Symantec Sued For Running Fake "Scareware" Scans

Sparrowvsrevolution writes "James Gross, a resident of Washington State, filed what he intends to be a class action lawsuit against Symantec in a Northern District California court Tuesday, claiming that Symantec defrauds consumers by running fake scans on their machines, with results designed to bully users into upgrading to a paid version of the company's software. 'The scareware does not conduct any actual diagnostic testing on the computer,' the complaint reads. 'Instead, Symantec intentionally designed its scareware to invariably report, in an extremely ominous manner, that harmful errors, privacy risks, and other computer problems exist on the user's PC, regardless of the real condition of the consumer's computer.' Symantec denies those claims, but it has a history of using fear mongering tactics to bump up its sales. A notice it showed in 2010 to users whose subscriptions were ending in 2010 warned that 'cyber-criminals are about to clean out your bank account...Protect yourself now, or beg for mercy.'"

Comments

Who still pays for antivirus?

[DCTech]

There are perfectly good free antivirus programs now, if you want to run one. Most of them are actually better than the non-free antivirus programs. Microsoft Security Essentials is a free antivirus that is many times better than Symantec's and others. On top of that it is lightweight and fast, compared to the bloated crap that Norton is. It works on slower machines too, detects more viruses and doesn't break stuff.

On 8 June 2011, PC Advisor listed Microsoft Security Essentials 2.0 in its article Five of the Best Free Security Suites, which included Avast! 6 Free Edition, Comodo Antivirus 5.4, AVG Antivirus 2011 and BitDefender Total Security 2012 Beta.

So choose from those. Personally I don't run any antivirus as I don't download random executables from the internet nor surf to random porn sites or download from torrent sites. Windows is also secure now a days, and I haven't had a single malware in like 10 years.

Re:Who still pays for antivirus?

[Anonymous Coward]

"Personally I don't run any antivirus... ...and I haven't had a single malware in like 10 years"

How can you know that for sure?

Re:Who still pays for antivirus?

[PenquinCoder]

I'm not exactly pro-MS but DTech is correct. MSE is actually one of the better anti-virus programs for windows these days. You can't fault MS for snapping up a company/product that worked well and then including it for free in their (buggy and insecure) OS. It's at least one thing they did right.

Re:Who still pays for antivirus?

[kvvbassboy]

But MSE is the best free antivirus software.

Re:Who still pays for antivirus?

[DCTech]

"Personally I don't run any antivirus... ...and I haven't had a single malware in like 10 years"

How can you know that for sure?

I don't have any problems, and I do check my network traffic from time to time with Wireshark just because legit programs send awful amount of all kinds of data to internet too.

Re:Who still pays for antivirus?

[gman003]

Dude, no, seriously. MSE actually works, and well. From personal experience, I can say that it's faster and more effective than AVG; I've heard from others that they switched to it from Avast, Comodo and Kaspersky.

Everything else Microsoft makes is pretty crap - Windows, Office, IIS, MSN - but apparently even Microsoft crap is better than every other antivirus' crap.

Re:Who still pays for antivirus?

[fuzzyfuzzyfungus]

In this case, his advice is probably correct for those running Windows at home, fluff about his decade-long record of having no viruses he has noticed aside. Security Essentials is 'free' as in 'bundled with your Windows license'; but if you've got a Windows license already, that makes it cheaper than anything that costs additional money and the products that do make a very, very, very, tepid case for why you should purchase them.

In corporate use, it isn't as clear; because ForeFront sure as hell isn't free, or necessarily superior to competing products(no matter how cynical you attempt to be, it is shocking how much more awful AV software is when aimed at intimidating some poor end user who got 90 days 'free' with their best buy box, rather than it is aimed at IT and therefore mostly keeps its mouth shut on the client side, so even some of the vendors that you wouldn't touch with somebody else's 10-foot pole at home can at least produce unobtrusive software for corporate.)

Re:Who still pays for antivirus?

[RogueyWon]

I'm by no means anti-MS (Windows 7 is the only OS on both of my home PCs these days), but I'd take issue with the blanket statement that "Windows is also secure now a days".

I went through endless fun thanks to the parents just before Christmas. They fell for one of those fake-DHL-shipping-notice spam e-mails (as they were actually expecting a Christmas-related DHL delivery) and, with a single click, landed their (3 month old, Norton-"protected", UAC-enabled) PC with one of the most vicious and persistent pieces of malware I've ever seen. One of those fake-AV-software ransomware jobbies. It disabled Norton, blocked Windows from accessing DVD and USB drives, did a dns redirect so that browsers could only access the ransomware page and all kinds of crap. I've sorted these before by doing a system restore from a backup point in safe-mode, but even though the restore allegedly worked in this case, the malware persisted through it quite happily. Ended up doing a full format and reinstall of Windows.

Now, there are a lot of failures in this story; my parents for clicking the link, Norton for being completely (and predictably) useless and so on. But I still have problems with describing an OS where a single click can land you in that kind of mess as "secure".

Personally, I use AVG, on the grounds that it provides some basic protection and makes my system chug less than most of its rivals. But it's by no means infallible, throws up a depressing number of false positives and the only way to avoid infection does appear to be abject paranoia (which is now my default policy).

Re:Who still pays for antivirus?

[Anonymous Coward]

You don't have to "willingly" download applications/.exe's to get malware, trojans, etc. There's a lot more out there then you think....

Re:Who still pays for antivirus?

[Joce640k]

I haven't had a single malware in like 10 years.

How do you know? It's not like they pop up a window to let you know if the installation was successful.

Re:Who still pays for antivirus?

[ledow]

Or his browser and security settings don't let him run random malware served from a bog-standard compromised website.

I run Opera, I've yet to see it run a program from the net without my permission. Hell, I have to press play just to make Java/Flash things load because I switched on the option to do so.

Just because *you* are an arse that lets their computer auto-execute anything in a browser (and is subject to lots of known attack vectors over things like Javascript, etc.) doesn't mean the rest of us are.

A browser renders HTML and Javascript. Inside that scope, it's pretty hard to compromise a machine without using some seriously crappy code (i.e. a dodgy browser). Any decent security-conscious user would not be executing plugins of any kind by default or using an insecure browser and would, by that token, be incredibly unlikely to get any sort of infection even if they do browse sites that momentarily have infectious malware added to them (or, more likely, their ad networks, which should also be blocked from running Flash/Java if you have any brains).

Catching a virus is 99% user error and only about 1% software problems. Granted that 1% still exists but if you control the 99% (i.e. DON'T RUN THINGS FROM THE INTERNET) you can be pretty sure of a decently secure experience.

Signed,

A person who's been on the Internet for 15 years without AV and whose only infection came from a CD copy of a SiN game demo from a published magazine (and which was spotted instantly from unusual computer activity even if there was no "obvious" sign of infection) when I was a careless teenager.

Hell, where I work, people send me their infected USB keys for virus checking and data retrieval. If you use your brain, have a good OS, have good settings, turn off autorun and only interact with the files by command line (i.e. "attrib -r -s -h *", "del suspicious_file_x", etc.) then it's virtually impossible to get infected by that avenue, and many others.

And running an AV *scan* occasionally to verify cleanliness is very different to having something intercept every disk read/write, process execution, HTTP packet, etc. in order to keep you safe.

Hell, my "antivirus" is virustotal.com. If I see something dodgy, I know if it's malware and cleanse it myself as necessary, but if I'm just suspicious of something that seems innocent I upload it there and let them tell me if they know about it. I still don't blindly trust anything they verify as clean, but hell, you can't do much more to protect yourself than that (and, no, constant read-intercepts of everything on the disk is still a stupid idea that adds zero additional security).

Re:Who still pays for antivirus?

[DCTech]

I'm by no means anti-MS (Windows 7 is the only OS on both of my home PCs these days), but I'd take issue with the blanket statement that "Windows is also secure now a days".

I went through endless fun thanks to the parents just before Christmas. They fell for one of those fake-DHL-shipping-notice spam e-mails (as they were actually expecting a Christmas-related DHL delivery) and, with a single click, landed their (3 month old, Norton-"protected", UAC-enabled) PC with one of the most vicious and persistent pieces of malware I've ever seen.

So in reality, it isn't Windows problem, it's user problem. Unless you run walled garden like iOS on your PC, there will always be malware that will try to trick user, regardless of OS. It works in Windows, it works in OSX and it works in Linux.

Re:Who still pays for antivirus?

[Riceballsan]

Noscript, adblock etc... there are dozens of ways to dodge things and reduce the chance of infection to .0000001% (there is always the hypothetical possibility of some rogue worm that breaks past a firewall/router, or heck someone breaking into your house and manually running a virus on your system with physical access). If this guy was endorsing or recommending the average joe to use no AV you would have valid reason to insult him, he isn't. Plenty of very tech savy people can safely use a computer with no AV with little to no risk, while many tech unsavy people will fill a computer with virus no matter what protection they use.

Re:Who still pays for antivirus?

[L4t3r4lu5]

I've found that Microsoft Security Essentials is no better than ESET NOD32 for anti-virus protection.

Then again, against anything but zero-day exploits, a properly configured OS and good browsing practices would make a potato a good AV solution.

Re:Who still pays for antivirus?

[mSparks43]

10 years you say.

Hmmm.

No wonder all those botnets are so persistent.

windows secure you say.....
Metasploit community begs to differ.

Re:Who still pays for antivirus?

[v1]

"Personally I don't run any antivirus... ...and I haven't had a single malware in like 10 years"

How can you know that for sure?

It probably has something to do with the fruit-shaped logo on his computer. ;) (I can say the same thing, for the same reason)

Tho getting more OT, I'm surprised that Symantec would stoop to doing fake scans in the most blatant expression of scareware. They already have a very long list of suckers, they don't need to break the law to be well into the black. They had to know doing something like this was going to be a net-loss?

Re:Who still pays for antivirus?

[Anonymous Coward]

Since you have worked at a PC shop, and are therefore are presumably a leading information security expert and well versed in the intricacies of system security auditing, please explain this process of manually checking for viruses. Given the general nature of how serious compromises actually work, this revolutionary method will be game changing. I am eagerly awaiting my subscription to your newsletter.

In all seriousness, I hope you didn't bill hours for your security expertise, although sadly I suspect you did.

Re:Who still pays for antivirus?

[Midnight Thunder]

Or maybe he is using an OS with a penguin as a mascot?

Re:Who still pays for antivirus?

[cduffy]

So in reality, it isn't Windows problem, it's user problem. Unless you run walled garden like iOS on your PC, there will always be malware that will try to trick user, regardless of OS. It works in Windows, it works in OSX and it works in Linux.

Infecting the whole system (not just that one account) with a single click (no UAC, no gksudo/sudo, etc)? Not so much.

Privilege escalation bugs are certainly easier to come by than remote exploits, for any OS, but that's not to say that everyone has known ones running wild at all times by any means.

Re:Who still pays for antivirus?

[Lehk228]

NOD32 is a pretty damned good bar to be "no better than"

for my own home use i use MSE now, back when i was in college and had to connect to the campus network i did run NOD32 and it's damned good, but i can't justify spending money on antivirus when i haven't gotten a virus in years since i am somehow resistant to the urge to download and run OMGPONIESALSONAKEDLADIES.AVI.EXE

Re:Who still pays for antivirus?

[fuzzyfuzzyfungus]

This doesn't help if you need a gigabit link to your switch, or only have one PC,(or, most likely, if you just don't look good in a tinfoil hat); but constructing a passive tap for 10/100 ethernet is trivial and allows you to sample the ether between your system and the hostile world of the internet from a second host.

If you need gigabit, or want to be all classy about it, you'll need a switch with port mirroring; but this is the easy and cheap way to slip an almost-certainly-OK-because-it-was-just-booted-from-LiveCD system onto the wire to have a look at what a possibly compromised host is doing...

Re:Who still pays for antivirus?

[RogueyWon]

No, I think there's a problem with an OS that allows for that degree of fundamental OS modification on the basis of a single click with no user confirmation prompts and no recovery path.

Re:Who still pays for antivirus?

[s4ndm4n]

You may be surprised, but I'm not. I've seen the instrusive ways that Symantec has tried to get me to buy their sh-- ahem -- products on more than one ocassion, including what I suspected were "fake scans". But then again, I've always thought that Symantec was a pretty shady company.

Re:Who still pays for antivirus?

[ElectricTurtle]

Autoruns, Rootkit Revealer. Granted, those are technically not for commercial use (giggle), but seriously, for SOHO stuff you really don't need anything else. This isn't exactly some DoD classified network here.

Re:Who still pays for antivirus?

[somersault]

The vast majority of malware isn't that clever or "serious" in the sense that it's written to specifically target you or a company you work for - so you could check running tasks and a few places in the registry for any dubious executables. You could check if the machine has any unexplained network activity. You might not be able to completely remove the malware just by looking in those places, but you have a good chance of detecting symptoms.

I don't think your sarcasm was particularly warranted in this situation.

Re:Who still pays for antivirus?

[jank1887]

true. I had Symantec corp. edition at home via the office's home use license. bogged down my older pc, older laptop, and netbook. switched all to MSE, and now rarely see Process Explorer showing the AV chewing up 25-50% of the cpu for extended periods of time.

I fear, however, that part of this is the usual Windows integration problem. Office suites that can't access the same undocumented API's as MS Office, running slower as a result, etc. So, once again MS offers a free version of something to undermine another software category (stacker, diskdoubler, defrag, etc.), and whether or not its a better product, it runs better with the software. At least right now this is an optional download, so it's harder to throw the monopoly abuse thing at them on this one.

Re:Who still pays for antivirus?

[Tim C]

He didn't say he doesn't have a firewall, he said he doesn't run AV software.

Re:Who still pays for antivirus?

[Kjella]

Either it was more than a single click, or your story is missing a remote code execution exploit in the browser/plugins they were using. You're in trouble on any OS if you have hostile code running, even if it's just under a normal user account.

Re:Who still pays for antivirus?

[justforgetme]

I might be wrong here but I think looking for bad files isn't actually rocket science.
Dismantling them, analyzing and countermeasuring them usually is the trickier part.

If I would have to go that route I probably would run checksum comparisons to accepted values for each file in the system.
All files that turn up in that list and are not logs/media/cache are candidates.
Then check all locations that contain files with autoexecution scripts and screen them for behavior I don't like.

After that you probably will have a lot to go on so good luck finding out what is wrong with all those files.
On the other hand you can just quarantine them (aka move into another directory), put valid files into the slots and see what stops working.

Just a thought..

Re:Who still pays for antivirus?

[Anonymous Coward]

Just because *you* are an arse that lets their computer auto-execute anything in a browser

While this guy phrased it somewhat abrasively, his point is valid. Damn close to 100% of infections are the result of requesting that some untrustworthy code run on your machine. Letting any random sites you surf to run even purportedly 'sandboxed' code on your machine is simply idiotic - the last few decades have proven that - and anyone who hasn't learned that by 2012 deserves what they get. It's like living in the slums with and letting crack gangs into your house just because they ask. You might be surprised the first time they trash the place, but after the 20th time, after the 200th time, after reading about it over and over in the mass media, why would you keep inviting them in? Fine, be surprised they trashed your place the first time, but after decades and popular cultural awareness and headlines on CNN and the BBC, you have to be pretty damn stupid if you are still asking them into your house, when you have complete control over whether they can come in or not.

People seem bewildered by this simple concept: don't run random shit from the internet, whether or not it's in a browser sandbox, and 99.999% chance you won't get jacked. If you go running every javascript any site in the whole world asks you to, well... don't act surprised by the results when something manages to escape the sandbox. PEBKAC.

It's 2012. Personal computing started taking off in the 1970's. That's 35 or 40 years now, and computers are a critical and pervasive part of modern society. There's no more excuse for not knowing how to use one.

Re:Who still pays for antivirus?

[Bengie]

Since Windows is actually secure now-a-days and malware can't just install itself without the user running it, I use the Linux approach. If you know what you're running, you don't need a virus scanner.

Since ALL of my applications fall under the Microsoft, Open Source, Steam, Blizzard, and Chrome category, and nearly all of my visited websites are a small group of known websites that I have been using for the past decade, I'm not too concerned about malware getting installed.

Re:Who still pays for antivirus?

[ifrag]

How do you know? It's not like they pop up a window to let you know if the installation was successful.

No, some of them do. The popup that warns you it's time to purchase the full version of their virus scanner with cleaning capability, because--surprise--you are infected now.

Seriously though, this is how I identified one of my old XP boxes was infected. Also around the time I switched from Avast to MSE.

Re:Who still pays for antivirus?

[datavirtue]

I do not recommend AVG. It will not leave you alone about system scans and I have found no way to disable the "warning." Also, Microsoft Security Essentials is nice--despite my loathing of Microsoft. I personally do not run any antivirus myself, which I find to be the cleanest solution. For regular users though I would recommend MSE--it stays out of the way. It is not legal for use in a business or on Enterprise versions of Windows 7.

Re:Who still pays for antivirus?

[datavirtue]

On another machine? Have you used Wireshark?

Re:Who still pays for antivirus?

[elsurexiste]

Not hard at all in most cases. Check the list of running processes for strange names. Run msconfig and check for weird programs starting up. Boot with a pen drive linux distribution, let's say Backtrack. Delete the offending files and clean those scripts. Rinse and repeat.

Re:Who still pays for antivirus?

[Kjella]

Plenty of very tech savy people can safely use a computer with no AV with little to no risk,

Possibly, but how could you tell? I'd say even the tech savvy should run anti-virus for verification, not for prevention. Of course there's the "trash my computer" or "hold it hostage" viruses that you'd know pretty fast after the fact, but there's also the "use as spambot", "steal my identity", "use as DDoS bot", "steal game accounts and CC info", "empty online bank account", "turn into illegal dumpsite", "use as platform for hacking" and probably some more varieties that won't announce themselves.

I know many people use it thoughtlessly, if the virus scanner doesn't find a virus they'll run anything. I only run things from places I think is safe, so if I ever had the AV stop me that'd be a surprise but if you don't use it at all I think you're arrogant. I'd maybe make a small exception if you're running only open source software from your distro's repositories, but any time you're running binaries, particularly binaries downloaded from the Internet then please give me my AV. Even if the software is perfectly legitimate there's no knowing if someone has compromised their download servers.

Re:Who still pays for antivirus?

[datavirtue]

On XP machines the use of root kits that utilize VSS are common. Don't bother trying to remove or use system restore since they are controlling the PC from that vector. Full wipe is the most efficient method of mitigation. On Windows 7 there are not as many root kits that work since Microsoft has implemented a randomized memory placement of juicy services (the old root kits can't take hold because their target memory location is invalid).

Re:Who still pays for antivirus?

[ElectricTurtle]

Where 'completely ineffective' means 'able to solve all problems experienced by customers' yeah, I'm ok with that. You don't need a CISSP to be an effective bench tech at a local PC shop. The customers can't afford it and don't need it. Get off your ridiculous high horse.

Re:Who still pays for antivirus?

[ArsenneLupin]

... would make a potato a good AV solution.

Yes, my pet potato is my best friend and protector. I call him Balthazar...

Re:Who still pays for antivirus?

[CastrTroy]

Well, I guess it all depends on whether or not we want to be running general purpose computers or not. You don't see many people complaining about viruses on the XBox or other game consoles. You don't see people getting viruses on the iPhone/iPad. But then, you can't run whichever program you want on these platforms. You can only run MS (or Apple, or whoever) approved software, unless you take some huge steps to go around the protections. The computer can either be designed to run whatever program the user tells it to run, or it can be made secure so that it only runs signed software. You can't have it both ways. Sadly, I think for this reason, that the majority of the population will go to appliance type computers in the next decade, where the downside is that they can only run signed software from specific markets, but with the upside that they will never get a virus. Those of us who know what we are doing can run general purpose computers, possibly without even having virus scanners, because we are smart enough to not even run the virus in the first place. I have MS Security Essentials, and if it wasn't so lean, I wouldn't run it, because it hasn't detected a single thing in the 2 years I've been using it. Because I know not to download and run crap off the internet.

Re:Who still pays for antivirus?

[DCTech]

I have as a test put an unprotected Windows box on the 'net to see what happened. Usually it's about 1/2 hr before it's port scanned and an hour before it's been rooted. That's it - that's your window of security.

Windows 98 box?

Re:Who still pays for antivirus?

[Anonymous Coward]

Huh? By "link", I'm assuming you mean to a web page. A web page can't do any of that unless you voluntarily run code it gives you (whether javascript or activex or flash or whatever it is), which history has shown to be a spectacularly bad idea.

It's like this: Toyota sells you a car with a gas pedal, steering wheel, and brakes. You are perfectly able to drive that car in an unsafe way, which can mean terrible results. That doesn't mean there's a problem with the car, it means there's a problem with the driver. Toyota is trying to sell you a general purpose vehicle, which means it can be used to safely travel down the highway, or unsafely smash into another car. It isn't up to Toyota to make you drive safely, it's up to the driver! Just because somebody shouts at the driver, "hey, you should drive 90 MPH on that icy road with the tight curves!" doesn't make it a good idea.

I'm pretty much 100% certain that I could click on the link you mention on my Win7 box with no ill effects. But then, I don't run random untrusted code from unknown web sites, whether they are exes or browser scripts. So if I can safely use Windows on the internet, and that guy gunning the engine on an icy road with lots of curves can't, do we blame the car, or the driver?

Re:Who still pays for antivirus?

[Troke]

I quite agree, MSE gets deployed at most of my client sites due to A) Budget Friendly B) Updates with Windows Update C) Simple interface

Re:Who still pays for antivirus?

[jimicus]

No, I think there's a problem with an OS that allows for that degree of fundamental OS modification on the basis of a single click with no user confirmation prompts and no recovery path.

I'd like to know how you'd propose getting around that in general terms with any modern OS.

gksudo and the prompt on OS X - once you've persuaded the person to enter their password, you're away. You've got root access, you can do literally anything you like. Up to and including patching the kernel so that you are more-or-less impossible to remove.

Re:Who still pays for antivirus?

[Charliemopps]

Yes, I'm ashamed to say MSE works really well. I'd argue its because Microsoft has access to their own source-code and knows where they screwed up... but whatever... it's the best AV I've used, and I've used them all.

Re:Who still pays for antivirus?

[dkleinsc]

There's also the GPL-licensed ClamAV, which has a Windows version called Immunet which isn't half-bad.

Re:Who still pays for antivirus?

[Lonewolf666]

I agree, if you know what you are doing, it helps a lot. In over 10 years on the Internet, mostly without AV software, I had one infection and that was from a remote execution exploit (MSBLAST on Windows 2000).
Even that one could have been avoided, I simply forgot to install the post-SP4 hotfixes after reinstalling the PC due to a non-virus related issue.

My safety measures at the moment consist of

- a DSL router with "lightweight" firewall and NAT - while not a 100% solution, it is better than nothing.

- not using products that have been frequently hacked in the past (except Windows). That means no Internet Explorer and no Outlook.

- generally checking downloads for their file type before opening them. If it is a .com or .exe I did not specifically download, it gets deleted.
      RANT: Especially in this context, fuck Microsoft for making the hiding of file extensions the default in Explorer. I know to switch that off, but for inexperienced users it makes it even easier to fall for "AnnaKournikovaNaked.jpg.exe". /RANT

Re:Who still pays for antivirus?

[Anonymous Coward]

Actually -

Microsoft Security Essentials is available for small businesses with up to 10 PCs. If your business has more than 10 PCs, you can protect them with Microsoft Forefront Endpoint Protection.

Since you mention "Enterprise versions of Windows 7" you likely are in an environment that is some order of magnitude larger but many small businesses run it.

Re:Who still pays for antivirus?

[Dog-Cow]

Office was, is, and likely will always remain optional. That has nothing to do with it.

Of course, you're just spreading FUD by insinuating that MS is "cheating" with MSE. Symantic's AV has always sucked. McAfee for that matter, at least their Windows versions.

Re:Who still pays for antivirus?

[DigiShaman]

None of the free AV suites provide central management from a server-side console. Secondly, even MSE states in the EULA that it's not to be used in a business environment. It's for personal use only. Microsoft Forefront Endpoint Protection 2010 however a version of MSE that's centrally managed and in fact uses the same engine and definitions.

BTW, I recommend Trend Micro WFB for small and medium businesses. The new version of Vipre is good from a management point of view, but still on the fence of how effective it actually is. Trend Micro on the other hand is exceptionally good and stopping most of the bad-nasties out there. At least when you compare the effectiveness to other products out there.

Regardless of what corporate AV suite you intend to go with (Symantec or not), be sure you have at least 4GB of RAM installed for all Windows 7 workstations and 2GB for XP. Oh, and stay the hell away from McAfee. That shit is the absolute devil that will fuck up your machines in of itself. Nothing's worse than an AV that makes IE take 20 full seconds to load, throws constant BSODs, and will prevent Windows Update from completing due to the constant registry blocking. McAfee is shit. I refuse to take any full time IT job at a company that uses it.

Re:Who still pays for antivirus?

[CastrTroy]

Which version of Windows? I know previous versions of Windows have had this problem, I think all the way up to the initial releases of XP. But I'm pretty sure that it's been fixed in Windows Vista and 7.

Re:Who still pays for antivirus?

[L4t3r4lu5]

That is exactly what I meant. It's no better than NOD32, and NOD32 is, as far as I'm concerned, the best.

I was almost sad when I stopped sending them my £40 per year for Smart Security.

Re:Who still pays for antivirus?

[mSparks43]

Just format and reinstall every 3 or 4 months. Why wait until you are sure your system has been compromised before you do it?

Most AV only detect virus's that get installed by some worm or rootkit they can't detect, bad men "sell" your machine on the black market.

Also good because it breeds good backup practices and keeps the machine running smoothly from all those apps you were "just testing" that you never got round to uninstalling. Once you've done it once or twice its a fairly quick process to get a clean install set up "just the way you like it".

Re:Who still pays for antivirus?

[tnk1]

Why would MS work to put AV companies out of business? The reason for MSE is plain: they're embarrassed about the (deserved) reputation of their past OSes in terms of security and needed to address it. These bloated AV programs like Symantec's suite were also bogging down the systems of people who use Windows, which makes Windows seem slow as well. In the end, it was a smart move to get in there and provide an AV that was both useful and mostly unobtrusive. This isn't the browser wars where MS was working to elbow out Netscape in a new area of software; AV companies have had years to make money and get it right and have instead written an expensive, and bloated product in almost all cases.

Re:Who still pays for antivirus?

[GameboyRMH]

Maybe you're a shill after all, who modded this shit up? You work for Waggener Edstrom?

Re:Who still pays for antivirus?

[Anonymous Coward]

Do you run your linux box as root? No??? Then why run all your Windows 7 executeables as administrator? Either you secured your parents box, or they were logged in with an administrator account and clicked through the UAC pop up without reading or without understanding.

Even if you're logged in as an administrator, that UAC pop up is the "user confirmation prompt" that you were just screaming about not having. And no recovery path? How do you think you'd recover from an rm -rf if you were logged into your term as root?

The fact of the matter is, there was a failure to secure the computer. Judging by how you described the situation and the support structure, that failure was yours.

Re:Who still pays for antivirus?

[GameboyRMH]

Yeah it's decent, if DCTech is a shill then MS is hurting MSSE's reputation with this shit. Good tools don't need to be advertised by shills.

Re:Who still pays for antivirus?

[ElectricTurtle]

It's called diminishing returns, homeslice. Yeah, maybe sometimes a few other things would turn up if more time was taken or the tech had more experience, but is it worth it to the customer to pay x times more and wait y more hours to offset the potential harm that's z% likely? It's all well and good to take some kind of absolutist approach as some ideological, utopian abstract, but when the practical scenario plays out for real people, they don't care to spend tons of money and time on some decade old piece of crap that creates documents and browses the interwebs.

Re:Who still pays for antivirus?

[Anonymous Coward]

Depending on the specific situation you may be violating the EULA for those clients. MSE is only for use in a business with up to 10 PCs. After that you need to use and pay for Forefront.

Re:Who still pays for antivirus?

[hawkinspeter]

It's more like Toyota selling a car that can have all it's controls and engine reconfigured from a panel stuck on the outside of the car.

Knowledgeable drivers would set up the engine and pedals how they want and then fit a lock on the panel so that random strangers can't alter their car's behaviour. However, the average Joe sometimes has problems driving his car when some joker has configured the brake pedal to be full acceleration.

I'd blame the car first for having such a stupid feature and the driver second for being too trusting.

Re:Who still pays for antivirus?

[Anonymous Coward]

No, I think there's a problem with an OS that allows for that degree of fundamental OS modification on the basis of a single click with no user confirmation prompts and no recovery path.

So this is fundamentally wrong?

rm -rf /

Ok, it's more than one click...

Re:Who still pays for antivirus?

[Anonymous Coward]

Then don't give your parents administrative privileges. It's that simple.

Linux can be just as hosed if you give everyone access to sudo, which is exactly what the UAC is.

Re:Who still pays for antivirus?

[hoboroadie]

I haven't run anti-virus since '99 or so, and once I trained the kid how not to click pop-ups and stuff when he's surfing porn, I quit having to format and re-install the OS. It's all about which sites one visits.

Re:Who still pays for antivirus?

[Rob the Bold]

No, I think there's a problem with an OS that allows for that degree of fundamental OS modification on the basis of a single click with no user confirmation prompts and no recovery path.

I'd like to know how you'd propose getting around that in general terms with any modern OS.

gksudo and the prompt on OS X - once you've persuaded the person to enter their password, you're away. You've got root access, you can do literally anything you like. Up to and including patching the kernel so that you are more-or-less impossible to remove.

I guess it means no root access or sudo privilege for the user.

Unfortunately, the user and admin of a home PC are usually one and the same.

Re:Who still pays for antivirus?

[Billly Gates]

Personally I don't run any antivirus as I don't download random executables from the internet nor surf to random porn sites or download from torrent sites. Windows is also secure now a days, and I haven't had a single malware in like 10 years."

Jaw drops ... DCTech, if I knew you personally I would guarantee you money your PC that your typing this on is trojaned! Seriously as a Tech I am sure you have seen plenty of malware.

Nothing is secure EVER. No Windows is not how you get nailed in 2012. It is through Flash, PDF, javascript, and java. That way you can target all 3 browsers and users are too dumb to keep these updated.

Everyone needs anti-virus software in 2012. Maybe 10 years ago if you had a hardware firewall and didn't use IE 6 then you were secure. Malware spreads via flash ads and bad javascript. Not through Windows out of date or through free_titties_mpg.exe anymore. I just cleaned a laptop last week from a woman who
a. does not download porn
b. Very computer literate and does not click on everything
c. Uses Windows update and had the latest anti virus software from Avast!
d. Only uses latest patched FF.

She got infected by going to www.livejournal.com to create an account and a javascript ad infected her system. Avast! couldn't even clean it and I had to use Malware bytes in safe mode. To her surprise 2 more malware pieces were detected and removed. Turns out her version of Flash was not up to the latest and the javascript malware used an IP address rather than a domain name in which FF XSS would have caught and prevented.

I reimaged my computer recently because I got infected too. I use OpenDNS, only IE 9 and Chrome, had MSE at the time (wont make that mistake again), and did everything right and had Java and PDF disabled. It came through a 0-day exploit. Unless you have java disabled, openDNS or Comodo Dragon's secure DNS, latest flash set to update, and Foxit instead of adobe PDF, predict network settings in Chrome off (Chrome will automatically execute each ad or link with it on!!), you will get infected. In fact FF is not even fully sandboxed believe it or not.

May God help you if you still use XP too. Because it does not offer exception handling bounds checking, ASLR, full DEP, and other things the sandboxing is crippled on XP in any major browser which is why IE 9 is not available on XP. ... end rant

Avast! is free for non business use by the way and it does not slow your system down like Norton 360 does. It is a necessary evil to run one and I had 0 performance problems. Run it in safe mode DCTech and I will bet you money it will find several trojans on your PC unless you just browse slashdot, have no flash or do anything but check email with it.

Re:Who still pays for antivirus?

[Kjella]

Just format and reinstall every 3 or 4 months. Why wait until you are sure your system has been compromised before you do it?

If you reinstall your OS every 3-4 months, then <shatner>Get. A. Life.</shatner>, besides if you don't know what of your software is clean what does installing the same virus going to do? It's like the IT admins that clean someone's PC and they go right back and install weatherbug and bonzai buddy. And that doesn't count the types I mentioned that are an immediate risk no matter how short they're installed, like password stealers. And all that to avoid running a free AV? I'll take my machine that's good for years without reinstalling, thanks.

Re:Who still pays for antivirus?

[Rob the Bold]

Then don't give your parents administrative privileges. It's that simple.

Linux can be just as hosed if you give everyone access to sudo, which is exactly what the UAC is.

The personal dynamics of the situation aside, you've got to weigh getting called frequently for minor issues like application installs and config changes against getting called occasionally for complete system wipe and re-install.

Re:Who still pays for antivirus?

[Anonymous Coward]

You just made my point for me. You wouldn't have actually solved the problems at all. If you think "lack of obvious indications that anything is still on the system" qualifies as solving the problem, you're making a living from lying to uninformed customers. Instead, you should be informing your customers of the actual risks involved related to the security of the private (frequently, including financial information) data on their systems.

Do you even try to deal honestly with your customers, or do you prefer to make decisions for them with a bunch of "it's highly technical, you wouldn't understand" hand waving, or perhaps hope they walked in the door informed enough to already know what they truly need? Do you prefer to take the lazy approach of selling snake oil just because "it's cheap enough that they can afford it," instead of maybe coming up with more efficient ways to do things better and less expensively? Do you also have an herbal supplements counter at your checkout, just in case your customers need some trusted home remedies while they're out?

Look, if a PC is compromised, you don't try to "fix it" by removing malware, at least certainly not as the first option. No, you don't even try to get clever and say "hey I'll use this trusted boot CD with malware removal stuff on it," because that's nearly as crappy in a number of cases, and remember that you don't actually know what is on the system, you just know it's compromised and have no way of knowing with any assurance how bad it actually is. You inform the customer that the safest course of action is (1) make a copy of all data on the hard drive, and if they already have known good backups that's even better (2) identify what needs to be kept, (3) nuke and pave the PC with a fresh OS load, (4) scan the living hell out of the customer's data using everything available to you (oh, you didn't really want to bother with checking the data? I've got some PDFs and JPEGs that do nifty tricks, sure do hope there's not any recently crafted stuff on that system), (5) reinstall applications, (6) put the customer's data back on the system.

Or I suppose you can do what a lot of local PC shops do and bill them for 2 to 4 hours of labor to "scan and disinfect" their system in place, because that's gotta be just as good, right? Maybe just charge them a nice flat $49.95 rate for the snake oil services you're rendering, and toss in a sample pack of those herbal supplements for good measure. What could possibly go wrong?

I guess it's easy to claim somebody's on a "high horse" when you're uninformed and/or dishonest. Have a nice day.

Re:Who still pays for antivirus?

[TheLink]

I'd argue its because Microsoft has access to their own source-code

I doubt that's the real reason, because both Norton and McAfee used to be good. Then they started to be bigger resource hogs than most viruses they were protecting you against (yes there's other evil stuff that viruses do but keep reading...).

I definitely recall Norton/Symantec making systems more unstable or causing problems:
1) Years ago someone had problems fetching email, turns out Norton/Symantec was intercepting the POP3 connections to scan for viruses (ok fine), but some email was causing it to _crash_ (extremely not fine- especially if it turns out to be an exploitable code-injection bug).

2) In 2007: http://www.pcworld.com/article/132050/millions_of_chinese_hit_by_symantec_foulup.html

A virus-signature update delivered automatically to users on Friday about 1:00 a.m. Beijing time to Symantec's antivirus scanning engine mistook two critical system files of the Simplified Chinese edition of Windows XP Service Pack 2 for a Trojan horse. The two files -- netapi32.dll and lsasrv.dll -- were falsely quarantined, which in turn crippled Windows. If an affected PC was rebooted, Windows failed on start-up and showed only a blue screen.

3) On 28 January 2010, Symantec's antivirus software marked Spotify as a Trojan horse, disabling the software across millions of computers

Nowadays depending on the situation I use Avira, MSE or "no antivirus". My personal home machine has no AV installed. My browser runs as a different user process. If I have something that I think is suspicious, I check it with VirusTotal ( https://www.virustotal.com/ ). So far I have had no problems doing things this way, so I don't see the point of constantly incurring the extra CPU/resource costs by installing a real-time virus scanner on my machine. For the past few decades my personal machines have never been infected by a virus. I may have downloaded viruses or malware, but I have not been infected by them. And yes I do know how to check.

A dedicated attacker might be able to put malware on my machine, but they'd know how to use virustotal or similar too, and still be able to plant malware on my machine even if I was running AV software (and wasting resources).

The machine my parents use on the other hand has AV software installed (not Symantec, nor McAfee).

AV software is not needed everywhere and in some cases if installed, it indicates someone is doing something wrong: http://xkcd.com/463/

Given my track record vs Symantec's track record, I would prefer to take the bet that Symantec is more likely to screw up my system than a virus. There have been other antivirus vendors with similar screw ups too.

On a related note, Trend screwed up notoriously - albeit with its antispam product, blocking the letter "p".

For these reasons production servers and other important machines that are well secured and managed should NOT have antivirus software installed.

If they are so poorly managed that the operators are much more likely to screw up than the AV vendors, then sure, install AV, but that means you are doing something wrong.

Re:Who still pays for antivirus?

[fast turtle]

Personally, I like MS Security Essentials as it's about as effective as AVG was. The nice thing is, it ties into Windows Update and does get an update once a month. In fact, I was able to convince a senior friend to pull McAffee from her system (caused to many slowdowns) and installed it. Much better performance for her and it doesn't get in the damn way.

As part of my system security settings, I've enabled DEP for all processes instead of the limited subset that MS enables by default. The interesting thing is, I've only got a single exception listed that is a windows game from 1998 (Call To Power2).

The one thing I do know is that eventually I'll pick up something that infects my system bad enough that the easiest thing is to nuke it from orbit and reinstall. Much faster now that I'm using a bootable 8GB flash drive with Windows on it along with a full copy of all the Updates from MS. This speeds up a reinstall to the next to last patch level before I even allow the computer to connect to the net when it can grab the latest updates and complete the process.

Re:Who still pays for antivirus?

[Billly Gates]

I suppose NOD32 is better than nothing. My college used it too with Cisco Clean Agent.

However it slowed my laptop down greatly and wouldn't let me run World of Warcraft. I found the program annoying but maybe later versions have improved.

Re:Who still pays for antivirus?

[antdude]

Office is crap?

Re:Who still pays for antivirus?

[Billly Gates]

Why is that funny?

Yes, a PC shop does have to be an expert. Maybe not a PHD CS researcher student, but like a mechanic shop (car analogy) a responsible tech comes in contact with malware regularly and needs to keep up.

If I had a tech who did not use anti virus software on his/her own system I would refuse to do business. Of course I can diagnose it myself but still.

Re:Who still pays for antivirus?

[Billly Gates]

No you need a real anti virus package like Avast! or MSE if you refuse to have full shield protections.

All it takes is 1 ad with a zero day exploit in flash or javascript to get on your system. It has happened to me twice this year. No I do not click on random shit and everything is up to date. The javascript hack used an IP address therebye bypassing XSS cross domain and openDNS security. Very sneaky.

After your infected your done. I reformat my system as I do banking and student loans on it and can't risk infection. There is no excuse not to run anti virus software in 2012. It is not 2002 where all you need is a hardware firewall and not use IE 6 to magically be 100% secure anymore. Hackers have moved on and target flash, java, and ajax ads to bypass Windows and target all 3 browsers.

Re:Who still pays for antivirus?

[jackbird]

And how many billable hours is that rebuild, when the customer has actual applications installed that Ninite won't load up (say, a full Autodesk Suite, 10 years of Quickbooks versions side-by-side, originally purchased through downloading, or some horrible niche vertical business management app)?

When a new perfectly serviceable desktop runs $400, you end up incentivizing people to throw infected PCs in the trash or simply not repair infected machines. That's crazy.

Re:Who still pays for antivirus?

[Inda]

It doesn't matter. Hidden virus, in your face virus, trojans, worms and shitware.

Whatever doesn't kill you, only makes you stronger, or your computer in this case.

That's what I tell the salesman in PC World when I purchase laptops for the family. They have no answer to it.

MSE is a good choice. I haven't had an infection in years. Online scanners for the files I don't trust fully - why scan with one when you can scan with 30?

Re:Who still pays for antivirus?

[director_mr]

Everything else Microsoft makes is pretty crap? Your examples are Windows (7 I presume) and Microsoft Office I'd have to disagree with you about, because I haven't found a better alternative. Windows 7 I find on par with OS X Lion, either can be better than the other depending on what you are doing. And Microsoft Office is tons better than any alternative I know of.

Re:Who still pays for antivirus?

[Billly Gates]

A trojaned computer will use ports like 80 or the Windows Update ports to avoid detection or use a rootkit so wireshark can hide itself.

Never trust netstat -an

Re:Who still pays for antivirus?

[Anonymous Coward]

I'm sorry you got infected. However you are spreading FUD. MSE is, of course, a real time scanner. Anything that is written to the file system is scanned first; just like with other real time scanners. Now, there probably wasn't a definition for the particular nasty you got infected with at the time. Either that, or you turned off real time - which MSE warns you not to do.

Re:Who still pays for antivirus?

[TheLink]

Uh, anything someone with a clue can't catch with a manual scan isn't going to be detected by realtime AV either.

Boot up a trusted machine (could run Linux/OpenBSD/whatever if you want), have the suspect drive attached, copy the files, scan them with a trusted scanner(s), if you're paranoid you could double-check with something like VirusTotal (check hashes and upload the really suspicious files).

I don't see how realtime AV is going to do better. Esp if the system gets pwned and rootkitted so that the installed AV can't see the malware.

BTW if you're doing it for forensics you'd need more expensive hardware that is certified to prevent writes and so that any evidence gathered looks better in court.

Re:Who still pays for antivirus?

[Billly Gates]

I like to think of it as driving where everyone tries to dash at your car to break in at EVERY stop light.

It is crazy and like the wild west. Secure doors are nice but people dashing to pop the hood while you stop to find ways inside your car.

Re:Who still pays for antivirus?

[nschubach]

A Turning Machine (sometimes referred to as a lathe) is used to make a things round, sometimes with decorative designs.

I would not consider it a general purpose computation machine. ;)

Re:Who still pays for antivirus?

[spire3661]

The practical scenario when you come upon these situations is the old standby "Nuke it from orbit, its the only way to be sure". I think people are being a bit harsh here, but the truth is, anyone that comes in with a virus infection in my shop is told its a full data recovery, wipe and reinstall. You cannot be sure youve wiped all traces of a virus from a windows machine. Even MS says so.

Re:Who still pays for antivirus?

[L4t3r4lu5]

For clarity; IMHO, NOD32 > MSE > Everything else.

Re:Who still pays for antivirus?

[spire3661]

If i had a tech who didnt have a full working backup system including a tested recovery method, THATS who I would fire. Running AV or not is pretty moot when you have solid backups.

Re:Who still pays for antivirus?

[Mister Transistor]

If I would have to go that route I probably would run checksum comparisons to accepted values for each file in the system.

Congratulations, you just re-invented tripwire which has been in linux since about 1992 or so. It scans the entire system and compares every file to stored checksums last time it was run. Apparently it has been developed into a commercial product since then but the free original version is still around.

Re:Who still pays for antivirus?

[Billly Gates]

Ok and the malware gets backed up and restored too right?

How does the tech know his lan is not infected spreading the malware to other machines including your own? If he does discover its infected then how long was it infected? etc

Re:Who still pays for antivirus?

[spire3661]

Noscript and adblock only work for advanced users and can be quite annoying to even that group, not to mention you rob your favorite sites of revenue. I cannot in good conscience use them.

Re:Who still pays for antivirus?

[spire3661]

Where was the BACKUP? There is no better anti-virus then good solid, tested backups.

Re:Who still pays for antivirus?

[Anonymous Coward]

Posting anon due to modding above.

ESET has, for years, offered a guide to prevent such issues with games. I agree with those who say ESET is "the best" in that it's not only effective but really doesn't bog a system down. I still think the value proposition of MSE is great. Most folks just don't need the customization options ESET offers.

Here's the ESET gaming config PDF.

Re:Who still pays for antivirus?

[Dishevel]

I do not know for sure if it is the best. But I am sure that it is good enough to be argued.

Re:Who still pays for antivirus?

[tepples]

As I understand this thread so far, my best hypothesis is that someone saw a user confirmation prompt and blindly clicked through it.

Re:Who still pays for antivirus?

[rickb928]

"Windows is also secure now a days, and I haven't had a single malware in like 10 years."

Your experience is atypical, even for users that are diligent about their anti-virus.

If you haven't used anti-virus software in 10 years, then not being infested means you have done relatively little with your computer. More power to you, but this is bad advice and a bad example.

And Windows, by Microsoft's own admissions, is not 'secure'. Better, but not totally. 'also secure' is a meaningless statement, if not naive.

Re:Who still pays for antivirus?

[Khyber]

"But MSE is the best free antivirus software."

Nope, Common Sense 2012 Platinum here. Haven't had any infection in well over half a decade.

Re:Who still pays for antivirus?

[tepples]

I think for this reason, that the majority of the population will go to appliance type computers in the next decade, where the downside is that they can only run signed software from specific markets, but with the upside that they will never get a virus. Those of us who know what we are doing can run general purpose computers

Provided that manufacturers still sell general purpose computers that can connect to the Internet without charging an order-of-magnitude premium over a comparably powerful appliance. For example, I don't want it to be $300 for an appliance or $3000 for a comparable general-purpose computer. Nor do I want it to be $300 for an appliance with web access or $300 for a general-purpose computer with no network access at all.

Re:Who still pays for antivirus?

[ShakaUVM]

You're the first nerd I've heard advocate for people losing root on their own computers.

No worries, though, Microsoft has heard your complaints and will deliver you a nice safe Walled Garden in Win8.

Re:Who still pays for antivirus?

[Khyber]

I guess you have no clue how to tell if certain behaviors change in your system, eh? Don't use process explorer like you should, either, I'd wager.

I've been infection-free for over half a decade. Why, yes, there are ways to determine if something unknown has hit your system.

>mfw you don't bother with system state diffs, nor obviously know how to obtain and analyze them.

Re:Who still pays for antivirus?

[spire3661]

The point is Backup (this means more then one physical copy and location btw) > AV. A proper backup plan includes months or years of backups to go back to.

Re:Who still pays for antivirus?

[justforgetme]

Embracing the penguin for the last half decade on my desktops I was quite amused one day when I visited a webradio portal that had been hacked and had scare adds on it saying that soAndSo.dll was infected on my machine.

Re:Who still pays for antivirus?

[icebraining]

rm: it is dangerous to operate recursively on `/'
rm: use --no-preserve-root to override this failsafe

Re:Who still pays for antivirus?

[Khyber]

>After your infected your done. I reformat my system as I do banking and student loans on it and can't risk infection.

This is my face when people apparently can't get some cheap $25 older computer to use for secure projects.

I've got a Pentium 3 sitting in the corner JUST for banking, everything BUT the bank blacklisted. I have an old crap laptop for research and development. Again, everything BUT my research facility is blacklisted, IP and DNS-wise.

Then I have my main desktop for screwing around, which still hasn't been infected, and only runs Common Sense 2012.

If you're getting infected, you're doing something wrong.

Re:Who still pays for antivirus?

[CastrTroy]

I guess it all depends on the market. How many people in the future will want general purpose computers? I think the market will always be big enough, and that parts in systems (general purpose or appliance) are similar enough that the price of general purpose computers won't be unattainable for the common man. Granted, appliance type computers may still be cheaper, but I don't think they'll ever be an order of magnitude cheaper. Perhaps only around 1/2 the price.

Re:Who still pays for antivirus?

[justforgetme]

Once (before I made the effort to write up savetu.be) I had been called up by a friend
that had installed a tube downloader (the copy/paste standalone program variety) on
his PC that had almost completely overtaken the system with addware.
It turned out that the youtube video that tutored him to install the program explicitly
said "Ignore the antivirus alert, this isn't a virus"....

Re:Who still pays for antivirus?

[justforgetme]

Norton does...

Re:Who still pays for antivirus?

[tepples]

The free version of Immunet apparently can't remove viruses; only the paid version can. Or what am I missing from this infographic?

Re:Who still pays for antivirus?

[pclminion]

"Full shielding?" what's with the dorky sci-fi talk? Invert the phase polarity and reroute power to the weapons array! Do you call your car the Starship Enterprise as well?

Re:Who still pays for antivirus?

[delinear]

Office is good enough, but it's hardly the user experience it could be if MS had any kind of meaningful competition to drive them.

Re:Who still pays for antivirus?

[delinear]

A full wipe and reinstall can't guarantee that either, though. And data recovery just runs the risk of re-introducing whatever infected the machine to start with. AV is the only sensible solution (I'm not sure why GP is talking about cost when there are so many free options - surely the time to install is less than the time to manually check a system).

Re:Who still pays for antivirus?

[delinear]

That ignores the various uses of PCs today. If a trojan keylogger manages to give a malicious user access to your bank account and he cleans you out, how are your backups going to help? Besides, good regular backups and AV are not mutually exclusive - you should be doing both.

Re:Who still pays for antivirus?

[justforgetme]

Ohh, tripwire! Had totally forgotten it existed. But it's been some years from the last time I used it.
Brilliant little program, Tripwire is great to have installed in production servers and my own PCs.

But it is less than useless when you get an infected windows machine to fix (which was my premise)
since you will have no reference. What you can do is aggregate checksums from trusted sources
and compile them into a knowledge base your command checks.

Re:Who still pays for antivirus?

[LordLimecat]

Im not sure if MSSE was developed in house or purchased, but its one of the finest pieces of software ever to come from them. Its unobtrusive, and does its job quite well, even managing to recover from nasty infections on some occasions.

Really, when it comes to designing a user-friendly piece of software that does its job and stays the heck out of the way of the user, Security Essentials should be the model all software developers use.

And may that be the last time I gush about an MS product, it makes me feel unclean.

Re:Who still pays for antivirus?

[kesuki]

this is why i use web-mail it lets you flag spam and read it too, because of image blocking and treating scripts as text. sure that means your email data is on someone's web-server possibly in the cloud but of course you have to assume hackers or sysadmins might be able to break into it. i don't trust computers with anything private anymore.

Re:Who still pays for antivirus?

[LordLimecat]

Rootkit revealer is BADLY dated. What you want is a combination of aswMBR, GMER, MBRcheck, and targetted tools like Kaspersky's removal tools.

Having a linux boot disk or MS Recovery console to check for hidden drivers and services is nice too, if you really want to dig in deep.

Re:Who still pays for antivirus?

[hairyfeet]

The problem I have with MSE is thus: As someone who actually has to clean up the machines when they get infected I've found MSE to frankly not be great on anything but Windows 7, on XP its especially horrid as it doesn't seem to catch drivebys until its too late and the code has been loaded on the page which means its shutting the barn after the horse has done left. On Win 7 its good, low resource, and quiet, but on XP it just doesn't do the drivebys well at all. Kicks ass on downloads, not great anywhere else. Now with MSFT concentrating on Win 7/8 that's understandable but not something an XP owner wants to hear. Maybe its because it was never supposed to be an AV, it was originally Giant AntiSpy before getting bought by MSFT, whatever the reason it just doesn't seem to stop real world threats like it does in those tests.

What I've found with my real world customers is either Comodo CIS or Avast free both seem to do the trick and stop bugs cold in ALL the currently supported versions of Windows. Comodo is better if you want to tweak as it has much deeper controls than Avast, i also prefer it on XP because its built in firewall is a hell of a lot better than the default XP one, whereas Avast is better on Vista/7 if you know the person and can tweak the user case on initial install. By that I mean if you have someone that ONLY surfs, but doesn't use P2P or IM? You can easily kill the P2P and IM shields and thus lower its footprint. Its also better for the more clueless customers as its UI is a lot simpler than Comodo.

That said on my gamer box and my netbook I use MSE simply because i'm not going anywhere where it will actually be used since i'm not running P2P or IM or going to anywhere other than a handful of well known sites such as Slashdot so its a security blanket more than anything and since i've found it does less it uses less when it comes to resources. But in my own personal tests with some off lease office boxes 6 months ago when i purposely went to some "Hey look at teh titties!" topsites both MSE and AVG got pwned, while Comodo and Avast didn't. So I'd say it depends on the user, if you are like me and practice safe computing? MSE is the lowest resource and doesn't cause a speed hit when gaming. you got users that are more likely to click things or just wander around the web? Then Avast or Comodo either one will be a better fit. I've been using Comodo on XP and Avast on Vista/7 for nearly 3 years now and knock on wood not a single box brought back infected, which is saying something when you have those "Punch the clown win an iPhone" click happy users.

Re:Who still pays for antivirus?

[LordLimecat]

Most infections follow a set pattern, and many have targetted removal tools. TDSS, for example, can be removed with Kaspersky's TDSSkiller. Ditto with Sality.

Some are serious enough that you do need to reinstall, but it is perfectly possible to remove a virus / rootkit, and generally its very obvious if your efforts fail.

You do realize that 95% of infections arent an actual hacker furiously backdooring your system, right? Its droppers and rootkits installing X components, and then making sure those components stay installed. And there are a number of tests you can perform to make sure your system is clean-- for example, if you use mbrcheck to try to re-write the MBR to a Win7 mbr, and yet it continues to report an XP mbr, theres a good chance youre still rooted.

Re:Who still pays for antivirus?

[ElectricTurtle]

To be fair I haven't been a bench tech in retail SOHO repair for more than half a dozen years. I do database support for the government these days.

Though I like to keep current anyway, so I'll be looking into those tools. MBR-based malware has really risen the last few years...

Re:Who still pays for antivirus?

[hairyfeet]

Maybe he just likes their products? So far I've been accused of being a shill for, in no particular order, MSFT, AMD, Comodo, and one who accused me of being a shill for Apple which I thought was particularly funny as the only Apple product I've ever owned is a B&W G3 I have sitting in the closet. If the guy is a shill he'll be modbombed off the planet and that will be that but you can't say for sure someone is a shill just because they like certain products. I mean I've never gotten so much as a sticker from AMD (Come on assholes, at least send me some stickers!) but I've had nothing but good luck with their CPUs and chipsets and think they give the best bang for the buck, so now that's all I ever use in new builds. Comodo is nice enough to give their AV free to business as well as home users and they make some kick ass free stuff like Comodo Time Machine which allows me to walk a customer through fixing a PC so badly broken by their kid the thing wouldn't even boot in under 10 minutes flat so i'm all "Yay Comodo!" but again not so much as a T-shirt.

So instead of spewing the "nigger cocksucker faggot' constantly, aka Troll, shill astroturfer why not simply judge each individual post on its own merits or lack thereof? As I posted earlier while i don't think MSE is a good product for those risky surfers or those on XP it is a decent product and it does seem to always be in the top five so he's speaking the truth there. Now if this were a post on FOSS and he was saying "Use Win 7 and MSE!" that would be a troll, but this is a post about windows AVs so I don't see where his post is anything but on topic.

Personally I think its nice when we can stop with the name calling and simply be geeks, isn't that nice? If what he is posting is bullshit give us some links, tear apart his arguments with rational arguments of your own, this way we can ALL learn and be better informed, isn't that a better way to go?

Re:Who still pays for antivirus?

[LordLimecat]

1) Dont blame windows for 3rd party app vulnerabilities.
2) UAC was not set properly if the application elevated with no prompt.
3) Usermode infections are possible on any system.

Re:Who still pays for antivirus?

[default luser]

Who still pays for antivirus?

People who buy cheap machines from OEMs that come laden with crapware. After the 6 month "free trial" the software pops-up a big glaring "you're not protected anymore please pay" sign, and most people probably give in.

I just encountered TWO different "free trial" antivirus programs installed on a family member's cheap E-Machines POS (they really cashed-in there). I removed both and replaced it with MSE.

The sad thing is, you can get a crapware-free PC, but the price premium is astounding. I'm constantly amazed just how much companies like Symantec pay to put their shitty "free trial that is not a free trial" products on PCs. And since people insist on paying the least they can (insert above family member here), they will always be flooded with crapware.

Re:Who still pays for antivirus?

[v1]

and had scare adds on it saying that soAndSo.dll was infected on my machine

My personal favorites are the sites that do a surprise "scan" on my machine and report my registry is infected... click here to download RegistryRepair! Oh I'm so on that.

Re:Who still pays for antivirus?

[Bruinwar]

Heck no! I call it the Millennium Falcon!

Re:Who still pays for antivirus?

[thoromyr]

which is why I'm always amused to see someone post that they do "X" and haven't had a virus in Y years. I'm guessing its because they think they are uber-elite and super-smart and would mystically just *know* if a nasty virus worked its way into their computer.

They know they haven't gotten a fake AV, or one of the other variants that makes itself known (typically scareware). And they are blissfully unaware of crimeware and think silent infections that steal passwords and conduct bank transactions are only done by highly targeted viruses or by skilled uber-elite and super-smart hackers.

Less amusing is when they use their uber-elite and super-smart skills to clean other people's computers (and some even dare charge for this "service"). It is increasingly common for a rootkit with reinfector capability to be installed so while they may remove the fake AV scareware they only dealt with the visible and (relatively) trivial problem and not the underlying infection. And then tell the person they "helped" that the computer is now clean and secure. Blech!

(Yeah, not every infection is that bad. But how much work did you go through to demonstrate that there *wasn't* a re-infector hidden in one of the many ways they can be? Or did you just run your tools until nothing was found? And realize that it is SOP for blackhats to tune malware until it isn't detected by tools before use. What, you thought the AV vendors quit trying?)

Re:Who still pays for antivirus?

[Bengie]

Yeah, pre-Vista was pretty bad at network security. Assuming you have Vista/7 patched, there's not much someone can do over a network to break in.

Re:Who still pays for antivirus?

[spire3661]

I totally agree that a good AV is vital, its just that we often focus so much on the threat defense that we forget to secure the payload itself. As for the trojan thing, I have an ipod touch that all it does is connect to my bank. Thats it. No MP3s, no apps besides the bank app. Its a private, secure bank terminal for under $200. If I have any doubt of its security i wipe it clean and start over.

Re:Who still pays for antivirus?

[default luser]

Nope, Common Sense 2012 Platinum here. Haven't had any infection in well over half a decade.

You and I used to be on the same page. I was smart and never got infected for years despite having no running virus scanner. I would verify every few months by running an online virus check, and that was that.

But two years ago I started reading about hackers compromising websites and ad networks and injecting their own exploits into an otherwise trusted webpage. Even tools like Noscript couldn't keep you %100 safe because of potential exploits in Javascript and PDF (unless you wanted to live in the dark ages of the web).

No amount of Common Sense could save you from this attack, and you had no idea when it could strike. I installed Microsoft Security Essentials, and I'm glad now that I did: a few months ago it caught a drive-by download exploit from a website I trusted. I'm very happy to have that level of protection on the Wild Wild Web.

Re:Who still pays for antivirus?

[hairyfeet]

Not if you have even half a brain it don't. I use a WinPE to boot into RAM and run a scan from there to ensure that the data being recovered isn't infected and i'm sure he did something similar. That said if its just a security tool variant once you know where the reg keys are its really not that hard to kill it dead. boot into WinPE, remove reg keys, scan with Spybot and HouseCall, boot and you're done. And since we are again talking about running a WinPE from RAM it isn't like there is anyplace they can hide the malware since the drive isn't running the infected OS.

Re:Who still pays for antivirus?

[kyrio]

Hey there, dumbshit, MSE is the top AV suggestion for people using Windows because it is the best one out there right now. The only other ones that are as good as MSE are either non-free AV or free versions of resource heavy AV software.

Re:Who still pays for antivirus?

[nigelo]

So, once you finally detect that you have some malware (how do you do that, again?) you are ready to go back to some backup that doesn't have the malware (how do you know which backup saveset to pick?) that may be months or years-old.

It sounds to me like you just lost months or years of data and code updates, even if you can guarantee the backup you chose to restore from was good (no malware).

Re:Who still pays for antivirus?

[NIN1385]

I have worked on malware/virus removal for years now, and I can speak from experience that Norton and Mcafee have created more problems for my customers than they have prevented. They are the most well known brand on the market which makes them a easy target for the virus creators.

I have seen those two programs do anything as bizarre as causing a mouse to not work to multiple machines losing all internet access until removed. There is a reason they both make a removal tool for getting the antivirus software off of your computer, because they know their software gets FUBAR all the time and needs to be manually removed.

I run no AV on my system and keep my important data on both a second hard drive and an external drive. If I get a virus I reinstall windows because nowadays that is the only 100% sure way to ensure a windows computer has no infections. I also cannot stress enough the importance of windows updates, especially in the Vista/Win7 era.

GOD BLESS COMBOFIX!

Re:Who still pays for antivirus?

[Sebastopol]

Who pays...??? People who don't have 20-40 hours of free time to learn what AV software is, understand all of the bits and pieces that different companies offer (email scanning? web scanning? disk scanning? registry scanning?), and understand what is best for them. I think for a computer noob like a grandma or non-techie (yes, they really do exist despite the trends), 40 hours is a CONSERVATIVE estimate of how long it would take for them to understand AV well enough to make those kinds of decisions. Hence, companies like Symantec (I miss when it was just norton utilities for DOS that came with a disk AND a book, with his nerdy smiling face on the cover).

This is why I hate PCs (and I was a teen building 286s in the 1980s).

Not understanding how 90+% of the world uses computers is a barrier many slashdotters encounter when trying to ascertain why the PC industry produces such poor products.

(here comes my bias...)

Which is why Macs are so popular. We can argue about virus threats on macs, but that isn't the issue: when some nerd like yourself makes people feel stupid for buying AV software they don't understand, that isn't even a discussed/advertised issue with Macs, they do an about face from the PC aisle. And I say good for them.

Re:Who still pays for antivirus?

[kyrio]

I've also had issues with installing MSE on XP - sometimes it just doesn't want to finish the install. I generally just default to Avast! on any system that can't use MSE. I'll test out Comodo and see how it is in comparison.

Re:Who still pays for antivirus?

[kyrio]

Indeed. There are so many instances that I can't even remember all of the people with perfectly good hardware stats complaining about their system being slow. Then when I check it out there are a couple of small viruses running and the master virus (Symantec/McAfee) running in the background, slowing their systems to a near halt. Format their computers and they go on about "OMG IT'S SO FAST!" Install MSE or Avast! Free and they are good to go.

Re:Who still pays for antivirus?

[Red Flayer]

The best thing about guard potatoes is that they get better at their job as they age.

But for more complete security, you should really upgrade to corn-n-potatoes. It helps to have some ears to go with those eyes.

Re:Who still pays for antivirus?

[kyrio]

>not using Opera

Re:Who still pays for antivirus?

[jmerlin]

Unless there's an 0-day in MS's libraries again that lets browsers download/exec payload without user consent, you still need to click twice. If they download an exe, it's fairly obvious you need to run it to cause harm (don't ever run an exe linked in an e-mail, simple advice). There's also an abuse of the insecurity of the JRE inside browsers in that the JRE needs only ask for permission from the user to do even basic things (writing temp files, reading files, connecting to a server, etc). That permission includes downloading and running with current user privileges any payload from the web (connecting to a server and running a file, IMO, are two entirely different levels of permissions). So when it asks for permission in a totally benign looking website made to look like some legitimate business, we're all trained to click yes because that's what Java applets fucking do, they require you to click yes before you can use them, and this is without fail. Seriously, all of them. So you get some page that doesn't really work after the applet loads, but it downloads a malicious payload and your PC is fucked. I had this happen a few years ago to myself, reversed the malware & the delivery method, found their FTP and sent all of the undetected binaries over to MMPC. It wasn't a fake antivirus but it did have minor side effects (it was poorly written, after all), but I knew the second I hit a java applet that did nothing from a link from 4chan that I had an infection, so I found the jar file in my internet cache and went from there. It was just a very basic trojan for turning a machine into a bot :|. Good job, anonymous, there's a reason nobody of value visits 4chan anymore.

Re:Who still pays for antivirus?

[DMUTPeregrine]

The only way to check for viruses is via a secure boot medium (eg a 'rescue' CD or DVD with AV tools on it.) Many, if not most, modern viruses have rootkit-like features, and so can't be detected from within an infected OS. Virus scanners are still useful for scanning downloaded files before they are first opened, and for finding incompetently created viruses.

Re:Who still pays for antivirus?

[roc97007]

> No, some of them do. The popup that warns you it's time to purchase the full version of their virus scanner with cleaning capability, because--surprise--you are infected now.

Man, I hate those. Family members have fallen for those. They're harder than heck to clean off.

I consider the McAfee scanner that's included free with practically everything to be in the same class, although not quite as annoying. It doesn't do much of anything except scare you and advertise the full version. I tell customers to avoid installing it (uncheck the "free virus scanner" option of whatever they're trying to install) and uninstall it when they find it. Besides, I've already set up virus scanning on their machines; McAfee just muddies the issue.

Re:Who still pays for antivirus?

[Em Adespoton]

However, to play Devil's advocate...
Do you really care if the OS portions of your computer are compromised? These areas can be overwritten with a clean install with minimal difficulty.

The portion of your computer you really want to protect is the user data -- you know, the stuff that doesn't require admin privs to access. The stuff that only has backups if you've personally backed it up. The stuff that is irreplaceable, and is extremely valuable to data thieves and ransomware artists.

There can be no complete solution, as any complete solution would require appliance computing (one fixed activity). As soon as you want to do something unique, you need to allow for some process to perform that task, and the process you grant those privileges to could easily be compromised.

Re:Who still pays for antivirus?

[danomac]

I know this is for personal devices, but I installed nod32 agency-wide at work. It's got good central admin tools with replication, and it still runs on our P3/P4 machines (equipped with 1GB RAM) without noticeably bogging them down. Excellent product.

Re:Who still pays for antivirus?

[danomac]

Ugh, I meant "this thread is for personal computers. Sigh.

Re:Who still pays for antivirus?

[danomac]

Letting any random sites you surf to run even purportedly 'sandboxed' code on your machine is simply idiotic

It's not necessarily even random sites, it could be random people using your machine.

I just had to reinstall a new laptop because the person's boyfriend installed a bunch of malware to get a video to play. It installed a trojan and a rootkit, so a reinstall was necessary.

I don't think she's going to let him use her laptop any more...

Re:Who still pays for antivirus?

[dasunt]

I will agree that autoruns and a rootkit revealer are great tools.

I'm also fond of searching for other files created at the same time as any viruses found. I prefer to do this from a known-good computer, after manually pulling the drive. This will often find other suspicious files that virus scanners miss. Admittedly, a virus could come along that would change its creation/modfication time, but IME, virus writers don't bother doing this.

I would also add pstools to the list, especially for removal. There are too many viruses that operating with several executables. Make a batch script to: 1. copy notepad.exe to the same directory as the executables. 2. kill the offending virus processes via pskill. 3. rename the virus binary. 4. copy notepad.exe to the virus binary names. Then clean up where the virus is launched from and reboot. If notepad comes up, there's a problem. Again, a virus writer could trivially code around this problem with a hash check of the binary, but it's more trouble than it seems to be worth for virus writers.

Heck, for a "this computer is infected" problem, just search for files created around the time the problem started. The result will often find some of the viruses. Then clear out temp folders under windows, temp flash folders, and the print spool, just for good measure. Also run a rootkit revealer on the drive.

The bigger problem is often the mess that remains. File associations can be messed up. Sometimes, the machine, once infected, isn't bootable, and removing the virus often does not solve the problem (virus writers don't seem to be very good at compatibility checking their viruses).

The advantage to a wipe & reload of a computer is that it fixes all of these problems. And it's a solution I usually recommend. Plus, most people with viruses have enough crapware installed that their systems are far from an ideal state. But manual virus removals have their place, especially in the real world. I'd prefer a wipe & reload, but sometimes there's that one program people have and the install disks were lost ages ago and it's vital to their continued existence (or something along those lines).

Re:Who still pays for antivirus?

[Riceballsan]

If you run an AV how can you tell your computer doesn't have a rootkit that it can't detect? At some point you have to just cross your fingers and hope for the best. Myself I do run an offline scanner every few months just as a double checking of things, and on occasion I check the process logs, start up applications etc... Even run a rootkit scanner etc... I've never caught a virus. My fiance's computer has antivirus on it, and it was infected when our 5 year old son was playing with it, going through random flash games.

Re:Who still pays for antivirus?

[kelemvor4]

Not on topic but....

Slashdotter-customized LED Panels - http://www.ecogroled.com/ Awesome Geek Toys - http://www.thinkgeek.com/

I had to laugh... dope growing light kits are "Slashdotter-customized"?

That's hilarious!

Re:Who still pays for antivirus?

[GrumpySteen]

Don't be silly. We're bashing Windows here. The fact that Windows 7 has UAC is irrelevant, as is the fact that every email program I've seen on Windows in the last decade asks you if you want to run the attachment you just clicked on rather than just launching it.

Re:Who still pays for antivirus?

[Hatta]

When a new perfectly serviceable desktop runs $400, you end up incentivizing people to throw infected PCs in the trash or simply not repair infected machines. That's crazy.

It may be crazy, but those are your realistic choices. Complete reinstall, buy a new PC, or continue using a compromised machine. What other option is there?

Re:Who still pays for antivirus?

[BitZtream]

Thats awesome, as I was there when tripwire was written.

Two things I can assure you.

First, in 1992, Linux wasn't running Tripwire, one could argue that it didn't really fit the definition of 'running' for a good portion of that year.

Second, Tripwire came nearly a decade later.

Re:Who still pays for antivirus?

[BitZtream]

Do you have any idea how absolutely trivial it is to cloak yourself from process explorer?

Re:Who still pays for antivirus?

[BitZtream]

That single click was to run an EXE that was emailed to them, its a rather common scam using DHL, Fedex, UPS, USPS and some made up 'shipping' companies as a basis for emailing some sort of reminder/pickup notice/confirmation/delievery change notice that you probably want to read if you want your package.

Its obviously a fake for any techie, but older people don't get it and will ask me every time one comes into our mail system to recover it from the mail quarantine so they can read it cause its important. Then I have to explain why it isn't.

Way to not have any idea whats going on.

Re:Who still pays for antivirus?

[shutdown -p now]

they were logged in with an administrator account and clicked through the UAC pop up without reading or without understanding.

And you expected them to do anything different because?..

You can't solve PEBKAC by "are you really really sure you want to be raped???!!!" kinds of prompts. This is conclusively proven by 30 years of PC history.

The only way you can secure casual users is by not letting them do harmful things in the first place, at all - i.e. precisely how Apple's walled garden works. And guess what? That's where Windows is also heading, with sandbox for Metro apps in Win8.

Re:Who still pays for antivirus?

[shutdown -p now]

To "infect the entire system", it would need write permission to system files. Which would, at a minimum, require a UAC prompt with default settings on Win7. Which is one more click.

Re:Who still pays for antivirus?

[operagost]

I have seen MSE let some nasty stuff get by, like Alureon boot-sector virus variants. MSE pretends to try, but is wholly incapable of removing boot sector viruses once it's let them get in. That being said, SAV probably does too and it slows your machine to a crawl to boot.

Re:Who still pays for antivirus?

[BitZtream]

I'd take you up on that bet. I haven't had an infection in 11 years and I've not used any anti-anything in that entire time.

You have to consider that all my machines live behind real firewalls and that I'm not an idiot in what I download and it becomes fairly easy to not get infected.

Its kind of like getting AIDS, its really not hard to avoid the likely infection vectors, and the unlikely infection vectors are going to get you no matter how hard you try to avoid it. I.E. Unprotected sex and running random files off the internet you can avoid. Blood transfusions and unknown remote exploits in tcp/ip stacks are a little more difficult to actively avoid and sometimes they get you, but those are really rare cases.

You're rant about XP is simply wrong for multiple reasons. I've seen FoxIT exploited, god knows how many times FF has been, its not even a shinning example of good software standing next to IE6, sorry to burst your bubble, but its not Chrome.

OpenDNS is roughly the same as unprotected sex, you deserve what you get and I'm sorry you can't recognize how you're being manipulated by it, they pull the same DNS redirect shit as Network Solutions, and specifically redirect google results to their own modified by looks alike page. You're being scammed and don't even know it.

Re:Who still pays for antivirus?

[mcgrew]

Windows is also secure now a days
WHAT???

Compared to the outhouse that 98 and XP were, the Win 7 carraige house is pretty secure, although nowhere near as secure as Linux's and Apple's homes. And, er, even bank vaults get broken into occasionally.

Security is like safety, neither one really exists. There are only varying degrees of each. So for someone who's never used a Mac or a Linux box, who's familiar with W95 and W98 and XP, W7 is actually secure. "Wow, I can sit on the can and there's not only no cold breeze coming in, there's even a lock on the door!"

Re:Who still pays for antivirus?

[rastoboy29]

lol and you still use windows because....?

I've got a few necessary Windows only apps, and that's what my Windows Virtualbox VM is for :-)

Re:Who still pays for antivirus?

[VJmes]

This is true for any OS on the market, under *nix or BSD once you give a process the ability to run under root (Which involves a nondescript password entry) then it can do anything to that system. However the difference in Windows is the long history of exploits which bypass UAC and privilege escalation and are able to spawn a new process as administrator, all without user permission.*

*Clicking on free viagra links don't count.

Re:Who still pays for antivirus?

[idontgno]

Spoken by someone who's apparently never seen a virus restored from backup.

Besides, your approach to fire prevention is apparently prefab modular construction techniques to rebuild destroyed structures on the ashes of their previous incarnation. That's OK, but not really solving the real problem, and frankly, it can be hard to get a good lawn to grow on the ashes of successive "generations" of not-quite-fire-prevented houses.

Re:Who still pays for antivirus?

[PsychoSlashDot]

How do you know? It's not like they pop up a window to let you know if the installation was successful.

What planet have you been on for the last decade? News flash: traditional virus threats (ie. self-propagating executables) are almost never seen anymore. For many years now the "bad stuff" that is seen tends to be very, very visible and spreads by means of compromised web servers. They rely on browser exploits and user intervention to actually "infect" a PC, and in the vast majority of the case their job is to make the computer barely usable while screaming bloody murder that the system is compromised and for $40 they'll fix it.

I manage hundreds of desktops and laptops and the number of traditional threats detected by realtime AV scanning is really, really low. Like... five instances a year. Everything else is 0-day web-distributed malware.

Re:Who still pays for antivirus?

[Whiteox]

It's also a matter of time. You don't want to spend days doing it, but I've also got some easy basic tools/practices that helps in the field.
The most obvious is system restore if it's clean and available. Creating another user via safe mode and rebooting into that allows you to access the HD if the main user is inaccessible (some scareware does this). Deleting ALL temp folders including prefetch and IE temp files prevents reinfection on boot up.
After that you can download MSE and scan to get rid of the rest. Hijack This scan for any weird BHOs and delete them. Rootkit scan. Remove any IE Adons/ActiveX/Toolbars and reset IE to default security etc.
As for file type association stuff ups, most of the time I tell the client to re-install downloadable apps like their camera/phone software etc.
Works 90% of the time and takes maybe 2hrs while I'm working on something else.
Then I cold boot a few times into the main user login to check if it's truly gone.
If the HD is truly stuffed, I recommend replacement if it's more than 2 years old or a full format and install if it's newer and that's another job altogether.

Re:Who still pays for antivirus?

[Billly Gates]

Chrome clicks on the links automatically and loads them before you select them. That is how it appears so fast. You can be exploited automatically and the last version of Chrome fixed 30 vulnerabilities. It is far from perfect.

OpenDSN blocks bad domains which is a huge source of XSS based attacks really well. I experimented with it on Norton's safe web of bad websites. Only 3 out of 10 got through with OpenDNS. OpenDNS only loads to their search engine if I mistype something horribly. Google works fine. I can do an image search without getting infected whether I click on links are not with OpenDNS. When OBL was killed you could get rooted by simply doing an image search without even clicking on the links. Yes, it was that bad and if you did this last spring you probably got infected.

FF does not offer full sandboxing capabilities and even IE is better these days. XP has double the vulnerabilities of Windows Vista or Windows 7 and many corporations who have upgraded reported a drop in infections.

Your machine is more than likely infected if you have flash, java, and simply browse the web. I can almost gurantee it and how would you know if it is clean or not? You need anti virus software in this day and age as they have between an 80% ro 90% success rate on new malware. It gets higher as definition files get updated. Rootkits and tcp/up stacks are quite common as Windows 7 is more secure and these are easier attack vectors in this day and age. Also it means less detection

Re:Who still pays for antivirus?

[Billly Gates]

Where are the file shield and behavior settings in MSE? They are not there. The file is compared after it is written and yes, after it is executed. Sure it had some nice success rates that were near the top last spring. It is down a little bit, but MSE does a great job removing them.

Just from what I hear and what I see. Heuristics and behavior based settings prevent something from being executed and that is why Kaspersky and Avast are great products. Kaspersky is even more heavy duty but slows down systems too much in my opinion.

Re:Who still pays for antivirus?

[Whiteox]

Actually, if you read TFA, you can work out that it's PCTOOLS nagging for money and not the reg cleaner which is free.

Re:Who still pays for antivirus?

[lightknight]

Oh good. Now I've thought of a new "Insanity Wolf" meme: "Install Windows, don't install anti-virus."

Re:Who still pays for antivirus?

[Whiteox]

I had a really helpful Indian/Pakistani/Asian guy from a Microsoft security company call me up and told me my PC was infected. I followed his instructions and he took remote control of my system to clean it up! And it only cost me $99.

Re:Who still pays for antivirus?

[arose]

They also avoided the bundling problem. MSE is given as one of the choices when Windows does its "your computer is not protected thing", at that point they are just another of the free options.

Re:Who still pays for antivirus?

[OS24Ever]

Don't forget Immunet (http://www.clamav.net/lang/en/about/win32/) which is free if you are connected to the internet with a $25 yearly fee to do a lot more and when you're offline. Based off of ClamAV.

Re:Who still pays for antivirus?

[kesuki]

the prefered way to deal with malware and av is to run a virtual machine set up, where the root host doesn't connect to anything but say a serial console, and the rest of the machine is virtual machines that when infected can be detected and rolled over using software. this is easily done on open source, closed source requires paying money to do the same thing. some anti-virus packages take use of the same things a virus does on windows then it proceeds to quarantine the software the hacker tries to deploy. i don't do this as a profession so i have no skills at it myself, but i know that a virus designed for one type of hardware/software will not be able to detect any well hidden vm master when only the vm slaves are visible, and networked according to the setup of your internal IT guys.

for home users its a bit harder, mind you i have cleaned off viruses machines mainly by saving 'essential files' formatting installing etc but i have from time to time found 'dirty' free av software that essentially i had to manually go to the programs directory deleting the av app and using a registry cleaner to remove av software that refuses to uninstall.

the second paragraph defines what i have done in practice. the former i only know about from reading what other claim work.

Re:Who still pays for antivirus?

[syousef]

So choose from those. Personally I don't run any antivirus as I don't download random executables from the internet nor surf to random porn sites or download from torrent sites. Windows is also secure now a days, and I haven't had a single malware in like 10 years.

Speaking as someone who once almost got pwnd drive by style on a well known photography blog and another on a major news site, I can honestly say you've got rocks in your head. Either you don't use your computer much at all for anything interesting (and I'm not talking about porn or warez crap!) or you have been very lucky and are living proof that often being lucky beats being smart.

The software that prevented both attacks was free in each case. Free version of Zonealarm and Microsoft Security Essentials. It was still very disconcerting that a process had been initiated on the computer and then frozen by the respective software.

Re:Who still pays for antivirus?

[Khyber]

It isn't when you're running diff on resource usage on a known static system :D

Re:Who still pays for antivirus?

[Mister Transistor]

One thing I can assure you of is that I was there. Not a decade later, I was actively using it in Linux in 1992-3.

I'm not sure which tripwire you're talking about, but I'm talking about one that was invented for Unix in 1992 and included in major Linux distributions almost immediately. I used to use the 2nd large distribution of Linux ever called Yggdrasil Linux, and it had it, and I was using that in 1992-3. I'm not sure if Slackware (the very 1st big Linux distribution) had it or not, I didn't use that version. I eventually switched to Red Hat when Yggdrasil was discontinued in 1995.

Yggdrasil even had a working bootable "live CD" of itself back then, so I'd say it fit the definition of 'running' as you say, very well.

Second, do a simple Google search. There is a tripwire page (2nd result) that says the original version was written in 1992.

Re:Who still pays for antivirus?

[Khyber]

I find it endlessly hilarious that you think these are for growing dope.

That look like cannabis to you?

How about that?

How about that one?

Anything in there look like dope to you?

The ignorance is quite astounding.

Re:Who still pays for antivirus?

[Fortran IV]

It's all about which sites one visits.

So you never visit sites like Yahoo, Google, Weather.com, Monster, Fox, US News, or the New York Times? All of these have been reported as serving up tainted ads at one time or another in the last couple of years.

There's much more to keeping secure than not visiting porn sites or clicking random links. Even CNET has been installing unwanted toolbars lately.

Re:Who still pays for antivirus?

[Trogre]

No, that would be silly.

My car is the Defiant.

Re:Who still pays for antivirus?

[Demonoid-Penguin]

I'm not exactly pro-MS but DTech is correct. MSE is actually one of the better anti-virus programs for windows these days. You can't fault MS for snapping up a company/product that worked well and then including it for free in their (buggy and insecure) OS. It's at least one thing they did right.

I hate Microsoft - but I agree they've substantially lifted their game (market forces at work, MS created the antivirus industry, now they're killing it). And I wouldn't call DTech's post shilling - he/she carefully noted the circumstances in which the OS is being used.

But to be totally fair - I only believe a machine running *any* OS is *clean* when I've had it running on a monitored network for some time. Until then it's sheer guesswork (apply the same methodology to determining you don't have cancer).

Re:Who still pays for antivirus?

[Demonoid-Penguin]

Read his post history, there's no if. I've seen five or six posts from him in the last week and every one of them reads like an MS press release (or is a direct attack on one of MS' competitors). You make a good point, I can understand them shilling their bad products but shilling their good products just makes people distrustful without reason.

Employing a wide brush on your part isn't doing much to advance critical thinking. Quite the reverse.
Fan bois are dumb all over. It's science, not talisman magic

Disclaimer - I only run GNU/Linux and FreeBSD.

Re:Who still pays for antivirus?

[kesuki]

"If you're getting infected, you're doing something wrong."

like trying to make money. like trying to listen to music, like upgrading corp edition to windows genuine. like blatantly believing you can just google or man-page the problem. or better yet, because you trust someone who was wrong and insisted they could solve your problems with formats.

remember this: what you define as a virus someone else saw as a tactical advantage, or even as a religious duty.

i have seen people's computers fail for no better reason than because they used cheap av software from overseas.

Re:Who still pays for antivirus?

[hairyfeet]

If you like having control you'll LOVE Comodo, as it lets you customize to your hearts content. Don't get me wrong, its defaults work just fine, but if you want fine grain control over your AV and firewall you really can't beat it, its got some of the best UIs for making AV and firewall rules I've ever seen. it also has REAL fine grain controls on its sandbox, you can decide not only which apps are included or excluded but set up conditions such as this app will ALWAYS be in the sandbox or this one should ask you before launch whether you wish to sandbox, really nice.

Basically I give Avast to the grandma types as its UI is VERY simple and easy for the clueless to grasp, anybody with any knowledge I give Comodo as its finer grained control makes it most excellent for those that don't mind spending a little time. I've even used it for years on a gaming PC and found it didn't affect my FPS at all simply by custom tailoring the rules such as tell it which folder a game is allowed read/write access to and which its not. Give it a try, its 100% free for home AND business (which is nice) and it doesn't bug you to buy their enterprise version. It'll take about a week to learn your programs and ask you questions but after that its completely silent unless it detects something, it just stays out of the way and lets you work safely.

Re:Who still pays for antivirus?

[kesuki]

i have seen malware come from av software. usually cutrate av that is freeware. it costs money to fight viruses, even with that money big av firms are a target to some hackers.

Re:Who still pays for antivirus?

[kesuki]

apparently you've never heard of Deft linux http://www.deftlinux.net/ probably not court proof enough but for forensics on the cheap...

Re:Who still pays for antivirus?

[Kjella]

That single click was to run an EXE that was emailed to them (...) Way to not have any idea whats going on.

"Click a link" doesn't mean the same as "Open an attachment", that you can't explain worth shit is the problem. I don't know any e-mail software that'll run an attached EXE with a single click, nor have I ever seen one of those scams unless the EXE is in a zip file, usually you get a big warning saying do you really want to run this. But I guess they clicked open, run, yes, yes because DHL told them to and forgot or ignored that part and like the sucker you were you believed them. I wouldn't be surprised if they clicked past the UAC prompt too, though that could have been an exploit. Don't confuse the way the user said it happened with the way it really happened.

Re:Who still pays for antivirus?

[Kjella]

If you run an AV how can you tell your computer doesn't have a rootkit that it can't detect?

You don't. But if I'm smart enough to not install 99% of all rootkits and the AV will catch it 90% of the time, then I've just upped the odds to 99.9%. Two layers of defense always beats one. And I've little confidence in running offline scanners from time to time unless you boot from a clean CD, some of these hide very well. You need that warning as you're about to get infected, before it can replace all the system tools with hacked versions.

Re:Who still pays for antivirus?

[doccus]

Fruit shaped logo.? Surely you refer to "Banana Junior".. correct?

Re:Who still pays for antivirus?

[jackbird]

It's the applications and restoring the user data that's the horrific time sink. If you just wipe and reinstall, you're in a race to the bottom with Best Buy.

Re:Who still pays for antivirus?

[Khyber]

A bit off-topic, but I think I see more issues now days with hardware than I do malware. Most of these people forget these things could use a little cleaning every now and then. Just today, had a customer from my porn shop give me a computer to look at. IGP's fried. Remove fans atop heat sinks, every heat sink has about 1cm thick dust. No airflow, no cooling besides the case fan - even the PSU vents were clogged up. No wonder it burned out. He doesn't even smoke, it was just dust from living out on a major street with the windows open all the time.

Re:Who still pays for antivirus?

[Lost Race]

I haven't had a single malware in like 10 years.

How do you know? It's not like they pop up a window to let you know if the installation was successful.

Let me turn that around on you: Why would you expect accurate results from a virus-scanner running on the computer to be scanned? That is, if the computer did somehow get infected then it doesn't matter if you're running a virus scanner or not -- the virus can interfere with the scanner causing it to report false negatives. All it takes is one lapse in your AV and then you can never again trust it do anything at all.

I post my technique about once a year here on Slashdot, whenever some oh-so-clever nerd asks this question. This is something I do occasionally, once every few years when I'm bored and have nothing else to do.

1. 1. Boot system from live CD (pressed, not burned) from e.g. Slackware.
2. 2. Make sector copy of system drive on a scratch drive. (dd if=/dev/sda of=/dev/sdb)
3. 3. Blank another scratch drive. (dd if=/dev/zero of=/dev/sdc) Yeah, I have a lot of scratch drives lying around. Don't you?
4. 4. Install a fresh OS and virus scanner (from trustworthy install media, of course) on the blank system drive. Do not connect this system to any network.
5. 5. Attach sector-copy of original system drive to fresh system, run scan. Wait for "clean" result.
6. 6. ???
7. 7. Profit!

Voila, I have verified clean systems with no AV running on them. In fact, the AV software (which I don't particularly trust) has never had access to my actual system drive or to the Internet. So even if this year's Nerd's Choice Ultimate AV Software turns out to be a front for the Russian mafia... no problem. They never got any access to my actual system or data.

Also I keep my systems patched up and don't run downloaded programs without trustworthy signatures, and don't use any browser plugins, and follow a variety of other good software hygiene principles. So even without the complicated scan above or any active AV software I'm still pretty sure my computers aren't infected.

This isn't exactly rocket surgery. With a little caution, foresight and discipline it really is possible to be reasonably and rationally confident of system integrity without any AV crutch.

Re:Who still pays for antivirus?

[tehcyder]

"Personally I don't run any antivirus... ...and I haven't had a single malware in like 10 years"

How can you know that for sure?

He checked with Norton's excellent suite of lightweight, robust security products.

Re:Who still pays for antivirus?

[tehcyder]

Re your sig, you can be either a left or right wing libertarian (with a small "l"). If you are of the right wing anarcho-capitalist tendency, it is hard to differentiate from straightforward conservatism, i.e. favouring business competition and the rich over employee protection and the poor.

Re:Who still pays for antivirus?

[tehcyder]

I guess it means no root access or sudo privilege for the user.

Unfortunately, the user and admin of a home PC are usually one and the same.

Similarly, I avoid malware and viruses on my computer at home by not connecting it to the internet at all. Also, I've made my car accident proof by removing the engine.

Re:Who still pays for antivirus?

[hoboroadie]

I seldom visit those sorts of sites, but perhaps my eschewing all the malware vectors excreted by Adobe has been fortuitous?

Re:Who still pays for antivirus?

[TheLink]

If you're paranoid and really want to be sure, you boot off a trusted _system_ (including hardware you know is OK) and do the scans offline[1].

Nowadays with virtual machine tech, you could make a clone/copy of a virtual machine while leaving it running. You can then scan the clone. In theory you could even scan the memory of the cloned machine[1] :). If the system is infected but you can't find any malware in the clone, it's unlikely that realtime AV software would be able to find and detect that malware either (if installed on the machine).

Of course, if the virtual machine host is infected/affected through the guest (there have been bugs in VM/hypervisor software), then there is a possibility that a very skilled and devious attacker could tamper with the cloning process so that the resulting copy would show up no malware when scanned by a trusted machine. But that'll take a pretty resourceful attacker, one that could pwn you in many other easier ways. I wouldn't be embarrassed if I ever got pwned by such an attack.

[1] In theory if the malware stays in memory the malware might not show up in a disk only scan. So if you "power-off" the machine, the malware won't show up. But then the malware would "die", unless it can pull itself back in somehow, in a way which cannot be detected by scanners.

Re:Who still pays for antivirus?

[FranktehReaver]

"Personally I don't run any antivirus... ...and I haven't had a single malware in like 10 years"

How can you know that for sure?

It probably has something to do with the fruit-shaped logo on his computer. ;) (I can say the same thing, for the same reason)

I have someone at work think the exact same thing "My Apple is immune!" well her work PC started to get viruses and bog down and eventually crashed on her. She contacted me when the crash happened claiming all she does is work on it and Windows was garbage. I asked her to run a Anti-virus/Malware scan on her Mac, she argued she didn't have to and it was Windows fault for being lame. Finally she did it and what did she find? About 300 or so viruses or malware files on the Mac that were using it as a gateway to infect other machines on her home network. I cleaned both out and checked the quarantine log in her work laptop and it was finding a virus file for about 3 months every week or so until it got overwhelmed one day.

Moral of the story is even if your Mac isnt showing signs of viruses they are probably there and if not doing damage directly they are using it as a launching pad to get to other devices on your network.

Re:Who still pays for antivirus?

[Ol Olsoc]

So choose from those. Personally I don't run any antivirus as I don't download random executables from the internet nor surf to random porn sites or download from torrent sites. Windows is also secure now a days, and I haven't had a single malware in like 10 years.

Seriously, you are some sort of expert here, and parrot the old "porn site" thing? Come on, there are plenty of sources, enough to make "I don't surf porn" meaningless. That would only be a subset of the problem.

I always like to point out that the one time I got a virus, It was when I was looking into garage door opener reviews. If there is anything as far removed form voyeurism or illegal file sharing, it has to be garage door openers.

So if you really haven't contracted anything, you've been lucky.

I agree on the part about Microsoft Security Essentials. And highly recommend you install it.

Re:Who still pays for antivirus?

[Ol Olsoc]

I've got a Pentium 3 sitting in the corner JUST for banking, everything BUT the bank blacklisted. I have an old crap laptop for research and development. Again, everything BUT my research facility is blacklisted, IP and DNS-wise.

Then I have my main desktop for screwing around, which still hasn't been infected, and only runs Common Sense 2012.

If you're getting infected, you're doing something wrong.

Yes, because we all know that the key to safe browsing is to only use one computer per website that you visit. It's not that your method doesn't work, but then again, it's hardly practical either.

Re:Who still pays for antivirus?

[v1]

I usually give people the benefit of the doubt, but this time I have to call BS. You're either a troll or uneducated and trying to spread FUD on a platform you have a grudge against. So I hope I'm throwing a wet blanket on your FUD rather than feeding a troll.

Thing is, a virus for a present version of the Mac operating system hasn't been spotted in the wild in the past decade. (a program that installs itself to a remote computer without user interaction, either by media exchange or network connection) 300? Name one. Just one. (lots of noobs don't know the difference between scareware, malware, trojans, viruses, and worms, and call them all "viruses")

There certainly is malware in the wild for the Mac though, MacDefender and the many aliases it goes by, is the most widespread. As with most malware, it requires user interaction and permission to install itself before it can cause problems with the one computer the user installed it on. MacDefender is a member of the "scareware" subclass of malware. I've also ran into a limited number of computers with a DNS redirector cronjob installed on them that masqueraded as a codec installer for watching the porn videos on the page it was hosted at, and that is a more classic example of "malware". Your claim of "About 300 or so viruses or malware files" isn't going to fly very far unless you're talking 300 copies of one or two unique malware apps, none of which would be even the slightest risk to other computers on the user's home network as you stated.

May as well throw this in for full disclosure. I've ran into TWO cases of spear-phishing malware on a Mac. These were custom jobs tweaked for the specific victim, and required direct interaction between the malware author and the victim. One of them was able to get an inexperienced new network admin to install remote access to his laptop, and the criminals then set it up to be a spam zombie, using tools normally installed onto compromised unix servers. It was discovered when he attended a conference, and found himself surrounded by astounded IT staff and network admins that had traced the spambot traffic at the facility to his laptop. It was the first time they had ever seen or heard of a compromised mac. Goes to show just how extraordinarily rare that sort of thing is on the platform. This is the only example I have ever seen of malware on a mac that is going on the offensive on the network. And I work on somewhere around a hundred macs a week. (which turn out to be mostly hardware repairs, in and out of warranty)

Re:Who still pays for antivirus?

[FranktehReaver]

Sorry should of been more specific in my details. Her mac was not affected or harmed by viruses for they were encoded for windows. But she used file and picture sharing on the network between the two devices. She also did this with a thumb drive quite often. Her kids used the Mac quite frequently and she never had any sense of where not to go on the internet for her thinking of Mac's being secure so she opened everything she came across. But when she was moving files around they were becoming infected and being stored in the Mac for safe keeping and coming back when she did something else. So when the virus scanner ran it found all those files that were infected or moved over. She has had that Mac for 5+ years and has never done anything but use it. Sorry to inflame you so much you get upset and defend your OS but I was trying to relay that Macs are not as safe as some wish to think and sometimes your virus infected files can be on that machine if you have no security on that Mac what so ever.

Re:Who still pays for antivirus?

[v1]

you might as well advise us all then how vulnerable flash drives are too. capable of storing and acting as a vector for viruses, even more so than a mac. Telling a user that their mac presents a virus danger makes as much sense as shooting the messenger.

Re:Who still pays for antivirus?

[FranktehReaver]

That wouldn't be necessary sir. Nobody stated flash drives were secure to begin with. Sorry for upsetting you.

Re:Who still pays for antivirus?

[Lehk228]

i never noticed any slowdowns on my old laptop (1.5 g ram, pentium M 1.66Ghz intel graphics) and i used to play world of warcraft on it.

Not mine; but apropos...

[fuzzyfuzzyfungus]

They are merely respectable businessmen, offering you their protection...

Antivirus?

[SuricouRaven]

We used to use Symantic antivirus at my workplace. Then we had a virus outbreak. Not a cutting-edge virus, just an old USB-stick-infector that symantic was powerless against. Didn't even detect it half the time, and when it did failed to do anything. So we use Sophos now.

Re:Antivirus?

[ledow]

Unfortunately, I can tell you the same story about any AV product out there, from personal experience.

Go to virustotal.com and upload any "known" virus you encounter and see how many big-name AV vendors don't recognise it at all.

Then make yourself a utility that crashes your system or takes over your startup entries, or does exactly what any virus will do and see how it fares against the same tests. I'd be very surprised if *any* of them picked it up, even with "heuristics" turned on.

Re:Antivirus?

[Joce640k]

I often respond to obviously-a-virus emails inside Virtual PC just to see what happens. The antivirus usually doesn't start protecting me until a week or more after the email arrives.

A week is an awfully long window for infection in the internet age. It makes antivirus programs next-to-useless IMHO.

The single best thing a Windows user can do to protect themself is not run as administrator.

{Cue all the "Or not run windows!" replies...}

Re:Antivirus?

[Spad]

This is true, however, Symantec's corporate AV/Endpoint is still pretty terrible and has been for a while, even if you ignore the ludicrously unreliable uninstall mechanism.

Personally I tend to shill for Sophos in these situations, but that's mostly because I've had very good experiences with their products; I'm sure there are lots of other AV solutions that are just as good for the Windows workplace depending on your needs.

Re:Antivirus?

[L4t3r4lu5]

Dump it and get ESET's enterprise protection. 1/3 the memory footprint, and significantly faster scanning time. If I had the option, I'd drop Sophos like a ginger stepchi... uhhh... A bad case of the cla.... errr... A hot potato. Unfortunately, due to bulk licensing, they come out around 50% cheaper than competitors, and bean counters are tight-fisted nowadays.

Re:Antivirus?

[jimicus]

Then make yourself a utility that crashes your system or takes over your startup entries, or does exactly what any virus will do and see how it fares against the same tests. I'd be very surprised if *any* of them picked it up, even with "heuristics" turned on.

Contrariwise, I'm a big fan of scripting away work for efficiency gains - and I've noticed some heuristic scanners have a tendency to block a lot of functionality in many scripts. You're buggered either way.

Re:Antivirus?

[SuricouRaven]

For all those curious people replying, I should have identified the virus. The Sophos identified it as Ramnit/A, and it certainly looks like Ramnit in the way it infects HTML files. It also infects removeable drives, hideing files in the recycle bin folder and using an autorun file to launch them, and places itsself in start menu startup. We believe it came in via USB, and suspect Patient Zero to be a user who brought in a copy of Grand Theft Auto 2 he torrented.

Re:Antivirus?

[tchuladdiass]

{Cue all the "Or not run windows!" replies...}

Or, as an alternative, run any infection vector program inside a VM, and access it from your main Windows host via RDP (if running a copy of Windows in the VM) or X (for Linux VMs). With my setup, I have Internet Explorer set to not run any scripts or plugins, and the Firefox icon points to a Cygwin script that launches Firefox on a remote Linux box. Same with IM clients, etc. Went from having to rebuild the Windows box that the kids used on a weekly basis to hardly having to touch it at all.

Re:Antivirus?

[OhHellWithIt]

We used to use Symantic antivirus at my workplace. Then we had a virus outbreak. Not a cutting-edge virus, just an old USB-stick-infector that symantic was powerless against. Didn't even detect it half the time, and when it did failed to do anything. So we use Sophos now.

Apparently some (most/all?) AV vendors age out virus signatures after a while, so that there aren't too many to be checked. You might want to consider AppGuard, which helps fill the gaps left by AV products. (Disclosure: I work for the company that makes AppGuard.)

Re:Antivirus?

[BitZtream]

That works fine for now, if you've got that much time and energy spare to bother with it all the time.

However, if that became 'the norm' then the virus infections would just also include code to exploit the VM subsystem.

You really don't think that VMware is better at security than Microsoft, do you?

Re:Antivirus?

[ledow]

Lesson confirmed - antivirus is a waste of time and the equivalent of having a "known shoplifters" list specific to each store. Sure, some stores will share it, and you'll keep the regulars out, but there's no way you'll ever stop shoplifting via this method.

Not totally fake in a way

[hcs_$reboot]

A number of users reported that after installing Symantec anti-viruses their system was slower, could detect false-positives, or worse, hang.
So in a way, the "scareware" is not totally wrong, as it warns about a degraded system - which may well be the case after the full product is installed.

Re:Not totally fake in a way

[fuzzyfuzzyfungus]

Symantec has a well-deserved reputation for being atrocious; but pretty much any AV mechanism that does on-access scanning(which is most of them by default, though it can generally be turned off somewhere, if you feel particularly lucky) is going to tank your apparent disk access speeds, since the AV process has to chew on the data before handing them over to the program requesting them. Unless you have an SSD or a fairly punchy RAID setup, lousy disk access speeds are one of the best ways to make a system feel miserably slow, especially now that abundant RAM and fast CPUs are so cheap...

Re:Not totally fake in a way

[fast turtle]

Thanks for reminding about On Access scanners slowing systems down. That just maybe the issue I've recently started suffering with swap file usage and yes More system RAM would more then likely solve that issue for the time being.

Re:Not totally fake in a way

[helix2301]

I been saying for years that Symantec is paying people to make viruses for them. This may not be a virus but scareware is close enough for me.

Re:Not totally fake in a way

[BitZtream]

An SSD or RAID will provide no help at all.

The slowdown isn't from disk access, its from the processing time it takes to scan the data and figure out if its good or bed, then pass it along.

You could do it on RAM disks and you wouldn't see much of a speed improvement over a spinning platter. Over slower media perhaps, but not worth mentioning on any modern desktop drive. Your CPU processing the data trying to pattern match on it is going to be far slower than your HD accesses.

It's not AV at the heart of this complaint.

[jimicus]

This isn't Symantec AV we all know and love(!) at the heart of these complaints. It's one of those "sooper-registry-optimizer!!11" programs that Symantec apparently offer.

Now, these strike me as somewhat odd. I've been dealing with Windows in one form or another since before the registry even existed - and I've never yet seen one of these tools do the slightest bit of good. Sure, if there's a specific problem (eg. malware) then a specific tool to deal with it may well help - but every single generic registry optimiser I've ever seen seems to be optimised to suck £20-30 from the customer's bank account rather than actually help them in any way.

Re:It's not AV at the heart of this complaint.

[Spad]

Registry "bloat" is a bit like encumberence in RPGs; there's very little difference between a new "clean" registry and one that's full of leftover crap from old apps and the like (as opposed to actual issues that may be present, but no automated system can reliably resolve those) right up you hit the limit and slow to a crawl. These days you'd have to be going some to reach that point, so it's just not worth the risk of knackering your system for some negligible performance gain.

Re:It's not AV at the heart of this complaint.

[Lehk228]

there are scans that are worth running, but i am pretty sure there are free tools that do what need to be done, scans that look for dead references, which cause the system to attempt and fail to load files or libraries that no longer exist on the filesystem can speed up installs, however installers / uninstallers have gotten a lot better about that kind of crap so there are not nearly as many dangling references left in the registry by common software

Re:It's not AV at the heart of this complaint.

[DavidTC]

CCleaner does what you're talking about, and is of course, free. (And you should have it anyway because of the actual functionality of it.)

All registry cleaners are essentially scams. Deleting paths to hundreds of files that don't exist anymore might speed up windows by 1 second during boot. None of it's worth paying any money for. Although if you have CCleaner you might was well run the registry scanner everyone once in a while, it won't hurt.

Re:It's not AV at the heart of this complaint.

[elgeeko.com]

We run Symantec End-Point protection and the clients are as thin as I think they can get and still provide some kind of protection. Any other product by Symantec is worse than having a virus and the same holds true for Mcaffe, we used to have a sign on the wall that said "If you have Mcaffe, we will remove it as part of the solution to fixing your problem, unless you specifically request we leave it, in which case there is an addition $50 charge for having to deal with it."

Re:It's not AV at the heart of this complaint.

[jimicus]

Haven't used Endpoint Protection, but I never had a big problem with their Enterprise AV product. Small, unobtrusive, easy to manage - what more do you want?

Re:It's not AV at the heart of this complaint.

[Adammil2000]

What does "optimized registry" even mean? Maybe the products don't work because they solve an imaginary problem.

User's choice dyslexia from hell.

[sgt scrub]

I think it is ironic that Microsoft fights like hell to make sure the customer is using their browser but leaves the security of the system "up to the user". As far as being scary: Is it any more frightning than the OS itself telling you, "Your unprotected! Get AV now!"? Why the hell would they want to frighten customers about the security of the system instead of just adding it to the OS?!? Insanity!

Re:User's choice dyslexia from hell.

[DaneM]

Notably, MS now puts out a free security suite (Microsoft Security Essentials) that's arguably better than most/all the other free ones out there, at present. Of course, this will not be the case for long, as seems to be the status quo amongst anti-malware vendors.

I agree that it's irresponsible to choose a browser for us, but leave security to the computer-illiterate masses. I also agree that they have legal reasons to shift the liability for their very insecure OS elsewhere.

Re:User's choice dyslexia from hell.

[nstlgc]

Because if they add it to the OS, they run into another antitrust case. It's not like they haven't suggested doing it before, much to the dismay of Symantec, McAfee and others.

And I think it's a bit ironic that you say they fight like hell to make a customer use their browser when the first thing I see when I run IE on a new computer is a browser choice dialog.

But hey, whatever fits in your agenda.

Re:User's choice dyslexia from hell.

[sgt scrub]

"when the first thing I see when I run IE on a new computer is a browser choice dialog"

Sorry to take so long. Installing Windows 7 Ultimate takes a while. I've opened IE. I don't see any mention of browser choice. Wait, it is doing something. No. That is Windows update not finding a network connection. Where is the browser choice dialog?

Re:User's choice dyslexia from hell.

[phoenix_rizzen]

If you switch to using Microsoft Update instead of Windows Update, then MS Security Essentials is listed as an Important Update and will be installed automatically.

Re:User's choice dyslexia from hell.

[BitZtream]

Its in Europe, and it also is on the other end of the net connection that is required to get a list of offerings for you.

Its only in Europe where they've made it a requirement for MS to sell their product with the competition on the front page.

This supports my long term claim that...

[Anonymous Coward]

...AV companies are in cahoots with the majority of virus writers.

The strongest evidence prior to this incident has been the high profile nature of virus attacks. If I were a virus writer my goal would be to remain as undetectable as possible. I would not want the presence of my program to be noticed as it did its work. The fact that the majority of viruses make their presence quite noticeable implies to me that my recognition of their presence is the goal. It is the problem, reaction, solution paradigm applied to making AV software more ubiquitous and profitable. That these same majority of viruses are written to be nigh impossible to manually remove further supports this hypothesis.

Re:This supports my long term claim that...

[Anonymous Coward]

You are wrong.

Yes, I know I'm posting AC so you've got no reason to believe me. And yes, I can see you do have some supporting evidence. But I can assure you, as an industry insider, you are wrong. You are wrong in the same way someone saying that the pharmaceutical companies are creating diseases is wrong. Quite simply, it's bad business sense. There are plenty of people making the viruses already, why would an AV company waste resource creating more?

Re:This supports my long term claim that...

[BitZtream]

He may be wrong in the 'pharmaceutical companies are CREATING diseases' department, but its a known fact that pharma companies would rather treat than cure, which is more or less EXACTLY what he's suggesting AV companies do.

Its not an unbelievable statement. Unlikely perhaps, but not impossible.

Re:ut it has a history of using fear mongering tac

[ledow]

Measuring an antivirus (actually, "security suite") package by the performance of its runtime is kinda like measuring the effectiveness of a crane by its top-speed on the road, regardless of it only being able to life 1kg.

Hmm.

[slasho81]

Symantec is scaring people to get what they want. So by definition, Symantec are terrorists.

Re:Hmm.

[someSnarkyBastard]

Marketing uncovered...

The sales and marketing departments will be third against the wall when the revolution comes...

Actually, according the Hitchhiker's Guide the mindless jerks in marketing are supposed to be the first against the wall when the revolution comes.

Re:Hmm.

[BitZtream]

Actually, according to the Encyclopedia Galatica that fell through a time warp from the future, they WERE the first people up against the wall when the revolution CAME.

Well, here's my metric

[Moraelin]

Well, dunno about him, but before I gave in and tried an antivirus again around Christmas, I can say that everything loaded much faster, there was no suspicious modem activity, there were no popups telling me to pay X dollars or else, and haven't had any funny charges on my credit card either.

Honestly, if I had any malware, it was far better behaved than any antivirus I've ever seen. From a simple pragmatic point of view, I should have stuck with that.

Not a problem on Linux

[archlinuxftw]

I have an elderly (85) neighbor who just wants to be able to read his email and look at the pictures of his grandchildren that their parents send. He was constantly being confused and alarmed by scareware and Windows security announcements, offers to upgrade Hotmail, etc, which occured practically every time he turned on his machine. I put him on Ubuntu, set it up to go straight to his Gmail when he powered on, and to never announce upgrades (he's happy with status quo as long as he has a working machine). Problem solved, he's happy as a clam, and loved how much faster his computer ran.

Re:Not a problem on Linux

[OhHellWithIt]

Not entirely. I've occasionally hit web sites that purport to run a scan and find a boatload of viruses on my computer. Since I don't use an antivirus program, it might be credible, except that I'm running Linux and the files "found" by the "scan" are things like Windows DLLs which are not, in fact, anywhere on it. I'm not sure if the web sites where I've seen this have any connection to Symantec. I hope the plaintiff takes them to the cleaners!

Is this legally provable?

[JThaddeus]

I'm wondering if this charge is legally provable. I would think the complainant would have to do some reverse engineering of Symantec's software and reverse engineering is most likely forbidden by Symantec's EULA. Without this, how can it be proven what Symantec did or did not find on the computer? Even then, does anyone think it can be made understandable to a judge or 12 jurors?

Re:Is this legally provable?

[Jeng]

It can be proven if the system did or did not do a scan, from the summary that seems to be the point of the case, that the program did not do a scan at all, it just presented fake results.

It is also verified since when people bought a new service after Symantec claimed to have found problems, but once the program is purchased and installed the program does not find the problems it claimed you had.

Re:Is this legally provable?

[Mister Transistor]

It's really easy. Install clean Windows, drivers and all the service packs from a CD or USB drive. Then use Autopatcher to bring the system current. This will all take about 3-4 hours to set up and update altogether. DO NOT CONNECT THE SYSTEM TO THE INTERNETS. That's it - then install and run your suspect AV "protector" and see if it comes up with any positives. It's that simple.

While they're at it, they should test and then sue the fuck out of the "MyCleanPC" and "MaxMySpeed" assholes. Those have been proven again and again to do exactly what Symantec is being accused of here, yet they have a great BBB rating and still advertise their scareware / rogue / shit AV and reg cleaner software on every stupid basic cable channel at night. Even after having been proved to be fake / rogue bullshit by the exact method I have given above. Plus, they use all the other shady fuck techniques like setting up your credit card so they can continue to debit it each month for your "continued protection" and enabling their techs to get into your system with remote access so they can "find and fix all the big bad software", and making it difficult if not impossible to "unsubscribe" from the recurring monthly debit.

Their product sucks, but their blog...

[virgnarus]

While I agree Symantec products are awful bloatware that infect many OEM and the PCs of other less educated souls, I do enjoy their malware analysis blog. Being someone who's studying reverse engineering, kernel debugging, and advanced PC troubleshooting (investigating BSODs, hangs, etc.), I enjoy reading about the dissection of malware and their approach in doing so. Indeed, there are many malware analysis blogs out there that offer the same, but I can't see how someone wouldn't appreciate more, regardless of whoever it is that's providing it.

Been a long time coming...

[DaneM]

I've been expecting something like this for years, now, and I'm a bit pleased that somebody is finally calling Symantec on their scare tactics. Pretty-much since Norton was sold to them and became Symantec Anti-Virus (or whatever they call it these days), their products have been crap. ...Expensive crap. ...Expensive crap that scares its users into paying more. ...For products that slow things down and don't generally work.

So there.

MSE vs. Avast

[tepples]

What makes Microsoft Security Essentials better than Avast?

Re:MSE vs. Avast

[lgarner]

Avast has started popping up "alerts" trying to get you to buy their paid product. Of course, the product is free and they're allowed to try to convert some of the free users to paid ones, but I'm also allowed to switch AV products. The Avast popups just got too annoying.

Re:MSE vs. Avast

[Khyber]

MSE doesn't have that shitty announcer that Avast has.

Re:MSE vs. Avast

[Beelzebud]

MSE doesn't have pop up advertisements urging me to buy a full version. That's why I dumped Avast a few years ago.

Re:MSE vs. Avast

[delinear]

It seems to have become much more aggressive, too. I'm sure it never used to nag me constantly but it does now. If I've closed the notification I clearly have no interest in signing up, at least respect that and don't push the issue again for a few weeks. This seems to be the case with all the decent free products, eventually they all either go paid or they all have a nag for the paid premium edition that gets progressively worse. I might have to switch back to MSE (at least they have an incentive to keep this free).

Re:MSE vs. Avast

[Ihmhi]

I've been using Avast for nearly a year now and I've yet to see one of these "alerts" you speak of. The only things I see are "Avast! Virus Database has been updated!" and "Threat detected." The sounds and voice of the announcements were a bit jarring at first but I find them quite charming now.

I guess if they ever did have them, they realized that people didn't like it and they stopped doing it. That says a lot about Avast.

Re:MSE vs. Avast

[Nemyst]

MSE doesn't waste resources trying to mask the perfectly fine Windows chrome. It also will never bother you about upgrading to the paid version, it gets updated by Windows Update and it's generally unobstrusive.

I used many free AVs in the past and MSE feels like a good balance.

Re:MSE vs. Avast

[Zeromous]

No, I get one every week at least once (and every time it is updated).

Re:MSE vs. Avast

[StikyPad]

Settings -> Sou... actually, nevermind. If someone can't figure that out, they deserve whatever happens by trusting the same people who couldn't secure the OS out of the box to secure the OS.

Re:MSE vs. Avast

[shutdown -p now]

It uses Windows Update to download definition updates. That's one less updater process around.

(1 down, 20 more to go).

Re:MSE vs. Avast

[Ihmhi]

I seriously do not get these alerts you speak of and I haven't since I've installed Avast. I'm on XP SP3 - perhaps it's only on Vista or 7?

If you don't want a hood on your car

[tepples]

It's more like Toyota selling a car that can have all it's controls and engine reconfigured from a panel stuck on the outside of the car. [...] I'd blame the car first for having such a stupid feature

So you're blaming Toyota for putting a hood (BrE: bonnet) on its cars. Or what do I misunderstand?

Re:If you don't want a hood on your car

[hawkinspeter]

I meant an easy to access control panel on the outside of the car that allows anyone to change the way the car operates.

I suppose you could do the same kind of thing by opening the bonnet (USE: hood) and hacking the engine and floor pedals, but you usually need to open it from the inside of the car and it's not normally that easy to change how a car works (easy enough to stop it from working, though).

The point I was trying to make is that you blame the manufacturer if a stupid design decision was made and I think a lot of viruses are due to bad design decisions made by software manufacturers (e.g. running programs as admin by default). I think a lot of the bad browsing behaviour by users is caused by Windows encouraging the installation of software from random sources (don't even get me started on ActiveX).

The walled garden approach prevents a lot of malicious programs just by pointing users at an "authorised" source of software. I particularly like the Debian/Ubuntu repositories for making it easy to install software from "official" sources.

Re:If you don't want a hood on your car

[tepples]

I particularly like the Debian/Ubuntu repositories for making it easy to install software from "official" sources.

I agree, but it appears everybody else adopting a repository model is also trying to charge per year for sudo apt-get install build-essential.

Tested backups... how?

[tepples]

There is no better anti-virus then good solid, tested backups.

How do you test backups for viruses? In fact, how do you test backups at all without having an identical computer to which to restore the system?

How do I burned SP-slipstreamed OS disc?

[tepples]

I'll hazard a guess that it was probably Windows XP RTM, no router. Not everybody has the foresight to burn a slipstreamed operating system install disc whenever a new service pack comes out. This is especially true when the only backup copy of the operating system that came on the computer was a "recovery partition" that just unzips the initial out-of-box image onto the main partition, blowing away both the operating system and the users' documents.

How much does Forefront cost?

[tepples]

I thought Microsoft would make it easy to answer the question "What will it cost to protect the eleventh PC in this organization?" but I couldn't make head nor tail of Microsoft's PDF document describing pricing for Forefront.

Re:How much does Forefront cost?

[shutdown -p now]

It's same as usual - whenever you get the magical word "enterprise" in product title, the pricing model suddenly becomes ludicrously complicated and hard to figure out *sigh*.

At home, I don't use AV

[elgeeko.com]

Never used AV at home before. Right now we only have 4 boxes running and only the one my daughter uses has Security Essentials on it. The others have nothing. In 20 years I've never gotten a virus on a home system. But I run all updates, I shut off the internet when we don't use it and I don't allow unapproved installs or downloads by my wife or kid. Oddly enough, being a responsible computer user results in having a much faster system. Call me a fool, but a 20 year track record of clean systems without AV and I'd say the fool is the guy paying $25 a year to protect themselves from viruses that are probably already patched in the OS.

Price: Call

[tepples]

I searched Google for microsoft forefront endpoint protection pricing, but the result recommended calling a Microsoft sales representative. In the past, this has ended up meaning "if you have to ask, you can't afford it."

Regardless of what corporate AV suite you intend to go with (Symantec or not), be sure you have at least 4GB of RAM installed for all Windows 7 workstations

How would one use more than 3 GB of RAM with a device for which a 64-bit driver is either unavailable or defective? An example of the latter is Zebra's LP2844 printer driver, which wouldn't work with my company's in-house label printing software.

Re:Price: Call

[DigiShaman]

4GB of RAM on Windows 7 is not required for AV software, but highly recommended. When you start opening multiple instances of a web browser with tabs, Excel, Word, and Outlook, a Win7 PC with only 2GB of RAM and AV software starts to run sluggish. If all you're doing is printing labels from a somewhat dedicated PC for this task, a Win7 (32bit edition if printer driver availability limited from vendor) PC with 2GB RAM and AV software will be more than enough. YMMV of course.

Re:Price: Call

[BitZtream]

Win7 in 32 bit mode?

PAE/AWE allow the OS to use more than 4G of ram without being 64 bit, it actually allows the OS to pretend to be 36 bit for addressing purposes.

This will allow your 32bit kernel to access more than 32 bits of memory, though any given single application running in 32 bit mode will ALSO have to be AWE aware
  or it will be limited to 4 gigs of ram for itself.

Both OSX, and Windows have no problem addressing more than 4g of ram in a 32 bit kernel. OSX even allows you to run 64 bit apps on a 32bit kernel, though my own investigation of this leads me to believe the truth here is that the actual kernel is 64 bit, but being that its a micro kernel and drivers run as userspace processes, they can still run as 32bit inside of a 64 bit kernel. This technically allows them to run 32 bit drivers 'in a 64bit kernel' but thats only because what they're claiming as 'the kernel' would just be 'user processes' to the rest of us.

Re:Price: Call

[tepples]

PAE/AWE allow the OS to use more than 4G of ram without being 64 bit

I thought only drivers designed for server editions of Windows were likely to support PAE.

Re:Price: Call

[DigiShaman]

Designed or not, you can still throw just about any newer workstation/server into AWE mode. The question is, would it help? Iffy at best. AWE is not a panacea for 32bit OS, but rather a work-around.

There are various reasons to be stuck with a 32bit OS. The OS, application, hardware, end-of-life peripheral support, or just plain laziness by the vendors to provide a fully functional 64bit driver. The later is genuinely the case with printer manufactures. It has, and always will be a major thorn in the side for those upgrading from a 32bit to 64bit environment. Damn printer support is such a huge PITA.

Basically, it all comes down to T&M costs. Are the proposed solutions to the problem worth-while to your business? Only you can answer that.

Price of a video game console devkit

[tepples]

How many people in the future will want general purpose computers? I think the market will always be big enough

Other people disagree, claiming that everybody except people who develop computer software for a living can get by with an appliance. Take a moment to compare the price of a video game console to the price of a video game console devkit to see how the market might not always be big enough.

Granted, appliance type computers may still be cheaper, but I don't think they'll ever be an order of magnitude cheaper. Perhaps only around 1/2 the price.

You can't compile iPad applications on an iPad, even if it's been docked to an external keyboard and monitor. You need a Mac ($649) and an iOS developer subscription ($396 over the expected four-year service life of an iPad). The combination of an iPad, a Mac, and an iOS developer subscription isn't exactly ten times an iPad alone, but it's close to three times. It comes a bit closer to an order of magnitude for the difference between an iPod touch and what is needed to program it, and that's assuming that Apple doesn't eliminate Mac models when expanding its iOS product line.

Re:Price of a video game console devkit

[CastrTroy]

How is $649 + $396 = 3 * $499? It isn't, It's almost double. Also, there's enough devopers in the world (I've heard around 4 million, numbers vary) that I think there's enough room for general purpose computers at a reasonable price. I suppose eventually computers might be so cheap that they will be given away for free with subscription to some service, they already are if you look at cell phones. With $25 raspberry pi devices, a device to watch movies on your TV could be thrown in for free with a Netflix contract. At that point, sure, a general purpose computer will be infinitely times more expensive than an appliance computer. But that doesn't mean that general purpose computers will ever reach the point of being too expensive. Also, you're talking about the cost of appliances VS the cost developing for the appliances. Which is quite different the cost of appliances VS the cost of a general purpose computer than can run programs written on the same machine.

Re:Price of a video game console devkit

[project5117]

I think that the parent was including the price of the ipad in the "total cost." Raspberry Pi looks pretty cool though, I'm glad that launch is coming so soon.

At work? I think not.

[Kamiza Ikioi]

I've found that Microsoft Security Essentials is no better than ESET NOD32 for anti-virus protection.

Then again, against anything but zero-day exploits, a properly configured OS and good browsing practices would make a potato a good AV solution.

For home users, sure. For work, corporate, enterprise, no. I've tested many, and I've yet to find anything better than ESET NOD32 for medium to large networks. Centralized updates, controls, new client/config installation pushing (push a button, and the client is remotely installed on a machine), logs, alerts, reports, etc. etc. etc.

This is a monumental difference between stand alone "good" and network "good".

Absolutely without merit

[The Immutable]

Just ran the registry mechanic myself, it does what it says. I verified that it was detecting legitimate registry errors (really more like artifacts) from programs I'd uninstalled. It also did a fine job of erasing all of my internet history which I really would have preferred it notify me about first.

Re:Absolutely without merit

[burisch_research]

Big fucking deal. So you spent some time cleaning orphaned registry entries -- so the hell what? That's 5 minutes of your life you'll never get back. And if you'd left those entries there ... well, SO WHAT? So nothing. You would never have noticed the difference.

Re:Absolutely without merit

[The Immutable]

The so what is that the registry mechanic does exactly what it says it does. It does not do 'nothing'. It does something trivial, but if people want to pay for it, that's their business.

Vested Interest

[Akita24]

Microsoft is the only antivirus software provider for the Windows platform that: 1) Has a vested interest in keeping viruses off the O/S. 2) No vested interest in the continued existence of viruses. Everybody else is pretty much like a pharmaceutical company. There is a lot more profit to be had selling you pills and band-aids the rest of your life than actually curing the disease. Actually fixing the problem is not in their best interest. AFAICT this holds true for all of the platforms. Anybody profiting from the problem has a vested interest in the problem continuing to exist.

adblock plus FTW

[KingAlanI]

Yeah, since I started using Adblock Plus, I stopped being bombarded with infections - scans (AdAware, Spybot) turned up less and less, to the point where I ran them less and less.

Ah, Norton. What has happened to thee?

[P-niiice]

Anyone remember when Norton was Norton and it was cool?

And how would you that for sure with AV software?

[Tran]

Taking the term anti-virus to the most base view that normal users see ( covering malware, scareware, rootkits and browser hijacks - all supposedly covered by these AV products).

I have seen to many times when free or commercial anti-virus fails to detect stuff coming in. One gets complaints that machines are not working so well anymore and upon examination you discover that despite AV software the machine has been usurped in some manner by some kind of *ware, often even having ( well in older versions anyway) disabled the AV, free or commercial.

I am going to paint with a broad brush here, but in my experience traveling salespeople's laptops have been the ones that have opened my eyes the most about these kind of issues. I swear, salespeople (not all) must be in competition as to who can show off the most crap to each other, in the process exposing their machines.

Thank god for smart phones replacing some of these laptops and so far having less issues in this regard. So far anyway...

Symantec is CRAP

[SlippyToad]

Of course, this used to be Norton's, which was also CRAP.

I installed Norton Tools on my Win95 box back in the day. Went to defrag the disk and it did this really, really, dumb thing. It defragged the FAT first, and then it started to actually move the files around.

When the program shot itself in the head about halfway through, and crashed the whole system, it came back up unbootable.

I realized then that Peter Norton sucks RANCID ASS at software design. Symantec seems to be continuing that tradition of SUCKING RANCID ASS at software design.

All in all, I will never EVER buy any of that half-baked, kindergarten-grade, fuck-off lazy SHIT SYMANTEC SOFTWARE again.

And I strongly recommend anyone else stay away from it like it is the fucking Ebola virus.

Re:Symantec is CRAP

[burisch_research]

Somebody mod this guy way, way up. Symantec is far worse than Ebola.

Other companies can use this tactics

[microbee]

I can come up with a few:

Google: Join G+ now, or you will find yourself extinct on the Internet!
Facebook: Sign up now, or you will die in a friendless, dark basement.
Twitter: Follow us now, if you don't want to be followed!

Re:Other companies can use this tactics

[roc97007]

> Facebook: Sign up now, or you will die in a friendless, dark basement.

I thought it was: Sign up now, *and* eventually die in a friendless, dark basement, with 31,226 friends on your account, none of whom have ever shared a meal with you.

Re:Other companies can use this tactics

[lendog]

Facebook has a limit of 5,000 friends.

Re:Other companies can use this tactics

[roc97007]

I'm a little disturbed that you know this...

Screenshots; Forefront pricing

[tepples]

MSE doesn't waste resources trying to mask the perfectly fine Windows chrome.

Windows chrome isn't "perfectly fine" if changes to the chrome confuse noobs. I've seen people get confused by the difference in chrome between Windows XP Luna and the default theme on Xubuntu, which is roughly the same amount of change as between Windows XP Luna and Windows Vista/7 Aero. Masking the Windows chrome allows one set of screenshots in the manual to cover both Windows XP Luna and Windows Vista/7 Aero without confusing noobs.

[MSE] also will never bother you about upgrading to the paid version

That's because the paid version's pricing info is so hard to find. Once you install it on ten computers in your organization, you're supposed to buy Forefront Endpoint before installing it on an eleventh, but Google led to me to a page on Microsoft's web site to the effect "call for pricing".

Re:Have any of you actually run Norton lately?

[crutchy]

To me that's asking the fox to guard your hen house

not really, because in this case the fox is the people responsible for writing the viruses in the first place. what logical reason would microsoft have for infecting its own product with viruses?

on the other hand, what incentive is there for antivirus companies to stop the influx of new viruses? if all of a sudden there weren't any new threats, they would all gradually go out of business, so there is definitely a reason to question the motives of such companies. you have to remember that the primary reason for any capitalist enterprise doesn't have anything to do with a particular product or service, its to make money... always. symantec is in business to make money (by selling "antivirus" software), not stop viruses.

microsoft is in business to make money also, by selling operating systems (among other things), but surely viruses that infect windows would (and does) harm the image of windows, so creating new windows viruses would seem to be against the interest of selling windows, which makes their money.

i wouldn't be surprised if microsoft had a whole department dedicated to trying to come up with new viruses and malware for competing platforms like linux and mac (not that they would admit it).

using a microsoft product is really like asking the guy who built the hen house to guard it (with all his building materials and tools). he may not be an expert or be able to stop new types of attacks (nobody can) but he has the best understanding of where holes might be and he has the best opportunity to patch them up sometimes before they are even noticed by the fox.

btw before anyone berates me as a shill, i despise microsoft products and prefer debian squeeze gnu/linux over everything else. i run clamav merely to help prevent anything i download from infecting my wife's laptop with windows vista on it (though i realize nothing can really help any poor soul suffering from the "vista" virus).

Wait....

[toby]

People still use Windows????

it just makes sense...

[roc97007]

As free solutions get better and better, and the business model of pay solutions start to fail, we get to a point, I think, where the only alternative is to start writing viruses. It's definitely in their area of expertise.

Re:That business models is the logical way to go

[BitZtream]

Wow, you're logic is awesome.

Linux won't suck less just because MS or Apple sucks more.

Rather than wanting your team to be better, you're hoping the other teams will get worse. Thats not a winning situation. Why are Linux fanboys such losers? You guys try to fail, it really is amazingly impressive.

I only connect to email so I am safe right?

[lendog]

Kidding. However I could hear my in-laws saying that.

Peter Norton

[Trogre]

Peter Norton must be rolling in the grave of what used to be his company.

Not the only Symantec scareware...

[hitmark]

Lately i have found some auto-installed "online scanner" from Symantec on various computers my relatives use, and it seems to operate in the most intrusive way possible. It basically pops up ever so often, nagging the user to run a update and scan but if a issue is found one must buy a full license from Symantec to get any removal going.

Setting it to keep quiet seems to do nothing, and uninstalling it just means it will show up again in short order.

My suspicion is that it comes down via facebook somehow, but i have never hung around long enough to see it actually install.

Most "paid" solutions suck...

[idbeholda]

Got tired of paying yearly subscription fees, so I've spent over 10 years developing my own scanner (http://www.tot-ltd.org).

http://www.tot-ltd.org/blacklist/0-F - Info obtained from pretty much any site that makes honeynet/honeypot, malware md5 information available online.
http://www.tot-ltd.org/whitelist/0-F - Info obtained from National Software Resourece Library (http://www.nsrl.nist.gov/) public archive, along with archives of legit applications and os installation files.
http://www.tot-ltd.org/installation.db - Default malware install paths/file names.
http://www.tot-ltd.org/ports/ - Default trojan ports. Only returns a positive hit if file fails detection in the blacklist database.
http://www.tot-ltd.org/API/ API based heuristics.
And there's more info at http://www.tot-ltd.org/techinf.html and http://www.tot-ltd.org/techinf2.html

Strange... if I were to...

[LostMyBeaver]

If I were to write a virus or other malware these days, that would be one of the first things I would consider getting right.

Scanning network traffic is a waste of time. A proper virus these days would do things by sending and receiving in bursts.. maybe on PCs left on 24/7 in the middle of the night for example. I run a CheckPoint Firewall-1 based router in my house with live virus and malware scanning and frankly, I still run antivirus on my PC. It's free and it does actually work.

There are some great programs which don't have to be installed which simply list the executables, DLLs and etc running on your PC and checks against online databases to see if the file and/or version that is running is legit. It doesn't do anything, but in a matter of less than a minute each month, you can just check your machine for anything naughty.

I on the other hand have two kids who use all my computers, so I run anti-virus because you can't be sure when the next time they'll try the new "Pokemon Forever free game!!!!" is. Then before you know it, there will be pictures of my kids playing games on a Saturday morning in their underwear in perverts hands all over the world. For that reason I actually also put tape over the webcams on my laptops which don't have sliding shutters. I'm not paranoid, but I do know that if you were that kind of perv, you'd only need to show up on Google for a matter of an hour or two under the name Pokemon if you're into little boys or Beiber if you're into girls and you can flood a server with endless images. Anti-virus wouldn't even catch that. Now that I think of it... I think I'll write a nifty little generic webcam driver which will simulate the shutter by posting a default image there instead... something like road kill. Then when you specifically enable the web camera, it would switch back. I bet I could sell that for $1 a copy for Windows or Mac :)

When the Mac is a peripheral

[tepples]

How is $649 + $396 = 3 * $499?

iPad appliance: $499
iPad with peripherals needed to turn it into a general-purpose computer: $499 + $649 + $396

Also, you're talking about the cost of appliances VS the cost developing for the appliances. Which is quite different the cost of appliances VS the cost of a general purpose computer than can run programs written on the same machine.

Until the iPad had a serious general-purpose competitor (Honeycomb tablets), the only notable iPad-sized general-purpose computer was an iPad plus what amounted to a peripheral used to develop for it. It didn't really matter that the Mac was a general-purpose computer by itself because Apple refuses to sell a Mac in an iPad form factor. The iPod touch 2 lasted even longer (three years) before a serious general-purpose competitor (Galaxy Player) arrived.