What's the Best Anti-virus?

remm said:

There is nothing stopping hackers from writing viruses for Mac or Linux...

Click to expand...

I don't know much about classic Mac OS, but you're definitely wrong about Linux, and probably MacOS X too. There ARE already viruses on Linux, about a known dozen from what I remember.

A virus is a program that when executed, spreads itself to other programs by embedding part of its code in other executables, which in turn will do the same. Hence the association with the biological viruses which act similarly.

Under linux, by default an executable won't have enough privileges to do that, this is what lehnerus2000 was talking about. So, to be able to spread, a virus would have to be able to break this wall, which is called privilege escalation, and is a much, much harder task than simply writing a traditional virus.

So all the viruses that already exist on Linux don't do much, they just execute and at worst copy themselves to user directories, but never beyond. If you have a Linux OS, you can even for fun download some of them and see for yourself.

So yeah, there is something preventing hackers from writing viruses for Linux : they just don't work on it.

remm said:

..it's only that the machines most used by businesses/gvmnt/people have traditionally been PCs running Windows.

Click to expand...

Again wrong. While it's true that Windows is the main OS for home users, and generally desktop computers, Unix-based and then Linux OS has been for a long time the main OS for servers/mainframes/super computers. So the business and especially government using mostly Windows is definitely wrong.
And of course, today Linux and OSes based on the Linux Kernel are becoming dominant on embedded and mobile systems.

oneeyed said:

remm said:

There is nothing stopping hackers from writing viruses for Mac or Linux...

Click to expand...

I don't know much about classic Mac OS, but you're definitely wrong about Linux, and probably MacOS X too. There ARE already viruses on Linux, about a known dozen from what I remember.

Click to expand...

Yes and there are rootkits as well. I don't think I said there were no viruses... I said they weren't overrun, as they would be (imo) if they had been the mainstays.

A virus is a program that when executed, spreads itself to other programs by embedding part of its code in other executables, which in turn will do the same. Hence the association with the biological viruses which act similarly.

Under linux, by default an executable won't have enough privileges to do that, this is what lehnerus2000 was talking about.

Click to expand...

I see. And that makes sense. However, where there is a will, there's a way, and since privileges can be granted in Linux with the proper commands (AFAIK), eventually when the motivation is high enough, virus-writers will break down Linux walls. The fact that Linux is open-source will also help that cause, I'd imagine.

So, to be able to spread, a virus would have to be able to break this wall, which is called privilege escalation, and is a much, much harder task than simply writing a traditional virus.

Click to expand...

That I don't doubt. But again... when the motivation is high enough... instead there has been a much easier OS to circumvent that has played center stage. In fact today, sadly, you don't need to have any knowledge of viruses to run botnets and perform other malicious acts on remote computers, as the tools are all free online, readily available. So while hackers with actual knowledge (the malicious minority) might be working on stealing or hacking into corps and gvmnt, entire generations of KIDS sitting at home who want to see "if they can" are playing with these tools causing at least a large portion of the 'common infections' seen running about on Windows machines. Again JMO.

So all the viruses that already exist on Linux don't do much,

Click to expand...

Yet.

they just execute and at worst copy themselves to user directories, but never beyond. If you have a Linux OS, you can even for fun download some of them and see for yourself.

Click to expand...

As previously stated I have several distros on sticks and setup Ubuntu on a laptop for mom to pay bills.

So yeah, there is something preventing hackers from writing viruses for Linux : they just don't work on it.

Click to expand...

Again, yet. We will have to agree to disagree on this.

remm said:

..it's only that the machines most used by businesses/gvmnt/people have traditionally been PCs running Windows.

Click to expand...

Again wrong. While it's true that Windows is the main OS for home users, and generally desktop computers, Unix-based and then Linux OS has been for a long time the main OS for servers/mainframes/super computers. So the business and especially government using mostly Windows is definitely wrong.

Click to expand...

Linux may run mainframes but if you walk into any corp you will see PCs running XP for the most part. In most cases companies have not wanted to invest the money to upgrade OSs.

And of course, today Linux and OSes based on the Linux Kernel are becoming dominant on embedded and mobile systems.

Click to expand...

Absolutely, which is exactly why the motivation to write viruses for Linux is increasing exponentially.

Time will tell which of us is right.

Don't think I totally disagree with you. Of course windows being so dominant on PCs is a big contribution, it's mainly the largest target there. I'm kinda playing devil's advocate here.

But still, when you talk about virus hackers' motivations I think you are off the mark. Most rich targets don't run on Windows, as a matter of course. Military mainframes, banks' servers holding your accounts, a lot of web servers, hell most REALLY important computers ARE under unix-based OSes. So the motivation is right there... The big money is there.

About hackers "breaking Linux walls". It's already possible, there are various exploits that are discovered all the time, Linux is in the same train as Windows on this. But only a few of these allow privilege escalation, and it's one of the most critical security problems. Linux being open-source, they get full disclosure (unlike Microsoft which until recently hid everything) and get patched very fast. A virus can't just get root access with a few commands, that's just not how it works; apart from exploits the only other way is to crack the root password and that's no simple affair. But exploits do exist, just like in Windows, and once they are patched... any virus relying on them don't work anymore, unlike Windows with administrator privileges as default (which was the norm till Vista) where viruses work no matter what.

Again, technology evolves and so do exploits and viruses... what is deemed impossible today becomes passe tomorrow. At one time 64-bit encryption was considered unbreakable. One day 256 encryption will not be safe and maybe soon, with quantum computing on the horizon. Linux will not be any 'safer' than Windows once it becomes a real focus, and phones and tablets are helping to steer things that way. History will bear me out, I believe. But again, this is JMO.

I think the major difference is most, if not all, exploits for Mac and Linux require user interaction. Clicking on a link, or a download. Windows can be infected just by visiting a page. And that could be a legit page. A Guy

A Guy said:

I think the major difference is most, if not all, exploits for Mac and Linux require user interaction. Clicking on a link, or a download. Windows can be infected just by visiting a page. And that could be a legit page. A Guy

Click to expand...

Bingo.

Owners & Permissions

I thought the "big reason" was that processes only run at the permission level of the user who started them, which is why you aren't supposed to run as "root" (Linux) or "Administrator" (Windows).

This is seemingly confirmed by observation of file copy results in Linux Mint (on my PC).

If I copy a file as the standard user, it keep the Owner & Group of that user.
When I have copied a file using "sudo" the Owner & Group change to "root".Note:
The actual permission values didn't change.

If that file had been executable, it would have kept that permission.

I have always used AVG and Microsoft Security Essentials. Never had a problem out of either one. I do a full computer scan every other week of the month. I do not like Norton. Every time I used Norton, it kept putting threats on my computer. Some say it's not best to run 2 antivirus programs at the same time, but I have never ran into a problem with running 2. A friend of mine who knew a lot about computers said that running to antivirus programs should not hurt anything.

jessejamestw23 said:

I have always used AVG and Microsoft Security Essentials. Never had a problem out of either one. I do a full computer scan every other week of the month. I do not like Norton. Every time I used Norton, it kept putting threats on my computer. Some say it's not best to run 2 antivirus programs at the same time, but I have never ran into a problem with running 2. A friend of mine who knew a lot about computers said that running to antivirus programs should not hurt anything.

Click to expand...

They may detect each other's malware signature database.
This could result in them deleting each other's malware data.

I have seen people claim that the 2 AV programs may fight with each other, using up resources like RAM and CPU.

AVG may disable MSE.
It disables Windows Defender in my W7 VMs.

lehnerus2000 said:

jessejamestw23 said:

I have always used AVG and Microsoft Security Essentials. Never had a problem out of either one. I do a full computer scan every other week of the month. I do not like Norton. Every time I used Norton, it kept putting threats on my computer. Some say it's not best to run 2 antivirus programs at the same time, but I have never ran into a problem with running 2. A friend of mine who knew a lot about computers said that running to antivirus programs should not hurt anything.

Click to expand...

They may detect each other's malware signature database.
This could result in them deleting each other's malware data.

I have seen people claim that the 2 AV programs may fight with each other, using up resources like RAM and CPU.

AVG may disable MSE.
It disables Windows Defender in my W7 VMs.

Click to expand...

Well, mine are not set to do things on their own without my attention. MSE is updated manually, and AVG updates automatically. But, it sometimes requires me to update it if it has a big update.

do you guys SERIOUSLY think any "AV" outfit, writing for Windows, is putting their best/brightest minds on a dying market segment?
nonsense.

as I pointed out weeks ago, even the officers of some of the big outfits that make money on large accounts and spin out crippled packages for consumers say that the packages are ineffective against modern malicious wares.

its important for the browser guys to do a great job of hopeful prevention at the browser level. Again, the best/bright minds will be on the handset versions of browsers. if the code is fairly easily ported to Windows xx, that will be good for the shrinking base of PC stalwarts.

zapp22 said:

do you guys SERIOUSLY think any "AV" outfit, writing for Windows, is putting their best/brightest minds on a dying market segment?
nonsense.

as I pointed out weeks ago, even the officers of some of the big outfits that make money on large accounts and spin out crippled packages for consumers say that the packages are ineffective against modern malicious wares.

its important for the browser guys to do a great job of hopeful prevention at the browser level. Again, the best/bright minds will be on the handset versions of browsers. if the code is fairly easily ported to Windows xx, that will be good for the shrinking base of PC stalwarts.

Click to expand...

Well Zapp mate I have said time and time again on this VERY tired thread there is no way known to man or science that can possibly give anyone an infallible AV. Because going on even on old figures 50,000 new malwares per day how could any company possibly fix it before it has had chance to make an impact.
In fact to me it would take at least an hour and I reckon I am being very conservative at that to pick up anything malicious and put out a fix for it. By the time that has happened something else will have taken it's place and on it goes.
To say that it depends in the main on how careful one is when using the net or emails - whatever goes before saying. Besides even being careful does not stop the hackers and it is my belief if it is there to be broken then they will.
I think the thread would be better titled "The current most effective AV" because it has like I said been going on since Adam was a boy.

The thing is, the "old recognized" threats are still being used. So you are better off to have an AV that knows about those. If you have layered security, then likely you will find at least some behavior analysis as well. Something in that layer will alert to suspicious activity. Even if it's Scotty barking about a new startup. As mentioned, no AV can catch every new exploit, but if they update soon after it's discovered, then you are at least protected going forward. The likelihood of you being exposed to some zero day, hot off the presses exploit of course would depend on how you surf. The major worry would be something new no one discovers for a long time. Not an unreasonable fear as many exploits have been discovered after being present for years sometimes. A Guy

Yes I know mate but this thread does drag on a bit and I think that there are a lot of folks who think that because they have some sort of security onboard they are safe.
I think like I said last post perhaps the thread title is a bit subjective - again made up in all sincerity I have to add but does attract everyone's own preferences - some of which I would not use in a pink fit and does not really address the problem of being careless when on the net.

I have said more often than I care to think about it and that is the best security is sitting in front of the keyboard and it is a pity that folks go out and buy computers and are blinded by sales pitches that are simply money grabbing exercises, and consider themselves safe and just go about their business oblivious to what is actually happening.
How you educate people and overcome that is nothing that you or I could ever hope to address and I suppose in a way it keeps the forum afloat to some extent

It was more of a general reply. I see people basically saying AV is useless because of new zero days always appearing. While that may be true, they aren't all prevalent in the wild, and an individual may not actually ever encounter one before they are added to an AVs definitions. And the majority of exploits encountered may indeed be older, more common ones that most AV will detect.

Any AV is better then no AV. A better performing AV increases the odds in the users favor. An AV is just one piece of the security puzzle. Even if you have all the best pieces though, you can never be 100% protected. So...do the best you can. System images are also great insurance should something sneak by.

Yes this subject has been discussed ad nauseam, but people continue to post here, so on it goes. And sometimes something posted needs to be countered

A Guy

Bill I wasn't criticising you personally as you say it has been done to death and absolutely an AV is better than nothing or otherwise I wouldn't be using one.

The posts that get me ticked off are the ones that either try to shove a certain one down ones throat, reckon none are needed and those who run multiples and wonder why things are in such a mess.

Really it is an unsolvable problem and like music there always seems to be a new tune or music theme around and like them not all are to everyone's liking. But at least there is music eh?

I think you have made a very valid point in imaging as you know how many posts do you or I for that matter have to ask for system specs and have they backed up data - it is something that makes my participation and I am sure yours too rather tedious at times and I really it in itself a real problem and why I write up my little ditties because one gets so tired of typing the same stuff over and over again.

Anyway better get back OT :huh:

Lol, the majority of what we help with here is the same thing over and over. Or some variation thereof. After years, do we yearn for some arcane, never before seen problem? I belong to a group, it's old WebTV members mostly. The PC issues they have I almost never reply to, as they are so basic, and others help them. I think those questions over and over must be an IT persons version of Hell. We are on the same page my friend

A Guy

Well Bill I wasn't trying to be a smart ass and I certainly would not want to offend you in any case. I agree re the threads tat are different - mind you sometimes the outcomes for virtually the same problems can be very very different which I find sometimes quite strange

Me personally I head for the threads that are really quite old, have had a heap of views sometimes in excess of 250 and no replies, and yep you probably have guessed it as soon as I do put something (usually very simple) in there is a torrent of others who are on the whole far better qualified to answer than me jump in with tons of fixes.

However it strikes me as odd that some threads are left for so long. But again doing it this way I do get some that are really appreciative of me answering them and for me that is the bottom line here in SF and a real buzz for me - so much better to give than to receive eh?

I take no offense. You know me, what you see is what you get I rarely get worked up over things (But if I do, watch out, lol). A Guy

Avast is good