So, you think you are secure and don't need precautions

[ultraplanet]

I read about a report in Maximum PC that out of 10 viruses 8 ran WITH UAC enabled so you do need antivirus.

Can you provide a link to the report?

 

[alwinwinjoe]

If you use Facebook, do you know Koobface?

 

[Tews]

When it comes to your systems/file integrity, you cant be too careful.. I use a multi-layered defense policy and adhere to it. While I have been involved with the IT industry since 1978, I never try to tell myself that I am immune to the nasties that abound on the interwebz... It takes not one whit of extra energy to run a good A/V program, and to totally ignore the possibility of infection is IMHO asking for disaster to strike.

Thanks for the heads up pparks!!

 

[alwinwinjoe]

When it comes to your systems/file integrity, you cant be too careful.. I use a multi-layered defense policy and adhere to it. While I have been involved with the IT industry since 1978, I never try to tell myself that I am immune to the nasties that abound on the interwebz... It takes not one whit of extra energy to run a good A/V program, and to totally ignore the possibility of infection is IMHO asking for disaster to strike.

Thanks for the heads up pparks!!

True. There's no harm in being to careful.

 

[Carbonyl]

I use the Windows firewall, with Windows updating daily. Either way, you can keep explaining how severe some viruses can be, and it won't change my opinion in that 99% of viruses can be blocked by common sense.

The idea that this whole thread is about is that common sense isn't good enough anymore. The guys writing the malware know how you're thinking. They're chaning their attitudes to attack people like you.

I use Firefox, 'cause IE is a death trap.

IE8 is arguably more secure than FireFox. FireFox has a large market share and security holes continue to emerge. IE8 defaults to lowest-privileges, and can browse in a sandbox. IE7 and IE6 remain deathtraps. IE8 is not either IE7 or IE6.

I don't click on a questionable link, such as the example you've given regarding PDF files that can execute code. Why would I open anything from a questionable link? Once again, common sense.

Reading comprehension, man! You don't need to click a link. You don't need to open a file! Here's an example:

1.) You visit these forums, via bookmark. You visit a topic that you started. There's been a new reply, and you want to check it out.

2.) Unbeknownst to you, the reply has a hidden iFrame in it, which launches an XSS attack on you. You don't see it, but a small 1x1 pixel window opens up without your intervention or input, and starts downloading malware to your computer.

3.) Depending on the nature of the attack, a variety of things could happen here. But let's go extreme and say that the latest PDF exploit is delivered. There's currently no patch available for Adobe, so immediately after auto-opening of the file (Remember, you did nothing but navigate to the forums and check your thread! Just like you had to do to read this message), the malware infects you. Bam. You're done.

In another situation, the iFrame might open a Javascript bug. Now you're looking down a window that says 'You are Infected! Buy our software to clean your computer!'. This is fake anti-virus software. You click 'No' 'Cancel' or the red 'X'. It downloads and infects you anyway.

4.) If the payload carried a rootkit, you have no idea you've been infected until sometime later when someone steals your email account. This is particularly worse if you bank on your computer.

You didn't do anything but view your thread!

Will Antivirus stop all of these attacks? Not 100%, but likely 90-95%. It's not about fixing the infection. It's about stopping it.

 

[UrbanBounca]

I use the Windows firewall, with Windows updating daily. Either way, you can keep explaining how severe some viruses can be, and it won't change my opinion in that 99% of viruses can be blocked by common sense.

The idea that this whole thread is about is that common sense isn't good enough anymore. The guys writing the malware know how you're thinking. They're chaning their attitudes to attack people like you.

I use Firefox, 'cause IE is a death trap.

IE8 is arguably more secure than FireFox. FireFox has a large market share and security holes continue to emerge. IE8 defaults to lowest-privileges, and can browse in a sandbox. IE7 and IE6 remain deathtraps. IE8 is not either IE7 or IE6.

I don't click on a questionable link, such as the example you've given regarding PDF files that can execute code. Why would I open anything from a questionable link? Once again, common sense.

Reading comprehension, man! You don't need to click a link. You don't need to open a file! Here's an example:

1.) You visit these forums, via bookmark. You visit a topic that you started. There's been a new reply, and you want to check it out.

2.) Unbeknownst to you, the reply has a hidden iFrame in it, which launches an XSS attack on you. You don't see it, but a small 1x1 pixel window opens up without your intervention or input, and starts downloading malware to your computer.

3.) Depending on the nature of the attack, a variety of things could happen here. But let's go extreme and say that the latest PDF exploit is delivered. There's currently no patch available for Adobe, so immediately after auto-opening of the file (Remember, you did nothing but navigate to the forums and check your thread! Just like you had to do to read this message), the malware infects you. Bam. You're done.

In another situation, the iFrame might open a Javascript bug. Now you're looking down a window that says 'You are Infected! Buy our software to clean your computer!'. This is fake anti-virus software. You click 'No' 'Cancel' or the red 'X'. It downloads and infects you anyway.

4.) If the payload carried a rootkit, you have no idea you've been infected until sometime later when someone steals your email account. This is particularly worse if you bank on your computer.

You didn't do anything but view your thread!

Will Antivirus stop all of these attacks? Not 100%, but likely 90-95%. It's not about fixing the infection. It's about stopping it.

Firefox has always been, and will always be, more secure than IE, especially with access to their addon database.

Secondly, with the Adblock Plus and NoScript addons for Firefox, I don't have to worry about iFrame's and their potentionally harmful injections.

 

[pacinitaly]

When it comes to your systems/file integrity, you cant be too careful.. I use a multi-layered defense policy and adhere to it. While I have been involved with the IT industry since 1978, I never try to tell myself that I am immune to the nasties that abound on the interwebz... It takes not one whit of extra energy to run a good A/V program, and to totally ignore the possibility of infection is IMHO asking for disaster to strike.

Thanks for the heads up pparks!!

can you please post your lines of defense

 

[Carbonyl]

Firefox has always been, and will always be, more secure than IE, especially with access to their addon database.

Secondly, with the Adblock Plus and NoScript addons for Firefox, I don't have to worry about iFrame's and their potentionally harmful injections.

While I agree about Noscript and Adblock, I'm going to ask you to back up your statement about Firefox being more secure than IE8. Unless you're running Sandboxie with FF, I don't think you can get much safer than an isolated environment in your browser. Mitigating factors to ActiveX and dropped rights in IE8 have cleaned up much of the problems with previous iterations.

If you're running your system as an Admin (i.e. the way windows installs, default), IE8 is safer out of the box.

Review: IE8 is no speed demon, but is most secure browser available

Microsoft becomes high priest of secure software development

OPINION: Pigs Fly! Microsoft Leads in Security

 

[Tews]

can you please post your lines of defense

I use a Dlink router with WPA2 encryption..Malwarebytes Anti-Malware, NIS2010, UAC on default settings, Sandboxie, Standard User Account... All are updated daily/weekly and run on a daily schedule... I also use Acronis True Image Home 2010 to make incremental backups to an off site drive.... I know that some may think this is overkill, but forewarned is forearmed...

 

[UrbanBounca]

Firefox has always been, and will always be, more secure than IE, especially with access to their addon database.

Secondly, with the Adblock Plus and NoScript addons for Firefox, I don't have to worry about iFrame's and their potentionally harmful injections.

While I agree about Noscript and Adblock, I'm going to ask you to back up your statement about Firefox being more secure than IE8. Unless you're running Sandboxie with FF, I don't think you can get much safer than an isolated environment in your browser. Mitigating factors to ActiveX and dropped rights in IE8 have cleaned up much of the problems with previous iterations.

If you're running your system as an Admin (i.e. the way windows installs, default), IE8 is safer out of the box.

Review: IE8 is no speed demon, but is most secure browser available

Microsoft becomes high priest of secure software development

OPINION: Pigs Fly! Microsoft Leads in Security

I stand corrected, however, I still don't trust IE. Out of the box, IE may be more secure, but is IE still more secure than a Firefox browser with access to the addon database?

 

[Carbonyl]

]I stand corrected, however, I still don't trust IE. Out of the box, IE may be more secure, but is IE still more secure than a Firefox browser with access to the addon database?

That I can't comment on, due to lack of experience. I certainly respect the hesitation to trust IE, given their track record, but it's important to realize IE8 is a completely different product than IE6 or IE7.

 

[pacinitaly]

can you please post your lines of defense

I use a Dlink router with WPA2 encryption..Malwarebytes Anti-Malware, NIS2010, UAC on default settings, Sandboxie, Standard User Account... All are updated daily/weekly and run on a daily schedule... I also use Acronis True Image Home 2010 to make incremental backups to an off site drive.... I know that some may think this is overkill, but forewarned is forearmed...

awesome.
what are the programs I highlighted in red?

 

[jav]

I stand corrected, however, I still don't trust IE. Out of the box, IE may be more secure, but is IE still more secure than a Firefox browser with access to the addon database?

It's hard subject,
As Both of them can be hardened and secured with additional things.

As you said firefox with addons.

But Internet Exlorer 8 can be hardened aswell by GPO (Group Policy)

And Internet explorer's advantage out of box are:
cross site scripting protection
good phising philter
Smart filter which checks website or downloads.


But browser comparison difficult topic.
I personally use Google Chrome. Advantages:
Speed
Simplicity
Internal sandbox

And just because I like it

 

[Tews]

can you please post your lines of defense

I use a Dlink router with WPA2 encryption..Malwarebytes Anti-Malware, NIS2010, UAC on default settings, Sandboxie, Standard User Account... All are updated daily/weekly and run on a daily schedule... I also use Acronis True Image Home 2010 to make incremental backups to an off site drive.... I know that some may think this is overkill, but forewarned is forearmed...

awesome...what are the programs highlighted in red?

Norton Internet Security 2010 ( just testing this one at the present time...it may or may not stay ) Sandboxie runs your browser in an isolated environment separate from your OS/System....

 

[Carbonyl]

Norton Internet Security 2010 ( just testing this one at the present time...it may or may not stay ) Sandboxie runs your browser in an isolated environment separate from your OS/System....

If you're going to browse the web without A/V, Sandboxie is a fantastic line of defense, provided you set it up to empty the sandbox each time you close the browser. Heck, I recommend it even if you do have A/V!

 

[Tews]

This is true, if its not set up correctly you may as well not have it at all...

 

[pacinitaly]

awesome...what are the programs highlighted in red?

Norton Internet Security 2010 ( just testing this one at the present time...it may or may not stay ) Sandboxie runs your browser in an isolated environment separate from your OS/System....[/QUOTE]


thanks so much, I'm reviewing sandboxie!!!!

Sandboxie - Video Reviews

 

[dmex]

I read about a report in Maximum PC that out of 10 viruses 8 ran WITH UAC enabled so you do need antivirus.

Can you provide a link to the report?

He was talking about this article: SophosLabs Sets Out to Prove Windows 7 Has Some Vulnerabilities | Maximum PC

I haven't used an AV in three years and still have not been infected, Vista's and 7's additions to the group and local security policy's made it possible for you to null the attack surface of Windows down to your preferences.

Firefox will be my primary browser while they keep nightly-builds as it helps stop drive-by-download exploits, nightly builds help make it near impossible for anyone to find/exploit a flaw and figure out a way to infect your machine before a new build is released all while without you knowing about it.

If UAC had a configuration wizard (like everything else ) that allowed us to specify our own execution level for an application and instead hash checked the program and the dll's it loaded against the preferences we set if indeed we set one for that program, it would then have some real teeth against a huge range of infections or attacks. Vista and Windows 7 include CardSpace in Control Panel and its a secure digitial 'wallet' thats more than capable of acting like a while-list for UAC but has yet been utilized

The current implementation of only checking the executable for a requestedExecutionLevel flag set by the developer and willy-nilly allowing dlls to load into an elevated application and execute code is unacceptable, this is a known limitation since Vista RC1 and I have yet to hear a reason why it hasn't been fixed in two OS releases.

 

[Zidane24]

I have read the entire thread and I agree with posts from both sides...

Urbanbounca I agree with you on the need for common sense on the internet. It does wonders for protection against viruses and other malicious software.

...BUT pparks and our resident MVPs on Consumer Security (Jacee and Corrine) are also correct. I was sitting here trying to remember this good quote I found but I couldn't so I will blankly put it out there: No one is perfect...if we were, tech sites like SF, tech support in general, hell nothing in the world would go wrong or need to be fixed. I understand that your common sense has fared you well...mine has just the same BUT I also realize that my abilities are not perfect and at any time something might "sneak in"

With this in mind I always run a low resource, very low maintenance anti-virus such as avast or MSE. They are non obtrusive, extremely low resources (especially Avast), and I always forget about them in the end. With that in mind...I have no reason NOT to run them as they are my fall back guys...

Anti-virus doesn't have to be your shields: for me Common Sense 99%...anti-virus 1%

 

[jav]

I haven't used an AV in three years and still have not been infected, Vista's and 7's additions to the group and local security policy's made it possible for you to null the attack surface of Windows down to your preferences.

Firefox will be my primary browser while they keep nightly-builds as it helps stop drive-by-download exploits, nightly builds help make it near impossible for anyone to find/exploit a flaw and figure out a way to infect your machine before a new build is released all while without you knowing about it.

If UAC had a configuration wizard (like everything else ) that allowed us to specify our own execution level for an application and instead hash checked the program and the dll's it loaded against the preferences we set if indeed we set one for that program, it would then have some real teeth against a huge range of infections or attacks. Vista and Windows 7 include CardSpace in Control Panel and its a secure digitial 'wallet' thats more than capable of acting like a while-list for UAC but has yet been utilized

The current implementation of only checking the executable for a requestedExecutionLevel flag set by the developer and willy-nilly allowing dlls to load into an elevated application and execute code is unacceptable, this is a known limitation since Vista RC1 and I have yet to hear a reason why it hasn't been fixed in two OS releases.

Why you are worried about Drive-by-download exploits if you use group and local security policies.
They can be configured to deal with Drive-by-downloads. And with the help of SRP it can be denied to execute even if downloaded somehow.

About your next statement.

Maybe AppLocker?
Enforcing rules too all files including DLLs.

I do agree with you that with AppLocker or SRP added with group and local security policies, there is not much need for resident real-time AV.
Just on demand scanner to scan downloads.