Pet hate -- Anti-Virus Software

jimbo45 said:

Hi there
If you read the initial post and apply those guide lines -- then you DON'T need it. Events like 9 year old granddaughters downloading stuff from the Internet are a totally different ballgame -- as well as those people who DON'T have a router.

I'm only saying this that IF you follow certain reasonable rules and DO have the router hardware then you actually don't need AV software.

If you DON'T fall into these cataegories then other rules may apply. --If I need a computer for work I'm not sure I would let a young child any where near it -- I'd have a separate machine on a different protected network for that purpose -- an Internet capable machine doesn't cost much even in thee credit crunch days.

Again, you fail to address drive by installations that a router ***will not catch*** of sites that have been caught in the SQL poisoning scheme - because the initiating request to view the web page comes from your machine, a trusted link on the network. Furthermore, this also applies to Banner Advertisement hijacking, and even the email schemes you speak of below.

jimbo45 said:

As for viruses being spread by corporations --just take a large corporation like SHELL OIL, IBM or whatever.

The sheer volume of "Fun". "Joke or "Non Work related" Emails sent from these organisations adds up to THOUSANDS if not 100,000's per hour. Any malicious attachment can be propagated around the planet in seconds.

Individual propagations of Viruses pale into insignificance compared with this volume --even torrent downloaders.

Yah, those are being sent directly by those companies. Again, I'd like to see stats of those messages - as opposed to those being sent through Yahoo Mail, Rediff Mail, etc. And, furthermore, additional stats showing how many of those from corporate sites are *spoofed* and cannot actually be traced back to corporate servers.

jimbo45 said:

And torrents aren't always "Illegal or Pirate" - Loads of LEGAL LINUX distros such as Novel for SUSE use a Torrent mechanism for distribution in addition to "conventional" downloads".

Also note that even if corporations block .'EXE' attachments it's easy to change them into XML so it looks like an Office 2007 format or other non-detectable formats -- and you can even use the old "Usenet" method of attaching Binary files by using embedded source that the Virus scanner won't detect anyway.

Some of the Old Dinosaur Technology actually defeats the Virus scanning mechanisms better than the new stuff BTW but you have to be old or crazy enough to remember it.

Cheers
jimbo

Right- so if it is in .XML format, how is it executed? Oh, wait, you need something to rename it back on your machine when it is there and stable - so that means, what, another executable? Manual instructions to the person to change the name of the file?

Guess what? My system scans all files upon creation, modification, or access. Therefore, as soon as the file is written, even if .XML may not get scanned, as soon as it gets changed to .exe, it gets scanned (and on my machines, *every* file gets scanned - regardless of location or of file type).

Without said AV program, I would truly be lost - but perhaps you don't realize just how far they have come - they make redundant backups of their definitions, and with Vista and now Windows 7, you have additional things like permissions playing into the factor.

I'm sorry, but I still disagree with you - in 14+ years of using an AV software, I have had a grand total of 7 FPs. that's 1 for every 2 years of operation.

And, for the average user, with little to no expertise in security, an AV is a *must* have.

Your points about separating machines for purposes is a good one - I use a machine at home for multiple purposes because I know how to keep my priorities and work flows separated, but not everyone does - hence you'll see some folks coming in to work with laptops that a child has obviously been playing on - but if you think it is easy as cake to hack modern AV programs and suites, I suggest you do a POC writeup and show us - and the world - how easy it is.