shot in the dark. They can simulate what they think your computing environment looks like, but it's just a guess. They cannot know if you have custom or proprietary software that matches one of their AV sigs unless they actually test that particular program against their sigs (and you don't let them do that, hence the "blind" remark).

Backwards and Blind is very problematic. Every once in awhile, we hear about fiascos like Symantec deciding an asian language DLL is a virus, killing all of their asian customers' windows installs for a day or two.

The question the benchmark is really trying to answer is: Which vendor's product is best tuned for the least amount of false positives and false negatives? When we should really be asking the question: Do I know what is good to run on my computers? And if the answer to that is "yes", then we should be asking the question: Why can't these vendors make a product that only allows my "good" programs to execute and nothing else?

Re:No.

[doti]

Ok. Then what can we trust?

Free open source anti-virus?

ClamAV is nice.

Re:No.

[thePowerOfGrayskull]

Do I know what is good to run on my computers? And if the answer to that is "yes", then ...

The problem with that, of course, is that the answer is "no" for most people.

Re:No.

[Ilgaz]

Some white hat guy coded RemoveWGA.exe which uninstalls the WGA check installed by Microsoft claiming to be unremovable. When you check it with Kaspersky, it says it is clean. You run trend's 'hijack this" and see what it does manually, it is clean too. You send it to Kaspersky engineer to check it once again, guy says it is really, really clean.

ClamAV detects it as a trojan, not a generic type, an actual one with name.
RemoveWGA.exe: Trojan.RemovWGA FOUND

I also took my time to tell them that it is obviously an abuse of their open source and community approach, they didn't respond or remove it from their list. You can easily guess who (or his friend) abused their sigs. The point is, as a OS X user who doesn't use windows except that horrible emulated Virtual PC 7, I sit and spare my time to handle the abuse.

If there are people blaming companies going with pricey solutions, they should spare time to it. I am not even commenting about the horrible false detections regarding Symbian OS.

Re:No.

[_Sprocket_]

Do I know what is good to run on my computers? And if the answer to that is "yes", then ...

The problem with that, of course, is that the answer is "no" for most people.

Not only do they not know - they likely don't have the wherewithal to make that determination.

Re:No.

[Thelasko]

Why can't these vendors make a product that only allows my "good" programs to execute and nothing else?

I think you just described the Advanced Packaging Tool.

Re:No.

[jimicus]

And if the answer to that is "yes", then we should be asking the question: Why can't these vendors make a product that only allows my "good" programs to execute and nothing else?

Because such a product wouldn't need to be updated every year or require monthly subscriptions.

Re:No.

[thePowerOfGrayskull]

Indeed; nor should we expect them to. The vast majority of computer users want to use the computer in the same way that they use any other appliance; and frankly, they /should/ be able to. Unfortunately, the only way to give them that experience is to a) line up all malware authors and shoot them; or b) provide them with locked-down machines that can only run Authorized Content in an Approved Manner.

Re:No.

[somersault]

To have a "complete" test we'd have to know every possible vector of attack. If we knew that then couldn't we build a perfect AV system? I doubt that will ever happen.

One man's virus could be another man's new fangled networked utility that could have similar characteristics to a virus. Wouldn't something like P2P clients or a busy SMTP server appear to be threats to a heuristic virus scanner? So you have to use black or whitelists rather than rely on heuristics. Whitelists are pretty good, but you still need an OS with no security holes for them to work properly - not to mention users that won't just blindly authorise unknown applications.

It would be nice to be able to scan a program and be told what kind of connections it may try to make, and to where, what files it will create or modify on your machine, registry options it will add if it's a Windows application, etc. Does anyone know of applications that do this? It would probably be easiest to just have some kind of virtualisation or WINE like environment to just run the program and see what it tries to do..

Re:No.

[dc29A]

Ok. Then what can we trust?

Free open source anti-virus?

ClamAV is nice.

How about common sense?

Common sense allowed me to run Windows since 1999 virus AND anti-virus free.

Re:No.

[RulerOf]

Why can't these vendors make a product that only allows my "good" programs to execute and nothing else?

You can already whitelist apps in Windows via group policy.

The problem with whitelists (or blacklists for that matter) is that they have to be maintained and updated. The way to ensure a good whitelist is to force programs to be signed much the same way Windows drivers are through the WHQL. The problem with this is that it raises the cost of independent development.

And lets face it, I'd wager that 90% of viruses are acquired through spank/punch the monkey games that, due to them actually being fucking viruses/malware, would never make it through the signature process anyway.

Re:No.

[Anonymous Coward]

English?

Re:No.

[somersault]

Why can't these vendors make a product that only allows my "good" programs to execute and nothing else?

Hmm.. sell perfect AV solution once.. or.. sell imperfect solution on a yearly subscription.. let me think now.. no, I can't see why they wouldn't release a product based on white-listing at all!

As thePowerOfGraySkull says though, trying this method with uneducated users doesn't really work anyway, as they tend to just white-list anything without caring. It would probably work quite well for your average geek though - especially when combined with a list of hashes for well known 'good' software. As you say, it would be a hell of a lot easier than keeping track of all possible 'bad' software.

One of our porn addict directors insists on always downloading those programs that claim to make your computer faster or clean up spyware infections etc. I'm surprised he isn't totally bankrupt by now. He's probably bleeding money to both legitimate anti-spyware companies, but also a few scammers who sell stuff that isn't really anti-spyware, not to mention people who have probably copied his credit card number and siphon money off it, etc. I don't really enjoy having to let him connect up to our network. I'm very tempted to get him to buy a Mac as his next machine, but he'd probably manage to screw that up somehow too.

Re:No.

[Klaus_1250]

This might have gone unnoticed to many, but nowadays most AV's block hacks, cracks and other Potentially "Unwanted" Software.

Re:No.

[Sancho]

Are you kidding? The list of "good" programs will change constantly. You'd very nearly need hourly updates to get this working.

Update Windows? Does iexplore.exe have a new signature? You need to update your security product.

Even better, you could require vendors to pay you to vet their product. That way, you get money coming out of both ends--the end-users who need your updates, and the vendors each time they update their software.

Re:No.

[Sancho]

A good balance would be to allow signed programs from certain manufacturers, and white list any other required software which isn't signed. That minimizes the white list process, while still giving you the option of using software from vendors who don't want to pay for a signing key.

In practice, this works out like HTTP over SSL does today. We have a third-party vetting of websites, but anyone who does not want to pay for that vetting can still use HTTPS connections. The main difference is that we're still talking mostly about business customers doing this, because you need some way to ensure that your users aren't going to whitelist Elfbowl. In other words, this works for corporations, but not so much for grandmothers.

Re:No.

[_Sprocket_]

Indeed; nor should we expect them to. The vast majority of computer users want to use the computer in the same way that they use any other appliance; and frankly, they /should/ be able to. Unfortunately, the only way to give them that experience is to a) line up all malware authors and shoot them; or b) provide them with locked-down machines that can only run Authorized Content in an Approved Manner.

The problem with that is we've just spent the last 20+ years going through massive innovation because there's no particular approval to how this tech is used. Bolting on Approval could have ugly effects. Unless, of course, that approval is from the end user. Which puts us in the same place we are now.

The other issue is that we're not dealing with a toaster. Nobody expects their toaster to also become a calculator, telephone, and TV on demand. We're dealing with a complex and powerful machine. A computer is not a toaster (or a truck - but I digress).

That doesn't mean we shouldn't be trying to simplify the tech. After all, an automobile is also a pretty advanced piece of machinery as well. But the key to this is making really intelligent and sufficiently paranoid choices on how to go about doing this so the end user doesn't have to. Part of the problem is that some aspects of the industry like to portray their products as toasters while making poor design choices; a customer base of monkeys with machineguns.

Re:No.

[hairyfeet]

Actually as someone who has been working in Win PC repair more years than I can count,I'd say the biggest problem would be a simple fix for MSFT,but for some reason they haven't. And that is that file extensions are all or nothing. What I mean is this: either they can see file extensions,in which case the user can fuck up EVERY single file they touch,because it lets them wipe the file extension when they go to rename the file. Or you can't see the file extensions,in which case the nontechnical user get bit by the "OMG watch Britteny suck teh titties!".avi.exe malware.

There should be a way to show file extensions but not change them unless you right click and explicitly choose "change file extension for this file" which would give the user a warning,like "This can cause the file not to open correctly. Are you SURE that you want to change the file extension?". If you did that,a whole damned lot of the infected machines that cross my desk weekly wouldn't be filled with malware. I don't suppose anyone knows of a freeware solution that does what I just described,do you?

Re:No.

[228e2]

and in a off-line environment?

if thats not the case, please reply with your ip address :)

Re:No.

[iztehsux]

ClamAV works great. I've been using it on several computers over a long period of time and found it to leave a minimal footprint, yet effectively protect the computers. Most of my family members are not computer wizards, so it's simple for them to use.

Re:No.

[hesaigo999ca]

This si where it is up to the AV vendors to stop taking our money for nothing, and actually get a list of hash sums for each of the dlls used by let's say filezilla software, or firefox software etc.... for each of the version, that way when they check the file system dlls for code that should not be there, they only have to do checksums, this is the point of tripwire (linux).

Then after that, you need a sandbox environment(a la VMWare) to work with softwares that do little things. Open a word document in a sandbox environment, and see if any of those signatures change the overall checksum for the system, if this passes, then the document can be opened in the real world computer and not the virtual one, as it contains no virus code to execute.

This of course would have a great overhead, but would not be that different then running an AV that already takes 80% of your cpu anyways!!!

Re:No.

[A non-mouse Coward]

Exactly. So to do the right thing, they'd have to cut off their profits. And they've already convinced so many people that hourly untested (at least not tested in your environment) updates to something so close to the core of how your computer behaves is "normal".

So, in not too far of a parody, we've already given the Nigerian royalty (AV vendors) our account numbers. The social engineering is complete--time for the exploit.

Re:No.

[jimicus]

Are you kidding? The list of "good" programs will change constantly. You'd very nearly need hourly updates to get this working.

Or you automatically allow anything that has a valid digital signature from a select list of signatories.

Re:No.

[mkraft]

It's "blind" in that they aren't seeing what is actually running on your computer. For privacy (and performance) reasons, nobody provides metrics back to AV vendors about all of the executables that weren't labeled "bad", and rarely do the metrics about what is labeled "OK" actually go back to them.

Actually Symantec's Norton Internet Security 2009 and Norton AntiVirus 2009 do send back metrics about what people run on their system. It's called Norton Community Watch. Norton takes all this data to create a "white list" of programs that have been deemed "safe". This also let's Norton run a lot faster since it doesn't scan these "safe" applications. So some AV vendors have started to remove the blindfold and walk forward.

Re:No.

[RulerOf]

In other words, this works for corporations, but not so much for grandmothers.

Exactly. But Windows already has very robust (to my understanding) whitelist capability. It's not as easy to use as a signed application policy could be though.

Anyway, the point is I guess, that if it doesn't work for grandma, then I'd wager to say it doesn't work.

It just may not be possible to lock the personal computer down the same way cell companies do, their damned phones... especially the iPhone. And even if they could... would we really want that?

Re:No.

[Anonymous Coward]

Umm.. I'm currently on 127.0.26.85

Re:No.

[Ilgaz]

It is potentially unwanted only for Microsoft. I don't enable --detect-pua too. Trojan is a huge claim, trojan is documented and it is something which promises a user something and does something else. It looked way interesting to me so as I said before, I have run a simple "hijack this" (like tripwire but way simple) test. It does delete the WGA check and does nothing else. I am sure actual analysts at AV vendors like Kaspersky did way more advanced tests.

It is clear that someone abused ClamAV database and worst is, they don't care. Lazy AV vendors copying their .sigs are also effected.

Re:No.

[Klaus_1250]

Many AV's seem to rely on Virustotal and what other AV's report. Whether the threat is real or not, you can even see FP's spread from there.

Re:No.

[Dark$ide]

And if the answer to that is "yes", then we should be asking the question: Why can't these vendors make a product that only allows my "good" programs to execute and nothing else?

Because such a product wouldn't need to be updated every year or require monthly subscriptions.

Which funnily enough is just how mainframe software is managed.

Guess what? We don't have viruses on mainframes, we have an IBM guarantee (since 1981) of security and integrity.

Re:No.

[mpeskett]

The list of bad programs changes constantly. They have how many million virus definitions now?

Just have them shift gears and work on issuing signatures for known good programs, if they can put them out at anything like the rate that they can come up with signatures for malware then they should have a complete list by next week

I'm almost loathe to say that there should be a way to allow programs for yourself... that just opens the door to stupidity, but if you make it a multiple step procedure requiring deliberate user action, with warnings all along the way (as opposed to constant "program X wants to run, cancel or allow" messages) then hopefully it'll make it hard for the idiots to get themselves infected, which is at least an improvement.

Re:No.

[Kalriath]

Are you saying something positive about a Symantec product?

Please pack your things and turn in your Slashdot ID on the way out.

Re:No.

[Kalriath]

Why can't these vendors make a product that only allows my "good" programs to execute and nothing else?

I actually saw a product like that once - it was called Stardock SecureProcess. An interesting theory, it would prompt you with Allow, Allow Always , and Block when a program started so you could whitelist or blacklist apps you wanted to run or not, with a greylist as default. They seem to have stopped developing it though.

Re:No.

[jimicus]

Because such a product wouldn't need to be updated every year or require monthly subscriptions.

Which funnily enough is just how mainframe software is managed.

Guess what? We don't have viruses on mainframes, we have an IBM guarantee (since 1981) of security and integrity.

Most organisations that are big enough to run a mainframe almost certainly depend so heavily on it that they're unlikely to begrudge IBM the annual maintenance fees.

I'm with Kaspersky

[LibertineR]

I dont care about any tests, I care about what detects dangerous stuff on my network and what doesn't. Every client I have in on Kaspersky stuff, after Norton, McAfee, Trend and others FAILED to detect viruses that Kaspersky found straight away.

Game over.

Re:I'm with Kaspersky

[AioKits]

I'm with you on this one. I have had good experiences with Kaspersky in the past and got the package with three user licenses for like $50 or so off the website (this was back towards the beginning of 07). Two licenses for me and one for a friend who just runs around all day with his laptop.

The real fun tho is when I run WAR it detects 'keylogger like behavior' from the software. Heheee.

Re:I'm with Kaspersky

[quarrel]

If it didn't have so many false positives I'd agree with you.

However Kaspersky seems far and away the most prone to them.

From random image false positives, to objecting to "hacking" tools, otherwise known as network discovery tools...

--Q

Re:I'm with Kaspersky

[Spazztastic]

I'm with you on this one. I have had good experiences with Kaspersky in the past and got the package with three user licenses for like $50 or so off the website (this was back towards the beginning of 07). Two licenses for me and one for a friend who just runs around all day with his laptop.

I'm going to push the institution I work for to use Kaspersky in the future because having Symantec on these machines is detrimental. I had a good experience with Kaspersky in my home network of several machines and at clients households when they want proprietary anti-virus.

Re:I'm with Kaspersky

[IceCreamGuy]

Now I've never actually used any of Symantec's AV software, but I usually hear from peers that their enterprise solution is actually pretty lightweight, unobtrusive and generally decent software.

having Symantec on these machines is detrimental

Again, I really don't have any experience, but would you feel like elaborating?

Re:I'm with Kaspersky

[Spazztastic]

I ran it at the small business I worked for which primarily worked in programming digital signal processing algorithms. Regularly it would slow down the machines as they were compiling, and it would use up a lot of background memory.

The current institution I work for uses it and it's been a bit of a headache personally, it didn't like nmap. Or a handful of Cygwin utilities I tried to install.

If any other readers have personal experiences, share them. I've just become favorable of Kaspersky in the past from my personal use.

Re:I'm with Kaspersky

[IceCreamGuy]

Heh, if it doesn't like nmap or windows rsync, then damn, it's out of consideration already for me. Thanks!

Re:I'm with Kaspersky

[sqlrob]

Also netcat, which is a "hacker tool", immediately deleted by our policy.

I work on proxy software. Netcat is one of those things I need on a regular basis.

Re:I'm with Kaspersky

[CopaceticOpus]

I don't care about tests either, I only care about anecdotal evidence in random /. posts. If Kaspersky worked for this one guy, it's good enough for me.

(Actually my only anti-virus protection is not using IE, and not running things that shouldn't be run. I've had no problems.)

Re:I'm with Kaspersky

[Tridus]

I haven't used their enterprise stuff. But the home stuff is awful. Every time someone asks me to troubleshoot a weird computer problem for them, my first question is "do you have Norton?"

If they say yes, my first answer is "uninstall it and try again." Thus far, that has never failed to fix the problem.

It doesn't matter what the problem is. Windows not going into standby? Uninstalling Norton fixed it. Onboard RAID not working? Somehow, Norton was buggering it up. World of Warcraft not running properly? You guessed it.

In my experience, it causes far more problems then it solves, given how backwards AV protection really is and how poorly it works.

Re:I'm with Kaspersky

[AioKits]

Not sure how this is a false positive as it did detect something that would usually be 'malicious' to the average user. How many average users pick up network discovery tools? That and trinkets like that can just be added to the exceptions list easily enough.

Doesn't really matter tho, go with what works for you I say.

Re:I'm with Kaspersky

[Bloodoflethe]

Yeah, I've been pushing for Kapersky for a long time on my server, but The Dell Rep says that Symantec's is The Best AV Software out there. And he is clearly more knowledgeable about such things than a server jockey like me.

Re:I'm with Kaspersky

[Spazztastic]

There is no "best" AV software, only preferable ones.

Re:I'm with Kaspersky

[AioKits]

Well, if that's all you need for influence in purchasing decisions, allow me to make the following recommendations!

- Suave Shampoo for Men
- Reese's Cereal
- SILK Soy milk (great for lactose intolerance)
- Trinidad cigars (try the triple maduro!)
- Arm & Hammer Natural Kitty Litter
- Meow Mix (I tasted it, not too bad..)
- Wolf Brand Chili
- HEMP skin care products

Lemme know if you need more suggestions, I use a ton of things in my daily life!

Re:I'm with Kaspersky

[Daryen]

For me working at an Educational Institution, Symantec Corporate was worse than your average virus in terms of CPU and Memory usage, and caused more noticeable problems to the user as well. I've switched over to free antiviral software, and am working on packing clavAV into an msi to push out.

Re:I'm with Kaspersky

[kesuki]

"I only care about anecdotal evidence in random /. posts."

that was me in 2005. actually from most of 2000 through part of 2006

after having problems with windows 98 and malware from *cough* warez *cough* i was pretty good with using a free open source firewall, until around 2002 when it was starting to annoy me and i decided based on slashdot that 'cheap' commodity grade wifi/routers were 'equal' to the level of security i got from my dedicated free open source firewall when i manually compiled everything from the ports tree.

ya know, it's not the same level of security, in fact if i could rank the level of security, i'd give commodity routers a 1 out of 10. and the everything compiled myself route a 4 out of 10 (at least they way i was doing it) i'd give my current approach a 8 or 9 out of 10, i just don't have the money for a server with 8 gigs of rams and 2 cores and a 80+ gig hdd to have a single box hardened firewall with services running in xen based hardened virtual machines. any service that runs too slow in VM, would get offset to the current firewall, in hardened single service fashion. that's a 9 or 10. on my scale, and it's not easy. I think i could figure out from a little research and custom config of smoothwall how to set up the 10, without having to manually log in to each machine every time i needed to tweak something. dunno if i can tweak smoothwall to do full stateful inspection, but if not, i know how to do it with a ubuntu server setup.

full stateful inspection suggests some custom scripting to check for known bad data over allowed ports, and e-mails of detailed traffic by hour summaries. in other words work. i might settle for a 9.

Re:I'm with Kaspersky

[ePhil_One]

If you're a server jockey incapable of installing your own AV software, you're not really a server jockey

Re:I'm with Kaspersky

[theCoder]

The company I work for recently (last 6 months or so) switched to Norton from McAfee. We also use ClearCase for or software revision control. It turns out that there is some bad interaction between the two, and running applications out of a dynamic ClearCase view can sometimes lock up or blue screen the machine. This doesn't happen very often, maybe 0.5% chance or less. But we have hundreds of unit tests that we run, which are built in the ClearCase view and would be run there. So, over the course of testing, you have a pretty good chance of causing the error.

Unrelated, but this pales in comparison to the big problem I have building on Windows now. I got a new build machine and some thing (some driver?) is causing some sort of process ID starvation. We use GNU make in Cygwin to build the software, and make creates lots of processes to do its work. I don't know what the correct behavior should be, but on some of our machines, newly created processes get ever increasing IDs (but not sequential) as time goes on, until some ceiling is reached. After that, it becomes harder and harder to make new processes. Presumably, this is because the Windows kernel asks whatever it is to make a new process ID, and that either fails, or returns an ID that something else rejects. Maybe it thinks it's still in use or something. But the result is that a new process fails to start, and the build stops. I don't think this problem is related to Norton. I found a single Internet posting on a Cygwin list that blamed an ATI driver, which this machine has. But the machine is newer than the switch to Norton, so it could be a bad interaction between Norton and the ATI driver (and maybe ClearCase too).

Fortunately, I can ignore all these fun things and just work on Solaris and Linux. Even the ancient version of Gnome (2.0.2) on my Solaris machine is preferable to dealing with the problems on Windows :P

Re:I'm with Kaspersky

[Bloodoflethe]

That would be funny if you were trying to make a joke. I am capable of whatever I want. Whether I would get fired for doing something that the business doesn't want to pay for is another question entirely. You are a server jockey if you have to go to management to make any decisions that would effect their billing. If I were given control of such things I would not have called myself a jockey. I might have called myself an administrator.

Re:I'm with Kaspersky

[BitZtream]

Which works great for the most part. That is until todays Windows file sharing exploit ends up planting and executing a virus on your machine from someone else who was infected without you ever having any part in the operation.

Re:I'm with Kaspersky

[Anonymous Coward]

I have about 75 clients using symantec endpoint security and they love it, I might actually try it instead of NOD which I have used for years, yet the newest version seems so damn slow.

Re:I'm with Kaspersky

[ZorbaTHut]

Anyone who has the Windows file sharing port exposed to the outside world is an idiot.

Re:I'm with Kaspersky

[steveo777]

Coffee on keyboard. Well done with the Meow Mix comment.

Re:I'm with Kaspersky

[mebrahim]

My anti-virus protection is avoiding to use Microsoft products, specially their OS.

Re:I'm with Kaspersky

[Anonymous Coward]

try NOD32 from Eset - the fastest & least bloated AV, which btw has the most 100% VB awards...

Re:I'm with Kaspersky

[LibertineR]

Okay, dickhead. Point taken.

The fact is, Kaspersky on clients has a smaller footprint, has very granular protection settings, letting you have major control over what it checks and what it doesnt, if that is what you want.

It is also positively oppressive in alerting you if you want it to. I dont mind a few false positives as opposed to a single false negative; something that happens all the time with Norton. Norton screws up so many computers, it is the very first thing I look for if I am troubleshooting. I keep a demo copy on a thumb drive, and wipe out Norton straight away. Then, load Kaspersky, and lo-and-behold, viruses found up the wazzoo, that Norton simply ignored. Almost EVERY time, this is the case.

The server tools are good, allowing one local spot for clients to get updates, and again, take up LITTLE space in ram or disk.

Re:I'm with Kaspersky

[vux984]

I dont care about any tests, I care about what detects dangerous stuff on my network and what doesn't. Every client I have in on Kaspersky stuff, after Norton, McAfee, Trend and others FAILED to detect viruses that Kaspersky found straight away.

Game over.

Kapersky, in my experience, also has the highest rate of false positives.

Re:I'm with Kaspersky

[againjj]

(Actually my only anti-virus protection is not using IE, and not running things that shouldn't be run. I've had no problems.)

How do you know, if you aren't running Super Anti-Virus And Anti-Spyware Checker Plus With Extended Internet Security And Super Detection Capabilities For Home And Business Environments Power Edition (TM)?

No more....

[TheNecromancer]

than I can trust the hackers that write these damn viruses that keep infecting my PC! Yeah, standards in this industry would be a start in the right direction, but right now ANY virus protection software is better than none!

I use Norton Internet Security, and while it is passable, I find that it's a resource hog. I know there are other products out there that are less "intrusive", but I just don't want to take the chance (or time) with another product.

Re:No more....

[Anonymous Coward]

what is this "Norton Internet Security" of which you speak? Does it run on Linux?

Re:No more....

[AceofSpades19]

Norton is an utter piece of crap, it would be advisable to get rid of it now

Re:No more....

[IceCreamGuy]

Wow, solid, well supported argument right there.

Re:No more....

[Rogerborg]

[Your implicitly suggested alternative] is an utter piece of crap, it would be advisable to get rid of it now.

Citation required.

Re:No more....

[SatanicPuppy]

Norton is itself a virus. It hogs resources, causes errors, and can't be removed without killing the host.

For what you pay, you should get something that is better than cheaper or free products available on the web...I usually replace Norton with AVG, and while I'm not a huge fan of AVG, I've never had anyone complain.

Re:No more....

[TheNecromancer]

I've had a number of friends say this to me also, and I have been meaning to replace Norton with AVG (after my subscription runs out), but I haven't been able to get off my lazy ass and do it!

I've had a good experience with Norton over the years, but recently the quality of their product (read: quality sucks now!) has gone way down. For me, I first noticed it when they removed parental control from their antivirus product, and made it a free "add-on" that you had to install separately. WTF??? Why did you remove functionality that was previously included, just so I have to install it separately?!?!? In addition, they made it so goddamn hard to find the install file that it was equivalent to spending a couple hours with a help desk technician in India!

I'm sure I won't replace Norton until I get my full use of the subscription that I paid for. Or, when a virus kills my PC (knock on wood).

Re:No more....

[Ngarrang]

Wow, solid, well supported argument right there.

Indeed, it is. Norton really is a load of crap. It is a resource hog of cpu, memory and hard drive. I believe the only reason it is found on anyone's PC is because Norton pays PC companies to install it by default. Because, frankly, you would have to literally know nothing about AV to choose Norton. As in, you did no research and picked the shiniest box off the shelf. At which point, I have lost sympathy for the user.

My company relies on SOPHOS. In 12 years of working with SOPHOS, never has a virus had a chance to spread...despite the users best efforts.

Re:No more....

[Anonymous Coward]

Dude, what are you talking about, he got modded informative.

"Norton is a piece of crap, oh wow, I didn't know that!"

Re:No more....

[noundi]

but right now ANY virus protection software is better than none!

That depends, do you walk around all day with a rubber on your weiner? No? Newsflash, niether does your computer, so stop putting it's dick everywhere.

Re:No more....

[antique future]

I use avast and will probably use it until I come across something that infects me with avast running. I've used avg and avast and I prefer avast because it has detected orkut where others failed and I like the price and I like the update rate. http://blog.shankarganesh.com/2007/11/07/avg-vs-avast/

Re:No more....

[kesuki]

avg is a product that was last good in 2002. maybe it was still passable in 2003. but by 2006 it was so far behind everything except clam av that it was equivalent to not having any real protection from hackers.

real security comes in 2 parts. 1 part firewall 1 part anti virus/malware/etc. if you're going to push a 'free' product at least pus one that includes a firewall, like comodo. version 3 of their firewall includes a very vistay popup style security against code execution. annoying, yes, but if you have to in addition to run the program click through a popup that tells you everything the program is trying to do.... well there is a chance that you'll see 'replace cmd.exe?' and wonder why fluffybunny.swf needs to replace cmd.exe.

personally, i don't even trust comodo, i have a hardened half-open hardware firewall. sometime next year, i'm getting a hardened firewall, that runs each service in a hardened sandboxed VM. so even if there is an exploit in dns caching the worst a hacker can get access to is the dns virtual machine, which i can restore from hd image the second noscript warns me or a site that i clicked a link on doesn't work the way i expect. but ya know, that's a little more secure than the department of homeland security, and a drop shy of how paranoid the millitary is. i don't inspect my hardwares firmwares before plugging them into my network.

Re:No more....

[IceCreamGuy]

My company relies on SOPHOS

Now that is something I would really love to use. I've read really great things about them, and their demo really impressed me. They even offered to craft a custom installer that would remove our current AV at no extra cost. Sadly, the higher-ups didn't go for the price because they're used to AVG. :`(

Re:No more....

[Welsh Dwarf]

Correction:

The reason Norton is on any PCs is because Norton pays PC companies to install it by default AND IT IS ALMOST IMPOSSIBLE TO REMOVE.

Cleaning viruses off by hand is easier than uninstalling Norton.

Re:No more....

[mhall119]

Common knowledge generally doesn't require a citation.

Re:No more....

[mhall119]

It's crude, but a wonderfully accurate analogy. These conversations are like arguing over which condom gives you the best protection when screwing hookers, when the right answer is to just stop screwing hookers.

Re:No more....

[darien]

It is a resource hog of cpu, memory and hard drive.

I fear you're not up to speed with Norton's current line-up. Yes, some older versions were very resource-hungry, but the new 2009 edition adds only a few seconds to boot time and has a RAM footprint of just a few tens of megabytes when idle. Here's a brief review of it with a few facts and figures.

Re:No more....

[darien]

until I come across something that infects me with avast running

Don't assume you'll know about it...

Re:No more....

[Ngarrang]

So Norton finally got their act together with the 2009 version? Good for them. But, they have a long road to travel to fix the perception that their product is bloated. Such a history is difficult to change overnight.

Re:No more....

[kimvette]

Would you consider using ZoneAlarm for your software firewall (or get a "hasbro" level appliance for home if you don't have one and don't bother with a software firewall if the PC isn't mobile), and then a F/OSS AntiVirus package that does AntiVirus and ONLY antivirus? If so, then check out Moon Secure AntiVirus. I run it on my Vista installation (which exists for gaming).

On Linux, I don't worry about it. In fact, I submit bug reports to malware authors complaining that their crapware doesn't run on WINE and I feel left out. OH WOE IS ME!

Re:No more....

[RootWind]

In the past I would agree, but Symantec has really turned it around with their 2009 line. This is likely their first real overhaul in 7+ years, and they have come back with a vengeance. They finally fixed the two biggest annoyances of heavy resource use, and slow updates (pulse updates). Though I'm still an Avira, and Kaspersky guy, I can't recommend against Symantec any longer.

Re:No more....

[MBaldelli]

I usually replace Norton with AVG, and while I'm not a huge fan of AVG, I've never had anyone complain.

Allow me to be the first to complain. My experience with AVG is that it treated a patch to a game as a root-kit (false positive with every other AV software I've used since). And arbitrarily removed necessary DLLs for the phone software that I installed effectively rendering the interface unusable until I uninstalled AVG. (Another false positive).

Because of it misbehaving and not wanting to risk another false positive arbitrary removal, I have since moved over to ESET's NOD32.

Re:No more....

[maxume]

Windows XP, as of service pack 2, provides all the software firewall that an average user needs.

Re:No more....

[AceofSpades19]

The Sky is blue [Citation Needed]

Re:No more....

[Anonymous Coward]

I have eventually formatted my C drive clean and reinstalled XP from scratch to get rid of the damn thing.

Re:No more....

[jimicus]

May I recommend the Norton Removal Tool

It shouldn't need to exist in the first place, of course - the uninstall should work - but IME it works pretty well.

Re:No more....

[ceoyoyo]

It doesn't spread, so it's not a virus. More like a cancer. Or a birth defect, if it comes pre-installed.

Re:No more....

[JustinOpinion]

Norton is ... ALMOST IMPOSSIBLE TO REMOVE.

Which I found especially hilarious/frustrating when I was required to upgrade the version of Norton on a bunch of lab computers. The upgrade wouldn't work, and told me I had to uninstall the previous version. Turns out uninstalling the previous version was unbelievably difficult. The auto-uninstall didn't work. The Norton removal tool didn't work. Finally I had to follow a series of manual step-by-step instructions about what files to delete and what registry keys to modify.

And after all this pain and suffering to remove Norton... I had to install a new version. (That I knew would be a pain to eventually uninstall or upgrade.)

Needless to say I now avoid Norton like the plague. Yet I would argue that Norton/Symantec is widespread not only because of default installs--but because they seem to do a good job marketing to the higher-ups. They win large-scale deployment contracts, where the software annoys end users and many admins, but looks good and secure on paper, I guess.

Re:No more....

[kimvette]

Oh come on who are you kidding? It is easy to remove:

1. Log in as administrator
2. Open command prompt
3. cd \Program Files\ and rmdir /s Symantec
4. CD Common Files and rmdir /s Symantec
5. Open the registry and go to the SERVICES key and delete all the Symantec services
6. Open the registry and go to the RUN key and delete all the Symantec entries
7. Reboot
8. Install and run ccleaner, run the registry tool and let it clean up the now-broken library registrations
9. Use the uninstaller tool in ccleaner to remove now-broken uninstallers (that don't really clean up Symantec's poop trail ANYHOW)
10. Now try removing the directories again (steps 3 & 4) to remove the remaining Symantec poop

There, now Symantec PoopWare is now completely uninstalled. Now, wasn't that easy?

Re:No more....

[j79zlr]

Norton Removal Tool has worked very well in my opinion.

Re:No more....

[red star hardkore]

Not only is it because it is installed by default, but also because Symantec offer stores such low wholesale prices the profit margin for the store is huge.

While I was in college I worked as a tech part time with PC World who are one of the biggest offline PC retailers in Europe. The sales staff got extra commission if they sold Norton but standard commission for other AV products. Guess which one they pushed on customers. I actually felt guilty about even working there when I knew customers were getting ripped off so badly. Customers would come back a few months later complaining that they got viruses even though they had Norton. Although I was supposed to point to the 99.9% effectiveness label, and say they are within the 0.1%, and I would have to charge them 80 euro to remove the virus manually, my concience used to get the better of me. I'd tell them to uninstall Norton and get Avira or AVG for free and it would do a better job.

That was fine, until one day a customer complained to a manager that he had been sold bad software and that I had confirmed it. I didn't care, I was leaving soon afterwards anyway.

Back on topic... Symantec/Norton is one of the worst AV out there. They should spend less money on marketing and more on improving their product.

Re:No more....

[Anonymous Coward]

The Sky is blue [Citation Needed]

I'd go check, but that might constitute original research.

Re:No more....

[TheDarkMaster]

I can't say this better. Norton == virus

Re:No more....

[laffer1]

Many people had good experiences with their products in the past. I ran Norton since 1999 or so. At that point I was on NT4 and it worked better than the few alternatives for NT. You are also correct about marketing. Most products people mention now were not found in stores several years ago.

I got rid of it because the lowend version started incorporating their POS firewall but without configuration options. I've had nothing but bad luck with that firewall. It often gets damaged during updates and I'd rather use the built in windows firewall without any norton crap added on. Then when you combine trying to remove it, etc. It's really bad. Every year it gets worse and more expensive. I remember when you didn't have to buy a new copy every year. Those were the days.

I just wish clammwin could remove viruses. I love clamav on my mail server.

Re:No more....

[UberMorlock]

Sure you can. Just like a wife would recommend against trusting her husband just because he stopped cheating on her THIS YEAR, but had cheated on her in each of the last 6 years. Just because a change has been implemented does not mean that the change is permanent. Likely, this edition of Symantec is just a temporary reprieve from the all-consuming nature of Symantec products.

Re:No more....

[Anonymous Coward]

Removal tool works about 80% of the time. Sometimes it will tell you that you have a version that needs to be removed with add/remove programs, which invariably doesn't work.
Removing it manually is a gigantic pain in the arse.
Nortons is the worst I've dealt with in my career for sure.

Re:No more....

[NVP_Radical_Dreamer]

Or you could just use their removal tool which is much faster than a normal uninstall and removes all products in one fell swoop so there is no more removing their AV, then firewall, then antispyware etc

http://service1.symantec.com/Support/tsgeninfo.nsf/docid/2005033108162039

Re:No more....

[Anonymous Coward]

>6. Open the registry and go to the RUN key and delete all the Symantec entries
>7. Reboot

Norton likes to hook into stuff like the ATAPI drivers. If you kill all of the Symantec registry entries, neither Windows XP nor vista will be able to start. Easy fix with Vista, but on XP you're just boned. I know this from personal experience.

Just use the Norton Removal Tool provided by Symantec. It works really well, assuming your Norton isntall isn't completely FUBAR. If it is, well, you were probably due for a format anyway.

On another note, when Norton is uninstalled or the subscription runs out, it sometimes completely destroys the computer's ability to network. As in you can't even get an IP address. I can't count the number of times that a PC had mysterious network problems that were solved by Norton Removal Tool. And this is in addition to NIS blocking legitimate traffic like Windows file sharing. There really is no excuse for running Norton anything, let along Norton Internet Security.

Re:No more....

[darkmeridian]

The new version is supposed to be an entirely new rewrite. Not to push it or anything, but I read an article where the Symantec executive admitted that their previous software was shit, and they were starting anew. You know what they say about admitting the problem to be the first step to fixing it.

I hope Symantec goes back to writing their nice, clean antiviral software. I remember the good old days of Symantec not sucking.

Re:No more....

[Anonymous Coward]

Yeah, i tried that. And still from time to time the windows security center claims that norton antivirus (the anti worm part to be more exact) is out of date and/or disabled. That was preinstalled with the HP laptop. And the only way to get those bits of the system was a reformat/reinstall...

Re:No more....

[element-o.p.]

No, it's a greatly oversimplified analogy. It's easy to blame the end-user for doing stupid things on a networked computer -- and a lot of times, it's true -- but not all viruses and worms are contracted by visiting...ummm...questionable?...websites or clicking attachments in an e-mail.

If you recall, neither Slammer, Code Red or Nimda required user action -- they propagated by establishing connections to open ports. While "safe surfing" might be adequate for a techie users on a home network behind a highly restricted firewall, if you are responsible for maintaining a Windows network for a business, you absolutely *better* be using some kind of A/V on the corporate desktops and servers.

Re:No more....

[element-o.p.]

That was what I was thinking to all of the people who had posted along the lines of "I've used Windows since with no anti-virus, and I've never been infected!"

If you don't check, how would you know ???

Re:No more....

[Sancho]

Is AVG really that much cheaper? In my experience, most of the antivirus vendors are comparable in price/license/year.

Re:No more....

[Anonymous Coward]

And people say Linux isn't ready for the desktop...

Re:No more....

[AmberBlackCat]

Although I opted to run with no antivirus software at all rather than use Norton Antivirus, I still haven't found a better firewall than the one that comes with Norton Internet Security. There are at least two times that I bought it just for the firewall. I would love to know about a free alternative that is better, and runs on Windows XP.

Re:No more....

[Anonymous Coward]

Oh, you should try add/remove programs in control panel. If you still fail at life, Google "symantec removal tool" and it will completely remove any version of Norton Antivirus off your computer.

Your uselessness completely invalidates your opinion.

Re:No more....

[IceCreamGuy]

AVG is dirt cheap, and you get exactly what you pay for. I'm talking $1,000 for ~300 licenses; Sophos quoted me almost $11,000 for the same number. AVG is not a true enterprise-class solution, it's home software hacked (ugly hacked) into a networkable-ish product that barely does the job it's advertised to do. And although I've never owned any Symantec software, I have dealt with their consumer Norton product and if you thought that was bloated and ugly, well, I think you just haven't experienced AVG 8.x.

When I did look into a couple of the others while I was looking for a new AV solution, I found what you said to be true for most of the real brands; the difference between Sophos, TrendMicro, and others was pretty minimal.

Re:No more....

[Sancho]

Wow, that's pretty crazy.

I've never found AVG's free software to be that great, but I'm fairly certain that the last time it was installed on my computer was several years ago. It seemed ok, and it was one of the only free solutions which included on-access scanning. It never detected any viruses, so eventually I stopped using it, and shortly thereafter I started using Linux full-time, so I know that I'm a little behind the times.

Re:No more....

[MadMidnightBomber]

This CISSP says, "best analogy ever".

Re:No more....

[mhall119]

In the analogy, the "hooker" is the user's OS, not the websites they visit.

Re:No more....

[Anonymous Coward]

I remember the good old days of Symantec not sucking.

when was that?

Re:No more....

[Rogerborg]

Common knowledge generally doesn't require a citation.

Snopes confirms.

Re:No more....

[kesuki]

I hate to rant about windows firewall, i really do, so i'll let pcworld do it http://www.pcworld.com/article/39841/firewalls_plug_holes_revealed_by_security_test.html

i'll give you hint windows firewall in a leak test scored a 0 out of 6-7000 points. don't recall the exact total score, but windows SP2 firewall is not 'enough firewall for the average user' even the vista sp1 firewall has questionable merit being turned on.

Re:No more....

[blueskies]

Does linux need AV protection? I thought Linux didn't have any exploits?

Re:No more....

[Anonymous Coward]

are you joking? used sophos for 4 years and it couldn't catch a fly. mail scanning and heuristics were non existent and we were frequently attacked by worms. the only thing in its favour is that it is light on resources, probably because it is not doing anything.
i can only conclude that you are a PHB, or work for the marketing dept of sophos

Re:No more....

[Anonymous Coward]

Does anyone really need to support the argument that "crap is crap"? His real mistake was his redundancy.

Re:No more....

[antique future]

I'm not assuming. It's amusing that you took such a patronizing stance. As far as I am concerned, your comment is irrelevant. Most of the folks here have half a brain and know when they are doing something on the risky side. Your comment would have much more meaning in a forum where the folks don't know what heuristic actually means. Those folks probably won't know about it. It would take an amazingly skilled bloke to infect me or likely many of the people that will read this post. I'm usually virtualized, so unless the virus writer is more than the typical script kiddie that may get lucky, he won't get past the virtualization*. Before he gets lucky though, he would have to get past a few good scanners that I run. Avast just happens to be the one I like the most. I don't depend completely on any single scanner. I think it's unwise to put all your eggs into one basket in that respect. *Possible:http://en.wikipedia.org/wiki/Blue_Pill but unlikely.

Re:No more....

[Anonymous Coward]

Common knowledge generally doesn't require a citation.

[citation needed]

Re:No more....

[Thyamine]

Both +1 Funny and +1 Insightful.

Re:No more....

[maxume]

That article predates service pack 2. The firewall in service pack 2 and later prevents inbound connections from opening ports.

Preventing malicious software from opening outbound ports is a feature, but it doesn't really do a whole lot to add to the security of a machine (Yay!, my machine is compromised, but at least it isn't working for the bad guys, Yay!).

Re:No more....

[mhall119]

http://www.yale.edu/bass/writing/sources/plagiarism/common.html

and, just for the humor of it:

http://en.wikipedia.org/wiki/Wikipedia:You_don't_need_to_cite_that_the_sky_is_blue

Re:No more....

[Anonymous Coward]

Thank you, Nick Burns. :)

Re:No more....

[Cro Magnon]

I haven't used the latest Norton products, but the last time I used it, it was a total POS. If they have improved, it's too little too late.

Re:No more....

[steveo777]

So more like Down Syndrome, right?

Re:No more....

[Cro Magnon]

I remember the good old days of Symantec not sucking.

Wow, and I thought I was old!

Re:No more....

[Anonymous Coward]

you don't get much spam, do you. or you just ignore it...

in the old days compromised computers directly sent the e-mails to users, in today's captcha cracked world, they send the email to microsoft, yahoo and google, and of to e-mail users around the world. remember, if the captcha system isn't the end all be all of the system, if they block the number of e-mails a single ip can send if it belongs to an isp, and is likely not corporate traffic, then the spammers need a large number of bots sending unique spams to google, yahoo etc, if yahoo lets a user send 45,000 emails a second, then they only need one really fast internet connected machine with a lot of processors.

it all depends on the anti-spam measures in place. a good firewall that blocks outbound traffic raises the cost of sending outbound spam to yahoo etc, if a program adds executable whitelisting and blocking of traffic based on type of traffic, or of opening inbound ports... can stop an executable from modifying files etc... with say an ugly vista style popup... it helps increase the cost of sending spam.

if we can't add stamps to e-mail then we need to take measures (like the lameness filter on slashdot) to fight spam (the lameness filter is actually to fight trolling more than spam, but it does fight spam, the slashdot lameness filter is like a template for stopping spam if you're willing to inconvenience the user)

it even fights annoying chain letters and fourms. when do you see a slashdotter use a form like on usenet (aka google groups) chat groups. yeah google groops is the last vestage of usenet

Re:No more....

[kesuki]

yeah i got the wrong article, the article i was looking for was the one that linked to a test of newer firewalls and gave them a score of 0-7000

it sucks that the issue comes up again and again, i think the point though was that the newer article was about out bound protection, which let firewall vendors give sp2 firewall a 0 score while having a 7000 score for the high end products.

grc.com hasn't covered the issue since 2000, so he probably thinks the windows firewall is safe enough. that being said, this problem DOES crop up with firewalls that supposedly block inbound ports ALL THE TIME. especially hardware based firewalls based on skimming their code base from linux distros and not testing them vs leak tests or Denial of service attacks.

i think the most recent one was sending a packet on certain ports with certain datagrams that caused firewalls/routers/computers to be unable to send data as long as the packets were still coming inbound. (and in some cases caused crashes or forced reboots)

as a guy who plays online video games i can testify i have an affected wireless dlink router(their cheap one though), because the latest disc hack is based on the Denial of service attack, and just by playing online games for 45 minutes i am almost 100% for sure going to encounter a disc hacker. (this is only half the reason i don't play online games with the wireless router in between my pc and the net)

it's a cheat that doesn't go to the provider of the game, but rather to the people in the game, by getting their ip address through packet sniffing, which in an older game with no anti-cheat monitoring process, it's impossible to detect the putting the interface in promiscuous mode and correlating it with people disconnecting.

Re:No more....

[Anonymous Coward]

Want more unscientific evidence?

Doing tech support for Comcast, I'd have several calls every week from Norton users. Zone Alarm was probably number 2, but no where as close. Usually they'd present as being able to ping out, but not being able to use their browser or other apps. As soon as I heard they had Norton, the cause and solutions were obvious. Either a winsock catalog reset (in 2k/xp/vista: "winsock reset catalog"), or total uninstallation of the offending software.

Re:No more....

[ceoyoyo]

Yeah, that would work. I prefer to think of computers with Norton as the crack babies of the computer world.

Re:No more....

[Anonymous Coward]

andy zebrowitz

Re:No more....

[antdude]

All OS' have exploits.

Comment removed

[account_deleted]

Comment removed based on user account deletion

VB100?

[iammani]

Wow i thought VB was destroyed after VB6, and now there is a VB100?

Re:VB100?

[Anonymous Coward]

You're behind on the times, old geezer!

Tests need to evaluate _something_

[PhYrE2k2]

Take crash tests on new vehicles. Name me one that doesn't have a 5-star crash rating? The rating system is too easy, and needs to constantly be moved to achieve a new level of betterness. Not everybody should get A's. Once the majority of players reach a standard, the standard should be moved to motivate advancement in the field and show the better of the pack.

For example, the 5-star front-impact crash rating is par for the course now... but nobody seems to advertise the offset crashes, such as the right half of your bumper hitting the left half of your 'opponents' bumper. Why? Because it's sad in comparison. It's also not pretty to watch.

So all the power to making the standards hard to achieve. Yes this may not be the 'real world' threat, but it's a threat nonetheless. They're basically saying "Since England isn't going to declare war on the USA, any preparedness for receipt of an attack by the USA shouldn't be considered in overall military preparedness". That's of course rediculous. Protect only against the popular virus and the unpopular virus will begin to spread.

Re:Tests need to evaluate _something_

[thedonger]

In an unusual parallel, world famous rock climber Chris Sharma wanted to downgrade a rating on a climb - one of the hardest climbs of its type in the world. From what I gather, the reason was that you reach a point where the rating system becomes meaningless as higher and higher ratings are made, and you lose the context in which the previous ratings were assigned, and the foundation on which the rating system is based.

Re:Tests need to evaluate _something_

[PainKilleR-CE]

Take crash tests on new vehicles. Name me one that doesn't have a 5-star crash rating?

Most cars do not have 5-star crash ratings across the board (in fact, very few do). They might have a 5-star rating in one or two of the tests, but the reality is that in advertising if you get 1 5-star rating you advertise it, and if you don't, you just don't mention your crash ratings at all (just your number of air-bags and other safety features).

They also manage to advertise it even if only one package of several received a 5-star rating. Of course, your point still stands in one way: very few cars receive 3-star or less ratings, and it's not a required test to begin with...

For example, the 5-star front-impact crash rating is par for the course now... but nobody seems to advertise the offset crashes, such as the right half of your bumper hitting the left half of your 'opponents' bumper. Why? Because it's sad in comparison. It's also not pretty to watch.

Actually, it's two different groups doing the tests. 5-star ratings come from NCAP, which doesn't do offset tests. Offset tests are done by IIHS, and most cars receive a "Good" rating on offset tests, which is the highest rating they give. Further, when the IIHS releases their "Top Safety Pick" awards, they are usually advertised by the recipients, and the vehicle has to have received a "Good" rating in all the overall categories they test. Yes, the tests need to be better and the ratings need to be harder to achieve, but the IIHS has been pointing out that in the just over 10 years they've been doing the offset tests the industry has improved significantly in its results.

The rating systems on crash tests are based on hard numbers, and they list what those numbers are on their respective websites. If they change those numbers over time they remain relevant, though I'm not aware of them changing those numbers in any significant way recently. Of course, you do have to question whether or not it's really possible to get significantly better than a 10% chance of serious injury (a 5-star rating) in a crash test with current technology. They should probably increase the speeds on the tests rather than messing with the survival rates.

So all the power to making the standards hard to achieve. Yes this may not be the 'real world' threat, but it's a threat nonetheless. They're basically saying "Since England isn't going to declare war on the USA, any preparedness for receipt of an attack by the USA shouldn't be considered in overall military preparedness". That's of course rediculous. Protect only against the popular virus and the unpopular virus will begin to spread.

Actually, the tests they failed on were non-threats. Yes, I agree that they should detect breaches of vulnerabilities in the system (though I also agree with them that a known vulnerability should be patched), but the fact is that the reason they weren't detected is because there was no payload.

These tests are like doing the crash tests without actually causing a crash. We usually call those tests crash avoidance or brake tests, not crash tests, and there's a valid reason for both types of testing. You don't give someone a 1-star crash test rating when the car can't avoid a crash but still manages to prevent injuries to the driver and passengers most of the time. Similarly, you don't rate them well for braking and crash avoidance just because everyone can walk away when the car doesn't stop.

Re:Tests need to evaluate _something_

[barzok]

Name me one that doesn't have a 5-star crash rating?

Well, here's one.

Also keep in mind that when you see car ads saying "5-star saftey rating", the fine print typically says that it was for only one or two of the half-dozen test the NHSTA does. If you want a car that gets 5 stars across the board, that's not as common as cars which get a single 5-star rating.

NHSTA has one set of standards that all makers must conform to. The IIHS is NOT a government entity and is much harsher on vehicles.

Re:Tests need to evaluate _something_

[Anonymous Coward]

2009 BMW 5 Series 4-DR w/SAB - 3 stars in frontal driver rating.

I'm sure if you check out http://www.safercar.gov you'll find plenty more that don't get five stars.

Re:Tests need to evaluate _something_

[Anonymous Coward]

2009 BMW 5 Series 4-DR w/SAB - 3 stars in frontal driver rating.

I'm sure if you check out http://www.safercar.gov/ you'll find plenty more that don't get five stars.

Re:Tests need to evaluate _something_

[Vellmont]

Not everybody should get A's. Once the majority of players reach a standard, the standard should be moved to motivate advancement in the field and show the better of the pack. ...
So all the power to making the standards hard to achieve.

I find these to be odd statements. It was my understanding that the test is supposed to exist to give me an idea if I'm actually being protected from a threat, not as a giant dick-measuring contest. What you propose is an infinite "advance the field for the sake of advancing the field", which is great for people who care about such things, but past a certain point, pointless for everyone else.

My point is that a product can at some point achieve a level that's "good enough", and further measurement of it is pointless. Sound recording has essentially reached that level with the CD. There's products that offer "better" quality, but we've reached a point in sound recording where the differences are relatively meaningless. We haven't reached that level in anti-virus software (and likely never will since the target is constantly moving), but I'd say that a testing methodology should measure where you want to be, not ever-increasing goals.

Re:Tests need to evaluate _something_

[Sancho]

2009 Toyota Yaris has 4-stars for frontal impact, and is listed as untested for side impacts.

Re:Tests need to evaluate _something_

[Anonymous Coward]

Take crash tests on new vehicles. Name me one that doesn't have a 5-star crash rating? The rating system is too easy, and needs to constantly be moved to achieve a new level of betterness. Not everybody should get A's.

I disagree. For things like picking the best restaurant, a rule like "not everybody should get A's" may make sense. For safety ratings, you don't want to grade on a curve, you want a standard. And if you meet the standard, you meet it.

We would all like a car that uses fuel efficiently. We would also like a car that is built like a tank, and can protect us from horrifying accidents. These two work against each other. The tank-like car is heavier, and heavier cars will use more fuel. The government is already ratcheting up the standards for fuel efficiency, requiring higher and higher levels over time. Now you are proposing to also ratchet up the safety standards, requiring ever more tank-like cars. I don't see how we can ratchet up both at once.

Re:Tests need to evaluate _something_

[mgblst]

The climb hasn't gotten easier though, has it?

I am not sure about this reasoning. If more and more difficult climbs are starting to be used, then maybe we should go from 5 to 7 star ratings. Or are we getting charged per star these days?

Re:Tests need to evaluate _something_

[thedonger]

The climb didn't get easier. But perhaps it was acknowledged that new techniques - either training or climbing - made possible the ascent of the something that was before thought not possible. Also, it will put today's climbers into proper context with climber from 20 years from now. Someone in 2030 will wonder if Joe Climber from 2008 could have ascended a 5.20, the idea of which doesn't even make sense in the current context.

Comment removed

[account_deleted]

Comment removed based on user account deletion

That's why I

[svendsen]

I have different Anti virus product on each of my machines at home. I figure the gap of what they won't detect is smaller then what just having one product will detect.

Bullet proof? Of course not.

So far with Avast, AVG, (mind you one virus product per computer only) ZoneAlarm, FireFox, and some basic sense I haven't been hit.

My only issues (sad enough) is when a windows update broke Zone Alarm and when AVG detected Zone Alarm as a virus (cause a new version came out) and shut it down.

Now that i really think of it all the products designed to protect me have been the ones giving me all the trouble. HAHAHA (as I cry)

Re:That's why I

[IceCreamGuy]

I deal with AVG Network edition (which is the same as the free edition but not free and with a semi-functional control center), and I can tell you that they put a lot of what I would consider legitimate software in their defs. Their newest version 8 does not remember your exceptions correctly, either.

Re:That's why I

[Ilgaz]

The new version of Kaspersky and couple of other vendors who spends money to development instead of animated ads tries to go with "white list" approach.

For example, while it does very suspicious things (due to its function), Zonealarm is very known to the AV solution and once it is surely the ZA it trusts, it won't bother with it too much UNLESS it starts doing things which it isn't known to do. It adds lot to the performance and Kaspersky is the last vendor to blame about heuristics since its early versions. If they didn't do a lot of heuristics against unknown threats, they wouldn't be blamed for making it "slower" than free AVG and robbing the users.

I can understand why Mr. Kaspersky is particularly touched by the claim of the test and the products failure against imaginary threat. Kaspersky was one of the first AV solutions to run a small virtual machine and emulate things before giving them go. It is also running way deeper than many on the market (ring 0) so that is why it may create horrible slowness with hypervisor, emulation type of Windows. E.g. on Virtual PC 7, it is plain suicide to run it.

Re:That's why I

[kesuki]

well, i like comodo as a firewall far better than zone alarm. there ARE ways zone alarm can be replaced with a trojan that simply turns off all the firewall abilities of zone alarm. I've seen it happen in the wild, and was the primary reason i stopped trusting zone alarm. that was when i learned about comodo. free as in beer, and it includes code execution prevention on top of inbound and out bound firewall. yeah i know vista has code execution prevention, but it just says 'program x needs to to be run as admin and Bleep you up the ass'

comodo tells you what the program was trying to do, be it modify the registry (and even the key it's about to jack) if it's creating a file or directory, or replacing one, or even if god forbid it's trying to erase a file or directory. complete with file names and directories. hell it event ells you when iu's trying to open a port as a server, unless you mark a program as 'trusted'

does your firewall do that? why not?

Re:That's why I

[svendsen]

off topic to the main article ...

Comodo sounds really interesting will have to do more research. How is it telling you information about programs asking for internet access?

For example in zone alarm it will say XXX.exe wants access. When you click for more info it tells you jack (except a program wants access...duh) and you have to research it yourself? Is comodo better at this (I hope so)

The other thing I hate about zone alarm is every program gets added to the program list when you run it. So imagine a clean list and I open notepad, guess what notepad is now on the zonealarm list it isn't given access but it makes managing stuff a pain.

I will do my own research of course but you seem to really like it so figure get some second opinions.

Re:That's why I

[jimicus]

I have different Anti virus product on each of my machines at home. I figure the gap of what they won't detect is smaller then what just having one product will detect.
[....]
So far with Avast, AVG, (mind you one virus product per computer only) ZoneAlarm, FireFox, and some basic sense I haven't been hit.

I bought a Mac.

Re:That's why I

[thePowerOfGrayskull]

So far with Avast, AVG, (mind you one virus product per computer only) ZoneAlarm, FireFox, and some basic sense I haven't been hit.

Somehow with some basic common sense, no antivirus software*, and a hardware router/firewall, the last time I was hit was in 1988 - a non-destructive variant of Stoned which was transferred to my PC by infected floppy. In my experience so far, Antivirus is only necessary if you don't verify your file sources; and/or are in the habit of opening things without thinking. (Or allowing applications to do so for you automatically.) Common sense alone suffices to keep you safe.

I'm not saying that there isn't a need for antivirus - hordes of computer users rightfully don't /want/ to have to constantly worry about what is safe to open. This isn't their fault, any more than it's my fault when I expect my refrigerator to keep my food cold. My point is only that if you're knowledgeable about computers, and are willing to exercise some minimal caution, AV is a ripoff and a waste of system resources.

* I do periodically run various rootkit detectors, and ClamAV from a linux partition -- probably once a month or so, just to confirm that I'm still virus-free.

Re:That's why I

[kesuki]

i'm not booted into windows at the moment, but off hand it tells you in flat percentages the amount of bandwidth used by each active process, it has a full process tree of every running process and every file it's got allocated in memory, sadly programs that use svchost.exe still show up as svchost.exe but with the process map you can tell if say rundll32 is running svchost.exe and that's a big red flag right there.

it only warns you of specific ports when they're creating a 'listen' stack on the tcp/ip stack, so it's clearly monitoring the tcp/ip stack for new connections inbound and outbound although on outbound it only tells you the program.

oh yeah i forgot, it tells you when a program hooks in the keyboard or mouse, and it has a paranoid mode where it will give you more popups and allow finer grained control. it doesn't add every program (except for the active process map, but that's only active processes) and it logs activity it finds suspicious, and can even submit files to comodo if they're not on a whitelist of trusted apps, or ar anew different version.

i know comodo made the program for it's core business as security consultants so it really, really has a lot of awesome cutting edge features. anything a customer wants, goes on the feature list.

Re:That's why I

[kesuki]

then you're even more in need of some basic security. webkit is a fork of khtml khtml is coded by KDE, you know, Linux Desktop KDE. yeah, that is this culture in linux that it's all about the firewall. i have to admit the firewall is crucial to internet security, but for desktop security dealing with 'the pc is an appliance' crowd, more than a firewall is needed. malware sites running cross browser clickjacking could be coded and debugged with 1 macbook and desktop multi booting linux and windows xp/vista, in about half an hour, if your an experienced cross browser clickjacking exploit writing expert. the experience would involve at least 3 years coding browser exploit sites, and that means likely you're a salary man with the mob. which mob, depends on which language you're most fluent in. japanese, russian, english and/or italian. i'm not sure where the arabic languages or african languages fit in, but likely one or more of the bigger mobs has certain territory staked out.

desktop mac has one of the worst track records for fixing Known vulnerabilities. they're slightly worse than microsoft. the fact that most mac users think mac osX is like a super condom, when it's really the 'sponge' well, heck... true, browser exploits need to followup with malware to be persistent. yeah malware for mac os is different. but if they can make x dollars a year per infected mac user, and the typical mac user stays infected for y years where x+ y = z where z = 'the additional cost of developing mac based malware', then the business of being in the mafia makes it profitable.

i think one of the big things the mafia is missing out on is how much less money it would cost if their exploited machines became more secure from competing hackers, through the malware. but that's probably because the hackers getting paid have thought about it, and realized they could be laid off (not paid as much) if they had less work to do. when you're the employee and you understand the business far better than the owner, you can always seem to be swamps and be earning your guys a lot of money.. making you worth more.

up to a point, you don't want to do something they'll find out that would make them willing to put an international hit out on you. normal employers it's a little easier to fudge how useful you are.

Re:That's why I

[svendsen]

Which is fine. Though the cost to switch is way to high. I dont have a couple thousand of dollars laying around at the moment to get a mac, software I need, and to replace the external hardware (scanners, printers, etc) I have which are not compatible with the MAC.

Switching may be easy but it ain't cheap :-)

Re:That's why I

[jimicus]

Which is fine. Though the cost to switch is way to high. I dont have a couple thousand of dollars laying around at the moment to get a mac, software I need, and to replace the external hardware (scanners, printers, etc) I have which are not compatible with the MAC.

Switching may be easy but it ain't cheap :-)

Horses for courses though, isn't it?

I've never bought hardware which isn't cross-platform compatible because IME Windows-only hardware is almost always cheap, nasty garbage, and I don't know about you but I can get on just fine with a mac mini.

Re:That's why I

[Fallen Andy]

I do something similar (Avast installed, clamwin on a memory stick as a second opinion, sysinternals process explorer as the task manager and spybot-sd (minus teatimer). RegProt as a ersatz registry settings protector. In the last resort - and I have used it a few times I upload suspect files to Hispasec's virustotal..

(But for my non tech friends machines it's usually AVG + spybot. No zonealarm because it causes more grief for non tech users especially when programs update themselves).

Andy

Re:That's why I

[svendsen]

Depends on when the hardware was bought. I have stuff that is 5 years old that still does it job perfectly. Back then there was a lot less cross compatible stuff. Now a days if it can't support windows and OS X at a min. I don't buy it.

I can't get by with a Mac Mini. I *need* a laptop for my job and school.

Don't get me wrong I have nothing against Macs but people tend to forget about the costs to switch platforms.

Trust anti-virus ratings?

[olddotter]

I'd just like to be able to trust anti-virus software.

http://arstechnica.com/journals/apple.ars/2008/10/20/mac-malware-program-macguard-masquerades-as-antivirus-app

I'm getting really paranoid about things. I find myself avoiding any web service that wants me to download a app or plug in I'm not very familiar with.

Re:Trust anti-virus ratings?

[kesuki]

as a very paranoid person i have a few suggestions.

first off, there is noscript, no script only runs on gecko browsers, so you really only have firefox, icecat, ice weasel, and ephiphany, and whatever other gecko based browsers are out there... noscript is sexy, and was the first program to protect from clickjacking.

secondly i recommend getting a hardened firewall running on some cheap dumpster grade pentium 1-2,3 system, dumpster grade systems are easy to find, and if you cant' find one, there is always the option of hitting pricewatch.com and grabbing the cheapest 'no os' complete desktop, with the oldest, cheapest parts. for a beginner, smoothwall is pretty easy to learn. http://www.smoothwall.org/

i suggest going with half-open, and getting a crash course in what ports need to be opened for whatever you use besides web browsing.

then, you can worry about anti virus, and code execution protection, and outbound application level blocking on your native os. if your network isn't secure, then the best anti virus in the world isn't going to help you a lick.

Not a fan

[apharas]

I have been solidly unimpressed with the results from most of the main stream anti-virus vendors. There are of course huge trade offs between speed, usability and accuracy. I also don't like having programs think for me without giving me a viable option to change the way it's handling a situation on the fly. For my machines I've switched all windows machines to ESET's NOD32. All my personal linux boxes I have on F-Prot. -- a

Re:Not a fan

[Anonymous Coward]

I switched my XP machine to ESET NOD32 as well. It isn't the "best" one, but is light on resources and has good polymorphic virus detection.

Re:Not a fan

[b0bby]

+1 for NOD32. I've been happy with the way you never notice it, until it catches something. Just what I want from an antivirus program. We've been running it here for 3 years now, and no issues. It does help that we have a 3rd party scanning our email before it even hits our server, so we rarely get alerts.

Re:Not a fan

[Klaus_1250]

NOD32 used to be good, until v3 came along. Seems they spend so much time coming up with a noob-proof interface and ironing out all the bugs in the v3 series, they forgot to maintain a proper virus-db. Submitted samples were normally included in days, now some just aren't included at all.

Re:Not a fan

[element-o.p.]

I've put all of our Windows servers where I work and all of the Windows desktops at my wife's two businesses on NOD32 as well. I lost faith in Kaspersky after a virus outbreak on a network I manage despite running Kaspersky on the desktops and servers.

The only problem I've seen with NOD32 is that if your Internet connection isn't rock solid and reasonably fast, it will sometimes have trouble updating. I have a Windows server in a remote location that's across a satellite hop, and found that I couldn't update NOD32 on it from Eset's web site, but I *could* update it from a mirror on another server in my main office. Also, one of my wife's businesses is on a rather flaky ADSL connection, and I have had a lot of problems updating the machines there from Eset's web site as well.

What's a PoC?

[Anonymous Coward]

ok... anonymous coward for obvious reasons...

Re:What's a PoC?

[Anonymous Coward]

Proof of Concept.

They can all kiss my ass

[GuloGulo]

I have yet to find an anti-virus solution that doesn't

a) slow my computer down
b) continuously download crap
c) works as advertised
d) doesn't crash randomly
e) I'm sure there's a few other things I forgot.

When it came down to it, I got so tired of the hassle I installed Ubuntu to dual boot, and only boot into windows when I need to use the work related software I have.

And no, I don't use any anti-virus, as I'm never in windows more than a few minutes anyway.

So you can keep your apparently useless anti-virus ratings, and your anti-virus software too.

Re:They can all kiss my ass

[Anonymous Coward]

NOD32....

did you even look?

Re:They can all kiss my ass

[OrangeTide]

I had all sorts of troubles trying to install AVG on a heavily infected system. But once I installed it on a fresh system it was fine. If the virus scanner is blowing up, something is probably attacking it.

And yes, running Linux is a lot less of a hassle. And you don't have to buy a new $40-80 AV license every year or so. Also you can install ClamAV on Linux, it's pretty handy if you're allowing Windows users to upload/share files with your Linux computer. Also helpful if you're one of those poor saps that has to run Wine.

Re:They can all kiss my ass

[Anonymous Coward]

I have yet to find an anti-virus solution that doesn't
c) works as advertised

Ever tried Norton? I'm not sure you could say that works in any way, let alone as advertised.

Re:They can all kiss my ass

[nabsltd]

And yes, running Linux is a lot less of a hassle. And you don't have to buy a new $40-80 AV license every year or so.

The Symantec "Corporate" line of AV products have the advantage of not being subscription based (at least up to version 10).

Although only useful if you have more than one PC to protect (because the minimum number of licenses is 5), you end up paying about $40/machine for a permanent license (i.e., updates forever). I had been using version 7 for many years before jumping up to version 10 last year. It's not free, but it works out to about $10/year for my usage, and that's acceptable to me.

PoC == Proof of Concept

[Anonymous Coward]

I've never seen "Proof of Concept" abbreviated PoC, but there you have it.

Universal measurement

[noundi]

That's what happens when you stupify data, you loose data. Anyway Kaspersky don't give a rats ass about any tests, if it was them up there at the top of the list they would have nodded their heads and opened their pockets wide. And I wouldn't be surprised if someone fiddled with the software to the advantage of others, or even worse, fiddled with the logic. The anti-virus industry is ironicly equal to the medicine industry, same overadvertising unnecessary medication using scare tactics. It's simple folks, keep your fucking shit together, don't put your dick wherever it fits and then complain when it falls off because you eat 30 vitamines every day.

Re:Universal measurement

[gardyloo]

That's what happens when you stupify data, you loose data. Anyway Kaspersky don't give a rats ass about any tests, if it was them up there at the top of the list they would have nodded their heads and opened their pockets wide. And I wouldn't be surprised if someone fiddled with the software to the advantage of others, or even worse, fiddled with the logic. The anti-virus industry is ironicly equal to the medicine industry, same overadvertising unnecessary medication using scare tactics. It's simple folks, keep your fucking shit together, don't put your dick wherever it fits and then complain when it falls off because you eat 30 vitamines every day.

Well, that about speaks for itself . . ..

PoC = PoC (Proof of Concept)

[Anonymous Coward]

would have been nice if the submitter/reviewer put that in the description...

PoCs

[the_other_chewey]

OMG - I really know lots of IT and CS related TLAs (and even longer ones, only very few are shorter AFAIK),
but couldn't resolve "PoC" without RTFAing.

WTF is this, some kind of trick to make us read TFA?

Re:PoCs

[SatanicPuppy]

Proof of Concept; sad, but in Securityville this is actually used often enough that it would be considered a "normal" acronym. The debate usually revolves around the fact that a lot of PoC's are completely esoteric and can't be made into actual workable mass-market exploits.

Re:PoCs

[the_other_chewey]

Is there an acronym for "woooosh"?

Re:PoCs

[grcumb]

Is there an acronym for "woooosh"?

IMHO: no. YMMV.

HTH HAND

8^)

Re:PoCs

[the_other_chewey]

Is there an acronym for "woooosh"?

IMHO: no.

ITYM "AFAIK"

Re:I really could care less

[iamapizza]

By our assessment, your reply was irrelevant. However, this slashdot post proves that our definition of 'irrelevant' is wrong. Please consider any negative marks you receive as a positive.

TLAs

[pjt33]

My guess was that it's a politer version of PoS.

Open Source and Free

[speroni]

I've had good luck with a combination of Firefox with the No Script addon and Clamwin, and maybe just a little common sense.

I don't see why this is so hard..

[ethana2]

sudo apt-get purge virus

My favorite AV software:

[mcgrew]

Mandriva. Suse's pretty good too. Haven't tried Ubantu.

I have my home PC (and PCs of friends who want me to support them) dual boot, with networking disabled on the Windows side. As there are NO LINUX VIRUSES a setup like this needs no AV software.

This makes computing a brain-dead simple, and supporting friends' computers almost as easy. Without the need for AV the thing works faster, too.

Now mod me down, astroturfers. My karma can take it, even if the truth hurts you.

Re:My favorite AV software:

[Anonymous Coward]

Don't forget to turn off USB mass storage, Bluetooth, firewire, CDROM drive and floppy on the Windows side. maybe HHD too for extra security !

You'll be left with a safe, but almost unusable setup. The virus has got you, double backward. DUH !

Re:My favorite AV software:

[hAckz0r]

That's very strange. Then someone should go tell VirusList.com that because when I do a query for "linux" I get 1156 hits. Ok, so maybe they are not all technically viruses because the first 306 are classified as backdoors, then came the denial of services, then... I didn't look at the rest because I just got tired of clicking the next page button.

Virus or not, there is plenty of malware out there so it is still prudent to be regularly check your system and be aware of these threats, even on Linux. [c|k]lamav, chkrootkit, and rkhunter are your friends and don't mind working late at night while you sleep. Setting up ipfilter to to default deny for outgoing services is also a good idea. I like firestarter because it lets you monitor what apps are connected to the net on what ports to catch some types of covert channels and back doors.

Re:My favorite AV software:

[PainKilleR-CE]

As there are NO LINUX VIRUSES a setup like this needs no AV software.

Most are short-lived, but they definitely exist. There are also plenty of reasons that people wouldn't need AV software on any system, it's just a matter of how people use their systems and whether or not they trust everything that comes through their browser and email software.

Of course, it also helps to have a firewall, which should be considered far more important than AV software for everyone.

http://en.wikipedia.org/wiki/List_of_Linux_computer_viruses

I remember my college getting hit pretty hard by bliss in 1997. Apparently even the network admins had fallen victim to the idea that Linux and Solaris were safe and hadn't bothered to log in as a user to run some bit of code that wasn't part of normal administration. Of course, even some of the normal users managed to do a little damage running infected files on the networked systems, and the thing even managed to spread to remote users because the local ISP was run by the college.

In the end, bliss wasn't a hard mess to clean up (many versions included command line options that would clean themselves up for you). However, it impacted the network and its systems for two days, and the only problem the Windows users on campus had to deal with was the inability to turn in their CS homework with the mail server down.

Re:My favorite AV software:

[mcgrew]

I haven't seen a floppy virus for over ten years. In fact the only viruses I've seen in the last decade were internet viruses.

I never said the setup was impregnable. Trojans are (almost) as easy to impliment on Linux or Mac as Windows, and any computer can be cracked, given time and skill. But for a home computer, keeping Windows off the internet is sufficient.

Re:My favorite AV software:

[mcgrew]

You are correct; as I just told another guy, a trojan will work on any platform, and the only unhackable computer is a broken computer.

Backdoors, trojans, and DoSes are not "technically" viruses any more than a window is not "technically" a door and a screw is not "technically" a nail. And I doubt very seriously that Linux has 300 back doors; I'd be surprise dit it had one. If your source calls a trojan a "backdoor" your source is ignorant.

And yes, it's prudent to be vigilant. But with Windows, vigilance isn't enough. A Windows computer can be compromised before it can even be patched.

I see someone modded it "overrated", but there are a lot of microsoft employees on slashdot. I expected some asshat to mod it "flamebait" or "troll".

Re:My favorite AV software:

[element-o.p.]

Very true, but be aware that chkrootkit tends to have a lot of false positives. Still, it's better than nothing.

Re:My favorite AV software:

[mcgrew]

Of course, it also helps to have a firewall

I wouldn't run ANY system without a firewall. And your main defense against viruses (and trojans, which are NOT viruses, and worms, and power spikes, and faulty hardware) is backups of your data!

Another good idea (which Microsoft makes hard to do but most Linux distros do by default) is to have your OS and apps on a completely different drive (or at least partition) than your data. Then if your system does get compromised, reformatting your drive doesn't entail reloading all your data.

Re:My favorite AV software:

[Erikderzweite]

I haven't seen a floppy for years. Yet I see virii on flash usb drives very often. Thanks penguin that doesn't bother me, but not a few Windows boxes got infected via USB sticks.

Anti-virus products

[UberMorlock]

The last anti-virus program I had on my Windows install was BitDefender. I felt the program protected me well and also didn't use anywhere near the same amount of resources as Norton or McAfee do. At this point, I don't even bother paying for anti-virus programs for my Windows install anymore. I'm just not logged into Windows enough for it to be worthwhile and, even when I am logged into Windows, I have its network access blocked unless I specifically need something from the Internet (Windows updates, primarily). After that, I re-block its network access. All my web surfing, updates to my wife's website, and stuff like that is all done from within Linux. Windows is probably only booted for about 2 hours a month.

Re:Anti-virus products

[EXrider]

Windows is probably only booted for about 2 hours a month.

...and that 1st hour is spent downloading and installing the latest security updates and patches.

Re:Anti-virus products

[Anonymous Coward]

In contrast with daily patches for the latest linux kernel vulnerability...

Re:Anti-virus products

[UberMorlock]

Not sure which distro you're using, but I don't have daily kernel updates to do. In fact, I've got 14 updates waiting for me to apply them right now and not ONE of them will require a reboot. Contrast that with having to reboot nearly every time there is an update for Windows or a program that runs in Windows. In fact, the last time I had to install Windows XP for someone (pre-SP3), I had to reboot the dmn machine 14 times before all was said and done (and that was just for WINDOWS updates and not for any programs other than WMP - Office was never installed).

Why start from the back?

[AnalPerfume]

Why stick to an OS which is fully virus compatible? I know Microsoft try their hardest to be incompatible with everyone else to lock people into their systems but they do have the market sewn up on malware compatibility.

The whole anti-malware market exists to fit one purpose.....to plug the holes Microsoft's incompetence leaves behind.

The moral of the story is that if you insist on (or have to because of some proprietary software you need) using Windows you're never gonna be secure, no matter how many anti-malware programs you use because the underlying OS is a piece of shit.

Switching away from Windows to UNIX / Linux / OSX will give you a huge head start on security before you even start thinking of what else you can do to stay secure.

It's like choosing the back row as your starting point in a race, knowing you don't have a snowballs chance in hell of catching the pack, let alone overtaking them.

Re:Why start from the back?

[nabsltd]

The whole anti-malware market exists to fit one purpose.....to plug the holes Microsoft's incompetence leaves behind.

Although there is no doubt that there is a lot of poor code from Microsoft that causes some of the virus issues, at this point there is also no doubt that market share has a lot to do with it.

If Linux had even 25% desktop market share, there would be spam bots for it that would drive-by download from thousands of web pages. You don't need a root account in Linux to send e-mail...you just need an e-mail server running.

There are also a fair number Linux root exploits that require you to start as a user that is logged in locally. With more market share, these would be seen a lot more.

Re:Why start from the back?

[Darth Cider]

Why was this modded Flamebait?

Re:I really could care less

[Anonymous Coward]

I really could care less

The fact that you could care less than you currently do suggests that you do in fact care. However, this conclusion doesn't quite fit with the general tone of your post. Could you clarify, do you or do you not in fact care?

industry created whole

[QX-Mat]

Proof of concepts are tangible vectors to infection. By not including and rigerously detecting such methods, they AV companies will allow more viral products into the market. This is a very self-serving stance.

I actually see problem of trust emerging. Once upon a time KAV was a brilliant peice of software that ran in DOS well enough to remove the plague of Win95 Marburg infections that hit the UK gaming community after a bad cover CD. That was a time when viruses existed, and you had to stop them infecting you. The prospect of new and novel viruses infecting you wasn't really an issue as home Internet penetration was small. As such, AV software wasn't marketed as the only thing you needed to stop all viruses forever, but as a tool that will detect more than its competitor more reliably. The money you paid was for a good huristics engine that was fast, efficient and more importantly, updated reguarly.

Now I see AV products as nothing more than 'ineffective-ware'. If AV programs claim to prevent the infection of known viruses, and reduce to risk of infection from emerging viruses, I'd probably have more faith in the industry. But they don't... in subscribing the "we can protect you from everything" marketing hype, almost every AV company has asked us to put faith in their product to stop "unknown" viruses... and we expect them to.

They don't. It's a computational nightmare.

KAV are in a past mindset. They have to change. They have to consider that what people really want is reliability - they want software guarantees. If any peice of AV software is going to help the market rather than hinder it, it is going to be reliable. What is the most reliable part of an infection? The vector, not the virus itself.

The truth is really in the pudding. Viruses have changed. Almost all now are polymorphic and highly reentrant. A few lines of code will change a signature making it undetectable. Fnfection is detectable at the point of entry. If the research is put into proof of concept code in making a system vulnerable, then the AV response should be to track and thwart that success.

Matt

Re:industry created whole

[Sancho]

Most AV these days actually use heuristics to guess at whether a program is malicious. There's not much better that they can do, for the reasons that you point out. But a POC exploit without a payload is not malicious, so why should the AV fire? Kapersky is doing the right thing here.

As for the marketing aspect, sadly, that's just business. Every AV vendor out there makes the same claims. If one of them made weaker claims than the others, they might get your business for their honesty, but the pointy-haired bosses out there will compare the two and say, "This one prevents unknown viruses. Get that one."

Process - Not Product

[Exanon]

Call me a Schneier fanboy, but I practice security on my home network like a process, not as in buying a product and be done with it.

Security for me begins with sensible configuration of the router and the PC's on the network, then it moves to access rights and regular patching of said computers.
This includes regular checkups and glancing at logs every three days or so to look for obviously suspicious traffic. Finally, after all of these steps, I use Kaspersky (since I had heard good things about it) together with rootkit detector. (Oh, and Firefox with NoScript)

All of this prevents pretty much all the scriptkiddies from getting in (I hope), but then again, the best thing you can do is to not download anything you don't know what it is.

Re:Process - Not Product

[strjms72]

there are various types of users so you cannot expect everyone to know what's good to download and what not. so that's why there are commercial AVs that fill that market...

Re:Process - Not Product

[Anonymous Coward]

Jeebus dude, why are you still battling away with Windows? Get a Mac or Liux or *BSD. Windows is procedurally broken.
You can still boot into windows for games, but dont use it as a general purpose OS.

I know, I know, I know, but one day you'll realise I'm right. You'll look back and think 'What the fuck was I doing running and OS that needs AV?'

Re:Understand first, then pick sides....

[Ilgaz]

I suspect the imaginary threats they fail is like the usual wintrolls argument "So do you think Linux/OS X is secure? Run rm -rf / and see what happens." They run a test which no actual virus/worm author (it is a money making industry) will bother to code and they blame real life solution failing to detect it.

Couple of worms actually install pirate Kaspersky with a special setting to ignore them so they are sure they are the only malware they are running. That is the prestige of Kaspersky for you and state of current threats. Virus/Worm writing as way beyond the amateur sickos writing malware now. It is a huge industry in black hat terms.

obligatory

[Luke_22]

Xkcd explains it all.

Re:I really could care less

[pmbasehore]

That's all fine and good for personal use, but very few businesses can be 100% *nix. Anti-virus software exists for Linux and Mac because they are often networked with Windows machines.

Anything networked to a Windows machine can send a virus to that machine, regardless of the operating system.

2009?

[antdude]

Have you tried 2009 versions? 2009 version is a total rewrite from scratch. Installs and uninstalls can take about a minute on a fast computer. Low memory usages (no hogs).

Re:Understand first, then pick sides....

[guruevi]

Technically, your operating system should protect you against that in the first place. I don't even know why there are still antivirus programs in this world. We had virusses back in the day of DOS when memory was accessible by anyone and everyone had the same permissions (even back then, OS/2 and other OS'es had better functionality without virusses) but nowadays, the only reason your box should be rooted is because of an exploit in a misconfigured box and nothing can protect you against that.

I was going to say: Anti-Virus programs, how quaint but then again, there is still an OS out there that is criminally retarded.

Re:I really could care less

[somersault]

Damn. I knew I should have shelled out extra for the anti-virus option on my toaster.

why bother ranking AV crap?

[Sloppy]

It seems the industry still can't agree on the best way to rank AV vendors.

That's like saying it's hard to rank which kind of banana, when put into your ear, is best at keeping elephants away.

Ranking AV vendors is pointless, because the products are useless. If your policy is to download and execute random software, hoping that an AV system will filter out the malware, you are guaranteed to eventually lose, no matter how good the AV software.

The title should be "Can you trust Kaspersky?"

[Zakabog]

The title should say "Can You Trust Kaspersky?" Since the article is basically Kaspersky complaining that the Anti-Virus test (that his software just failed to score 100% on) is flawed. It sounds like Kaspersky is just upset that his software didn't pass the test and he's now trying to dismiss the test as meaningless.

Although if you look on the products page you'll see they display the VB100 logo. Then in the article Kaspersky goes on to say - "The products which have a very poor level of protection, they have the certificate, while products which have a very high level of protection, they donâ(TM)t have the certificate."

Well his product had the certificate, does that mean he feels that his software had a very poor level of protection?

Inherently corrupt...

[argent]

Unfortunately there seems to be some kind of inherent corruption in the way the antivirus industry operates. I'm sure that most of the individuals involved are as honest and honorable as they can possibly be. The problem isn't really in the people, it's the way they have to operate.

But the result is the same. Anything that comes out of there has to be treated with extreme skepticism, whether it's antivirus software for operating systems where there's not even a credible infection vector, or attempts at taking over operating system responsibilities, or the way they tiptoe around huge lacunae in Windows security model...

Not necessarily

[Sycraft-fu]

For something like crash testing, the ultimate limit is the human body. You can only survive an impact of so much. So if the car can survive more without a catastrophic failure, well it really isn't meaningful. So I can see having something like a 5 star rating meaning "The car can take more than you can." Basically that you are going to die from acceleration shock before something in the car would fail in such a way as to cause injury/death.

Continual raising for the bar for it's own sake isn't always useful. There are realistic limits to consider, in this case the limitations of the human body. I'd say that so long as the car doesn't fail in a way that would cause injury or death before the point where a person is going to die anyway because of the sudden acceleration, then it is a top level rating. If an acceleration from 100kph to 0 in a fraction of a second will will me, I don't really care about the different between a car that will have it's cabin survive or one that will collapse at 150kph to 0. It's already past the point I'd be dead anyhow, if the car fails it doesn't matter.

Re:Not necessarily

[kesuki]

5-point harnesses have been known to be safer than tri-point lap/shoulder belts, yet other than baby seats, where the size is age based, and which can be sold second hand at thrift stores.. the only people using a 5-point harness (and a whiplash restraint) is nascar/truck racing.

the problem, adjustable 5-point harnesses are a real pain and so the big auto market 3-point 'height adjustable' restraints as an improvement over lap belts. when adjustable 5-point restraints become affordable for the consumer segment, someone like lexus will market them to doctors who see the car crash victims at work will at least be willing to buy into 5-point harnesses.

kinda like how airbags that only actuate if a adult is sitting in the seat are considered the bastion and savior of human kind, by slowing down our forward progress in a high speed crash. the tech got cheap enough to make it a selling point. yet i don't see nascar using airbags, while they do use 5-point harnesses. the 5 point harnesses probably have a gradual release on impact rather than a hard stop. it's not impossible to design such a feature in the 4 digit price range. the easiest way to get gradual release it to take advantage of silk's tendency to stretch slowly when force is applied. silk seat belts would be expensive especially in a 5-point but they'd be safer than cotton.

Review Sites

[Anonymous Coward]

There are many sources for getting detailed information on anti-virus software. Sites like www.toptenreviews.com and www.starreviews.com have both expert and consumer written reviews and rankings.

Re:Understand first, then pick sides....

[PainKilleR-CE]

For the most part under Vista and XP you get a virus for the same reason you would on any other system:
- You haven't kept things up to date (installed patches for vulnerabilities)
- You have a user running with escalated privileges that is doing something they shouldn't be doing.

The biggest problem with Windows remains that by default you run as administrator. Vista made it less painful to run as a standard user, but still left the default user account as an administrator.

Additionally, since it has always been common for Windows users to have administrator access, a lot of software assumed it was available or did things that required administrator access when they didn't really need it. This meant that when Vista was first released, it was common to get prompted for administrator access when installing non-administrative software and performing some actions that wouldn't normally require administrator access (like running a game, for instance).

This meant that early adopters were either conditioned to grant programs access that shouldn't have needed it or turn off User Access Control (which additionally had/has some performance penalties associated with it), which returned them to the previous state of Windows where everyone ran as administrators and didn't know whether or not the software they are using is doing something it shouldn't be doing.

At this point it's far less common for programs to try to gain administrator access in Windows, but until MS changes the defaults and makes the primary account a user account, or somehow makes it more annoying to run as an administrator than as a normal user (which would just piss people off, I'm sure), these problems will still persist.

Personally, the company I work for mandates AV software on their computers, so the computer I work on, which is technically better than the computer I use at home, is slow and has unusual glitches (like random blue-screens when working with a lot of open files in varied programs that require a lot of resources; or the long periods of thrashing on the hard drive as the virus scanner tries to scan every file I'm accessing).

At home, where I switch between Vista and Linux, I don't use AV software unless Vista starts misbehaving. The computer is much more stable and much faster than the work computer, and when it does start acting up I usually find that it's some piece of spyware that most AV software won't pick up anyway (and running 1 or 2 spyware scanners picks it up right away and kills it). So, someone gets to spy on my surfing habits until they get annoying, and they get the boot.

Of course, I don't assume my Linux system is secure, either, I just don't run a stable enough Linux system to worry about it, and reload the whole thing every other week.

Doesn't actually mean it's better

[Sycraft-fu]

I've found that some AV scanners are too paranoid, they detect things that aren't really problems. Sophos, for example (which I pick on because it's an amazing piece of shit and we have it at work) gets all suspicious of the VMWare Tools client, and the Intel Audio Drivers because they modify the registry. Yes, really. It pops up a warning, though it doesn't stop them. I've seen other virus scanners that get set off by game trainers. They hook in to monitor key strokes, and the scanners think that's bad behavior.

So just because it finds more, doesn't mean it is right. I had that problem with AVG. Kept giving false positives. NOD32 I find is much better at that (not to mention a lighter weight program) though I still caught it on one false positive.

The question isn't just how many baddies does a program catch, but how good is it at not flagging legit programs. I mean after all, I can make a 100% effective virus scanner so long as you don't care about false positives. I'll just stop any program that isn't on a specific white list from running (or heck, maybe any program at all). Done. Not so useful in the real world though.

I've never used Kaspersky so I dunno how good it is, just saying that a high catch rate isn't necessarily indicative of a good program, maybe just a paranoid one.

You can just do not use any antivirus

[TheDarkMaster]

After all, no one antivirus can protect from unknown virus, for example here have many crappy "virus" (bankers stealers from script kiddies) not found on any other country. The best protection still is a educated and alert user.

Re:I really could care less

[Lostlander]

You have a Networked Toaster?

Used Many AV over the years

[GlassHammer]

My Progression in AV software went: Mcafee-> Norton AV -> AVG -> AVG + No script + Zone Alarm -> Linux (Fedora 9)with Clam AV -> Linux F-Secure (trying it out) What sparked the changes in AV was always "Computer Performance". Some of the above devoured my computer and left me with little reasources.

AV-Comparatives

[bendodge]

http://av-comparatives.org/ provides pretty decent testing. The most recent results are as follows:

Advanced +
AVIRA
GDATA
Symantec
McAfee (with Artemis)
Avast
TrustPort
Kaspersky
AVG

Advanced
ESET
BitDefender
F-Secure
eScan
Sophos
Norman

Standard
Microsoft
McAfee (without Artemis)

No Award
VBA32

TRUST THIS (layered security), &, a test

[Anonymous Coward]

"Ok. Then what can we trust?" - by 404 Clue Not Found (763556) * on Thursday October 23, @09:49AM (#25481201)

HOW TO SECURE Windows 2000/XP/Server 2003 & even VISTA, plus, make it "fun-to-do", via CIS Tool Guidance (&, beyond it's "industry best practices" for security):

http://www.tcmagazine.com/forums/index.php?s=49125ef36605621c1a4c34eb160411a9&showtopic=2662

----

You can trust that material in the URL link above! Mainly because it's YOU doing the work, yourself, albeit, with a tool that makes it some fun, & explains why you are weak in a particular area in securing your own system, yourself, with a fun to use tool to do so.

The CIS Tool test is much like PC performance benchmark, but this one's for security!

(&, it reviewed well in COMPUTERWORLD no less for doing so)

So, it's a test (which is what you asked for in fact) to quantify your improvements, after you do the work securing yourself based on its advisements (& points that go beyond just that test only are also in that guide above)

E.G. -> In not quite 1 yrs.' time online, it's passed over 200,000 views on the 27 forums its on, & people are doing well using it... but, take a peek @ it yourself, & YOU judge, as to whether it can help YOU, help yourself, vs. the threats present online, today.

----

"Without some sort of test, however imperfect, how is the average home user supposed to choose?" - by 404 Clue Not Found (763556) * on Thursday October 23, @09:49AM (#25481201)

Layered security!

( &, that's what that post from Tech Connect Magazine gives you, & shows YOU, the end user, how to do for security of your system today, online... &, as a bonus? You'll even end up surfing F A S T E R as well... )

The problem with today's antivirus programs is that they're largely MOSTLY "signatures based" & with polymorphic viruses that can "mutate" into ones that look totally different to an antivirus program (defeating signatures based detections) from one minute to the next?

HEURISTICS ("looks like a duck, sounds like a duck, smells like a duck - IT MUST BE A DUCK!" type logic) is the way to go for them, alongside whitelisting &/or blacklisting of applications allowed to run!

I mean, take a look @ this CURRENT information on SECURITY SUITES failing left & right on tests run, vs. the threats out there, TODAY (not yesteryear tech in them):

----

Top security suites fail exploit tests (COMPUTERWORLD):

http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9117042&intsrc=news_ts_head

&/or

Top security suites fail exploit tests (SECUNIA):

http://secunia.com/blog/29/

----

The "old-school methods" (what security suites use generally - like anti-virus programs using virus detections signatures, which only work vs. KNOWN threats, when they ought to be concentrating on white or blacklisting sites &/or HEURISTICS levels of detection ("smells like a duck, tastes like a duck: IT MUST BE A DUCK!" type logic))

Signatures-based detections aren't working that well nowadays guys, vs. std. viruses... & MOST of what folks get today? They're bad javascript driven (in combination with iframes &/or bad or vulnerable plugins) usage, anyhow. AntiSpyware programs do better here, imo @ least, than antivirus programs do. By far...

After all, you know it, & I know it:

People - The REAL, TRUE threat's out there today are coming thru your email, webbrowser, instant messenger programs (& even Adobe .pdf files with javascript active in the program,

Who writes the viruses?

[DeskLazer]

Sometimes I feel like the AV companies are the ones who write the viruses, or at least the different strains, so that everyone will be scared into using their anti-virus product. Does anyone have any proof or thoughts on this?

I am a Norton user myself, mainly because my University continues to pay for licensing for it and I've only had one real bad outbreak in the past 6 or 8 years [and it was caused by my family using my computer]. I remember people sang praises of NOD32. Anyone have any experience with that AV?

Also, I think Mcafee is pure trash, considering how many viruses I've cleaned up on friends' computers that had a working subscription that they were doing updates on. *shakes head*

AV industry has halted innovation

[akad0nric0]

"I don't want to say it's rubbish," Kaspersky told PC Authority. "But the security experts don't pay attention to these tests. It doesn't reflect the real level of protection."

That's right. Security experts recognize Anti-Virus for what it is: an outdated security mechanism which amounts to nothing more than an IPS for your system, detecting known threats. I'm glad this industry is finally starting to realize their approach is ineffective against modern, sophisticated adversaries.

...just remember this when they try to tell you their product protects from "unknown" or "future" threats - threats that start as POC's, or are built from POC's to specifically target your company. These are rubbish to AV vendors. They don't care about these "hard" problems, and have no interest in protecting you from them.

I see it as tacit acknowledgment that their industry has given up on innovation.

Re:AV industry has halted innovation

[GlassHammer]

I look at the same way I view home security: "You want to be more secure then the next guy and hope the bad guys go for the easier victim."

XKCD FTW!

[RedDirt]

Once again, XKCD predicts the future:

http://xkcd.com/463/

Dang that guy is scary ...

Of course it's ALL bullshit

[gelfling]

There is NO reliable taxonomy for even what a virus is let alone what they can and cannot do to you. More often all AV vendors look for things THEY ARE ABLE TO FIND. And they ignore everything they are not able to find and declare them meaningless. Moreover you really don't even know if what they find when they find it meaningful. When I see a P2P file that 'exhibits traits of xxxxx.xxxxx.' and the tool asks me what to do, I kind of have to accept as an act of blind faith that a) they really found it b) they really found something c) that something is a virus d) it's not a false positive and e) they can actually control it.

Don't use Windows....

[KozmoKramer]

Use Linux or purchase an Apple and your Virus troubles will go away.

Put your "pecker" anywhere you like, & here is

[Anonymous Coward]

"That depends, do you walk around all day with a rubber on your weiner? No? Newsflash, niether does your computer" - by noundi (1044080) on Thursday October 23, @10:15AM (#25481543)

Mine does, lol, essentially!

AND?

So can yours, or anyone else's, via following some simple steps (many common sense, others more complex), via this guide (which has you use a noted test of your system's security, which is multiplatform (not just restricted to Windows, but also to many *NIX variants as well), called CIS Tool):

----

HOW TO SECURE Windows 2000/XP/Server 2003 & even VISTA, plus, make it "fun-to-do", via CIS Tool Guidance (&, beyond it's "industry best practices" for security):

http://www.tcmagazine.com/forums/index.php?s=49125ef36605621c1a4c34eb160411a9&showtopic=2662

----

The CIS Tool test is much like PC performance benchmark, but this one's for security!

(&, it reviewed well in COMPUTERWORLD no less for doing so)

----

"so stop putting it's dick everywhere." - by noundi (1044080) on Thursday October 23, @10:15AM (#25481543)

I can, & DO, because I use a simple concept, that works (no virus/worms/trojans/spyware/malware-in-general here, for more than a decade++ now in fact, because of this) -> I practice a thing called "Layered security", nowadays, & yes, it works!

( &, that's what that post from Tech Connect Magazine gives you, & shows YOU, the end user, how to do layered security of your system today, online... &, as a bonus? You'll even end up surfing F A S T E R as well... )

See - The problem with today's antivirus programs is that they're largely MOSTLY "signatures based" & with polymorphic viruses that can "mutate" into ones that look totally different to an antivirus program (defeating signatures based detections) from one minute to the next?

HEURISTICS ("looks like a duck, sounds like a duck, smells like a duck - IT MUST BE A DUCK!" type logic) is the way to go for them, alongside whitelisting &/or blacklisting of applications allowed to run!

I mean, take a look @ this CURRENT information on SECURITY SUITES failing left & right on tests run, vs. the threats out there, TODAY (not yesteryear tech in them):

----

Top security suites fail exploit tests (COMPUTERWORLD):

http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9117042&intsrc=news_ts_head

&/or

Top security suites fail exploit tests (SECUNIA):

http://secunia.com/blog/29/

----

The "old-school methods" (what security suites use generally - like anti-virus programs using virus detections signatures, which only work vs. KNOWN threats, when they ought to be concentrating on white or blacklisting sites &/or HEURISTICS levels of detection ("smells like a duck, tastes like a duck: IT MUST BE A DUCK!" type logic))

Signatures-based detections aren't working that well nowadays guys, vs. std. viruses... & MOST of what folks get today? They're bad javascript driven (in combination with iframes &/or bad or vulnerable plugins) usage, anyhow. AntiSpyware programs do better here, imo @ least, than antivirus programs do. By far...

After all, you know it, & I know it:

People - out online, today/nowadays?

The REAL, TRUE threat's out there today are coming thru your email, webbrowser, instant messenger programs!

(& even Adobe .pdf files with javascript active in the program, & plugins like Adobe Flash (which I guessed correctly on here weeks before it was revealed ->

Fail test, denounce it?

[Anonymous Coward]

Is it any surprise that the company that fails these tests will denounce them?

Your brief review is possible shilling

[TravisO]

You do realize that's it's possible, albeit likely Norton encouraged them to write the review?

I believe this is tangent to the point of the /. article: not only are tests flawed, but you should inherently not trust any major news source to unbiasedly review a product.

- Why do they only compare it to Kaspersky?
- Why do they mention ram but not a speed comparison (I'd gladly give up 15mb of more ram just to have better performance in my AV, ram is dirt cheap)
- If NIS2009 is so "lite", why don't they mention the specs in comparison to older NIS (only Norton would want to cover up their old specs, which is a core issue that makes me suspect this is a shill article).

Not to mention I never trust any online news source, including tech sites, to have somebody savvy enough to know how to test an AV properly, which, as the /. article points out, not even the AV "experts" have figured that out, much less some tech site.

Re:Your brief review is possible shilling

[antdude]

Why don't you try it even in a virtual/test machine if you're scared to try it?

Norton for Macs

[soren100]

Norton is ... ALMOST IMPOSSIBLE TO REMOVE.

Which I found especially hilarious/frustrating when I was required to upgrade the version of Norton on a bunch of lab computers. The upgrade wouldn't work, and told me I had to uninstall the previous version. Turns out uninstalling the previous version was unbelievably difficult.

My dad runs OS X, but got some emails with a note that said a virus had been removed by his email provider. The messages about a virus were worrying enough to him that he asked my brother (a PC user) about it. Norton was buggy, annoying, caused all kinds of problems with surfing and email, and was almost worse than getting a virus. My dad was really annoyed when he found out that Macs essentially don't get viruses and don't need antivirus software. And just like a virus, it was just about impossible to remove.

Funny note -- I had a friend that worked for Mcafee -- she (and her tech support buddies there) were sure that they hired people to write viruses to increase the demand for antivirus software.

NOD32 *

[x102output]

NOD32 FTW!

Try Free Avast Antivirus

[ITJC68]

For these people who are paying for antivirus. I had a commercial AV of CA antivirus and it didn't detect anything like Avast did and they were real virus programs that were on system. This is the free version plus not running any programs that I don't know and not going to pron sites no worries.

Testing for testing sake

[Dark$ide]

In the wonderful land of Microsoft windows there's a threat of a virus/trojan/malware since Win3.1 with the glut of boot sector viruses that were popular when folks shared floppy diskettes - I don't understand why Microsoft haven't done more to fix it (perhaps they like folks making money from selling anti-virus software). The average threat currently lasts about a week before the virus writers move on to the next virus/trojan/malware and the old one starts to die. So the primary need for anti-virus software is to prevent the zero-day threat.

When folks publish an article saying company X anti-virus found nn% of the viruses we threw at it in our testing. That's nonsense, it should find 100% (unless the testers are writing new viruses or re-engineering old ones). If it doesn't then I don't want it.

On the whole they would do much better to assess the anti-virus on a) how it reacts to a zero-day threat, b) how much performance it takes out of your CPU and/or hard disk, c) whether it has to scan the whole disk every day/every week/every month or whether it has a constantly running service. Assess anti-virus on cost/performance. How often does it update, how fast does the vendor get the updates puushed out to the users to protect from something new. How much do they screw you for annual subscription.

In general I'm happy running freeware anti-virus like AVG or Avast. (On my linux machines I simply don't bother with having any anti-virus.)

Insightful? WTF?

[jagripino]

Windows has been doing that now for quite a while, with the warning bit and all!

Re:Insightful? WTF?

[hairyfeet]

Actually,no it doesn't.

How often does a user actually WANT to change a file extension? I know that in my day to day I've had to change a file extension maybe twice in 10 years,and that is probably overstating by at least one change. But when you have "hide file extensions for known file types" unchecked,and you right click and pick rename,WHAT does it highlight? The entire file,INCLUDING the file extension. So quickly the user gets pissed because he fucks up the file extension,then has to pick "no" and undo his rename becuase he doesn't know WHAT the original file extension was,and THEN he has to rename by typing the whole name or clicking multiple times until he gets ahead of the dot 3 extension. Does that sound intuitive to you? Try switching a user to shown file extensions and see how quick they call you because "something is wrong with my PC" and you have to undo it.

To this day the only thing I have seen handle it correctly is Xplorer2 file manager replacement by Zabkat. When you have file extensions visible and click rename,guess what it does? That's right,it puts the rename BEFORE the dot 3 extension,and keeps you from changing the file extension unless you go out of your way to move the cursor and change it!!! Now doesn't that make a whole lot more sense? Lets face it,99% of your users are never going to need to mess with the dot 3 extension. Yet with Windows either you hide the extension or every time you hit rename and backspace the FIRST thing it does is clear the ENTIRE file,including the extension! So I'm sorry,but that is still all or nothing in my handbook. Instead of making it intuitive,they made it a royal PITA to not have the extensions hidden. Just dumb design and it makes the user hide the extensions or get slowed down in his work.

Re:Insightful? WTF?

[david_thornley]

But when you have "hide file extensions for known file types" unchecked,and you right click and pick rename,WHAT does it highlight? The entire file,INCLUDING the file extension.

I have a Vista SP1 box here at work, and Vista seems to work right here. I clicked to rename a file in Explorer, and it highlighted everything up to and not including the period. It appears to work just as you think it should.

So, that's an advantage for Vista over XP that actually applies to me. It still doesn't make Vista anywhere near as good as XP, but it's a start.

5-point nay

[PhYrE2k2]

5-point harnesses are not safer than tri-point for street use. The 5-point harnesses do hold you more securely in your seat, which enables you to be more functional in high-g cornering and similar. There's no denying that it holds you firmly in your seat and distributes pressure better.

That said, the main issue with 5-points is rescue operations. With a tri-point, an emergency official can pry open the door and slide you out of the car without ever releasing the belt. Having the open side enables emergency officials to save your life in the event of its need.

-M

The chickens come home to roost

[Master of Transhuman]

This is an example of how the entire IT industry sucks rocks. This industry couldn't produce a reliable, cost-effective product if not doing so meant the world would explode.

Various tests by AV rankers have shown almost all the AV products on the market can't even come close to detecting spyware (as opposed to viruses and worms) - test rates were around sixty percent or lower, including the big names.

ClamAV's detection rate sucks rocks.

So of course some people try to prove it's REALLY not that bad by doing tests with selected malware, claiming that ClamAV detects more of the so-called "real" malware currently around than the other vendors.

Sorry. The whole point of ranking the AV's with tests is to determine who's better or worse. If we can't do that, the entire issue is up for grabs.

And ClamAV thus has no claim to being anything at all, just like the rest of them.

Neither does Comodo AV, which is completely free as well even for corporate use - but which hasn't been adequately tested or has done poorly when it was tested.

The bottom line is that the AV companies simply aren't doing their jobs because their products both fail to detect actual malware - especially targeted malware which is increasingly the problem - plus their products by cramming in firewall, anti-spam, anti-phishing, anti-spyware, yada, yada, makes them so bloated that people won't even run them once they see the impact on their PC's performance.

I've got 19 users running Kaspersky at one of my clients - at least four or five of them won't run it because they claim it slows their machines down. And that's with Kaspersky set to do ONLY on-access file scans and incoming e-mail scans - all the rest of the features are switched off! I've got another client running 20-odd copies of Kaspersky and most of them don't have that problem - probably because they're running desktops, not laptops, or they're not the sort of users who spend most of their day flipping from one application to the next, as some of my other clients are.

The real problem is that security was never designed into the computing environment, either at the Internet level, the OS level, or the application level. Bolting it on as an afterthought simply isn't working - and may never work. And since redesigning the entire computing environment isn't going to happen, we're stuck with it.

Basically, people need to get used to the fact that you're going to get "mugged" occasionally on your PC - just like you will if you repeatedly go into bad neighborhoods. Well, the Internet is a "bad neighborhood" and it's one that's never going to get better.

And as long as the educational system in this country can't turn out people who can think, the PC consumer is never going to be able to deal with the complexities of dealing with PCs AND PC security.

Game over. Go home and get drunk. This is just another case where there is no solution because you're dealing with humans - whose basic nature IS the ORIGINAL "security flaw".

Or as Rutger Hauer, playing a terrorist based on "Carlos the Jackal", used to say in the movie "Nighthawks": "Remember - there IS NO security."

Simple Solution - Package manager

[Casandro]

Well the simple solution is to simply forget all that virus scanner crap and find better solutions.

Simply put, the idea is to make bad ideas harder and good ideas easier.

Under Windows you download a file with the extension .exe and after that the browser will ask you if you want to execute it. That's usually a bad idea. Under other operating systems, you will not be able to execute the file directly, but will have to turn it executable first.
You might now wonder how someone installs software. It's preety simple, you make good ideas easier. On ubuntu-Linux, for example, you have a little programm named "Install or Remove Software". With it you have easy access to large repositories of software, all, at least to some degree, looked over by people who know what they are doing. This greatly reduces the chance of downloading any malware.

Now, why are virus scanners such a bad idea. It's because they are often written by people who can't use their tools. The often use C and seem to be unable to prevent buffer overflows. This has caused them to often execute code from the file they wanted to scan. So in effect they potentially execute every file they scan which might be every file you download, including little pictures your browser needs.

ratings

[chris.evans]

Simple rate based on sheer number of viruses detected. http://bbx.flnet.org/pub/dmsoft/projects/vxav/vxax.c

One popular example: Slammer

[BitZtream]

Right, because a malicious app on a machine inside your network could not possibly ever take advantage of such an bug to spread itself. Nothing has ever slammer'd machines behind a firewall to spread or anything.

Lets just pick a few of the popular ones:

http://en.wikipedia.org/wiki/SQL_slammer_worm
http://en.wikipedia.org/wiki/Blaster_worm
http://en.wikipedia.org/wiki/Sasser_worm
http://en.wikipedia.org/wiki/Nimda - multiple attack vectors, but could easily spread via an internal IIS installation installed by someone behind your firewall.
http://en.wikipedia.org/wiki/ILOVEYOU - requires user action, but thats just another example of how it can get past your firewall.

Firewalls don't fix everything.

my personal solution

[l3bonge]

a computer infected with a r00t kit these days can be next to impossible to disinfect. even with kaspersky, or nod32 which i consider to be in the top few antivirus programs.

unfortunately they slow your computer down quite a bit.

after comming back from holiday to find my gf had somehow gotten the computer infected and it was a root kit that kept bringing in new malware that was the last straw. this virus must have been brought in on a usb stick and it was an encrypting virus that took some of my music and put it in passworded rar files. argh, this really did aggravate me!

so as i use ubuntu much of the time (as i find interface with the desktop much more relaxing than xp, and i use it for fortran and mathematica under linux. i also enjoy using many linux native programs such as kile and emacs) i decided on the following strategy.

• partition the machine so that there is an 8gig system partition just for xp and core essential application
• reinstall xp (hopefully for the last time ever)
• fully patch xp and setup the hardware, install basic drivers for video and mobo
• fully defragment this system partition
• use something to erase the empty space on the partition (eg create a very large file containing only zeros) and then delete this file
• reboot to ubuntu and use dd to backup this 8gig partition to a file, xpimage
• go back to xp and do some further customisation
• return to ubuntu and dd this 8gig customised version and rsync this against the basic backup
• burn several copies to dvd (i think i made at least 3) of the basic image and rsync 'diff' (because the 8gig compressed very well even with gzip on fastest as it is largly empty space so it easily fits on a single layer )

  now all documents and anything that is more permanent is saved to another ntfs partition. if windows is ever infected i can just reboot to ubuntu and then use something like zcat xpimage.gz | dd - bs=100M of=/dev/hda2 which is very fast, ive timed it and specifying a large block size speed up the restore significantly reducing it from about 12min to 4min ~ 34meg/s..

  so if xp ever gets infected i can restore it in 4min.. its just not necessary to have the speed of the computer constantly crippled by having everything that is executed or accessed, emulated and scanned and analysed.

  if i need i will use antivir under linux to scan the secondary ntfs partition. antivir also provide an iso of a linux based virus rescue cd which is great for giving to friends with windows that keep asking for free reinstalls which can take several hours if you have download and install a sp and drivers (depending on how prepared you are and how fast the available internet happens to be)

  and of course everything that should be archived is backed up

  i really recommend this scheme its saved me a lot of stress and time. i hope it can be of some benefit for my fellow /.ers

Re:I really could care less - Hey, GREAT!

[Anonymous Coward]

So you really COULD care less?

Then, uhh, why don't you?
Please- make our day. Care less.

Nobody tests offset crashes?? Not so.

[hman]

... but nobody seems to advertise the offset crashes, such as the right half of your bumper hitting the left half of your 'opponents' bumper. Why? Because it's sad in comparison. It's also not pretty to watch.

Euro NCAP do test that one. See the Frontal impact1 test description: frontal impact at 64kph (40 mph) at only 40% overlap.

The only comparison I found useful

[Anonymous Coward]

http://www.av-comparatives.org/