Slashdot Mirror

← Back to Stories (view on slashdot.org)

Test of 16 Anti-Virus Products Says None Rates "Very Good"

Posted by timothy on from the keeps-the-av-people-in-business-though dept.

An anonymous reader writes "AV-Comparative recently released the results of a malware removal test in which they evaluated 16 anti-virus software solutions. The test focused only on the malware removal/cleaning capabilities, therefore all the samples used were ones that the tested anti-virus products were able to detect. The main question was if the products were able to successfully remove malware from an already infected/compromised system. None of the products performed at a level of 'very good' in malware removal or removal of leftovers, based on those 10 samples."

344 comments

  1. I use Microsoft anti-virus and love it by Anonymous Coward · · Score: 3, Funny

    BuY H3rB@l V1agaRa t0Day!!!

    1. Re:I use Microsoft anti-virus and love it by Anonymous Coward · · Score: 2, Insightful

      BuY H3rB@l V1agaRa t0Day!!!

      I know you are going for funny with a shot at Microsoft (will that work around here I wonder? :), but you did notice that Microsoft Security Essentials was one of the best in the test? ;->

    2. Re:I use Microsoft anti-virus and love it by baptiste · · Score: 4, Insightful

      BuY H3rB@l V1agaRa t0Day!!!

      I know you are going for funny with a shot at Microsoft (will that work around here I wonder? :), but you did notice that Microsoft Security Essentials was one of the best in the test? ;->

      No kidding. I am not an MS fanboi by any stretch, but when they released Security Essentials, I gave it a whirl and have now swapped out AVG for it on everything I run AND recommend it to many of my clients (who usually are complaining about how slow their computer is since they installed NORTON 360 or they have a paid AV that expired years ago) It's lightweight, easy to us, has a very easy to understand user interface that isn't so graphical (*cough* N360), and it just works. Nice to see it garner some of the higher ratings in this test.

      What amazes me is how much like Malware Norton, McAffee, and CA can be. Uninstalling them doesn't remove them completely. You HAVE to use their removal tool. I had to remove CA ISS the other day and it was painful. Had to remove it in pieces AND run a fix on the registry permissions which had been completely locked down to the point that 'Administrator' couldn't add/remove programs. So yeah - any time systems come into my shop, I recommend they drop whatever paid AV they're using and run MSE. No nag screens like AVG and it doesn't talk to you like Avast :) My only fear is that in a year they'll let it stagnate OR try to bloat it like the others. But if they keep it simple and go for the majority of infection vectors, hats off to them. Still won't make me use IE, but it's nice to see something like this come out of Redmond, even if they bought part of it.

      --
      Top Most Bizarre/Disturbing Error Messages
    3. Re:I use Microsoft anti-virus and love it by Moryath · · Score: 1

      Indeed. Sometimes getting rid of the "antivirus" software is harder than cleaning off the (simple) malware.

      The other problem is that for any new malware, the companies are caught between multiple rocks and hard places:
      - If they classify "ad programs" as viruses, they might get sued. If they leave them alone, they're not cleaning off malware.
      - Even while they constantly update, the virus writers (especially the ones on the pay of various countries' organized crime rings, since spam and extortion and credit card harvesting via botnet is now big business), the writers are testing against their product. The old saying goes, "a good virus scanner is effective against everything up to this week's viruses."

      Add to that the rise of rootkit or "rootkit lite" behaviors (Vundo, for instance, has started attaching itself to lsass.exe and explorer.exe to hide itself from process watchers and redirect file-scan requests to innocuous locations) and your main hope for cleaning a system is to go at it from an external source (other PC and usb drive cage, LiveCD of your chosen OS, etc) because once the infected OS is in the middle, the malware is actively working to hide and protect itself. Once you've got the nasty files deleted, you can always boot without your net cable and clean your registry out properly.

      If the makers of antivirus products were really smart, your antivirus package would be able to (without needing extra software) burn a LiveCD of itself for the purposes of just such externalized scans. But none of them have done it yet.

    4. Re:I use Microsoft anti-virus and love it by TJamieson · · Score: 1

      Seconded, big-time. I keep ClamWin installed in case I want to be really sure. :-)

      --
      For the last time, PIN Number and ATM Machine are redundancies!
    5. Re:I use Microsoft anti-virus and love it by Opportunist · · Score: 1

      Allow me to answer both of your statements.

      First, yes the MSAV tool is pretty good from a technical point of view. Still, I cannot recommend using it. Why? Because it is by its very nature in widespread use and thus HAS to be overcome by new threats. Malware is tested against common AV tools because it is useless if the average PC cannot be infected by it. And that's also the reason why AV tools in widespread use have to be locked down to the point where it's outright painful to remove them if you want to get rid of them: Because malware tries to do just the same. For the last few years a few malware products have been trying not only to bypass AV tools but to outright disable or even uninstall them. For obvious reasons, because a signature update that would find it is pointless if you don't have it installed anymore. So in the battle between AV and malware the AV makers have hooked their tools deeper and deeper into the system so it's now sometimes a hard guess what's worse, the disease or the cure.

      My recommendation would be to go for lesser known and still good AV tools. They're rarely besieged by malware, don't dig deeply in the system, malware is often not tested against them (or only cursory) and they are often much less heavy on the system than their mainstream counterparts.

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
  2. Security... by xanadu113 · · Score: 5, Insightful

    Security is a process, not a product.

    --
    -Myke
    1. Re:Security... by sopssa · · Score: 2, Insightful

      Since you seem so confident and intelligent, how do you plan to teach that to a "normal person"?

      And on real slashdot style, a car analogy; we dont care how the taxi works or how its supposed to secure us, we just want to get around conveniently. Without getting killed. Now the taxi driver might care more about his systems and how the inners of car work, but we just couldn't care less. It's the same thing when casual people use computers, and you're pretty ignorant if you dont understand why it is so or why they "just want it to work" so they can do whatever they want to. Like with every other hobby or thing, only those interested in computers and security are, others are not.

    2. Re:Security... by poetmatt · · Score: 1

      You're dead on. However, it sure is surprising that they didn't test ClamAV, isn't it? /positive MS score and open source antivirus not tested? color me surprised.

    3. Re:Security... by davester666 · · Score: 5, Insightful

      It's like a piece of wood, a tape measure and a saw. If the person doesn't use the tape measure properly, and saws the wood too short, there isn't any magic that can fix the problem. Even buying a new piece of wood and a new fancy tape measure will still have the same problem if the user can't be bothered to learn how it works.

      And a computer is only slightly more complicated than a tape measure...

      --
      Sleep your way to a whiter smile...date a dentist!
    4. Re:Security... by N3Roaster · · Score: 1

      Bad car analogy. Ignoring the tautology at the end, the computer user is more analogous to your taxi driver who does care. If you just want to be a passenger who doesn't want or need to know anything other than where they want to go, you hire the taxi driver (or perhaps a chauffeur). Now, I'm not saying that software shouldn't be made better, more secure, to do what you want, and be harder to accidentally scatter your guts over the road while killing innocent bystanders, but it's never going to be perfect, so if you want to drive yourself and not be a menace to yourself and others, some basic awareness is going to be needed. Don't like it? Take the bus.

      --
      Remember RFC 873!
    5. Re:Security... by Anonymous Coward · · Score: 1, Insightful

      I suspect it's because ClamAV doesn't have "malware removal/cleaning capabilities", which is what they were testing apparently.

    6. Re:Security... by Jurily · · Score: 3, Interesting

      Here's another analogy for you: don't rely on the police to catch the robbers. Use houses with locks on them and learn how to use it.

    7. Re:Security... by engun · · Score: 2, Insightful

      Exactly. This is why I don't use any AV product at all. As long as you're reasonably careful not to download and install unknown programs, there's no way to justify incurring a huge performance hit on a daily basis. For example, I once "fixed" a friend's PC in which she had installed two AV programs - Avira and McAfee - for additional protection and security as I heard. File copying had dropped to something like 150Kb/sec between two hard drives because both anti-viruses were scanning it. Disabling one increased the speed to about 1.5Mb/Sec. Disabling both improved it to about 6Mb/Sec (figures according to rough recollection, to be taken with a pinch of salt). I eventually left one on since she wasn't an experienced user and needed some anti-virus program, "just-in-case".

      But experiences like these over the years have convinced me that the wisdom about adjusting your process is far more valid than having an army of products. I haven't had a single virus infection for as long as I can recall and if I did, that was because I'd been careless and run some program off the net without finding out what it was. Also, I don't think AV programs offer any meaningful protection against things like browser flaws. If someone decides to exploit say a buffer overflow vulnerability in your browser and you simultaneously decide to browse to that very site which does so, well, so sad, too bad. Might as well wait for the browser vendor to release a patch which fixes that flaw and use a more secure browser like Chrome to browse dodgy sites, rather than pray an ineffective AV magically detects it with its "heuristics". Most often, all that DLL injection and the like result in an unstable browser, rather than providing any real protection.

      Having said all that, I do see the utility in being able to do an occasional on-demand scan on an executable. I also see why AV vendors are going for the nanny philosophy to deal with the armies of inexperienced users who have no idea about the "process" behind security. But for those with a reasonable idea of it, it's probably better to suffer the rare virus infection than endure a crawling system on a daily basis thanks to some overzealous AV product.

    8. Re:Security... by Kratisto · · Score: 5, Insightful

      No, see, it's like a computer and a user and antivirus software. The user expects the antivirus software to either protect him from getting a virus to begin with, or to remove it swiftly if it fails. Unfortunately, the antivirus software isn't very good in the latter situation, and because the user is an idiot, no antivirus software can help him in the first situation.

      --
      Conscience is the inner voice which warns us that someone may be looking.
    9. Re:Security... by pelrun · · Score: 1

      Which is fine until that one virus manages to get through by accident. I ran my machine AV-free for a long time until that happened, and the cleanup was unpleasant - the preventive features of AV software are far superior their cleanup ones. :S

      That said, the performance of my machine running AVG got worse and worse with each new version till I got fed up and ditched it. I'm running Avast now, and the best feature is the easy access to the "disable on-access protection" option in the systray. It stays on most of the time, but I don't have to go digging through menus when I just want it to get the hell out of the way.

    10. Re:Security... by Darkness404 · · Score: 3, Insightful

      Which is fine until that one virus manages to get through by accident. I ran my machine AV-free for a long time until that happened, and the cleanup was unpleasant - the preventive features of AV software are far superior their cleanup ones. :S

      Yes, but think about it this way. Lets say your computer runs at half its speed with an anti-virus. You run your machine for 365 days without an AV for 30 mins doing routine work that would be slowed down by the AV (file copying, plus additional maintenance for the AV itself, etc) so it would take an hour. That is 182.5 hours per year you use it for maintenance without an AV. With an AV that doubles to 365 hours. Even if you add in a entirely long clean up process of 48 hours, you still come out ahead. And unless you get a nasty virus that somehow corrupts everything you can just restore from backup (you do have a backup of everything important right?) and if you don't have a backup you can usually boot from a Linux disk (most can read NTFS just fine) and copy things to an external HDD. So unless that machine was really mission critical (such as, if its down for 2 days you are out of lots of money) not having an AV and having a long clean up may actually save you time.

      --
      Taxation is legalized theft, no more, no less.
    11. Re:Security... by Afforess · · Score: 2, Insightful

      I find it interesting though that Microsoft Security Essentials was one of the top three AV tested, with two "good" ratings. It also happens to be free. Maybe Microsoft is learning lessons from the past?

      --
      If our elected representatives no longer represent us, do we still live in a Democracy?
    12. Re:Security... by an+unsound+mind · · Score: 1

      Throwing some hardware at the anti-virus is easy.

      Throwing some hardware at it doesn't work for me.

    13. Re:Security... by Leekle2ManE · · Score: 4, Insightful

      I've been reading slashdot for a while and I've avoided commenting because... I'm not a nerd. I'm a geek. Which my friend always find annoying because 'back in his day' nerd and geek were the same thing.

      I've been into computers for over 10 years now and while I know far more than the average user, I don't know enough to hold a flame to many nerdier folk.

      However. I've dealt with enough real life cases in computer security/maint to know that the average user doesn't care about a process. They don't want to hear about it being a process. They view the computer as a glorified telephone/television combo. They just want to be able to power up, do what they want and log out. The average user these days isn't going to spend time to learn about how to properly protect themselves online because they have other things to do.

      To expand on a car analogy someone else used...
      Likening computer security to a car would mean comparing it to car security. While some people might take their cars to a car audio shop to get a security system installed, most will just buy their car from the dealer and just want to push the button and have their car secured. Even if they won't always push the button. Unless they're in an 'unsafe' neighborhood.

      What the average user doesn't understand is that every time the get online they're in an unsafe neighborhood. They don't know it and they're not going to do the research to find out. They're not reading /. They don't see comments about Security being a process and not a product. They just want to start up the computer and feel safe that their security system is working. They're not going to search online to find the best anti-virus product(s) available. They're not going to look for reviews of 16 anti-virus programs reviewed. They quite simply don't care and don't feel that they should have to care.

      What good is firewall software if the user has no clue whether to allow a process access to the internet or not, but since it just popped up while they were installing something new, they allow it anyways? The firewall/software does nothing for them.

      And before someone brings up the Linux solution. I love Linux. I use it. It is NOT user friendly though. With all the different flavors around, the *cough* average user would just rub their temples in frustration and stick with Macrohard products. And if they did pick a Linux distro, they would have to pray that all the components in their computer are compatible. I've installed linux on multiple systems (which previously ran some variation of winblows) and every system has had at least one piece of hardware that didn't have a driver available.

      So, to make a long story short (TOO LATE) computer security for the average person will never happen. The only way to make computers secure for the average user to make the internet secure. The only way to make the internet secure is to allow your local ISP to start white-listing/black-listing sites, thus dictating where you can and can not go. And that's never going to happen. Or at least, we hope it doesn't.

    14. Re:Security... by similar_name · · Score: 2, Insightful
      People still have to learn how drive. It doesn't just work. I can go into oncoming traffic and head end a semi. Cars don't 'just work'. The best security product is never going to keep someone from running something stupid.

      they "just want it to work"

      My mom used to say 'Want in one hand and shit in the other and see which one fills up faster.'

    15. Re:Security... by mysidia · · Score: 2, Insightful

      Yes, but malware is a product.

      AV/Anti-malware software should be a product that can expunge/protect against one type of security threat: rogue/malicious software.

      Nothing beyond the product should be required for expunging malware. If you are updating and the software maker is doing their job, that security threat is permanently dispensed with, and you can move on to other threat categories, if they ever become important to you.

      If not, you are secure, and done.

      Security is a process, not a product, refers to security in general, which is a lot harder than security against specific types of threats.

      Anti-malware won't stop an insider from offloading sensitive customer records to their USB stick and selling them off to some ID thief living in india.

      Well, you use another security tool for that: group policy. Configure all workstations so that removable media is allowed, and you no longer need to worry about USB sticks.

      Group policy won't protect against a hacker guessing your admin password, FTP'ing into your server, and pulling the files.

      There's a product for that too: A firewall. Which you install, and configure properly. Voila: hacker FTP'ing in is no longer a threat.

      Security is not just a process, but a bunch of products and proper configuration of those products.

      Probably one of the most important products is proper training and education of your staff, and proper configuration and choice of what issues to educate them about, and how you configure your organization's HUMAN security policies, for example, how you prevent random untrusted outsiders from pretending to be "maintenance" and gaining unescorted/unapproved access to your server room, from an employee @ front desk who knows where the key is.

    16. Re:Security... by mlts · · Score: 1

      I run AV software for a few reasons: The first is that most AV software has heuristics. This is important for a "burglar alarm" in case something manages to get executing natively on a system. The second is to catch known threats before an OS update. AV products update at least daily, which is usually faster than OS or browser updates unless the hole is super critical. Another use is scanning files and documents before emailing. This way, if the recipient claims to have gotten an infection, I can say that it was scanned with a utility before it was sent, thus the recipient's problem.

      Of course, there is the legal element. A business that doesn't have AV software on machines (regardless of how really effective it is), is like a business that doesn't have locks on building doors. People would say the business is not doing due diligence.

    17. Re:Security... by Anonymous Coward · · Score: 0

      Horrible analogy. There isn't a lock out there that can't be picked/broken. Kind of like antivirus software.

    18. Re:Security... by Runaway1956 · · Score: 1

      True - security is a process. But, the process should have reliable results. When the process proves unreliable, then it's called a "failure". Security failures on Windows are common - just tally up the number of banks that have been compromised, then try to make some kind of a wild stab at the numbers of consumers who have been compromised. Some of them are actually pretty savvy, too.

      Now, look to the world of Unix and Unix-like OS's. The process is FAR MORE reliable, and requires less user input to be effective. The least secure default installation of *nix that I have ever seen is on an equal footing with the most secure installation of Windows that I have ever seen.

      Just to clarify - the clueless bozo can give his information away in a number of ways, no matter how secure his system. We only ask that the system doesn't turn on the owner, and give the information away FOR him!

      Reliability. What a concept.

      --
      "Windows is like the faint smell of piss in a subway: it's there, and there's nothing you can do about it." - Charlie Br
    19. Re:Security... by Anonymous Coward · · Score: 1, Funny

      Mod parent up! He just upgraded my arsenal of meaningless statements that convey authority.

    20. Re:Security... by slarrg · · Score: 3, Insightful

      Even when people learn to drive, accidents still happen. That's why technology is developed to reduce the negative outcomes of those accidents (crumple zones, seat belts, airbags) or attempt to diminish the likelihood of an accident occurring in the first place (brake lights, mirrors, reflective road signs.) This is the same reason anti-virus software is developed and it's certainly appropriate to debate the effectiveness of these methods.

    21. Re:Security... by Anonymous Coward · · Score: 0

      "And before someone brings up the Linux solution. I love Linux. I use it. It is NOT user friendly though. With all the different flavors around, the *cough* average user would just rub their temples in frustration and stick with Macrohard products."

      Um... wait a second. Did you just infer that Microsoft has a big, hard dick? If anything, their "proper" name is more fitting. Or MicroFlabby...

    22. Re:Security... by syousef · · Score: 1

      Security is a process, not a product.

      Where can I buy that process? Who's the best supplier?

      --
      These posts express my own personal views, not those of my employer
    23. Re:Security... by similar_name · · Score: 2, Interesting

      it's certainly appropriate to debate the effectiveness of these methods

      I completely agree, but some people seem to think security software is going to prevent anything from happening to their computer. I don't think a seat belt, crumple zones etc are going to prevent anything from happening to me regardless of what I do. Or for that matter what another driver does. Why should I refuse to learn anything about using a computer?

    24. Re:Security... by dmorris68 · · Score: 2, Informative

      Yes, but think about it this way. Lets say your computer runs at half its speed with an anti-virus.

      I wouldn't run any AV that causes my computer run at "half its speed."

      I used to be a huge Norton AV hater. But since v2009 they did a major overhaul to their AV engine and now it runs extremely well. 2009 and 2010 consume virtually NO detectable resources, update themselves literally every few minutes, and turn themselves off completely during gaming. Kaspersky 2010 is a bit worse performance-wise, but not terribly so. I've also installed MSE on a few PC's for people and have been impressed with its performance. None of these three slow your PC "by half" and of the three, I'd say Kaspersky is the biggest hog, but still far and away better than the Norton of old. AVG used to be lean and mean until v8 I think, then it bloated up and got slow too. Avira free was decent but the ads were too annoying, as was the mandatory annual registration renewal for it and Avast. I finally decided to pay, and have been quite satisfied.

      So based on my experience, for free AV (that doesn't bug you with ads) I'd recommend MSE. If you're willing to pay, Norton 2010. And if you shop around online, you can get some good deals. I got 3 PC's w/ 2 year subscription of Norton Internet Security 2009 (and free upgrade to 2010) for $60, and I've actually found it even cheaper since.

    25. Re:Security... by ZosX · · Score: 2, Interesting

      Using it right now. It found a suspected trojan in my half life 1 install. It looked like a false positive, but who knows. I quarantined the file anyways. It was for opposing force. Anyone else have this detection? What was interesting was that it said it listed it as active. I was kind of surprised by this. Since I long lost my half life cds, it was a pirated copy, but usually they embed trojans in the installer exe or the cracked exe, which all tested out to be fine. Security essentials seems pretty good though and is relatively lightweight. I agree that it is about time that microsoft starts getting a lot more serious about security and vista/win7 and now this seems like steps in a good direction.

      --
      zosxavius photography
    26. Re:Security... by v1 · · Score: 3, Interesting

      It's not a question of being or not being totally effective, you can make that argument from any direction and arrive at the same answer. No product is 100% effective. It looks like this review was just saying that none of the products tested met their expectations.

      So that either means that their expectations were unreasonable, or all the tested products stink.

      Or a combination of the two. That's where my money is. Regardless of topic, security is best handled from the inside, where your footing is solid and attacks only come from one direction. Problem is, the inside is not secure. At that point you require extraordinary external security, which either means you need to be very good at it yourself, or you have to find someone that's top-notch to make up for the problem. It's no surprise that so many of these products didn't fair well, they're defending the castle while standing outside the walls. And since you're already starting out with a handicap and are going against experts and people motivated by money, if you want the job done right, you're best to do it yourself. The human element of unpredictability along with knowing what's safe and what's not safe is the best defense, not software. If you're a computer noob, there simply isn't a "very good" solution, as this review basically concludes.

      --
      I work for the Department of Redundancy Department.
    27. Re:Security... by LordLimecat · · Score: 1

      ClamAV does nothing automatically, so it wouldnt really qualify for the first part of the test. If youre suggesting ClamAV to people as a primary antivirus, youre doing it wrong. Moonsecure would be a different story, but Im not sure how good it is.

    28. Re:Security... by LordLimecat · · Score: 1

      Im not sure how much water the due diligence argument holds; antivirus doesnt keep anyone out. Firewalls and IDS would be due diligence; antivirus is of debatable value.

    29. Re:Security... by v1 · · Score: 1

      People still have to learn how drive.

      Problem is, in today's world, everyone needs a jet to get to work. Do you know how to drive a jet? I sure don't. That leaves us with companies trying to sell "jets for the common man". I'd personally prefer a jet that flies itself, doesn't randomly run into mountains, has a 100% (not 99%!) effective antimissile system, and doesn't require me to know how to maintain the turbofan. But then it looks like these companies are in the business of selling parachutes, air bags, and duct tape. I just think their whole angle is wrong to begin with, and is never going to produce a "very good" solution.

      ("an ounce of prevention is worth a pound of cure")

      --
      I work for the Department of Redundancy Department.
    30. Re:Security... by Anonymous Coward · · Score: 0

      This is Slashdot, Microsoft marketing's latest sheltered workshop.

    31. Re:Security... by slarrg · · Score: 1

      There's a difference between not learning anything about the computer (or car for that matter) and just learning enough to do the minimum necessary to use the device. When we get a driver's license, you are demonstrating that you have a minimum proficiency to drive an automobile. Truthfully, many of those people still have problems driving in inclement weather or when it's dark out but we accept that they have the minimum proficiency to share the roadways with others. Are you so certain of your mechanical knowledge of your car that you know that a tire will not fail or the car will not accelerate uncontrollably (such as the recent Lexus recall) potentially killing another person on the road? Are you certain, every time you start your car, that someone didn't maliciously tamper with your car putting you or others at risk once you start driving? Of course not. But, as a society, we accept that your lack of knowledge is an acceptable risk even though it puts other people's lives at risk.

      You could argue that people should have to get a license to operate a computer on a network but we, as a society, generally frown upon additional regulation. The only reason people accept licensing for drivers is because lives can be put at risk. It's unlikely that anyone would suggest that an elderly woman who has a computer online so that she can get pictures of her distant grand children through email should have some advanced understanding of computers. It's somewhat ridiculous that so many in the computer industry insist that people who have no interest in computers must learn a great deal about its inner workings before they can use one as a tool. Certainly no one expected you to be similarly informed about your car, household appliances or plumbing before you were allowed to use them. Why should they need to know more about their computer or the underlying technology within to surf the web or get email? They don't need to understand radio waves to use a television or cell phone.

      Look, I've been a programmer for over twenty years and I definitely enjoy learning about many minute details in the systems I use but I hardly expect the same from everyone around me. Developing safeguards to protect others without them becoming experts seems a logical thing to do.

    32. Re:Security... by Schraegstrichpunkt · · Score: 1
      The process change needs to occur in software development, not in end user behaviour.

      People need to safely run software from untrustworthy or marginally trustworthy sources, but the infrastructure isn't there. Anti-virus software is sort of a stop-gap measure, but tests like these are showing that it increasingly can't be relied upon

      --
      http://outcampaign.org/
    33. Re:Security... by Anonymous Coward · · Score: 3, Informative

      Your mom has a potty mouth.

    34. Re:Security... by similar_name · · Score: 2, Interesting

      I'm not suggesting people learn how to program or even know the difference between their cpu and computer case. I'm not suggesting developing safeguards are worthless. I'm only saying relying *completely* on safe guards is naive. Very simple things like not downloading free screen savers/games or clicking on links in emails from 2342@235ja.com would go a long way. I'm not suggesting anyone needs a license to get a computer.

      Unless things have changed since I took the test to get a driver's license it doesn't ask how often you should change the oil in your car. But somehow most (not all) people figure that out. There are however still people who ignore their check engine light until their car dies and there will always be people who run shady software no matter how many times you make them enter in a password. Education is still important.

      I use Windows and Linux and I trash them both because I know how to fix it. I don't know much about my car so I change my oil when the speedometer matches the number on the little sticker on my windshield and get maintenance when the manual says to.

      Too sum up, all of the education and safegaurds in the world will not prevent sheer stupidity. However, education and safeguards are still worthwhile pursuits. There is an area between expert and completely ignorant.

    35. Re:Security... by davester666 · · Score: 2, Insightful

      Except this is dealing with AFTER the system has been infected. From TFA, it seems as if virus checking was disabled, the system intentionally infected with various viruses, then virus removal was run. The AV software would have a reasonable chance of being able to revert your system to a pre-virus state IF it's running while the virus is being installed (which in itself shouldn't happen, but it should stop it before it's installed), but to say it should remove all trace of any given variant of any virus is ridiculous. Particularly system settings, as there are lots of changes that are completely valid for both virus and non-virus applications, that would potentially screw up 'real' applications and/or annoy the end user because they intentionally changed it, but the AV software "knew" better.

      Now, marketing for AV software may make dubious claims about virus removal (but offhand, surfing the Norton site didn't say much about virus removal, it was mostly focused on virus protection)...

      This seems kind of like a "we'll tie one arm behind your back and then see how well you can wrestle" test...

      --
      Sleep your way to a whiter smile...date a dentist!
    36. Re:Security... by slarrg · · Score: 2, Insightful

      The primary problem that anti-virus software tries to protect against malicious activities of other people and not the actual computer user. The level of security to truly harden a networked computer from attack is incredibly high. Even the most sophisticated of us cannot guarantee 100% security of a networked system. Certainly my systems and your systems will have high levels of security but even we cannot guarantee 100% security of our own systems. Luckily, if you're in the top 50% of secure systems and you don't have military grade secrets, you're probably secure enough. Of course, that still leaves a lot of systems that are less than adequately secured. And, their users may be unlikely to become educated in the safe use of those machines

      This is not to say that we shouldn't try to educate them but we would certainly be lax if we didn't attempt to improve their security by installing systems that automatically improve the security of their systems. We do this in the real world, too. When you buy a car, it comes standard with a lock and key system to give a small amount of security. Many people in the industry can bypass those safeguards and steal your car. But still we don't keep someone from flattening your tires, cutting your battery leads or draining all your brake fluid. Most of these things could be done to a car that is locked and with the security system armed. Luckily, it's a rare enough event that we don't feel insecure as a result

      Likewise, our houses have locks on the doors. Many can still be breached through a window. Some have bars to prevent thatt. But many of those only stop a person from entering with a thin layer of siding, some fiberglass insulation, and a sheet of drywall; all of which could be breached in under a minute. So we develop automated warning systems that can quickly alert the homeowner (and paid security specialists) of a breach. Still they're not foolproof but we accept them as adequate.

      This is the equivalent of anti-virus software. Certainly we should attempt to educate people but we should also create systems that alert and notify people when their security has been breached. Likewise, we should have methods to help them remove invaders from their computer. In the real world, we have police to come in and remove criminals occupying a space illegally and it is appropriate to have software and services to do the same in a computer. The police should do the job of removing intruders regardless of whether the person forgot to lock their front door or didn't install a security system.

      I guess I'm just a little mystified as to why people always feel a need to start harping on the stupidity of the victims every time an article is written that evaluates the safeguards designed to enhance security. Education is important and certainly needs to be an ongoing effort on all security issues but in the end no one is ever completely secure and other improvements that are willing used by people to enhance their security should certainly be evaluated for effectiveness and reported on accordingly.

    37. Re:Security... by Anonymous Coward · · Score: 0

      Wow!

      The maker of the OS that knows how it is designed and even has the source code is able to detect strange things that does not belong there. Now - thats what I called an achievement.

      At the other hand the makers of other virus detection software have to guess what is inside the OS, so having a tougher task - and the score not as good.

      You know. I have the strange feeling I am not too surprised. Now why should that be?

    38. Re:Security... by Post-O-Matron · · Score: 1

      Security is a process, not a product.

      I completely agree, but these products are supposed to be able to remove the malware.

      The correct car analogy (unlike those above) is: the user expect certain things from the car (like going straight), if the user then misuses the correctly-behaving car (like going straight into a tree) -- that's a different question.

      In this case after reading TFA I conclude that the the people who performed this test were being snobby. They expected all the AVs to remove all malware completely and without a reboot. In practice some of them require a reboot for some of the infections and some of them left behind non-malicious parts of the removed malware, possibly on purpose (it might prevent a future infection).

      In other words those that removed "all 10 but..." worked fine. The rest is process.

    39. Re:Security... by shutdown+-p+now · · Score: 2, Insightful

      How does having the source code for the OS helps you in detecting viruses - written by someone else - located inside binaries belonging to software - also typically written by someone else?

      PE format (Win32 .exe/.dll) spec is open, by the way.

    40. Re:Security... by mlts · · Score: 1

      Very true. However, a lot of larger businesses have stipulations that their vendors have AV software on all computers used in a project. Even the AIX box crunching the numbers and the large Suns with the database end up with McAfee on them. Not that there is some major AIX virus, but to allow sales to tick off a box on the contract.

      This pill is made easier to swallow though. Most AV products usually have more than one function these days. Symantec's can be used to block removable media, while other brands bundle with it comprehensive auditing consoles. Other brands, the antivirus is usually as part of a suite (Forefront comes to mind.)

    41. Re:Security... by Anonymous Coward · · Score: 0

      many antivirus programs give a false positive on DQ2249.ICD

    42. Re:Security... by interkin3tic · · Score: 4, Funny

      It's like a piece of wood, a tape measure and a saw. If the person doesn't use the tape measure properly, and saws the wood too short, there isn't any magic that can fix the problem.

      Ah muggles... you never cease to amuse me!

    43. Re:Security... by interkin3tic · · Score: 4, Funny

      My mom used to say 'Want in one hand and shit in the other and see which one fills up faster.'

      Well? What were the results? How many times did you repeat the experiment?

    44. Re:Security... by CrossChris · · Score: 0, Flamebait

      Firstly - NO anti-virus product has "heuristics" no matter what the advertising BS tells you.

      Secondly - NO commercial anti-malware software is remotely good enough to compensate for or obviate the stupidities of Microsoft, or those of Microsoft users.

      Thirdly - "due diligence" is ONLY provided by using an OS that cannot be corrupted by viruses or other malware.

      The solution is out there, and it doesn't involve Microsoft!

    45. Re:Security... by turing_m · · Score: 2, Interesting

      Horrible analogy. There isn't a lock out there that can't be picked/broken.

      It's really not. If other houses on your street don't bother with locks, a lock is all you need unless you have a dedicated adversary.

      --
      If I have seen further it is by stealing the Intellectual Property of giants.
    46. Re:Security... by TheRealGrogan · · Score: 1

      That's my take on it too (Well, similar). The time I would waste messing with security software would be better spent fixing the machine on the off chance that I get it infected. That's quite unlikely, I only use Windows for games. I'm a Linux user predominantly and I don't trust Windows for anything but goofing off. I also might use firefox if I need to check my forums and stuff from Windows. If I need to download something questionable like a "nocd" crack for a game, I'll upload it to jotti for scanning with many antivirus products.

      I make a fair bit of money cleaning up stupid Windows computers in my on-site computer business. I did not need to read the article to know that antivirus software is not very good at removing malware. If it was that easy, people wouldn't need my expertise for that. Once some of those trojans are hooked, they can be difficult to remove (it's a feature)

      There's also such a thing as using the right tool for the right job. Things like Malwarebytes, Superantispyware and Spybot Search and Destroy are better at removing modern malware than mostly file deleting antivirus software.

      To say that Norton is any good at that is a joke. It just refuses to touch anything it can't remove. I remove Symantec shitware on sight. I despise that garbage (even though current versions 2008 and 2009 are much improved at least in the way of not being as crippling, I still don't trust that rubbish on my customers' computers)

      I like Avira Antivir (free version) which does a very good job of at least detecting things, Eset Nod32, which is at least light weight and seamless. I like Kaspersky less, but it's also decent protection.

    47. Re:Security... by Idaho · · Score: 1

      I, too, was wondering how to distinguish between "very good" and merely "average quality" snake oil.

      --
      Every expression is true, for a given value of 'true'
    48. Re:Security... by Alpha830RulZ · · Score: 2, Insightful

      Except that the user isn't interested in the wood, tape measure, or saw, he wants a table, and thought he bought one, thank you very much. Why does he have to know how the tape is made to put his plate on it?

      Computers are somewhat unique in the level of awareness that a user has to have in order to use one safely. Unfortunately, for a lot of users, the difference between computers and magic is not apparent to them.

      --
      I was taught to respect my elders. The trouble is, it's getting harder and harder to find some.
    49. Re:Security... by Alpha830RulZ · · Score: 1

      Another bad car analogy: the problem is that computers are becoming like cars in Los Angeles. You have to use them to do what you want/need to to do, whether you know enough to drive safely or not, because the alternatives are really poor. Not using a computer isn't really a credible option anymore for any modern person who isn't a hermit. Even my 75 year old mother and 82 year old mother in law use a computer on a daily basis now. This imperative created by the culture is going to pull vast numbers of ignorant users into the mix, and it's naive, I fear, to expect them to assume the responsibility for getting themselves educated.

      In my family, I have about a 1/4 time job as community sysadmin. I'm typing this on a freshly rebuilt windows machine. AVG didn't catch whatever got this one. I'd put linux on it, but ITunes and Rhapsody won't run on linux. I have simply taken the step of giving the kids a sacrificial machine, and resigning myself to a yearly rebuild.

      --
      I was taught to respect my elders. The trouble is, it's getting harder and harder to find some.
    50. Re:Security... by IRWolfie- · · Score: 1

      I never understood why people won't devote any time to learning how to use a computer properly when they spend weeks (and potentially lots of money) learning how to drive properly.

    51. Re:Security... by Wildclaw · · Score: 1

      As long as you're reasonably careful not to download and install unknown programs,

      The real problem is the whole user security model of most operating systems. Any operating system operating on the assumption that the user and the program has the same security level is fatally flawed from a security perspective.

      If you haven't read and understood the source code of a program, then why do you trust it enough to give it the same security privileges as yourself. From a security perspective you shouldn't. A program should never be given more trust than what is needed for it to perform its task. And for most programs that should be precious little.

    52. Re:Security... by Alpha830RulZ · · Score: 1

      People would say the business is not doing due diligence.

      Minor nit, just so you don't say this to a manager type. "Due Diligence" usually refers to the process of properly checking out a deal or business arrangement, checking the truth and reasonableness of the assertions being made around the deal. You are "exercising due diligence in evaluating IBM's claims that DB2 can now read minds". I think you mean that the business is being negligent, or not taking the steps that a normal prudent person would be taking. Losing a customer's data due to a virus caused corruption of the system because your boss was allowed to turn off his AV so he could run LimeWire might be viewed as negligent.

      --
      I was taught to respect my elders. The trouble is, it's getting harder and harder to find some.
    53. Re:Security... by Alpha830RulZ · · Score: 1

      PCI guidelines require any business handling credit or debit card data to run AV and/or intrusion detection software, regardless of whether the system is a reasonable target for viruses. At my company, they make us install some ancient piece of IBM IDS crap, that requires python 1.9 to run. We can't update to a recent kernel (we're using SuSE 9.5, IIRC, which is believe is 2.6.19) because the IDS won't run on a newer kernel. That's right, we are not updating our kernels to take up some 20 various security fixes, because our security software won't run on it. But, damnit, we're running our IDS software.

      --
      I was taught to respect my elders. The trouble is, it's getting harder and harder to find some.
    54. Re:Security... by Alpha830RulZ · · Score: 1

      Um... wait a second. Did you just infer that Microsoft has a big, hard dick?

      Ballmer is good for two out of three...

      --
      I was taught to respect my elders. The trouble is, it's getting harder and harder to find some.
    55. Re:Security... by Anonymous Coward · · Score: 0

      If you don't want to learn how a computer works then don't operate one. Just like you don't drive a taxi.

    56. Re:Security... by jez9999 · · Score: 1

      My mom used to say 'Want in one hand and shit in the other and see which one fills up faster.'

      Ah, so now we know the identity of Tubgirl.

      --
      == Jez ==
      Do you miss Firefox? Try Pale Moon.
    57. Re:Security... by Anonymous Coward · · Score: 1, Informative

      Have you cleaned up a compromised UNIX box before. NO OS is immune to viruses and malware, NONE. I've cleaned off rootkits off of Suns, AIX machines, Linux boxes, yanked Macs from botnets (due to users wanting "free" iWork 09 versions). I have found experienced hackers who edited the RPM database so an rpm -Va doesn't catch their bongoed tripwire and sshd.

      Microsoft doesn't have a monopoly on stupidity, nor do their users. Don't let the Apple ads fool you. The guy who wanted a pirated copy of iWork is just as stupid as the person downloading pr0n running as Administrator on XP with a backlevel, unpatched Web browser. The same guy who follows instructions to download a .DMG file and run the contents as root is likely the same guy who downloads a "pr0n codec" on Windows. Either way, the machines are fragged the second the user approves admin access, be it via sudo, or UAC. Even on UNIX systems, I've seen sysadmins have "." and ".." in their $PATH, so when they cd into a user homedir and type in "cat blarf.txt", they are not running /bin/cat, but just ran some shell script that just boned their system.

      Please, if you know an OS that cannot be corrupted by viruses or other malware on an enterprise IT level, with the ability to deal with various corporate policies (including due diligence), by all means share it with us.

    58. Re:Security... by somersault · · Score: 1

      I think you'd do well to just install Windows inside a virtual machine, then you can just take a snapshot of the VM after you first install XP. A lot easier to revert to a non infected version of the VM.

      You could have Virtualbox running in seamless mode so that they do all their browsing etc with Linux and only Rhapsody and iTunes need to be run using the VM.

      iTunes is awful anyway, I've always used Amazon MP3 for my MP3 downloads since they were DRM free from the start, and just about any media player is better than iTunes IMO. When I was using OSX I used to use Songbird (still didn't do everything I wanted though). In Ubuntu I use Exaile ("just right" for me :) ).

      --
      which is totally what she said
    59. Re:Security... by tyroneking · · Score: 1

      And I thought we were doing Britney Spears related analogies now ... for example:
      Saying Security is a process, not a product, is like saying Britney Spears is a person, not a product...

    60. Re:Security... by TheLink · · Score: 4, Interesting

      Most popular operating systems can be analogous to a house with locks and a separate room for "maintenance personnel only" that's locked, and your personal room with a door and lock too (there may be similar rooms of other people with corresponding doors and locks).

      The trouble is when you invite a guest into your house, there is no guest room that _you_ can easily use, so you have to invite him into your personal room. The design of the house is such that you cannot usefully interact with the guest while the guest is in a different room from you.

      This means he has full access to your personal room. The geeks who don't understand the real world will say "Ah, but OS XYZ is secure because the "maintenance personnel only" room is locked and unaccessible". But who the fuck cares? You keep most of your stuff and valuables in your personal room! Insurance can take care of recreating the maintenance room stuff - not hard since the stuff in there is the same for every house of that model. They'll never be able recreate your personal documents.

      This is changing a bit with Vista and Windows 7, but it's still not good enough IMO. As for Linux, I don't see much help with what I'm talking about for the average desktop user yet. Apparmor is not "desktop ready" yet, and SELinux is barely even ready for average admins.

      This test of AV products is like inviting a crook/spy into your whole house, closing your eyes and letting him mess it up (plant bugs if he wants etc), and then get someone to try to clean everything up and restore stuff back to what it was.

      Yes it can be done in many cases. But it's foolish to expect the clean up to be 100% in all cases.

      If you really want to do that, you use a special house. Then you invite the crook into that special house. Then when he's done, you press a button and the house reverts back to its original state.

      --
    61. Re:Security... by mustafap · · Score: 3, Interesting

      >If the person doesn't use the tape measure properly, and saws the wood too short, there isn't any magic that can fix the problem.

      Use the other end of the piece of wood?

      Worked for me many times :o)

      "Measure twice, cut once"

      --
      Open Source Drum Kit, LPLC deve board - mjhdesigns.com
    62. Re:Security... by Anonymous Coward · · Score: 0

      And before someone brings up the Linux solution. I love Linux. I use it. It is NOT user friendly though. With all the different flavors around, the *cough* average user would just rub their temples in frustration and stick with Macrohard products. And if they did pick a Linux distro, they would have to pray that all the components in their computer are compatible. I've installed linux on multiple systems (which previously ran some variation of winblows) and every system has had at least one piece of hardware that didn't have a driver available.

      Why do people talk about the average user like they were the target of all computer nerd? I don't see why they should be the target of anyone really.

      So, to make a long story short (TOO LATE) computer security for the average person will never happen.

      Who cares? It's really their loss.

      The only way to make the internet secure is to allow your local ISP to start white-listing/black-listing sites, thus dictating where you can and can not go. And that's never going to happen. Or at least, we hope it doesn't.

      I hope it doesn't happen either. That would be awful. Terrible. Unfortunately ISPs don't quite reach out for people who actually know how to operate a computer. It's a shame.

    63. Re:Security... by unitron · · Score: 1

      Unfortunately, for a lot of users, the difference between computers and magic is not apparent to them.

      Nonsense. The difference is obvious. Magic is much more likely to work correctly much more often with much fewer unintended consequences.

      --

      I see even classic Slashdot is now pretty much unusable on dial up anymore.

    64. Re:Security... by Anonymous Coward · · Score: 0

      More like cars, they want to to drive them around and not have to tinker under the hood but we still require people to have a license to drive and can revoke that privilege if they screw it up too much. At least with the computer in most situations nobody gets killed but when somebody loses their entire retirement because of something on your computer you should be held accountable.... unless of course you are in the financal sector in which case you get a bonus.

    65. Re:Security... by gmagill · · Score: 2, Insightful

      Are you counting the time & troubles created by having a trojan-injected keylogger collecting all your bank and assorted other login passwords?

    66. Re:Security... by HermMunster · · Score: 1

      Most of what you are saying is exaggerated. It is likely that one out of half a million Linux boxes are infected and are infected in a way that requires far far less work to clean than a windows box (vista and win7) included. As someone that spends the greater part of my day cleaning infected windows boxes (having done so for the better part of 6 years--and having over 25 years supporting PCs) I can attest to the fact that windows machines almost seem to be designed to become infested. There are so many design issues that allow for the easy compromising of units that one must wonder whether the purpose of the EULA wasn't written specifically to protect the liability behind that design alone.

      There are so few accounts of Linux infections that I have never heard of a single one--one where there is something more than anecdotal evidence. I have heard of some wine installs becoming infected in a minor way.

      I have heard of OS X machines becoming infected, but as I also repair Macintosh computers, there has never been an infected box in my shop.

      Windows claims over a billion installs worldwide leaving four to five percent to Linux and another couple percent to OS X. The Linux installed base comes to (of the known installs) between fourth and fifty million worldwide). If you account for the unaccounted for installs you are likely looking at nearly one hundred million worldwide.

      The infection rate of windows boxes is considered to be around eighty percent. My experience demonstrates that accurately. If you look at Linux boxes you can accurately testify that Linux infections are no where near that, if they come to one tenth of one percent of the installs -- essentily non-existent.

      If you attempt to say that windows is a more lucrative market I will not dispute that fact. But I will say that diversity is the key to success. Every organism adheres to that. So diversify and live longer. Linux is an incredible OS with a stable and strong backbone that is highly resistant -- nay, nearly immune -- to infection.

      To say the least your examples are exaggerations when compared to real world numbers. Windows' rate of infections are extremely high and are due to endemic flaws in it's design, and the implementation rate. If you want to reduce to near zero the chance of infection you should diversify to an OS known to be nearly immune.

      --
      You can lead a man with reason but you can't make him think.
    67. Re:Security... by TapeCutter · · Score: 1

      "That's why technology is developed to reduce the negative outcomes of those accidents (crumple zones, seat belts, airbags)"

      An air bag that explodes in the users face when they click on a spam link is a wonderfull inovation, where can I get them in bulk?

      --
      And did you exchange a walk on part in the war for a lead role in a cage? - Pink Floyd.
    68. Re:Security... by Anonymous Coward · · Score: 0

      I don't know enough to hold a flame to many nerdier folk.

      It's not hard. Just pin them to a wall: most non-nerds can do this easily using just one hand. Then use the other hand to hold the flame to the nerd. They'll soon become more cooperative; I once forced a nerd to install WindowsME over his Gentoo installation using this method, so it definitely works.

    69. Re:Security... by glitch23 · · Score: 1

      Use the other end of the piece of wood?

      That assumes that the 2 ends are different and that you don't need the entire piece of wood except the piece you were originally sawing off. If you need 4' piece of wood and if its too short you can't attach it but if it's too big it won't fit and your current piece is 5' then you need to cut 12" off it. If you cut 13" you made it fit but now you can't attach it because it is too short. Flipping the piece of wood around is not going to help your case because the length hasn't changed.

      --
      this nation, under God, shall have a new birth of freedom. -- Lincoln, Gettysburg Address
    70. Re:Security... by CarpetShark · · Score: 1

      Security is a process, not a product.

      Please tell this to the racketeers who call to my place every Thursday with baseball bats, to sell me their security product.

      Thanks,

      Bob.

    71. Re:Security... by CAIMLAS · · Score: 1

      No no, it's "Measure twice, cut once... oh fuck, how did I do that? Measure twice, cut a second time..."

      --
      ~/ssh slashdot.org ssh: connect to host slashdot.org port 22: too many beers
    72. Re:Security... by Blakey+Rat · · Score: 2, Insightful

      To think that anybody on this community knows anything about the average user is ridiculous.

      --
      Comment of the year
    73. Re:Security... by RAMMS+EIN · · Score: 1

      ``They just want to be able to power up, do what they want and log out.''

      The question is why there isn't a company making major money providing computers that work that way.

      --
      Please correct me if I got my facts wrong.
    74. Re:Security... by Anonymous Coward · · Score: 0

      That is true. However, the goal of locks is to do one of two things: Get a thief to go "not worth my time" and find an easier target, or slow down the thief enough so someone detects it and nabs them in the act.

      Similar with AV software. It does not make a machine completely secure, but no security tool can.

      There is one thing though. Having multiple AV packages is a good thing. If people standardized on one single package, then an attacker can just spend their time working on how to bypass that package. However, with multiple solutions out there, an attacker has to divide up their time trying to make code to get around NAV, MSE, McAfee, Panda, Comodo, and may other offerings in order to not have their breach be detected.

    75. Re:Security... by dotgain · · Score: 1

      Compared to GPL the licensing terms are a breath of fresh air as well.

    76. Re:Security... by GeorgeS · · Score: 1

      Computers don't crash into you at 60mph and kill everyone in the vehicle/room

      --
      "I'd rather have a bottle in front of me than have to have a frontal lobotomy."
    77. Re:Security... by GeorgeS · · Score: 1

      Welcome to Slashdot!
      Good post...wish I still had some mod points left

      --
      "I'd rather have a bottle in front of me than have to have a frontal lobotomy."
    78. Re:Security... by lennier · · Score: 1

      Measuretwiceus cutonceus!

      --
      You are not a brain: http://books.google.com/books?id=2oV61CeDx-YC
    79. Re:Security... by McDutchie · · Score: 1

      Your car analogy breaks for the simple reason that only people with a license are allowed to drive cars. You have to pass both a theory and a practical test to obtain such a license, which constitutes a major investment in effort, time and money. Not caring is not an option. If similar requirements were imposed for letting people on the Internet, we would be having none of these problems.

      And before someone argues that unqualified Internet users don't kill people and are therefore harmless: in fact, the malware their computers inevitably contract and disseminate regularly ruins lives in various ways, either their own or others'.

    80. Re:Security... by rtb61 · · Score: 1

      To solve your problems http://mediakey.dk/~cc/itunes-on-linux-ubuntu/ and http://www.real.com/rhapsody/linux, there you go, iTunes and Rhapsody on Linux.

      As for secure computers until the OS is hard wired it will always be a problem. With computers being consumer level appliances, it is now getting to the stage, where an open source OS can be built right into the CPU, for near instant on, assured reboot and really fast OS execution. The hardware over the last few years could be very effectively functional for decades (usefulness rather than survivability).

      Certainly a really stable secure Linux kernel could achieve the next logical step and be built right into the CPU as one of it's cores, whether to build the Gnome GUI in there as well is the next question.

      --
      Chaos - everything, everywhere, everywhen
    81. Re:Security... by Anonymous Coward · · Score: 0

      While you're right in principle, the robber doesn't have to be really dedicated to want in the house, particularly if it has a door that doesn't face the street. It's easy and painless to break down a typical entrance door entirely. I've done it by *accident*, and no, the wood wasn't rotten (I was a teenager and I *thought* my cousing on the other side was just leaning against the door to hold it closed during a snowstorm, instead of the bigger jackass manoeuvre of locking it and leaving it). The hinges just ripped out with the screws still inside.

      Obviously that would be harder if you had a steel door with thick hinges connected inset by spikes to a granite wall or something along those lines, but that's a mite more than a lock.

      What a lock will do is keep the very laziest of thieves moving to the next house over.

    82. Re:Security... by Chris+Mattern · · Score: 1

      The trick is the "do what they want" part. They haven't quite got the mind-reading circuitry all worked out.

    83. Re:Security... by fishthegeek · · Score: 1

      "You can't fix stupid" - Ron White.

      Enough said.

      --
      load "$",8,1
    84. Re:Security... by Anonymous Coward · · Score: 0

      You're assuming that the leftover piece is longer than the piece that was cut too short...

    85. Re:Security... by Anonymous Coward · · Score: 0

      I am always surprised to read profesionals who claim that adding another layer of software makes you MORE secure.

      If end-users looked at the number of NEW critical vulnerabilities published EACH MONTH for leading AV products then they would wonder what good they are paying for (more holes?).

      Inviting total strangers into your PC and giving them full-access to everything, well, this is not an activity without risk.

      AV products are a business -and not the prettiest one. If you want to be safe, do not connect your PC to the Internet (or have a dedicated PC for this).

      If you like to be spied upon, then you don't need to pay for that.

    86. Re:Security... by EricTheO · · Score: 1

      >If the person doesn't use the tape measure properly, and saws the wood too short, there isn't any magic that can fix the problem.

      Use the other end of the piece of wood?

      Worked for me many times :o)

      "Measure twice, cut once"

      No matter how many times I cut it, the board was still too short.

      --
      -Eric
    87. Re:Security... by Opportunist · · Score: 1

      Teaching that to a normal person is easy, trying to get it through the skull of PHBs is hard. They want to buy some product and be done with security.

      But when you insist in a car analogy, your computer is not a taxi. In a taxi, you don't have to care whether the car is in good repair or whether the driver is capable of doing his job. Someone is doing that for you. Your computer is your car. You're responsible to check the brake fluid and oil and whether it has enough gas, that the tires have enough grip and that your lights are working. If not, you get pulled over, get fined and maybe even get your car impounded. You don't know how to repair your car, you bring it to your mechanic and you don't wonder why it costs a few 100 bucks to get it back into shape.

      Yet with computers everyone insists that they can use it and worse, that they can keep it in good repair. And get angry if they are asked to pay 50 bucks to get it back into shape after they managed to cripple it beyond reason.

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
    88. Re:Security... by Opportunist · · Score: 1

      Because they are so versatile. Unfortunately no car analogy fits because cars can only be used for one thing, transportation. Computers can be a lot. They can play games, do your taxes, play music and so on.

      What's the alternative? Basically locked-down computers that work like an iPhone, only running software the maker of the computer approved and sanctioned. Do we want that? Probably not, but I fear it could be something a lot of people would want.

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
    89. Re:Security... by Opportunist · · Score: 1

      The same applies to Linux.

      It's been quoted so many times that Linux would be so much more secure because malware could not get "system privileges" without the user giving it root access. And even ignoring the dancing pig problem, since most people only have one account on their system and use this exclusively, running with the privileges of that one user is enough. The user has the right to access the internet (or else the user using it cannot either), the account has the right to install software, at least in the user's environment (else the user couldn't either), has the right to read all of the user's files and data (or else the user... you know), basically has all the rights the user has.

      And that's usually enough to create a mess.

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
    90. Re:Security... by Opportunist · · Score: 1

      But AV tools are more a seat belt and an airbag. I mean, you use them but you still don't drive into incoming traffic just because you have belts and airbags. Likewise, AV tools are no replacement for common sense and waryness. Just because you have an AV suit doesn't mean you can leave your brain at home when entering the internet.

      "Use AV tools and surf like you don't have them" is my usual advice.

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
    91. Re:Security... by Opportunist · · Score: 1

      No, but I start to wish they did. Then the problem would probably solve itself pretty quickly though evolution.

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
    92. Re:Security... by Opportunist · · Score: 1

      Send it to www.virustotal.com and see what other AV tools say about it.

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
    93. Re:Security... by Opportunist · · Score: 1

      Because people would not buy those computers, simple as that. Why? Because they would obviously have to be less capable and versatile than the normal computers we have today.

      It's trivial to develop a computer with a fixed state system partition that cannot be altered that allows you to browse pages and read mail and takes away your ability to alter the system in any way or to install additional programs. The problem: This system would cost at least as much as more versatile systems because, well, the components are the same. Actually it would have to cost more, because your additional work to lock it down would have to be paid.

      How do you want to convince people to pay more for less?

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
    94. Re:Security... by AmiMoJo · · Score: 1

      Consumer protection laws are there to prevent people getting ripped off with promises of great products that are accompanied by exploitative loan agreements or extended warranties. The assumption is that Joe Average might not be clued up enough to fully understand and not fall for these scams.

      If you accept that then it seems unreasonable to expect Joe Average to also struggle with misleading "click here for free smilies!" type malware scams. Using a computer is pretty much a requirement for most people to live their everyday lives and to work, so rather than just writing them off a stupid we should probably look for some way to help them in these situations.

      --
      const int one = 65536; (Silvermoon, Texture.cs)
      SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
    95. Re:Security... by Opportunist · · Score: 1

      It still is a process. Because the threats develop.

      20 years ago, nobody cared about external intrusion because networks, especially widespread worldwide networks, were rare and the threat to the average network you might have as a small company were minimal at best, because you did not have perpetual connection to it. 10 years ago nobody cared about password stealing malware because the threat simply did not exist in widespread use. 5 years ago nobody cared about drive by infections and secure surfing because the threat was virtually unheard of. 2 years ago nobody cared about infected PDFs in webpages because that angle of attack was not used yet.

      I have no idea what the future will bring. Maybe we'll get malware that redirects your Windows update requests, or malware that piggybacks on online games. Maybe we'll get something I can't even think of yet. You can't just "buy stuff", configure it and sit down and pretend you're now secure for all eternity. You have to reconfigure it, maybe "buy more stuff", and keep on top of the development of malware to protect against it.

      That's what's meant with "it's a process". You can't just buy a box and that's it for the next few millenia.

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
    96. Re:Security... by wings · · Score: 1

      Your guest may want to riffle through your papers and make a mess, but what he really wants to do is break into that maintenance room to tap your phone, read your mail, insert advertisements and porn in your Cable TV, clog up your drains, crank up the heating and A/C, open all the windows and doors, then kick back and wait for instructions from his boss about sending out spam or whom to DOS. If you try to evict him and do it improperly, you end up burning down the whole house.

    97. Re:Security... by Opportunist · · Score: 1

      Taste and GUI.

      Seriously now. AV suits are not entirely snakeoil. Some are, and I'm as angry as the next person that these bad apples soil my field of work. The problem is that there's no standardized test, no quality assurance institute that can help you avoid bad AV suits that double as malware (and I'm not even talking about real malware/snakeoil that claims you have 9 bazillion infections unless you buy their product).

      Determining that something is malware is also not easy. It's even a little like being the immune system of a living body. You can't just attack everything that looks like a bacterium because there are benign bacteria in a living, healthy system. It's pretty much the same, you can't go for software using certain DLL calls because they exist for a good reason, and even flagging changes in system files cannot be used because systems get updates.

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
    98. Re:Security... by vertinox · · Score: 1

      This means he has full access to your personal room. The geeks who don't understand the real world will say "Ah, but OS XYZ is secure because the "maintenance personnel only" room is locked and unaccessible". But who the fuck cares? You keep most of your stuff and valuables in your personal room! Insurance can take care of recreating the maintenance room stuff - not hard since the stuff in there is the same for every house of that model. They'll never be able recreate your personal documents.

      This is why you keep your very important things in a safety deposit box, in the bank, at a completely off site location.

      AKA Backups.

      Also insurance is as a last resort as you'll have to fight the reinstall process (just like your insurance company will fight your claim so will Windows if you modified your hardware when you format and reinstall the OS).

      Anyways... The point of the matter is that no local program should modify the OS. It should be designed to work with the OS as no matter who intelligent and brilliant the programmer of the 3rd party app thinks he is, he cannot predict the behavior of the user and/or other 3rd party programs may do to the OS as well. Nor can he predict future fixes and patches and revisions of the OS API which may break their program down the road.

      If the 3rd party app is mostly OS agnostic, then the less problems it will have down the road when thinks get changed or broken in the OS.

      As far as the home directory analogy. Make backups. Make off line backups.

      Because chances are your hard drive will fail just as easy as a malicious program wipes all your data. Secondly, as long as the OS has not been compromised, reinstalling home directory data usually will not cause the malicious program to run as it would require it to be manually run again.

      --
      "I am the king of the Romans, and am superior to rules of grammar!"
      -Sigismund, Holy Roman Emperor (1368-1437)
    99. Re:Security... by Anonymous Coward · · Score: 1, Insightful

      what kind of bonehead measures things like this in 'clean up' time? your data has been compromised. your passwords should be changed. your ssn or credit card numbers might have been made available to others...

      you should do a complete format and reinstall all of your applications (i hope you have backups of your data). you should also hope there isn't a nasty surprise now hiding in your bios.

      there are a tremendous number of reasons to care about securing your systems and relative clean up time is NOT one of them.

    100. Re:Security... by TheLink · · Score: 1

      Your mail is already in your room, and he can read it, see all your passwords as you type them, since he's in the same room as you are.

      --
    101. Re:Security... by TheLink · · Score: 1

      That's fine for the destruction problem.

      But doesn't help for confidentiality and other problems:

      1) your private stuff can all be seen by the program running using your account.
      2) there are many ways it can get your passwords too.
      3) the private stuff can include your browser cookies and various credentials, so it could do stuff in your name, with your authority.

      --
    102. Re:Security... by mustafap · · Score: 1

      You're one of those people who write the Ikea assembly manuals, aren't you? :o)

      --
      Open Source Drum Kit, LPLC deve board - mjhdesigns.com
    103. Re:Security... by Anonymous Coward · · Score: 1, Insightful

      Until you find you have a trojan and all your assets (credit cards, banking info, ebay/paypal accounts) have been compromised. Have fun cleaning up that credit!

    104. Re:Security... by vertinox · · Score: 1

      Which is why I think the most secure OS would sandbox each program separately from each other and not just the OS. Say when you install a program it only gets access to \home\programs\programnamehere\ and not be able to look at anything else without going through hoops of fire.

      May not be the most friendly OS and the easiest to use, but it would do a lot to making sure home directories are just as secure as the OS.

      --
      "I am the king of the Romans, and am superior to rules of grammar!"
      -Sigismund, Holy Roman Emperor (1368-1437)
    105. Re:Security... by Anonymous Coward · · Score: 0

      Since you seem so confident and intelligent, how do you plan to teach that to a "normal person"?

      Teach them? Never.

      But I will charge them though the nose till they decide to educate themselves.

    106. Re:Security... by erple2 · · Score: 1

      This argument is true of _any_ system, however, not simply these particular ones. If I can get a sysadmin to run this binary that I've put in my home directory, then I can fully compromise the entire machine.

      There is no way to secure the interior completely without making it unusable. There are simply levels of security.

      Any time you introduce humans into the equation, there is ALWAYS a possibility of compromising a secure system. So by that extent, maybe the test has unreasonable expectations?

    107. Re:Security... by tehcyder · · Score: 1

      Security is a process, not a product

      But a rolling stone gathers no moss. And kind words butter no parsnips.

      --
      To have a right to do a thing is not at all the same as to be right in doing it
    108. Re:Security... by tehcyder · · Score: 1

      >If the person doesn't use the tape measure properly, and saws the wood too short, there isn't any magic that can fix the problem.

      Use the other end of the piece of wood?

      Worked for me many times :o)

      Say you have a six foot piece of wood that you want a five foot length from. If you cut it at four feet, the other end isn't going to help you much...

      --
      To have a right to do a thing is not at all the same as to be right in doing it
    109. Re:Security... by Epi-man · · Score: 1

      stick with Macrohard products

      You just made my day. That's my preferred nickname for the Redmond giant, but I seem to be the only one to use it in my circles.

      (perhaps the most inane post I have ever made on /.)

  3. Sign of the times... by unitron · · Score: 2, Interesting

    Despite this being Slashdot, when I first saw the headline about "anti-virus" products, I immediately thought "stuff like Tamiflu".

    --

    I see even classic Slashdot is now pretty much unusable on dial up anymore.

    1. Re:Sign of the times... by Anonymous Coward · · Score: 0

      Nice conspiracy theory. -1 tin foil hat

    2. Re:Sign of the times... by buchner.johannes · · Score: 3, Interesting

      They took 16 flu shots from companies that produce flu products, and used several flu strains that all companies advertise their products for (influenza C, H1N1, H1N2, H3N1, H3N2, and H2N3). The study focused on creating the necessary antibodies and 'cleaning the system' from the flu. Unfortunately, none of them rated 'very good'.

      If you have a dark sense of humor, read on.
      399234 test subjects were used, and 4735 deaths recorded.

      --
      NB: The message above might reflect my opinion right now, but not necessarily tomorrow or next year.
    3. Re:Sign of the times... by drinkypoo · · Score: 1

      Please provide citations, I could use them. Otherwise, stop teasing me.

      --
      "You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
    4. Re:Sign of the times... by buchner.johannes · · Score: 4, Funny

      I can't provide citations to stuff I just made up

      --
      NB: The message above might reflect my opinion right now, but not necessarily tomorrow or next year.
    5. Re:Sign of the times... by mustafap · · Score: 1

      >I can't provide citations to stuff I just made up

      lol.

      That's going in my sig.

      --
      Open Source Drum Kit, LPLC deve board - mjhdesigns.com
    6. Re:Sign of the times... by unitron · · Score: 1

      Sure you can, just make them up! : - )

      --

      I see even classic Slashdot is now pretty much unusable on dial up anymore.

    7. Re:Sign of the times... by amRadioHed · · Score: 1

      Of course you can. What do you think wikipedia is for?

      --
      We hope your rules and wisdom choke you / Now we are one in everlasting peace
    8. Re:Sign of the times... by Lunzo · · Score: 1

      You could if you were studying Philosophy :)

    9. Re:Sign of the times... by Opportunist · · Score: 1

      Amateur. How much would it have taken you to create a webpage for the "American institute for national healthcare"? And presto, citation material.

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
  4. antivirus 2009 by Anonymous Coward · · Score: 0

    They need to try this antivirus it detects thousands of viruses in my computer!!!!!,I can't wait for antivirus 2010 to come out.

  5. dd by Anonymous Coward · · Score: 2, Funny

    Guess they didn't try:

    dd if=/dev/zero of=/dev/sda

    Only sane way to remove viruses. Rates an "Excellent".

    I guess the equivalent in Windows is to buy a new computer. Also, an "Excellent" method.

    1. Re:dd by gzipped_tar · · Score: 1

      I'd use /dev/urandom. Three times ;)

      --
      Colorless green Cthulhu waits dreaming furiously.
    2. Re:dd by Kvasio · · Score: 1

      this is not a secure recommendation. This is exactly how they've created winsock.dll version 3.10.0.103.

    3. Re:dd by Opportunist · · Score: 1

      Also in the news, Smith&Wesson have been creating a cure for cancer for over 100 years now. No living cancer cells could be found in any people treated with their remedy after only a few hours after they got a shot...

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
  6. Browsing safely by Utopia+Tree · · Score: 5, Insightful

    I don't think anyone sells common sense.

    1. Re:Browsing safely by Tumbleweed · · Score: 5, Insightful

      I don't think anyone sells common sense.

      It wouldn't matter if they did; no one would buy it as everyone thinks they already have it.

    2. Re:Browsing safely by oldhack · · Score: 1

      Common sense is a vaporware.

      --
      Fuck systemd. Fuck Redhat. Fuck Soylent, too. Wait, scratch the last one.
    3. Re:Browsing safely by Jessta · · Score: 1

      huh?
      ok, safe browsing 101:
      1. install virtual box
      2. install your operating system in virtual box
      3. install a web browser in virtual box
      4. get checksum of everything in virtual box image
      5. open and use browser to access a page
      6. close browser, check all checksums are fine, reboot vitural box image
      7. goto 5

      Don't open anything from inside the virtualbox on your main system and everything will be fine.

      This isn't common sense, this is madness!
      There is not way to be safe with just common sense. Every major browser constantly has vulnerabilities, every major plugin has vulnerabilities.

      --
      ...and that is all I have to say about that.
      http://jessta.id.au
  7. On *NIX it is standard policy to format and by LukeCrawford · · Score: 2, Insightful

    restore from a known good backup whenever the root account is compromised, be it compromised by a worm or a human, in part because it's impossible to tell the difference between a human pretending to be a worm and a worm, so it is quite difficult (perhaps impossible) to know what the attacker did, and how to undo the damage.

    1. Re:On *NIX it is standard policy to format and by Jadecristal · · Score: 1

      This really still applies to Windows too, which is why "cleaning" never made a lot of sense to me. I suppose that one could put their trust in the big AV companies, who analyze viruses and note what they mess up/with, but in the end, I have no way of knowing what I just had run rampant on my computer, and so it's far far far safer to just wipe everything.

    2. Re:On *NIX it is standard policy to format and by pjt33 · · Score: 1

      The thing is that very few people have the option of wiping Windows and reinstalling without spending a lot of cash, because most of the software on their computers was installed by the OEM and they don't have install disks. Of course, even with the option many would prefer a quick "clean" to a time-consuming install process, but better customer support in the form of including install disks would help those who have the time and inclination but not the money.

  8. How come they never test Comodo? by hairyfeet · · Score: 1

    Comodo is free, it doesn't bog down the machine, and while I admit I don't go to the sleaziest parts of the net so far it has caught everything that I have run across. It also has a nicer firewall than the crappy Windows built in one, so how come nobody tests it?

    --
    ACs don't waste your time replying, your posts are never seen by me.
    1. Re:How come they never test Comodo? by wizardforce · · Score: 1

      Don't forget the open source Clamwin antivirus program.

      --
      Sigs are too short to say anything truly profound so read the above post instead.
    2. Re:How come they never test Comodo? by John+Hasler · · Score: 1

      > ...so how come nobody tests it?

      Most likely because they don't have a big enough marketing budget.

      --
      Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
    3. Re:How come they never test Comodo? by jesseck · · Score: 1

      I use Clamwin at work, but I would never recommend it to the users. I'm smart enough to watch where I browse, scan suspicious files before opening, etc. But the users aren't... they click on everything, and need a real-time scanner to watch what they do. Clamwin doesn't offer that (yet), but the moment it's available I'd roll it out to everyone.

    4. Re:How come they never test Comodo? by mysidia · · Score: 1

      This is typical of AV-comparatives. They don't test every single product in every single comparative, see their testing methodology and conditions for participation; they test a select list of products that have passed certain criteria, generally no more than 16 per test, and their board chooses which products.

      Note, they didn't test other popular AV software such as Trend Micro, CA Antivirus, F-Prot, Fortinet, Panda, ZoneAlarm, DriveSentry, Cisco Security Agent, nProtect, eSafe, in this test, either.

      Also, the vendor has to choose to participate and have applied for inclusion. AV comparitives won't just take any AV products they see off the street and test them, the vendor participates in this, and signed an application and agreement with the vendor's seal. The vendor gets to provide software and license keys, pay some fees for using AV Comparitives logos, etc, and make some agreements regarding the exchange of missed virus/malware samples.

      Also, see here

      :

      Qualified Candidates: At AV-Comparatives we limit the participants in our tests to about sixteen and where possible we include only good and reliable products/vendors. Due to this, we have devised various requirements in order to take part. One of these is the detection of a minimum percentage of SET A test set. We believe that even for new vendors this should be easy to pass, as long as they have a good engine (products included in the current main tests all scored between 97-100% over SET A). This also aids us identifying and filtering out rouge anti-virus vendors. Fulfilling this requirement does not necessarily mean that a product has good detection rates over SET B.

    5. Re:How come they never test Comodo? by micheas · · Score: 1

      Don't forget the open source Clamwin antivirus program.

      http://www.moonsecure.com/

      Should be a better fit as I believe it uses the windows idea of how an anti-virus program should work (scan on read.)

      --
      Work bio at MMWD
    6. Re:How come they never test Comodo? by Machtyn · · Score: 1

      Agreed. I use Comodo as well because their firewall is EXCELLENT. But I would like some independent reviews of its AV product. It hadn't been released when I did an AV review for one of my school projects ... and I really don't want to go through that trial basis again. ... But perhaps I will have to do that at some point.

  9. WRONG SITE! by Anonymous Coward · · Score: 5, Informative

    They said AV-Comparative.org in the article. Try going there and see what happens. The correct site is av-comparatives.org.

  10. if mearly loading a website compromises my by LukeCrawford · · Score: 2, Insightful

    computer, my browser is completely broken.

    1. Re:if mearly loading a website compromises my by Anonymous Coward · · Score: 0

      Here, let me fix that for you.

    2. Re:if mearly loading a website compromises my by GigaplexNZ · · Score: 2, Interesting

      Completely broken? No, it still functions correctly most of the time, so just partially broken. Writing bug free software is virtually impossible, so while blaming your browser might seem like a good idea, the only way to guarantee that you aren't using a broken browser is to not use any browser.

    3. Re:if mearly loading a website compromises my by LukeCrawford · · Score: 1

      Exactly what I meant. firefox on linux noscript and without flash is fairly safe

    4. Re:if mearly loading a website compromises my by Anonymous Coward · · Score: 0

      My browser is `wget -O - | html2text | less`. Try exploiting that!

  11. Re:I Just switched to an interesting product .... by Anonymous Coward · · Score: 0

    My god you are an ass.
    there are virls out there designed for OSX because it is now finally getting a marketshare big enough to have it worth making something to comprimise your precious yuppie OS.
    Putz.

  12. Somewhat vague... by allknowingfrog · · Score: 0

    The article doesn't say much about what "good" means. If they tested what I assume are the 16 most popular products and none of them achieved "very good," by what standard do they judge? A ranked list would have been more useful for me.

    Also, I find it ironic that "average" is one of the scores. "Good" and "poor" imply an objective scoring system, but "average" would imply that the score is relative to the rest of the group. : )

  13. Format C: by Anonymous Coward · · Score: 0

    They must not have included the free offering from MS: "format c:" It is very good at complete removal of malware.

    1. Re:Format C: by Anonymous Coward · · Score: 0

      HAW HAW HAW! never thought of that, how hilarious! oh my god i'm still laughing! keep it going! HOOOOOOOOOOOOOOOOODAAAAAAAAAAAWGY!LOL.

  14. They tested Anti-virus software for malware by Jazz-Masta · · Score: 5, Insightful

    How about testing some malware removal programs? Malwarebytes, Adaware, Spybot?

    I find Malwarebyte's Anti-malware to work wonders. Paired with Avast home edition, it is a good free combination. I think most system administrators notice the difference between software primarily tailored for virus detection and removal, and ones tailored for malware detection and removal.

    They tested these:

    Avast Professional Edition 4.8
    AVG Anti-Virus 8.5
    AVIRA AntiVir Premium 9.0
    BitDefender Anti-Virus 2010
    eScan Anti-Virus 10.0
    ESET NOD32 Antivirus 4.0
    F-Secure AntiVirus 2010
    G DATA AntiVirus 2010
    Kaspersky Anti-Virus 2010
    Kingsoft AntiVirus 9
    McAfee VirusScan Plus 2009
    Microsoft Security Essentials 1.0
    Norman Antivirus & Anti-Spyware 7.10
    Sophos Anti-Virus 7.6
    Symantec Norton Anti-Virus 2010
    Trustport Antivirus 2009

    1. Re:They tested Anti-virus software for malware by ScottCooperDotNet · · Score: 1

      I find Malwarebyte's Anti-malware to work wonders.

      It appears Malwarebytes uses simple techniques, like the name of a file, to determine if it is infected or not. This works very well against malware that uses the same name/path, but also makes it highly likely to find false positives. Try naming a harmless file after a fraudware program (say, Personal_AV) and you will see MBAM mark it as infected.

      I have yet to see these antimalware programs be tested for false positives, but it would be interesting to see the results.

    2. Re:They tested Anti-virus software for malware by Anonymous Coward · · Score: 0

      All security software sucks. Yes, even your favorite package.

    3. Re:They tested Anti-virus software for malware by MojoStan · · Score: 1

      They tested Anti-virus software for malware

      How about testing some malware removal programs? Malwarebytes, Adaware, Spybot?

      How should we define "malware?" AV-Comparatives.org chose (for now) not to include "adware, spyware, dialers, tools and rogue programs" (which they define as "Potentially Unwanted Applications"). They do include viruses, trojans, backdoors, rootkits, exploits, DDoS, flooders, sniffers, and nukers (from their "methodology" pdf file).

      Also, their "Removal-Test" page makes it clear that they are testing "Anti-Virus" products. I guess they are using the term "malware" because we expect "anti-virus" products to detect/remove more than just viruses (e.g. trojans, rootkits, etc.)

      --
      TO START
      PRESS ANY KEY

      Where's the 'ANY' key? I see Esk, Kitarl, and Pig-Up...

    4. Re:They tested Anti-virus software for malware by goga_russian · · Score: 1

      where is DrWeb?

      --
      Dont Judge The situation by the Misfortunate. Goga.
    5. Re:They tested Anti-virus software for malware by dbIII · · Score: 2, Insightful

      I think most system administrators notice the difference between software primarily tailored for virus detection and removal, and ones tailored for malware detection and removal.

      I think all system administrators performing the job they are paid to do don't muck about with such things - guessing where the system has been compromised and what is in some hidden corner. Instead they wipe it and rebuild or restore from backups. Of course outside the job we are confronted by people that do not have backups or even install media (every raving MS windows fanboy I've met did not actually pay for the software), so then you have to muck about with "cleaning" things and hope you've got the lot.
      They are called 0wned for a reason, it's not your computer anymore you are better off wiping it and starting again.

    6. Re:They tested Anti-virus software for malware by mysidia · · Score: 3, Informative

      Agreed...

      They should have instead tested:

      1. SUPERAntispyware
      2. PC Tools Spyware Doctor
      3. Malwarebytes Anti-Malware
      4. PrevX CSI
      5. Webroot Antispyware with AV and Firewall
      6. Spy Sweeper
      7. ThreatFire 4.5
      8. Vipre Antispyware 3.1
      9. CA Pestpatrol
      10. CounterSpy
      11. Trend Micro Security
      12. Tenebril SpyCatcher
      13. LavaSoft AdAware Pro 8.1
      14. McAfee Anti-Spyware
      15. Panda Internet Security
      16. AVG Anti-spyware (not anti-virus)
      17. Ashampoo Antispyware

      And then maybe considered testing some of the lesser-known or that I believe to be outdated and/or quite ineffective:

      • Spybot Search and Destroy
      • Crawler Spyware Terminator
      • SPAMFighter Spyware Fighter
      • Spyware X-Terminator
      • Xblock X-cleaner
      • Cyberdefender
      • Spyware Terminator
      • StopZilla
      • SpyEraser
      • GarbageClean
    7. Re:They tested Anti-virus software for malware by mysidia · · Score: 1

      How many average windows users do you see taking important files and renaming them to Personal_AV.exe ?

      For most windows users, 'hide file extensions' is checked, so it would already have to be a .EXE file that they are renaming.

      I won't doubt the possibility of a false positive; however, it seems quite unlikely in actual practice to see that.

      Simple methods can be quite effective sometimes, as long as they are quite careful about what filenames they single out as possibly bad.

      I would expect they have to use the more complicated methods for malware that randomizes its filenames, anyways.....

    8. Re:They tested Anti-virus software for malware by harlows_monkeys · · Score: 1

      Why would anyone want to test Spybot? It's crap. I've seen false positives remain in Spybot that every other vendor fixed 5 years ago. It was once pretty good, but those days are long past.

    9. Re:They tested Anti-virus software for malware by simoncpu+was+here · · Score: 1

      Disregarding corner cases is bad design. It does not matter if it's unlikely that the user would name a file as Personal_AV. If that condition is possible, and side-effects would occur because of that condition (i.e., deleted files), then it is a bug.

    10. Re:They tested Anti-virus software for malware by mysidia · · Score: 1

      In this case, files get moved to quarantine, maybe, and user gets a nice taste of why they shouldn't tempt fate by doing weird s***.

      It's also conceivable, something will possess the user one day to type X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*

      Or some other commonly recognized virus pattern into a text file.

      Neither in that case, nor this one, is it a poor design for the AV program to have a false positive in such cases.

      It's why AV software quarantines malware instead of outright deleting, and why there is generally an option to whitelist or exclude certain directories from scanning.

      But in the case of MalwareBytes, the software is free, so it should definitely be no surprise to you that you don't have something that is currently an Enterprise-grade product when you use it.

    11. Re:They tested Anti-virus software for malware by simoncpu+was+here · · Score: 1

      It is also conceivable, among other countless scenarios, that an MP3 or JPEG will be encoded in such a way that those series of characters will occur. Disregarding corner cases is bad design. This is a good initial test though.

    12. Re:They tested Anti-virus software for malware by Toad-san · · Score: 1

      I too am a big Malwarebytes (MBAM) fan. At our computer shop it's one of the standards (often the first) that we run when checking and cleaning systems for viruses and malware.

      However Microsoft Security Essentials (MSE) has joined the suite since it came out, and it apparently is catching things (real things too) that MBAM (and everything else) is missing. And doing a good job of realtime protection as well as cleaning, traces and all.

      Panda Antivirus Online continues to be a regular member of the test suite too. The free online test won't remove anything but the simplest infections. But it gives full details as to where it found all the other stuff so you can remove it manually. High Sign to PAV for a Most Excellent product. Of course now way would I use their resident AV software: way too big, too intrusive, slows down most systems horrifically. But Panda Online is a good too.

      Norton (any product): worthless. Ditto with McAfee. AVG Free isn't bad, but MBAM and MSE are better. Kaspersky isn't bad, but no free version we'd want to install on customer systems. Avast isn't bad, but their "free" version nags like crazy, so we don't use it.

      So MSE is installed on user systems, along with MBAM as a "second check" backup.

    13. Re:They tested Anti-virus software for malware by GeorgeS · · Score: 1

      Kaspersky isn't bad, but no free version we'd want to install on customer systems

      Do they get pissy when ya charge them for installing free software?

      --
      "I'd rather have a bottle in front of me than have to have a frontal lobotomy."
    14. Re:They tested Anti-virus software for malware by templar112 · · Score: 1

      Malwarebytes all the way. It has fixed many a thing for me without having to reinstall Windows.

  15. Re:I Just switched to an interesting product .... by davitur · · Score: 0, Flamebait

    Isn't this an example of security through obscurity? Maybe an example of how virus authors subscribe to the pareto principle...

  16. Stop with the recommendations by HermMunster · · Score: 4, Insightful

    Stop recommending products. The tests demonstrate that av products don't perform well. It is right on. 80% of my day is spent cleaning malware. I have written here many times about how you need a combination of products. I've also emphasized the need to do the initial cleaning with the infected drive as the secondary in a second machine.

    Until you do this day in and day out please stop with the recommendations, as you are not helping anyone one bit.

    --
    You can lead a man with reason but you can't make him think.
    1. Re:Stop with the recommendations by Anonymous Coward · · Score: 0

      What about recommendations for people trying to prevent malware (the category under which most of us fall, (hopefully))? Would you say they need multiple AVs too or just say 'go away, i will never recommend a single product'?

    2. Re:Stop with the recommendations by Spatial · · Score: 1

      Here's my recommendation: go hog wild, people! I love your money.

    3. Re:Stop with the recommendations by Anonymous Coward · · Score: 0

      80% of my day is spent cleaning malware.

      You need a new job. Unless you enjoy what you're doing, in which case Good For You.

    4. Re:Stop with the recommendations by mysidia · · Score: 2, Informative

      Instead i'm going to make lots of recommendations. Cleaning an infection is all about using lots of tools, since no one tool is perfect, every tool has a gap in what it can detect or clean. But when it comes to prevention as few tools as possible should be used, and low-overhead choices should be used, since every tool installed and running slows down the workstation, and big-footprint tools have a big negative effect on users' productivity.

      I've also emphasized the need to do the initial cleaning with the infected drive as the secondary in a second machine.

      I don't recommend this. Your scanner has no way of knowing the secondary drive is a complete system.

      Some malware/viruses make registry and system-level changes, and these registry changes can have serious long-term consequences. Get anti-malware on the system that can fix the registry in the proper removal process.

      In the extreme case, running the scan on the medium plugged into another system, can result in you rendering the disk you are scanning an unbootable OS.

      For cleaning process, I recommend having a bootable USB stick, with a hardware write-protect switch. Always set the physical write-protect switch to the read-only position when plugging into the system being cleaned.

      Then install anti-virus/anti-malware tools, I use:

      Avira Antivirus
      SUPERAntispyware
      Malwarebytes Anti-malware Technician Edition
      PC Tools Spyware Doctor
      PrevX Enterprise
      Lavasoft Adaware Business
      ESET NOD.32
      ComboFix
      HijackThis

      Copy tools installers to some innocuous folder on the hard drive, or have them installed to run from USB.

      Run a Malwarebytes quick scan first, if possible, since it's fastest. Since the USB stick MBAM is installed on is read-only, malware can't delete or tamper with mbam.exe. Sometimes it doesn't work: some malware detects specific cleaning tools.

      In that case, use a different program. Or, actually have various methods of stopping malware from detecting the program: things like hexediting strings in anti-malware executables to make the anti-malware "undetectable" by malware's naive procedures.

      Anyways, after the initial pass with some scanner, it will generally require a reboot, then another pass with the scanner to delete locked files. Do that.

      After all that, boot from a bootable USB stick, which is either an Avira, ESET, BitDefender, or Kaspersky rescue disk image, and run a full scan from rescue media.

      Then boot back into the system... and run a complete scan with all 6 anti-spyware tools (except HijackThis and Combofix, only use use once, pick only one AV tool to use. Only remove things with HijackThis if you understand what is not safe to remove).

      Otherwise: any time that a tool reports something found, I clean it, reboot, and note that when finished this round of scanning with the next tools, the spyware scans need to be done over again with all tools.

      Only after running a complete scan with all the anti-spyware tools and successfully getting "0 results found successively with each tool, can one reliably say "I think it's clean".

      Once you get that, uninstall all anti-spyware and AV tools that were installed on the system, and install the preferred End-Point preventative security tools.

      Many of the tools that are great for scanning aren't the ones good for prevention.

      HijackThis and Spybot can make for reasonable cleaning in some cases. But for prevention of malware, it's gotta be something like PrevX or Spyware Doctor.

      And virus prevention should be eEye Blink, or ESET + Trend Micro, with some sort of IDS and network-wide patch management in place, e.g. Shavlik NetChk.

      The major consideration with prevention of AV on user workstations, is that: realtime protection should be available, enabled, and configured properly. The footprint should be minimal. Users shouldn't notice any slowdown,

    5. Re:Stop with the recommendations by Anonymous Coward · · Score: 0

      Hahaha, you work as an IT janitor.

    6. Re:Stop with the recommendations by Anonymous Coward · · Score: 0

      I clean malware all day (yes, it is part of my job too) and I think the recommendations do help people. Something is better than nothing. Once the computer is compromised, something can *still* be better than nothing - it just depends on what the PC was compromised with. Most users can't boot into safe mode, much less swap hardware around. Don't take away the easy solution just because it isn't the best solution.

    7. Re:Stop with the recommendations by troll8901 · · Score: 1

      Stop recommending products. ...Until you do this day in and day out please stop with the recommendations, as you are not helping anyone one bit.

      I think TFA can be read as a reminder that we should not solely depend on one product. I think it's just a test, nothing more.

      The company I work at uses a mix of various antivirus products - AVG, Avira, BitDefender, Kaspersky, McAfee, Norton, PC Tools, Trend Micro - trial, paid and free versions. (The need to uninstall them has caused me many hours of unpaid OT time.) I researched av-comparatives and toptenreviews, and ended up testing and recommending a product that was on neither list.

      Reading these comparisons have made me realize something:
          1. The range of products are incomplete, since only X number of brands are represented, and only 1 product from each company is represented.
          2. Some comparisons can be biased, being advertising-supported.
          3. Universities don't have the budget anymore to do and publish antivirus comparisons. :(
          4. Antivirus protection is just a part of my company's computer security needs. Others stem from user behavior, data leakage, and so forth. A holistic implementation is needed.

      I think other readers are smarter than to take these comparative reviews as gospel.

    8. Re:Stop with the recommendations by HermMunster · · Score: 1

      I own and operate a computer repair shop. Haha you and your suggestions.

      And yes I'm frustrated with the infection rate and the aggressive nature of today's malware.

      --
      You can lead a man with reason but you can't make him think.
    9. Re:Stop with the recommendations by HermMunster · · Score: 1

      What happens with recommendations here on slashdot in threads such as this is that they almost always turn into nothing more than "my product defies those test results". And then we degenerate into threads about why this product is no good and that one is and everyone has their own reasoning, which ultimately ends up with people confused and misguided about resolving their problems.

      The second thing that happens is that people tend to conclude from the recommendations that the recommended product is the one necessary to solve all their problems. And that is somewhat tragic as almost no product can handle what's out there today.

      It is better to teach them good practices and that they should use many products to scan their computer rather than giving them the false sense that they are clean after scanning with a single product.

      --
      You can lead a man with reason but you can't make him think.
    10. Re:Stop with the recommendations by HermMunster · · Score: 1

      I guess so. I guess you can call me that if you are willing to call someone that installs software an interior decorator, or someone that builds computers an assembly worker.

      I own and operate my own computer repair shop.

      --
      You can lead a man with reason but you can't make him think.
    11. Re:Stop with the recommendations by HermMunster · · Score: 2, Informative

      Regarding my comment about using a second machine to do the initial cleaning. I would have to say that you are quite short sighted. If you think ahead you'll understand the reasoning. And, if you are wise you'll understand that I would not recommend using a Windows box as the second machine.

      You are correct in that there are parts of the infections that a scanning from a second machine can't get. I don't dispute that, but that's why I said "initial" cleaning. The purpose of the initial cleaning is to allow you to go into certain folders and to delete files that you know are common havens for malware. After doing that you can use any of the several native Linux anti-malware products that will detect and remove infections from NTFS drives attached to the system.

      Today's malware is good at what it does. This isn't saying that some of the malware writers are not idiots. If they were competent at what they were doing they'd have your system infected and you'd never know it. Instead they pop up ads and slow your computer down and alter permissions to folders/files/registry entries--all of which are tell tale signs of an infection. What I'm saying is that malware has become quite aggressive and the authors experienced, it's just that they are sometimes dumb as a post at how to get it done without alerting the users.

      There are some pitfalls to leaving the drive in the infected computer. Some of these are exploited by malware authors. Several examples would be: some malware products will attempt to delete any anti-malware product (including the installers when you try to execute them), some malware products will disable the ability to run certain anti-malware products (even if they were installed prior to the infection), some malware products will use the system (e.g., autorun on flash drives) to copy malware onto your flash drive in order to copy their infections to new machines.

      Yes, there will be missed traces of an infection when putting the drive into another computer. If you are any good at what you do then you'll know that you have removed the vast majority of the infection prior to putting it back into the original computer. You'll have deleted known malware folders, rogue programs, the temporary folders (go through your computer and count the number of \temp located under the OS and user areas), such as temporary Internet, prefetch, temp, history. At that time you then copy over the necessary software (anti-malware installers) that you'll use to do the cleaning. After putting the drive back in the original computer you then can begin the full process of cleaning.

      I do agree that you have to clean heavy and use only what's necessary to keep yourself clean (though that requires due diligence on the part of the user, which is an uncommon characteristic of their behavior). If you over compensate you'll end up with a machine that is worse than the infection--just as some popular commercial products do.

      I generally recommend using Linux as the secondary machine as it will allow you to bypass Windows security. Unlike XP, where you can get caught by Windows security but can get past it, Vista and Win7 really try to lock out user accounts from each other and that security can get in the way. Not to mention the fact that malware is often running and using the infected machine just prolongs the cleaning.

      --
      You can lead a man with reason but you can't make him think.
    12. Re:Stop with the recommendations by The+Archon+V2.0 · · Score: 1

      Stop recommending products.

      I'm not allowed to where I work. Too much chance of something going wrong and then us getting blamed. My standard line for years has been "No virus scanner or spyware scanner is perfect."

      The tests demonstrate that av products don't perform well. It is right on. 80% of my day is spent cleaning malware.

      We wound up having to make the labor charge on our virus cleaning more expensive just to reduce the number of people getting it done. Takes up far too much in the way of resources to do it right, especially when we've got tons of hardware related diagnostics to do on other machines.

  17. No Joke by Das+Auge · · Score: 5, Interesting

    I've been working in the on-site support field for over a decade. I've seen the viruses get nastier and nastier.

    It used to be that the virus got a hold of the system, maybe did a little damage or had a little fun. Sometimes it was pretty funny. Such as screwing with the mouse.

    Then things started to get a little more serious. The virus would insinuate itself into the system folder and maybe IE. They stated doing tasks. Thus rose the botnets.

    Then it became big business for people. The spreading of spam and fake anti-virus (that wanted you to purchase the "full version" so that you'd get rid of the virus they said you had) was the order of the day. They started blocking access to the run box, the task manager, and sites that might be able to help you (online virus scanners). They started killing the AV programs. They also replaced the explorer.exe and iexplore.exe files. Hell, they even go after Firefox, Chorme, and Opera.

    They really get their hooks into in and don't want to let go because it means money. Big money. So I'm not surprised that AV programs are having a tough time getting rid of them. It hasn't been kiddies out for fun for a long time. Now it's all about professional programmers out to make an ill gotten buck.

    1. Re:No Joke by d3ac0n · · Score: 5, Interesting

      Ain't that the truth.

      The kicker? Most of the infections I deal with on a regular basis are coming from AD BANNERS. I have literally had people get a brand new machine, sit down at it, open IE8 and browse to one of the major sports news sites (ESPN, TSN, MLB, NFL, etc.) and get IMMEDIATELY infected by a banner ad!

      There are few things worse than giving someone a brand new machine, and before you've even been able to get back to your cube and sit down your BB is buzzing and you are being told to get back there because they have a virus! ARGH!

      Honestly, it's gotten so bad that with most of the fake AV viruses we just freaking wipe the stupid PC immediately. Format and re-image and done. It's faster and easier.

      --
      Official Heretic from the "Church of Global Warming". Proven right thanks to whistle blowers. AGW = Flat Earth Theory
    2. Re:No Joke by Myrcutio · · Score: 1

      actually i've been making a fair amount of money off of those fake AV programs lately too. I think it's called Total Security or Cyber Security or something like that, insinuates itself in the AV section of the action center. After the first couple systems i got pretty quick about removing it, only took me 15 minutes for the last system i cleaned. Just kill the active process, delete the CS folder from program files, remove the browser helper object and set avast to a thorough scan of all archives. Incidentally, ALL the systems i've cleaned to date have had norton 2010 installed. Lately i've taken to recommending that any customers with norton just remove it regardless of existing subscriptions and install Avast. Haven't had a single complaint yet about the viruses resurfacing in the cases that took my advice.

      makes it somewhat suspicious that TFA claimed that Norton was one of the best rated malware programs out there, and that Avast was hardly average. Sounds highly questionable.

    3. Re:No Joke by mlts · · Score: 3, Informative

      Its even past that. It used to be kids who were out to knock off someone's machine on a local BBS. Then it became the legion of professionals who went blackhat due to cash.

      Now, you have well heeled groups, from criminal organizations to whole governments who have immensely deep pockets who spend billions in order to search through every Windows and UNIX executable just to find the single buffer overrun, race condition, or other small goof that can be used in an elaborate attack. The payoff is big, and not just economics.

      Of course the attacks are nastier and nastier.

      Best defenses? After the obvious firewall and network IDS, two of the best system level out there are virtualization with a hardened hypervisor and jailing of apps. After that, an OS based IDS that can detect known signatures and unknown suspect activity. This way, something that gets access to the OS via an unjailed browser or plugin hole is stopped.

    4. Re:No Joke by dangitman · · Score: 4, Insightful

      Most of the infections I deal with on a regular basis are coming from AD BANNERS. I have literally had people get a brand new machine, sit down at it, open IE8 and browse to one of the major sports news sites (ESPN, TSN, MLB, NFL, etc.) and get IMMEDIATELY infected by a banner ad!

      Hmmm... could a law suit (class-action or otherwise) be an idea here? After all, isn't it illegal to infect someone's computer with malware? How is it that these major websites are getting away with it?

      --
      ... and then they built the supercollider.
    5. Re:No Joke by bendodge · · Score: 1

      Important! I noticed the other day that one of those fake AV programs (Windows Enterprise Suite), also hijacked the HOSTS files and messed with the permissions on it. I just deleted it and made a default file.

      --
      The government can't save you.
    6. Re:No Joke by buchner.johannes · · Score: 0, Troll

      How likely is it that no one will answer 'Screw Windows, just use Linux/BSD, it works for me' to the parent post ...

      --
      NB: The message above might reflect my opinion right now, but not necessarily tomorrow or next year.
    7. Re:No Joke by Nimey · · Score: 1

      It's not the major sites, it's the compromised ad servers that are run by others.

      --
      Hail Eris, full of mischief...

      E pluribus sanguinem
    8. Re:No Joke by Anonymous Coward · · Score: 0

      I've seen this behavior too from major websites. However, the infected ads are *not* coming from their website. Rather, they are coming from infected 3rd party ad sites they've contracted out to. So who's really at fault? The major websites, or the outsourced ad site providers?

    9. Re:No Joke by Anonymous Coward · · Score: 0

      How about a RICO style legislation placing the responsibility about the infecting adds to the "presenting" website, provided that the website belongs to an active organization? Just think about the consequences...

    10. Re:No Joke by Antony-Kyre · · Score: 2, Insightful

      That is why we have to love how Google does their ads. Graphical ads just don't feel safe. But, maybe I'm paranoid. Maybe it's the flash ads that are the real offenders.

      So, either banner blocking software, or perhaps freeze software, so if someone is infected, a reboot brings it back to status quo.

    11. Re:No Joke by mrbcs · · Score: 1
      Did you have this one?

      http://www.mvps.org/winhelp2002/hosts.htm

      --
      I'm not anti-social, I'm anti-idiot.
    12. Re:No Joke by Anonymous Coward · · Score: 0

      I have literally had people get a brand new machine, sit down at it, open IE8 and browse to one of the major sports news sites (ESPN, TSN, MLB, NFL, etc.) and get IMMEDIATELY infected by a banner ad!

      I have a hard time believing this. Where they using XP instead of vista? You may be surprised but vista IS more secure than XP and would probably would have've stopped the attack.

    13. Re:No Joke by dangitman · · Score: 1

      But the major sites choose to run those ad servers, so aren't they somewhat complicit in this?

      --
      ... and then they built the supercollider.
    14. Re:No Joke by dangitman · · Score: 1

      So who's really at fault? The major websites, or the outsourced ad site providers?

      Both. The major websites deliberately chose not to vet the advertising providers, so should share some of the blame, if not the lion's share of it.

      --
      ... and then they built the supercollider.
    15. Re:No Joke by Anonymous Coward · · Score: 0

      Ads are being served by a third party, who in turn, do not review the ads they get submitted until someone complains (Doubleclick anyone?). Just like sites dont monitor the torrents they serve, banner ads are being handled with the same excuse.

    16. Re:No Joke by shutdown+-p+now · · Score: 1

      How do you get infected by a banner ad? It's just an image. Presumably there may be bugs in the renderer, and we know of two specifically - the WPF exploit (which doesn't work on Vista and above out of the box, IIRC) and the PNG security hole. Both are long patched, however, and you mention IE8, so I assume the machines in question are reasonably up-to-date with respect to updates. So how does it work, then?

      Or do you mean that users click on those banners, download an executable, and run it (because it tells them to, to get free porn or whatever0.

    17. Re:No Joke by mlts · · Score: 1

      Even if someone does mention it, it is factual in a way -- UNIX variants have a very low number of viruses. However, come to think of it, modern day Windows really doesn't have true viruses as of recent. Mainly because people tend not to distribute executables amongst each other. Instead, attacks are either Trojans, worms that infect machines in real time, or done via Web browser, or done via browser add-on exploits. These affect all operating systems. The reason one sees Trojans for Windows and OS X is the profitability factor -- more ROI to hit the top 1-2 used platforms rather than try to find a way to remotely root someone running NCSA Mosaic on an old IRIX 5.x box.

      But eventually all operating systems should have some type of OS level IDS system that can detect known threat signatures and unknown ones that match various heuristic rules. This way, if someone does get in via yet another hole in a service, the IDS will be able to detect and log it, or actively stop the attack.

    18. Re:No Joke by weicco · · Score: 1

      When you download something with IE it is marked that it came from the internet. When you execute it Windows asks if you are alright running this executable which might or might not contain malware. If user clicks "Yes, yes, I want viruses and stuff" maybe they should sue themselves from stupidity. Well, maybe some computer fraud thingy could come to picture if executable is presented as non-malware software. I'm not familiar with US laws.

      But I find the whole GP's statement suspicious. I just visited ESPN and NFL websites and got zero viruses or any other type of malware. I use Windows Vista, IE8 and Avast. UAC turned on (or left on, as is set on as default). I'm not sure if I should have clicked those banners or something to get infected or maybe GP turned every security setting off to get his/her Windows infected or something but no viruses here.

      --
      You don't know what you don't know.
    19. Re:No Joke by Anonymous Coward · · Score: 0

      . . . isn't it illegal to infect someone's computer with malware? How is it that these major websites are getting away with it?

      They aren't. There's no way anyone is being infected by these sites.

    20. Re:No Joke by xlsior · · Score: 2, Interesting

      They aren't. There's no way anyone is being infected by these sites.

      Don't be so sure -- there have been plenty of cases the last few years with major websites being duped into pushing out malware.
      For eample, the New York Times pushed out trojans recently: http://www.scmagazineus.com/New-York-Times-inadvertently-sold-ad-space-to-hackers/article/148990/

      Another one (a little longer back) revolved around .WMF files - an old printer image metafile format that can include executable code which windows ran without asking anything. Simply viewing the file in internet explorer ran the payload. Icing on the cake is that it still worked if the malicious .wmf files were renamed to .JPG thanks to the way IE handles the image rendering. Some entrepreneuring people spread a bunch of these on the major ad networks without getting caught, and there you go... Any website running ads from these networks now came with a malicious payload.
      http://www.dailykos.com/story/2006/1/1/235748/4675

      Now, hey may not have done so intentionally, but plenty of big, mainstream websites have indeed been caught unwittingly pushing out trojans and malware over the last few years. It's really not that far-fetched. These are just two examples, there have been plenty more over the years.

    21. Re:No Joke by Anonymous Coward · · Score: 0

      The major websites are just targets. The malware is in the ads, which come from a third-party ad vendor. The malware authors work out which ad vendors the big sites (ESPN, MLB etc) use, and buy ad space through a front company.

      It might take a day or two before the big site realises they're serving infected ads (the malware will have been written specifically for the campaign, and will have been pre-tested to avoid detection by static scans from all current AV software (sites like VirusTotal are probably more useful to malware authors than to ordinary people)). When they do notice, they'll pull them, but how do they follow up? The front company that bought the ads will be located in a different country than the major site owner, and the ad vendor (which was already quite possibly in a different country to the major site).

      And it's a front company anyway, set up just for this purpose, that easily makes the money back, so can be discarded afterwards.

      I agree completely that legal action should be brought - making malware ads cost ineffective is the best way to shut them down, and legal action is part of that. But it's not an easy thing, even though it is a worthwhile thing.

    22. Re:No Joke by Anonymous Coward · · Score: 0

      "It used to be that the virus got a hold of the system, maybe did a little damage or had a little fun. Sometimes it was pretty funny. Such as screwing with the mouse."

      Ya, there's nothing funnier than when someone you don't know, takes your computer out for a good time, gets it drunk, and returns it to you by wheeling it home in a shopping cart and leaving it on your doorstep, ringing the doorbell and running off. Fun times!!

    23. Re:No Joke by Nimey · · Score: 1

      They typically have no idea what ads they're actually running - the ad-server operators buy space and time on the major page, then sublet that out to random people.

      Best thing to do, based on limited correspondence with a website ads guy, is to contact the webmaster & let them know about the rogue ads, and then the site owner can block ads from the random sublet-ee in question.

      --
      Hail Eris, full of mischief...

      E pluribus sanguinem
    24. Re:No Joke by Bender0x7D1 · · Score: 1

      Unfortunately, the idea of vetting everything doesn't work.

      To be sure no one is doing anything wrong, every ad will have to be vetted. Do you have any idea how long that would take? It would increase the overhead so much that no one would advertise. "That would be great", you say? Unfortunately, you're going to have ad providers that will decide to go after those ad dollars by offering a "no-vet" plan. Which will be jumped on by the advertisers since it would be vastly cheaper. Then websites that want more revenue so they can keep operating, (there are a lot of sites that are ad supported), decide to allow the "no-vet" ads - which is a reasonable decision since they would go out of business otherwise. (Hey, I'd love it if there wasn't bad stuff on the Internet, but I'm also not going to ask someone to give up their job over some b*st*rd trying to f*ck them over with malware ads.) Then, the major sites realize profitability has gone into the toilet, and see that they need to accept "no-vet" ads, and we're back where we started.

      The only place I can really see vetted ads working is in a specialty environment like kids entertainment. Since, if a bad ad gets shown, the negative press from it could put you out of business. But, even there, it would be better to limit yourself to ads from major companies like Disney, Nickelodeon or Toys'R'Us which has a lot to lose from a malware filled ad.

      There are bad people in the world that are going to take advantage of the system. It sucks, but that's the way it is. I'm not saying don't go after them and prosecute them when you can; but you have to accept that they will always be there.

      --
      Reading code is like reading the dictionary - you have to read half of it before you can go back and understand it.
    25. Re:No Joke by WuphonsReach · · Score: 1

      Flash and Javascript ads are the two main methods of drive-by, user didn't even do anything, infections.

      Firefox + NoScript + FlashBlock

      The internet ad business is going to have to change, or the end-users are going to revolt and install ad blocking software to keep their machines safe.

      --
      Wolde you bothe eate your cake, and have your cake?
    26. Re:No Joke by dangitman · · Score: 1

      They typically have no idea what ads they're actually running

      Again, aren't they guilty of negligence? If you aren't aware of how a major part of your business operates, then that's a problem. It's like Kellogg being unaware that some of their cornflakes are being manufactured by Columbian drug cartels Not acceptable.

      --
      ... and then they built the supercollider.
    27. Re:No Joke by dangitman · · Score: 1

      To be sure no one is doing anything wrong, every ad will have to be vetted. Do you have any idea how long that would take? It would increase the overhead so much that no one would advertise.

      I don't see why they should get off scott-free, just because it's internet advertising. If you advertise on TV, all kinds of vetting goes on, and yet somehow TV advertising still happens.

      --
      ... and then they built the supercollider.
    28. Re:No Joke by HermMunster · · Score: 1

      I have postulated in the past that the consumer should sue the advertisers. That's where the spam and pop ups are coming from. When others attempted to investigate this very suggestion those entities paying for the ads are feigning ignorance claiming that they just spend the ad dollars and aren't paying attention to how the dollar is being used. To me this is a great cop out and an indication of a great liability.

      If you think about it it would certainly cut down the amount of ads on the net if these ad entities were sued and they began to lose money and I think you'd see far less spam. But suing the advertisers is a catch 22, it drives the web (which it shouldn't--there are other ways).

      Imagine the viagra type companies getting sued because they knowingly support companies that spam your inbox. We've all heard the dollar amounts that businesses loose to this spam, often incredible amounts a year. Someone besides the consumer paying for the Internet access should have to compensate them for it.

      --
      You can lead a man with reason but you can't make him think.
    29. Re:No Joke by Anonymous Coward · · Score: 0

      >There's no way anyone is being infected by these sites.

      Any form of executable code can cause an infection, whether it's improperly sandboxed plugins or Javascript, a buffer overflow in a piece of code, a popup that happens to appear just before you click a link, or any other means of access.

    30. Re:No Joke by dangitman · · Score: 1

      Wow, what a sharp and incisive response!

      --
      ... and then they built the supercollider.
    31. Re:No Joke by nuckfuts · · Score: 1

      it's gotten so bad that with most of the fake AV viruses we just freaking wipe the stupid PC immediately. Format and re-image and done. It's faster and easier.

      Agreed - 100%. Today's malware can be so tenacious. You can waste hours battling an infection only to discover that none of the tools available can eradicate it. And THEN you give up, reformat and reinstall.

      Now when I see one of these buggers that fights back hard, I go straight to a reinstall and get on with my life.

  18. Re:I Just switched to an interesting product .... by Anonymous Coward · · Score: 0

    You are going to end up with the aids virus though... just sayin.

  19. The usual suspects by EmagGeek · · Score: 5, Informative

    Of course, half of the software they tested is not anti-Malware software (Avast, for example, is an AV, not an Anti-Malware).

    They also did not test MalwareBytes, probably because it would make all of the others look bad.

    1. Re:The usual suspects by BikeHelmet · · Score: 2, Informative

      Malwarebytes seems to detect everything nasty.

      Of course, in my experience, it also detects a lot of stuff that isn't nasty. Don't even bother running it on a drive from an old Win98 computer. It'll tell you there's 30 viruses from 2008/2009 installed on it, even if that computer had no internet access. :P

      But if you examine the results and use some deductive reasoning, it's an amazing tool.

    2. Re:The usual suspects by CAIMLAS · · Score: 1

      That's a pointless distinction, when you consider that people pay for McAfee, Avast, etc. and expect it to protect them (user-ambiguous distinctions between "virus", "trojan" and "malware" aside) from harmful software.

      MalwareBytes is useful as a clean-up tool, but only (IMO) as a detection tool telling you that you need to reinstall/reimage, or in a home client computer repair scenario. Once you're infected, you're infected; I've found there's really no going back to a clean, well-performing system after that happens.

      --
      ~/ssh slashdot.org ssh: connect to host slashdot.org port 22: too many beers
  20. Re:I Just switched to an interesting product .... by Thantik · · Score: 1

    Yeah, instead you just lose your data randomly. I think they even came out with a game that deletes 1 file at a time each time you score...I think it was for.......OS X

  21. So recalibrate the gradings... by FlyByPC · · Score: 0, Flamebait

    OK, if I were to rate PC speeds as "Very Good" if they exceeded 500 petaflops, none would get that rating. But it's still quite possible that the fastest ones out there would be worth having, compared to the rest.

    If there are differences in performance in the products you are evaluating, your scale should reflect this. If none of the packages rate "Very Good," it's time to recalibrate the scale, unless there's a clear natural distinction between that rating and the next-lowest. Unless you're asking for perfection to achieve that rating (which is unrealistic), it doesn't really mean anything if none of the programs get your top rating.

    --
    Paleotechnologist and connoisseur of pretty shiny things.
  22. Leftovers = malicious? by Anonymous Coward · · Score: 0

    If AV software kept track of every malware component (non-malicious) the detection engine size would grow by a massive amount and people would then complain about performance.

    1. Re:Leftovers = malicious? by sowth · · Score: 1

      Exactly, which is why antivirus programs are mostly useless.

  23. Re:I Just switched to an interesting product .... by Anonymous Coward · · Score: 0

    My neighbor called me in a panic a couple of weeks ago saying that he needed help, that his computer had a virus. I go next door and I sit down in front of his mac which has words flashing "trojans detected." He had clicked on it and it downloaded multiple exe's onto his desktop. That's when I realized that OS X isn't completely useless. Some people can use real scissors, while others need safety scissors.

  24. Re:I Just switched to an interesting product .... by curmi · · Score: 2, Insightful

    He was hardly an "ass", though maybe a troll. Certainly an entertaining post, but your response to it was wrong.

    1) There are NO viruses for the Mac. There are trojans though, like any OS.

    2) The Mac has long had the marketshare for viruses - pre-OS X there were plenty of Mac viruses. There have been none for OS X because it is more difficult to write them with the way the new OS is designed. Writing one for OS X is like a holy grail for virus writers.

    3) Who is the "ass" calling OS X a "precious yuppie OS"?

  25. Isn't that dependent on how you define "very good? by Hurricane78 · · Score: 1

    I wonder who tests if the test itself is "very good"...

    How about you, good sir...

    And you perhaps...?

    ^^

    --
    Any sufficiently advanced intelligence is indistinguishable from stupidity.
  26. all lame by Danzigism · · Score: 3, Informative

    for the regular user, I can understand wanting the "feeling" that you're protected. however, when even the shittiest and lamest rogue-AV programs like WinAntiSpyware, Antivirus2009, System Protector Pro, Police Pro, and all the other bogus products can't be stopped by even the best of AV software, ya gotta think. these scanning programs don't do shit and make you feel like they have. so, understand how your system works. use Sysinterals Autoruns to see what shit is being loaded on your system. and become familiar with our dear friend combofix provided by Bleeping Computer. It is the only tool worth a damn that can also get rid of severe rootkits. Sometimes for the real bad ones you'll need to use the Windows Recovery Console to delete files hidden from the Windows API as well as disable infected drivers/services. AV will still be a joke since the bottom line is, you can still get infected. especially if you are prone to getting viruses anyway due to your browsing habits.

    --
    *plays the Apogee theme song music*
    1. Re:all lame by onefriedrice · · Score: 1

      Sometimes for the real bad ones you'll need to use the Windows Recovery Console to delete files hidden from the Windows API as well as disable infected drivers/services.

      So... it's possible for files to hide themselves from the Windows API? That explains a lot.

      --
      This author takes full ownership and responsibility for the unpopular opinions outlined above.
    2. Re:all lame by Anonymous Coward · · Score: 0

      alternate data streams

    3. Re:all lame by Danzigism · · Score: 1

      absolutely. it is very common amongst rootkits. typically they are .sys files that are completely hidden but loaded as actual drivers. not even a regular dir /ah will show you their existence. However mounting the filesystem from a Linux boot disk, or even the Windows Recovery Console will reveal the files. be sure not to simply delete the file for you may get a bluescreen. it is best to disable the service that is associated with the driver via the Recovery Console, then delete the file. rootkitrevealer is another simple application that shows you all files hidden from the Windows API.

      --
      *plays the Apogee theme song music*
  27. Expeted Linux fanboy response. by Hurricane78 · · Score: 2, Insightful

    *whispers*
    "Shall I?"
    (whisperwhisper)
    "Why me??"
    (whisperwhisper)
    "Ok, damnit! I'll do it! But you owe me one!"

    *steps forward into the spotlight*

    *loud*
    "Well, I found a better combination:"
    *louder*
    "JUST INSTALL GNU/LINUX!"

    *normal voice*
    "Thank you, thank you! I will be here..." *dodges flying chair and Granny Smith with bite mark* "... all night!"

    (P.S.: I use Linux as my main Desktop. And Windows for the games. No hard feelings here. :)

    --
    Any sufficiently advanced intelligence is indistinguishable from stupidity.
  28. Also by Sycraft-fu · · Score: 3, Informative

    Testing online (meaning running the removal program on a running, infected, system) removal seems kinda silly. You are fighting a war there and the malware has the upper hand being there first. On a compromised system you generally want to work on it offline. You either boot a live CD or take the hard disk to another computer. That way the malware can't be running. You can then use tools to track it down and remove it.

    Running a scanner on a live system is more of a preventative measure and a detection measure. You have a realtime scanner looking for threats coming in. If it finds them, it can block them before they have a chance to do anything. This is 99.9% of the good a virus scanner does. It stops them before they ever infect the system. It can then also help in terms of alerting you if a system is infected.

    However counting on one to be good at removal on a live system seems silly. Take the system offline, fix it, and bring it back up.

    1. Re:Also by Jazz-Masta · · Score: 1

      This is the best method to remove viruses/malware, I agree, but only if you have physical access to the machine.

      If you're supporting one of your 10 000 new friends (how convenient, so many new friends, all have viruses) over the phone, getting them to install one of those quickly, works.

    2. Re:Also by LordLimecat · · Score: 1

      Just tell them to use combofix. It removes everything.

    3. Re:Also by buchner.johannes · · Score: 1

      No. That would be the smart thing to do, but the products are designed to run on an infected system. That's why they should be tested in this way.
      Also, fixing the system offline is too complicated for the average user (to whom these products aim for).

      --
      NB: The message above might reflect my opinion right now, but not necessarily tomorrow or next year.
    4. Re:Also by Sycraft-fu · · Score: 1

      Actually the products seem to be designed to run on a clean system, and to keep it that way. None of the virus scanners I've seen seem to have the idea of "Wait till you get infected, then install us." They all instead believe you should have them running on your system at all times right from the get go. They are a preventative measure, more than a cure.

      Also, as I said, there is the simple matter of an arms race and who is there first. If malware is already on the system, running, then it has the ability to prevent any AV product from being installed. It could well be coded such that is recognizes AV products and blocks their execution, in much the same way an AV product can do to it. As such there's only so much you can expect from a program on an already infected system.

  29. Googling for URLs? by ScottCooperDotNet · · Score: 1

    Being that even legitimate sites like NYTimes.com and Boston.com can be spreading malware, how is browsing safely going to work?

    I'm still horrified by people who have to use Google to get to their destination. No wonder people fall for phishing. Do they know they can type in the address bar?

    1. Re:Googling for URLs? by Darkness404 · · Score: 1

      Googling for URLs is much safer than typing in the address bar. How many times do we misspell Google if we are in a hurry? We might spell gogole.com, gooogle.com, gogle.com, googgle.com googl.com, and a whole lot of others. Any one of those could be a phishing site. With Google you get a nice spellcheck for your search for one and for another it tries to block any site that has malware on it. Using Google you will avoid phishing much more than using the address bar.

      --
      Taxation is legalized theft, no more, no less.
    2. Re:Googling for URLs? by GigaplexNZ · · Score: 1

      Do they know they can type in the address bar?

      Have you ever heard of typosquatting? Or searching for some general piece of information without knowing what site hosts that information?

    3. Re:Googling for URLs? by LordLimecat · · Score: 0

      Or you could just use Chrome or OpenDNS, both of which do this automatically.

    4. Re:Googling for URLs? by gmuslera · · Score: 1

      Tried misstyping a domain in google? It suggest the correct one right there if the domain is widely used. Of course, bookmarking in shorter/safer/easier than typing every time the same domain. And chrome/firefox warns you to when you try to access reported malware and phishing sites. If you want to be horrified at something, start for people frequently typing URLS (or clicking them from spam messages) using a browser with vulnerabilities that enables to run binaries or without that kind of phishing protection. Like with the 20-30% that still use IE6, specially in environments where the consequences of getting hit are worse.

    5. Re:Googling for URLs? by Opportunist · · Score: 1

      Did favorites and stored weblinks really go out of fashion so quickly?

      Actually, I'm fairly sure most non-technical people rely heavily on them because they don't remember URLs any better than they remember IP addresses (the primary reason why URLs exist in the first place). But they do remember they want to go to "their" bank page, so they search for their bank in their favorites instead of remembering ... was it hyphenated, or was it bankofsomething or just bos, or was it .com or .$my_country_TLD (provided they know their countries TLD)...

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
  30. Re:I Just switched to an interesting product .... by Anonymous Coward · · Score: 0

    My God, your ass is full of stars

  31. Re:I Just switched to an interesting product .... by washu_k · · Score: 1

    There were not plenty of viruses for pre-OSX, no one cared.

    I've seen virus counts of between 50,000 to 150,000 for Windows around the time OSX came out. Lets say 100,000.

    Just before OSX came out MacOS had between 1 and 5% of the market. Lets guess on the low end and say 1%.

    That would indicate pre-OSX should have had a "virus market share" of at least 1000. In reality it had at most 80, more likely only 40 in total.

    pre-OSX had no were near the number of viruses it's market share would indicate. As pre-OSX had no security at all, security by obscurity worked pretty well for it.

  32. Let me put that another way: by LukeCrawford · · Score: 1

    if you are using a browser that is commonly compromised by opening the incorrect webpage, you are a moron. Don't run IE, don't run flash, and run noscript, and you should be fine.

    1. Re:Let me put that another way: by Anonymous Coward · · Score: 0

      if you are using a browser that is commonly compromised by opening the incorrect webpage, you are a moron. Don't run IE, don't run flash, and run noscript, and you should be fine.

      What browser should we run then? There have for a while been significantly more severe vulnerabilities for FireFox than IE8 on Vista or Win7 in all the advisories from independent firms like Secunia. The old vulnerabilities story seems to have switched 180 without all FF advocates realizing.

  33. Re:I Just switched to an interesting product .... by dangitman · · Score: 1

    I think they even came out with a game that deletes 1 file at a time each time you score...I think it was for.......OS X

    Whereby "they" you mean a conceptual artist who created that game as an art piece - not some script kiddie or malicious programmer or criminal. And the game was clearly labeled as to what it did.

    So, would you care to point to any real problems that have affected users, rather than creating a strawman?

    --
    ... and then they built the supercollider.
  34. Clicking On Links Shouldn't Be Dangerous by EXTomar · · Score: 1

    Although I agree no one sells common sense, I do think clicking on links in a web browser or email shouldn't put your machine at risk. If clicking a link in Firefox or Thunderbird in Linux or BSD created a compromise in the system, people would eagerly seek a solution by reworking the architecture of the system and software. The system we see today on Linux and BSD and the like grew out of those lessons. That isn't to say you can't click on a link in Firefox that causes trouble or have an bug that is exploitable in Thunderbird but the entire machine isn't ruined. On the other hand in Windows they decided it was "cheaper" to just throw scanning software in the way instead of fixing the design. Why does one feel the right way to approach the problem while the other feels like a work around?

    Of course Linux and BSD and Windows aren't frozen and are still evolving but I really see an evolutionary dead end in the way Windows handles this. This is insanity to continue to believe that security in Windows can be maintained by AV software and user intervention and Microsoft staying ahead of the bad guys. Users have no way of knowing before viewing if a link they click is really dangerous and even the best behaved users accidentally miss-click. Users can't tell the difference between malware and anti-virus software. Who validates what is AV software and malware? The AV software industry or Microsoft? These guys haven't given us much reason to trust let alone the problem of having a conflict of interest.

  35. Important rules for running windows by linu77 · · Score: 0, Redundant

    Tree things you need to do to have a Windows Box secure 1) Install an Anti-Virus 2) Don’t use internet explorer use Firefox opera etc 3) Don’t run windows as administrator (this one is the most important rule of all)

    1. Re:Important rules for running windows by Anonymous Coward · · Score: 0

      Gee, ya think?

      This place is getting more and more like a newspaper BBS, every day. Place used to be cool... but the "me too!" boys are breaching the gates.

  36. Wipe It by Talisman · · Score: 4, Insightful

    Imaging products have become so good and fast that I no longer bother with 'scrubbing' a computer clean when it gets a virus. I can reimage the machine in less time; 15 minutes from start to finish, and I don't have to worry about viral remnants in the registry or some deeply buried hidden folder with a time bomb inside.

    I keep our company's image file up-to-date, and when something goes wrong with a computer (drive crash, corrupt registry, malware, whatever) they are back online in 15 minutes. Screw scouring the web for a utility to remove a particular virus that may or may not work, and screw relying on an all-in-one product to save you from malware.

    I have come to terms with the absolute fact that users are stupid and careless and aside from rare individual who bother to be responsible, they will always be stupid and careless, no matter how much I wish they would change.

    In a business environment, imaging is the way to go.

    (I use a Mac at home and don't have to worry about such things)

    --

    "Study your math, kids. Key to the universe." -The Archangel Gabriel
    1. Re:Wipe It by clockwise_music · · Score: 1

      Most business's that I've worked for use imaging - and it's definitely the way to go.

      But what about at home? Are there any good open source or free imaging software? Can you DIY?

    2. Re:Wipe It by Anonymous Coward · · Score: 0

      (I use a Mac at home and don't have to worry about such things).

      Yet....

    3. Re:Wipe It by strikethree · · Score: 1

      Reimaging is fine and all but what do you use to keep all of the patches current on that image? If you have no way to apply patches to this image, you will be sending the computer out without all of the security patches, and those take time to apply manually.

      Unfortunately, in a Microsoft world, everything is painful, even the status quo.

      Regards

      --
      "Someone needs to talk to the tree of liberty about its ghoulish drinking problem." by ohnocitizen
    4. Re:Wipe It by Turzyx · · Score: 3, Insightful

      I use a Mac at home and don't have to worry about such things

      http://it.slashdot.org/article.pl?sid=09/04/16/2327246 I was with you up until the very end. Why ruin a perfectly good comment with overconfidence and arrogance?

    5. Re:Wipe It by troll8901 · · Score: 1

      when something goes wrong with a computer (drive crash, corrupt registry, malware, whatever) they are back online in 15 minutes.

      You are very lucky.

      I am not allowed to format the machines. I have to remove viruses the hard way.

    6. Re:Wipe It by Anonymous Coward · · Score: 0

      Where do you store the user's data?

    7. Re:Wipe It by Anonymous Coward · · Score: 0

      Carbon Copy Cloner (Free) for Mac OSX is able to copy mounted partitions, including system partitions to other drives or partitions.

    8. Re:Wipe It by Anonymous Coward · · Score: 0

      What do you do about the user's personal files and configuration?

    9. Re:Wipe It by kaoshin · · Score: 1

      I can reimage the machine in less time; 15 minutes from start to finish Not all businesses are alike. This can be complicated by many remote support situations and IT groups level of incompetence in developing solutions to accommodate them. A lot of unskilled hacks also use reimaging as a crutch for their inability to troubleshoot. Any halfway decent tech can clean up a heavily infected PC using basic troubleshooting and a battery of freely available software in a couple of hours. This often beats getting on a plane to go onsite, shipping the PC in, figuring out how to migrate a strange undocumented application that was built by some guy who was laid off, reinstalling a ton of non-standard applications and unpackaged apps that have to be updated, license activated and reconfigured. Yes, I realize there are solutions to address many of these issues, but from my experience it isn't only the users who are stupid and irresponsible. Anyone can fall under that classification, even mac users.

    10. Re:Wipe It by Lunzo · · Score: 1

      Why ruin a perfectly good comment with overconfidence and arrogance?

      He already said he uses a Mac. Doesn't that explain it?

    11. Re:Wipe It by StuartHankins · · Score: 1

      The article you cited describes Macs getting infected by users installing infected files manually. That's much different from a Windows user becoming infected with drive-by downloads / infection from banner ads. No system can completely secure the machine from a user running as root or with root credentials (which if you're unfamiliar with Macs is usually required to install most OSX software).

      The common thread I see is that Windows machines are still getting owned regularly despite attempts to patch it with AV software, and there just doesn't seem to be a good solution available.

      What do I use? Other than a Mac (with Windows XP and several other OS's in VMs), I use Trend on the XP VM along with stateful inspection on the Exchange server and firewall, which basically combines both "regular" server software with a monitored service that analyzes content accessed from within the network and people outside the network trying to get in. It's not cheap but it is effective, and the number of viruses / outbreaks are minimized as a result. But they are still nonzero, and time and effort is wasted on reimaging the machines (mostly laptop users). Despite all the protections, I do maintain multiple copies of my XP VM just in case.

      Do I ever worry that my Mac will become infected? Never. I consider the chance of infection from driveby's on OSX or Linux laughable, as does most of the industry. I've been in the industry (starting with programming, through PC repair, consulting, later sysadmining, DB, middleware and enterprise app development) for almost 3 decades on a considerable number of different system types -- and Mac viruses just aren't an issue. Anyone who tells you differently is trying to sell you something.

    12. Re:Wipe It by tylernt · · Score: 1

      Where do you store the user's data?

      Right where it belongs -- on the network.

      Are you implying employees still store data locally on their hard drive? Madness.

      --
      DRM 'manages access' in the same way that a prison 'manages freedom'
  37. Common sense was left out of the program by dbIII · · Score: 3, Insightful

    If you had more than a passing familiarity with Microsoft's products and the elaborate pile of stuff on top that makes it even more insecure you would be aware that you need more than that. Large numbers of viruses and worms have spread with no user interaction at all, and others that required intervention have spread via things that appear to be quite innocent to the user (banner advertisement on Australia's Telstra white pages telephone number search page one day for instance). Then of course there is downloading that program that the user assumes is only going to give them an animated purple monkey, a weather report or little images of smiles to decorate their emails. They don't know that they system has no way of protecting them from such things being other than what they appear to be.
    Don't fall for the copout of accusing the users of being idiots. Instead it's a long chain of events with stupidity at many steps on the part of some developers which gave us a house of cards which the user can upset so easily.
    We can't just say "haha, user is an idiot" when we in the computer software industry can look in the mirror to see part of the real idiocy. Every time I make a user "admin" or "power user" so that they can run badly written software I add to the idiocy and create another potential node for a botnet or another chance at credit card fraud.
    At one site I do work for EVERY user has to be "admin" so they can run an internally developed dotnet application that writes it's config file to the root of the system drive simply because that's where the developer wanted to put it. The developer has a string of certifications and years of experience but still carries on with such overtly STUPID actions, not because he is stupid but because a very large chunk of the industry is stupid and stupidity is standard operating procedure. Most of the new security options in Microsoft's products are rendered pointless when the applications on top come from such a culture of stupidity.

    1. Re:Common sense was left out of the program by Anonymous Coward · · Score: 0

      i believe windows file permissions are sufficiently granular such that the systems administrator could add each user to a group that had privileged access to that file but normal permissions to the rest of the system.

  38. Kinda pointless by jim_v2000 · · Score: 1

    The primary purpose of an antivirus is to keep you from getting infected in the first place. Cleaning up an existing infection is secondary and, in a growing number of cases, impossible.

    --
    Don't take life so seriously. No one makes it out alive.
    1. Re:Kinda pointless by Le+Marteau · · Score: 2, Informative

      Pointless? Not exactly. New viruses can appear on your systems before there are any patterns for them. It is then left to to a scan and a clean-up to deal with it.

      --
      Mod down people who tell people how to mod in their sigs
    2. Re:Kinda pointless by sowth · · Score: 1

      No, the primary purpose of real security is to keep from getting infected or allowing the malicious to gain an advantage.

      The primary purpose of antivirus is to do an AIDS test 10 years after you had sex without bothering to use a condom. Maybe you should wear the condom first, and when you get the AIDS test as a precaution, you won't be too worried about it being positive.

  39. Or to put it simply by dbIII · · Score: 1

    Dust off and fdisk from orbit, it's the only way to be sure.

  40. Re:I Just switched to an interesting product .... by dbIII · · Score: 1

    Isn't this an example of security through obscurity?

    I don't know about you, but I heard of Apple some time before I heard of Microsoft. The young ones may of course not noticed that Apple music player, you know just like the Zune only it works every day of the year :)
    In other words your argument has even less value than it had twenty years ago when it was merely bullshit.

  41. Re:I Just switched to an interesting product .... by Philip_the_physicist · · Score: 1

    Such a game would work just as well on windows, or any other OS. Beyond that, the sibling has said everything worth saying about it.

  42. Whack a mole, just like... by brit74 · · Score: 1, Insightful

    We've been fighting computer viruses for decades now. And we haven't made any headway. It just seems to get worse. Isn't it time that we all just give up and allow viruses to infect our computers? Let's stop fighting it. Let's stop playing 'whack a mole'. No? You don't think so? Sorry, I just has to say that to parody all of the 'you can't stop piracy, you should just permit it' arguments.

    1. Re:Whack a mole, just like... by thogard · · Score: 1

      A solution that would help a great deal is to white list the programs that can run and deny everything else. Microware's OS 9 had this back in 1982 or so.

    2. Re:Whack a mole, just like... by Anonymous Coward · · Score: 0

      My first experience with the dark side was a trojan in a whack-a-mole game. Ahhh, the good days when a hacker tells you that you have a problem and how to fix it.

    3. Re:Whack a mole, just like... by Karellen · · Score: 1

      Except you have to have a way to add programs to the whitelist. Either programatically for "real" apps to do it in their installer, which is useless because the malware will just add itself to the whitelist. Or via a system-enforced dialog for the user along the lines of "warning: The new 'dancing-pigs.exe' program you downloaded wants to run. Allow? Y/N", which ... is just as useless.

      --
      Why doesn't the gene pool have a life guard?
    4. Re:Whack a mole, just like... by misexistentialist · · Score: 1

      Indeed, computers should not allow users to install any programs; if additional software is needed, users can buy a new factory-programmed machine. Software updates will be registered with ISPs, and delivered for a fee to users. Any other distribution of programs to users will of course be punished with not more than 10 years in jail. Finally, there should be a law requiring ISPs to scan users' computers, and fine people with infected machines $50000; if they are caught 3 times, they should be banned from using a computer.

    5. Re:Whack a mole, just like... by Noughmad · · Score: 1

      it's A PiTy there are no such things today.

      --
      PlusFive Slashdot reader for Android. Can post comments.
    6. Re:Whack a mole, just like... by thogard · · Score: 1

      In a corporate environment it isn't hard to manage such a list outside of the scope of the system. Even in a home environment it would be a huge step forward.

  43. Offline isn't always best, actually. by RudeIota · · Score: 2, Informative

    The offline approach worked fantastically in the year 2000, but now... the playing field has changed.

    We have root kits that embed themselves into alternate data streams, utilize virtualization, employ self-encryption and password protection and randomize what would otherwise be easy-to-detect signatures etc.. Some root kits can *only* be reliably detected if they are actually *running* because they conceal themselves using these techniques. *Even then*, it requires a competent utility with things like stealth detection which look specifically for that behavior of concealing/unconcealing itself. As a result, some of these viruses don't show up in Safe Mode either...

    Scanning offline is a good first step if the system is hosed. From my experiences though -- if the system can boot and mostly works -- do whatever scanning you can first while it is online. Use your best judgment as to whether you have mitigated the threat and THEN take it offline for the final clean up.

    --
    Fact: Everything I say is fiction.
    1. Re:Offline isn't always best, actually. by Anonymous Coward · · Score: 0

      Unfortunately it is impossible to really clean up a system after a virus has full write access to it. In theory, you could decompile every piece of executable code on the machine, but it would take forever to check the resulting code. you can make checksums of all executable files, but the that still leaves configuration files that can call executable code with malicious parameters. If you add regular checksumming of the configuration files, then the virus may already be in the checksum for a long time.
      Reinstalling from a trusted source is the only way to be sure, and isn't that impractical either.
      (Note: running an operating system that makes it very hard for a virus to get write access to the whole system is a good start)

    2. Re:Offline isn't always best, actually. by Anonymous Coward · · Score: 0

      Strongly disagree. If your system can run it, then it can detect is as well. Just like with DRM, if you can play it, you can record it. Even if your malware encrypts itself, there must be a loader program that is not encrypted. Alternate data streams are also accessible offline (there are plentiful of tools for that). Polymorphism of course makes this harder, but this is true for online as well.

    3. Re:Offline isn't always best, actually. by RudeIota · · Score: 1

      Strongly disagree. If your system can run it, then it can detect is as well.

      Certainly, but it isn't as straight forward as you're implying. You're living in the 90s if you think a virus can't be hidden from a virus scanner.

      your malware encrypts itself, there must be a loader program that is not encrypted

      Yes, but can that loader or the mechanism for installing that loader not change its own instructions by randomly transposing code? Can it not insert NOOPs here and there? Can it not reassign registers and so on? Is it always going to have the same hash/checksum/bytes?

      No, no *good* virus will.

      Heuristics are the secret sauce of good AV scanners, but that is certainly far from perfect. Otherwise, virus scanners rely on some form of 'virus signature', which is often based on a database of known viruses and checksums. Nearly any changes at all means you're AV is left guessing... And no algorithm is going to be right all of the time, even *if* the changes to the loader or virus are minimal.

      --
      Fact: Everything I say is fiction.
    4. Re:Offline isn't always best, actually. by Hymer · · Score: 1

      If you've got some of those you simply:

      1. boot live CD
      2. backup your data
      3. format disk (no, quick format is not good enough)
      4. either reinstall OS and applications
        or restore disk image
      5. update system
      6. restore your data (remember to scan it first)

      It may be much faster than finding and removing malware... especially if you've got a disk image.

    5. Re:Offline isn't always best, actually. by Anonymous Coward · · Score: 0

      what you should do is make md5 sums of all system files (and repeat that after each update), then compare them offline.
      autoruns can make a list of startup utils. store that after clean install so you can later compare it.

    6. Re:Offline isn't always best, actually. by Velex · · Score: 1

      We have root kits that embed themselves into alternate data streams, utilize virtualization, employ self-encryption and password protection and randomize what would otherwise be easy-to-detect signatures etc.. Some root kits can *only* be reliably detected if they are actually *running* because they conceal themselves using these techniques. *Even then*, it requires a competent utility with things like stealth detection which look specifically for that behavior of concealing/unconcealing itself.

      Uhm, excuse me, call me ignorant, but when the system is powered off it's all bits on the drive. As another commentor replied to you, there has to be an unencrypted bootloader or loading program somewhere. This isn't magick. This is mathematics. It's very, very complicated mathematics, but it's still a machine. We like to anthropomorphize viruses like some bad episode of Reboot, but the computer is a machine that does what's it's told to do.

      Attempting to clean a machine while it's operational is completely stupid, but maybe not as stupid as the virus-writer who writes a virus that can be cleaned while the system is operational. That's probably your only saving grace.

      As a result, some of these viruses don't show up in Safe Mode either...

      It's called a rootkit. If I modify core utilities like Task Manager to show you what I want you to see, why would safe mode make a difference? Whatever, it's all the Matrix. We've got programs running all over the place. It's completely unpredictable! Let's just anthropomorphize it until we forget it's numbers. Does that make you feel like a warrior? Is it all so much more exciting when we look at it like a round of D&D instead of math?

      --
      Join the Slashcott! Stay away entirely Feb 10 thru Feb 17! Close all tabs to prevent autorefresh!
    7. Re:Offline isn't always best, actually. by Anonymous Coward · · Score: 0

      There is no cleaning up. For my customers, a format/reload was the only offered solution.

      After explaining why, they thanked me for it.

      (No longer works for self)

  44. Most of the anti-virus products performed well. by Michael+G.+Kaplan · · Score: 1

    If you look at the PDF of the report that the article references you will see that many of the products were completely successful at identifying and at least neutralizing the tested malware. The reason why none of them rated "very good" is because some of the programs required you to reboot your computer to remove some specific malware programs while for others the use of a boot CD was required. The report also criticizes when some anti-virus programs leave some non-malicious components behind instead of eliminating 100% of the program.

    The article gives the impression that the programs are failing to combat the malware, but the criticism is more about the convenience of the malware removal process. And yeah, I think it is a nice thing to completely remove a piece of malware but the report doesn't explain why it is so tragic if some anti-virus programs sometimes fail to remove some of the non-malicious components of the malware.

  45. They don't bother to manage their ads by Sycraft-fu · · Score: 1

    So what happens is that very few websites actually do their own ads. Instead, they sign on with a banner ad firm. They then just put code in their HTML to display those ads. so they aren't screening what goes on their sites. Now as to why you'd get hat form an ad company, most likely they got duped but who knows. At any rate they aren't doing it on purpose and it doesn't happen very often. They are just being lazy.

    1. Re:They don't bother to manage their ads by dangitman · · Score: 1

      At any rate they aren't doing it on purpose and it doesn't happen very often. They are just being lazy.

      I never thought they were doing it on purpose, but shouldn't they be held responsible for their negligence for not vetting these third parties? After all, it's not like malware being injected through third-party ads is unheard of, in fact it's widely known. These websites should be well aware of the risks of dealing with such advertising companies.

      --
      ... and then they built the supercollider.
    2. Re:They don't bother to manage their ads by Sycraft-fu · · Score: 1

      You'd have a lot of difficulty with that. I'm not saying that such a suit would be impossible, but it'd be pretty difficult. If there was a pattern of this sort of thing then ok you could probably argue that they were being negligent. However this kind of thing is quite rare over all. So they'd argue that it was the banner ad company's job, and that they had no reason to suspect they weren't doing it.

      Do remember that while it happens it is rather rare. I do computer support for a living and I've yet to encounter it. You'd have a lot of trouble with a lawsuit. If not, well then a lawyer probably would have brought one already.

  46. None Rates "Very Good" by Anonymous Coward · · Score: 0

    So use "None"!

    Also, nothing works faster than Anadin. So you can save some money there too next time you've got a headache.

  47. New approach by Tibia1 · · Score: 1

    I say if we can't win the software battle, set up alternative defenses.
    Emails should have a captcha (enter text above please) before you can send an email. Yes, this is a global pissoff, but spam is too, and this would do something about spam mail. All of those spam bots would be out of a job.
    Kids should be educated about viruses, and not to click that golden "buy full version to fix virus" button. Sure, many people still will, but educating people on not buying into the tricks would help.
    If we take away how malware developers can profit, that is doing a lot in the direction of fixing this problem.

    1. Re:New approach by Jorgensen · · Score: 1

      captcha for emails? This will just encourage innovation in the OCR field and computer vision in general. I believe that progress is being made in these areas already. At most, it will buy time until the spammers evolve, and annoy a lot of innocent users in the process (and discriminate against those with visual impairments). It might work if you assume that it will put people off computers: less people using computers might result in less spam for the rest of us :-)

      Education? Good luck with that. In general people are not interested in computers - they view them as tools or just a "magic black box" and have no incentive to understand what goes on inside. They're too busy with their own jobs to dwelve into the black magic of algorithms, patterns, security and whatnot. General sceptical education and encouraging people to think before they click might have some effect though. Until spammers and malware writers evolve new methods.

      Taking away how malware developers can profit? Hm... Malware is not really a technical problem, it's just another vector for scam- and con artists that brings the benefits of scale. In the end, they make their money off the victims, not off the computers. The computers are just the means.

      so... a new approach? I do not think it is plausible that any of the things you suggest will solve the problem. But then again, I don't have a solution either. I just want to make sure that the cure is not worse than the illness...

  48. A vicious cycle by Keithownz · · Score: 1

    The problem with AV removal tools is that once the infection is in place it's near impossible to run them. (at least in normal mode) The infection will often create restrictive GPO's, a chain of self replicating drivers/ services/ scheduled tasks/ startup entries so that even if one piece is removed it will be recreated.

    The best way to remove a virus is from a bootable environment which can remotely bind to the registry. Then it's just a matter of disabling the startup entires, deleting the install directories, removing the GPO's and deleting the malicious services and drivers. You can even run a command line version of the mentioned removal tools in bart pe to get the rootkits and hidden system file infections.

    The majority of infections I see are the rogue security software where they infect you then tell you to pay to remove it. What's interesting is the company "witabett" provides technical support for their fake AV products after victims have purchased them! Check out their complaint board it even provides a support phone number... Excellent drunk dialing material for my geeky friends.

  49. Not malware removal, but heuristics... by Anonymous Coward · · Score: 0

    It's not the malware removal I'm worried about. It is preventing the malware to infect the computer. A lot of anti virus scanners (see av-comparatives) have very high detection rates of more than 97%(of millions of malware samples) in combination with very fast updates. (GData has more than 99%) But this is signature based. So if I have the source code of a virus and I modify it a bit, it could get passed the detection. Heuristics is therefore more important, but even the most advanced virusscanner is after a week of no updates only on at 70% detection(again av-comparatives)

    How can we solve this? Can we ever develop a pro active virusscanner?

    1. Re:Not malware removal, but heuristics... by CAIMLAS · · Score: 1

      There's no need if you're running a firewall and an block-everything scanner like the Spybot S&D Teatimer.

      --
      ~/ssh slashdot.org ssh: connect to host slashdot.org port 22: too many beers
  50. It's a bit like the saying about drugs by blind+biker · · Score: 1

    "If they would really cure you, the drug companies would run out of business"

    --
    "The agriculture ministry is not in charge of Gundam" - Japanese ministry official.
  51. The Barn Door by Brainix · · Score: 1
    In Modern Operating Systems, Andy Tanenbaum put it best. I can't remember the exact quote, but it was something like:

    Running anti-virus software is akin to locking the barn door after the prize horse has escaped.

    --
    Raj Against the Machine! http://social-butterfly.appspot.com/
  52. Re:I Just switched to an interesting product .... by Anonymous Coward · · Score: 0

    80 or 40 is still significant. No-one said there should be a linear relationship between user base and virus count.

    While Mac OSX has NONE - despite a 5% market share and the fact that Mac OSX users don't usually run AV software and are often more affluent so the potential payoff for keyloggers to steal credit card details and online banking logins is great. Despite that we don't find OSX viruses in the wild.

  53. Do we need anti-virus software? by ivanwyc · · Score: 1

    Knowing how to use the computer properly is far more efficient than installing any of those anti-virus softwares. Those of my friends who care about anti-virus are the ones whose computers often get infected.

  54. Methodology unexplained by thenextstevejobs · · Score: 1

    They said WHERE they got the samples and how they picked them. But do you think most users get infected by dropping an individual malware sample on their machine and executing it? They probably get a huge load at a time from an installer that claims to be something else and anti-virus, if present, would have a stab at detecting system changes at that point, or maybe even when the file was downloaded...

    Obviously a destructive rootkit could change any number of things about your system that COULD be impossible to restore. This isn't a shortcoming of a security product but a factor of being able to perform actions as an administrator, something the system must have SOME way for you to do, and therefore can be abused. Granted, some systems will be tighter about this than others, and there's a trade-off in usability, etc. But that is for the OS designer, not the AV provider.

    --
    Long live the BSD license
  55. Many of you missed the point. by Computershack · · Score: 0
    Many of you seem to have missed the point that AV-Comparatives also mentioned, THAT IT WAS PREFERABLE TO LEAVE NON MALICIOUS TRACES BEHIND TO REDUCE THE CHANCE OF FURTHER INFECTION. Considering ALL the market leaders chose to leave registry entries and trace files in place, it suggests that leaving them in stops any chance of reinfection at all.

    Certainly I'd rather have a non-descript file sat there which any malware looks at and decides not to reload than to rely purely on the AV solution to catch it. How many times are we told to use more than one AV solution for on demand scans just to be sure?

    --
    I only please one person per day. Today is not your day. Tomorrow isn't looking good either. - Scott Adams
  56. if putting hdd in other machine by Anonymous Coward · · Score: 0

    remember to have autorun completely disabled, or it might just infect the other machine

  57. AVG Free: worse than just mediocre by macraig · · Score: 1

    I learned the hard way recently that the latest version 9 of AVG Free has a nasty habit of creating hidden directories and files on every partition, even externals, and then keeping some of those files open for no obvious reason at all. The result is that it becomes impossible to use Windows to reformat those partitions, even when they are otherwise empty and idle; the only way for inexperienced folks to format such partitions is to uninstall AVG entirely, since there's no accessible way to remove or close the offending files and no way to even temporarily disable AVG completely. I suspect it applies to the "premium" product as well. There were reports by others of the same problem.

    You know your antivirus software is FUBAR when it breaks fundamental operating system features that have been present for two decades. It's arguably a cure worse than the disease at that point. Would you pay money for software sporting such features?

  58. documents and user files by Anonymous Coward · · Score: 0

    Imaging is definitely the fastest, but if you have a single partition then you need to worry about documents and any apps or driver/os updates since the image. well updates may require periodically recreating the image, but the real problem is user documents.

    what i do with windows now is treat it like unix. i have a separate system partition and home partition. this way i can reimage windows and not worry about backing up all the other files. although now the user partition needs to be scanned. having a network drive for user files would be a good solution in a business, but for a home user i set the system partition to less than 8 gig. this way i can back it up to a double layer dvd, as well as keep it on the home partition for quick restore. while im at it i usually make a 2gig or so partition for swap space, although people say swap file fragmentation isnt really a problem and sometimes you might want swap at the outside of the drive for transfer rate and sometimes at the inside of the platter for lower seek time, i usually put the swap partition at the start of the drive and go for the lower seek time. hopefully shaves some time off a page fault.

  59. There is only one good antivirus by Anonymous Coward · · Score: 0

    Common sense. Use it, it doesn't hurt.

  60. In Russia, virus infects YOU by tepples · · Score: 1

    could a law suit (class-action or otherwise) be an idea here?

    Good luck suing someone who operates out of the former Soviet Union.

    1. Re:In Russia, virus infects YOU by dangitman · · Score: 1

      Good luck suing someone who operates out of the former Soviet Union.

      So ESPN, TSN, MLB and NFL operate out of the former Soviet Union!? Who knew? It's like those damn commies are conspiring to change the ingredients of apple pie and freedom fries!

      --
      ... and then they built the supercollider.
    2. Re:In Russia, virus infects YOU by tepples · · Score: 1

      So ESPN, TSN, MLB and NFL operate out of the former Soviet Union!?

      Here's the situation I was envisioning:

      1. The aforementioned sports entertainment web sites join ad networks.
      2. An advertiser in the CIS places a malware ad on an ad network, with any evidence of its destructive payload hidden.
      3. The advertiser activates the payload.

      To whom should we assign liability if neither the web site nor the ad network can reasonably vet the ads?

    3. Re:In Russia, virus infects YOU by dangitman · · Score: 1

      To whom should we assign liability if neither the web site nor the ad network can reasonably vet the ads?

      Why can't the advertiser or website vet the ads?

      --
      ... and then they built the supercollider.
    4. Re:In Russia, virus infects YOU by tepples · · Score: 1

      The advertiser is the malicious party here, based in Ukraine or Russia or wherever. The party responsible for vetting is the operator of the ad network. But the advertisement code has a time bomb implemented in obfuscated ActionScript bytecode (in an SWF ad) or encrypted JavaScript (in a DHTML ad) that activates only once the ad has been active for a while. Discovering whether a given ad triggers a malware download can prove halting-complete.

    5. Re:In Russia, virus infects YOU by dangitman · · Score: 1

      The party responsible for vetting is the operator of the ad network. But the advertisement code has a time bomb implemented in obfuscated ActionScript bytecode (in an SWF ad) or encrypted JavaScript (in a DHTML ad) that activates only once the ad has been active for a while. Discovering whether a given ad triggers a malware download can prove halting-complete.

      Yeah, so why can't they vet the ads? Why are they allowing ads from Ukraine or Russia, or wherever? Why can't they use a reputable source for ads? And why can't they do tests to see if there is malware on the ads?

      --
      ... and then they built the supercollider.
  61. Google begs to differ... by denzacar · · Score: 1

    Some of it is rather cheap even.

    --
    Mit der Dummheit kämpfen Götter selbst vergebens
  62. Did they test Ubuntu by Anonymous Coward · · Score: 0

    Did they test Ubuntu?

  63. Now here's your problem... by 51M02 · · Score: 1

    Furthermore, in some cases it is not possible to know if the registry values (or the hosts file) were modified by the malware or by the user itself (or third-party utilities used by the user).

    I don't know what they mean, my /etc/hosts files are only modifiable by "root". :)

    Joke aside, what would you expect from a system where configuration files are not protected.

    --
    --- Bouh !!! ---
  64. "very bad" by nurb432 · · Score: 1

    Is more like it. I have been burnt by more then one commercial product lately.

    But of course, if they fail, they aren't liable in the least. its a lot like tossing money out the window for insurance that wont do anything when you have a accident.

    --
    ---- Booth was a patriot ----
    1. Re:"very bad" by Anonymous Coward · · Score: 0

      .. its a lot like tossing money out the window ..

      Not really, some are free.

  65. Never a test on false positives? by Anonymous Coward · · Score: 0

    What bothers me greatly with these kind of tests is that they never want to put the finger on the sore spot. Over the past 2 years most of the "major" vendor products have managed to render many Windows systems totally useless because they (falsely) picked up system files as being infected; immediately removed them and left the user with a non-working PC.

    Why do we never get a nice overview of which programs have such an history and which actually try to protect themselves from this? I think to know; because the common goal here is to make money from the viruses, and as such you can't blame one product over the other because that would be bad for business.

    Personally I think a test like this is laughable when you see that some of the products which score "good" on malware removal also scored "bad" on rendering Windows useless.

    Just my 2 cents.

  66. Test results are not exactly meaningful by rcamans · · Score: 2, Interesting

    It was nice to see how various products did on the simple tests. However, several serious mistakes were made in the test methodology.

    First, 10 virus samples for the test cannot give a statistically meaningful result. At least 31 different samples are necessary, as people who have had testing statistics and quality control education would know.

    Second, and even worse, the tests were not performed under real world conditions. No system has ever been shown to have only one infection in the real world. The testing should have included detection / removal on systems with all malware installed. This is what real world users see.

    Third, the "cleaned" systems should have been retested to see if infection would repeat under supposedly "cleaned" conditions. If the registry entries blocked reinfection (I seriously doubt it), then that would be seen. This would not have been a valid complaint if they had not brought it up in their article. (courtroom trial rules)

    Fourth, with the anti-malware product running and protection fully enabled, would any of the malware be blocked from installing, or even downloading? This would not be a valid complaint if they only chose products which have no preventative methods (firewall, sandbox operation). Products which do not ahve adequate protective behavior are worse than worthless to the public, as they would have the idea that they are safe when using the product. That is the whole purpose of these products, to make the user believe he is in some way safe. But he is seriously not safe.

    Fifth, using only non-damaging malware samples is also unrealistic. Performance against damaging malware is very important, and was untested. Performance against one small, safe, variety of malware does not indicate anything about the anti-malware product's usefulness to the public.

    Sheesh, I could probably go on for a while, but I give up. We have surpassed the three strikes rule quite a bit already. This post is just an advertisement for AV-Comparative. Did someone get paid for this post? They should have.

    --
    wake up and hold your nose
  67. Comment removed by account_deleted · · Score: 2, Interesting

    Comment removed based on user account deletion

  68. Test of 16 Anti virus test says None Very Good by arnoldlawrence · · Score: 0, Offtopic

    That is good news... http://www.cypress.com/

  69. Trinity by SomeGuyFromCA · · Score: 1

    As far as cleaning up after this crap, I've been relying on Trinity a lot. LiveCD, boots, mounts and scans. http://trinityhome.org/Home/index.php?wpid=1&front_id=12

    The only problem is, you need some Linux skills to use it. Last time I applied it, it missed the Windows partition and I had to go in and manually mount it.

    If I were better with rolling Linux LiveCDs, I would add more scanners and set it up to run out of X

    --
    if the answer isn't violence, neither is your silence / freedom of expression doesn't make it alright
  70. No no no... by earnest+murderer · · Score: 1

    No no no... It's like paying the mafia for protection... and by "protection" they mean sending a couple of guys around every month to take your money. When they're breaking your knees for not having the money because it was stolen last week they tell you that you should have called the cops.

    PS I couldn't help but notice that MS's free software that so many CEO's derided over the previous months is doing a better job than many of their products, and as good as the best and most expensive.

    --
    Platform advocacy is like choosing a favorite severely developmentally disabled child.
  71. Interesting results by CAIMLAS · · Score: 1

    The results are interesting, in that they show MS Security Essentials - which is free and new to the market - performing essentially as well as the Symantec AV, and better than everything else. That's somewhat surprising, given the geek preference for NOD32/F-Secure/etc. over Semantec and MS products.

    I think I'll just keep recommending MS Security Essentials to my clients over Symantec or McAfee, though. Those products are junk and aren't worth the system overhead.

    --
    ~/ssh slashdot.org ssh: connect to host slashdot.org port 22: too many beers
  72. Linux is the best antivirus, although... by dargaud · · Score: 1
    I work in a research lab and as such almost everybody uses linux. We (rightfully) feel that viruses are something that can't happen to us, but a few weeks ago I sent the following message on the work mailing list to test user gullibility:

    If you type the following smiley in a shell, you get some interesting results: :(){ :;:; };:

    I'm happy to report that the experiment worked. I don't know towards what, but it worked...

    --
    Non-Linux Penguins ?
  73. I'd be first in line! by jonaskoelker · · Score: 1

    It wouldn't matter if they did; no one would buy [common sense] as everyone thinks they already have it.

    I'd be first in line!

    Wait, maybe I shouldn't have admitted to that in public...

  74. MickeySer by Anonymous Coward · · Score: 0

    I would like to see Panda Security products tested to see if they are still good at completely removing malware they could find. Panda Security products are not famous for detecting everything or for being very reliable, but one thing I notice in past is that if they detected, they would be very efficient in removing it from the system... something that at that time other products like symantec, avira (and others) simply wouldn't do (or do it badly). But with this thing of collective intelligence and others technologies I wonder if it got worst or is as good as in past was.

  75. Maze of shell companies; the halting problem by tepples · · Score: 1

    Yeah, so why can't they vet the ads?

    There is no algorithm that can determine whether a given script will or will not trigger a malware download. An ad network could just reject all SWF ads and all DHTML ads entirely, but in that case, advertisers will just switch to the competition.

    Why are they allowing ads from Ukraine or Russia, or wherever?

    Ad networks sometimes fail to see through the maze of twisty little shell companies that is the malware industry. There are ways to seem more reputable than you are and more American or more Western European than you are. Besides, some of the publishers (web sites that have ads on them) are in the ex-USSR area.

    And why can't they do tests to see if there is malware on the ads?

    I'll explain in more detail once I know how familiar you are with the halting problem.

    1. Re:Maze of shell companies; the halting problem by dangitman · · Score: 1

      Ad networks sometimes fail to see through the maze of twisty little shell companies that is the malware industry. There are ways to seem more reputable than you are and more American or more Western European than you are

      Still, why can't they just restrict themselves to ads from well-known companies (BMW, Nike, McDonalds, etc) rather than accepting ads from companies nobody has ever heard of/

      I'll explain in more detail once I know how familiar you are with the halting problem [wikipedia.org].

      I can't see how that has any relevance. What would make the program halt? And why couldn't you have a number of machines on different networks sampling the ads for malware? If people are getting it on their computers then it must be possible for it to happen to test machines, too. Don't the virus-tracking companies do a similar thing?

      --
      ... and then they built the supercollider.
  76. Microsoft killed this market also... by lamapper · · Score: 1

    It does not matter what any of the other Virus scanning software makers do anymore as Microsoft has killed this market; as so many others before them.

    --
    Is your Internet Throttled? Install DD-Wrt, OpenWRT or Tomato to learn the truth! Google: 1Gbps/1Gbps: 5 Communities
  77. ughhh by ajhtiredwolf · · Score: 1

    Wow, so many of you are missing such an important point. You're not worried about viruses because you can just reimage/reformat? Ok so what about a virus that steals your credit card information while entering it into a site? Once you do a format, that's not really going to help you is it?They already have your information. and if you do need to wipe and reformat, what if windows say "nuh-uh you have reached the maximum reinstalls" or that person does't have their windows cd anymore? I would say about 99% percent of the machines that are brought to me ( whether it be for an upgrade, a driver problem, whatever) that are running windows, have some sort of infecting software on them. I used to recommend that people use linux, but I don't don't do that anymore, after so many "why can't I use such and such device" questions you realize that if there is even one program the user uses that windows can run, which linux can't ( even if there is an alternative) they aren't happpy with their new OS. So im basically stuck letting them use windows, and I see all kinds of antivirus software, which does very very little, but with so many competing companies in makes me think that it really just isn't possible to secure and protect windows. I can't imagine how hard it would be to write a piece of software that protected a linux distro that always ran in root with full privledges. I think the only answer to a secure windows os is..... a secure windows OS, made by Microsoft. Maybe this new google-os will have good security, catch on and microsoft will have a reason to make their OS secure. Oh and to all of the, "its the users fault, they or as smartnessers as us!!! durrr!" Alright look, not everyone out there sits around poking and proding their computer like we do. It is our hobby, do you do stupid shit with your car, house, custom-remodeling job? Yes, because that isn't what interest you and you don't spend allot of time messing with it. This doesn't mean that you are smarter than everyone else as much as you wish that were true. -- -AJH

  78. Ticking time bomb, ticking ticking time bomb by tepples · · Score: 1

    Still, why can't they just restrict themselves to ads from well-known companies (BMW, Nike, McDonalds, etc) rather than accepting ads from companies nobody has ever heard of

    Because there is more than one ad network. If one ad network states "you must be at least this tall to advertise with us", advertisers who do not qualify will flock to other ad networks that specialize in smaller businesses, such as local or regional businesses. Dealing with smaller businesses is part of why there's so much more of a selection on Apple's app store than on Nintendo's or Sony's despite that Nintendo and Sony have been in the video game industry much longer than Apple.

    I can't see how that has any relevance. What would make the program halt?

    For each program P, there exists a program AD whose pseudocode is as follows: "Emulate program P, and when it halts, exhibit malware behavior and then halt." So if you have a program that analyzes AD statically to decide whether it exhibits malware behavior, you have a program that decides whether P halts. Because deciding whether an arbitrary program halts has been proved undecidable (over Turing machines) or intractable (over LBAs, which physical computers are), detecting malware behavior through static analysis is also intractable.

    And why couldn't you have a number of machines on different networks sampling the ads for malware?

    They won't detect the misbehavior until the ad has already gone live because the ad is programmed not to exhibit malware behavior for the first few days or weeks. That's what I meant by time bomb.

    1. Re:Ticking time bomb, ticking ticking time bomb by dangitman · · Score: 1

      Because there is more than one ad network. If one ad network states "you must be at least this tall to advertise with us", advertisers who do not qualify will flock to other ad networks that specialize in smaller businesses, such as local or regional businesses.

      Yeah, so what? The point is not what advertising networks the smaller companies use, it's what advertising network you, as Major Brand Website X chooses to use. the point is that you do lose the advertisers more likely to be malware shells.

      There are ad networks that specialize in quality and vet their ads. The Deck, for example. It doesn't bother them that other ad networks are getting the crappy ads. And it's not necessarily about size - most of The Deck's advertisers are small but quality.

      For each program P, there exists a program AD whose pseudocode is as follows: "Emulate program P, and when it halts, exhibit malware behavior and then halt."

      But why do you have to emulate anything? Just run an actual box (or a bunch of virtual machines) and see if they get infected.

      They won't detect the misbehavior until the ad has already gone live because the ad is programmed not to exhibit malware behavior for the first few days or weeks.

      Yeah, so what? That's what I've been suggesting all along - track the live ads.

      --
      ... and then they built the supercollider.
    2. Re:Ticking time bomb, ticking ticking time bomb by tepples · · Score: 1

      That's what I've been suggesting all along - track the live ads.

      By the time an ad network detects misbehavior in live ads, the damage has been done.

    3. Re:Ticking time bomb, ticking ticking time bomb by dangitman · · Score: 1

      By the time an ad network detects misbehavior in live ads, the damage has been done.

      So, nothing should be done to prevent it happening again? Even if the damage has been done, if you have been tracking it, you at least have some clues to who to go after. So, you're really preventing future damage, and punishing people who have been performing criminal acts. The ad networks will know who to avoid in future, and for the hosts of the ads, they may be able to pass risk and responsibility on to those actually responsible, rather than paying for it themselves.

      Do you really suggest that nobody tries to do anything about this problem because it's "too hard"?

      The idea that "the damage is done" is nonsensical in the first place, as if you could have stopped it three days into a malware campaign that could have lasted for weeks or months, you would have prevented a lot of damage.

      --
      ... and then they built the supercollider.
  79. sense by Anonymous Coward · · Score: 0

    I guess it's just a matter of which false sense of security you prefer.

    I sometimes put in some part time work at a local computer shop and you'd be surprised how many customers say "I don't understand how I got a virus when I update my anti-virus program regularly"

    which is a little like saying "I don't understand how I could catch a cold when I have an immune system"

  80. Where was Panda? by PHPNerd · · Score: 1

    They didn't test it on Panda which is a much bigger name than half of those 16 they tested.

    1. Re:Where was Panda? by Anonymous Coward · · Score: 0

      Because Panda prohibits the testers from testing them. So, you can think what you want rather than get an actual test result saying how good or bad they are.