Why Popular Anti-Virus Apps 'Don't Work'

Avantare writes "ZDNet Australia has a writeup about why AV apps don't work. The reason given is because the malware authors are writing code that will get around the signatures of the application by testing their code on the most popular anti-virus software before release." This comes as a follow up to another article detailing the sad state of anti-virus software currently on the market.

No S**t

AV software, and even most firewall software, which goes beyond port control simply prevents the user using the whole of the internet, but rarely stops the internet using them. This is just one reason why.

Still an interesting point it raises, and a good example to give to none believers if you ever have to give the "Nothing is perfectly secure" speach to a client.

Re:No S**t

Still an interesting point it raises, and a good example to give to none believers if you ever have to give the "Nothing is perfectly secure" speach to a client.

At least people are starting to realize this.

As for myself, I used to use Symantec's antivirus software both at home and at work, but a year ago decided it just wasn't worth it. The program was the most obscene resource hogs I've ever had the displeasure to use, and in the 7+ years of using the program it never once protected me from getting a virus. The same can be said for a lot of other AV offerings, and yet you still see some idiots suggesting you run 2-4 different AV applications just to "be sure you're safe".

Once people realize that the single best and most effective method of protecting themselves is common sense, they will be a lot better off. If you don't download from untrusted sources, don't click banners, don't install just any (activeX|extensions), and keep your machine patched, you'll be fine (YMMV of course).

The problem is that while people can buy Symantec's latest breakthrough in keeping your processor occupied, they cannot buy common sense.

In my experience, Symantec software is worse...

Symantec software is even worse than you said, in my experience.

You didn't mention the bugginess.

Re:No S**t

I did the same thing almost the same time ago. I had 5 computers in my home running Symantic AV. The subscriptions kept expiring on a seemingly continuous rotation. Looking at the logs, none of them had detected a single virus in over a year. I finally decided to develop a system of backing up any critical files on a regular basis and a proceedure for reloading my systems if they were affected by any malware that came along. I removed all protection from my systems and waited for the worst.

It's a year later and, other than my systems running almost twice as fast and having a lot fewer weird hangups and crashes, I have not had a single problem.

Re:No S**t

It's a year later and, other than my systems running almost twice as fast and having a lot fewer weird hangups and crashes, I have not had a single problem.

I cancelled the insurance on my home. One year later other than saving $550 I have not had a single problem. I wasn't robbed, it didn't burn down, and no hurricanes, floods, or earthquakes hit me either...

Just because the "worst" didn't happen, doesn't mean it won't.

Plus what is the "worst"? Its ill-defined. In my opinion its *not* a virus/spyware that pops up 400 popups and makes your computer an unusable steaming turd. Its the virus that installs a rootkit and remote control software, and adds your PC to a zombie spam network, and/or sets it up as "free ftp space" for child porn. All this after scanning your PC for passwords, financial records (the save files from tax software, credit card information, etc etc...), and installs a keylogger. And then it runs like this for 6 months without you knowing about it.

Then you get a low disc space warning and that's when you find the hidden folder full of child pornography you've been serving up for the last year.

I'm not saying Norton's software is better than garbage. I too think its over rated, over priced crap. But sadly, installing nothing and doing regular backups is far less protection than you might think.

I recall one virus in particular that periodically would randomly pick a file and rewrite a few dozen bytes in it in some random place. In theory it could run for months without getting detected. Gradually your doucments would become corrupt, or applications would start having issues until finally it would hit something critical and your pc would fail. Restoring from backups was worthless because this thing had been damaging files for ages, and your backups were full of damaged files.

For what its worth, I tend to agree that "real-time" protection is over-rated, 0-day exploits and so one will continue to get through, but frequent full system scans with the latest definitions are a good idea.

Re:No S**t

If your house burns down you physically have to buy / restore the current one with hard earned cash.

Are you saying you don't make regular backups of your house? Man, you are really tempting fate.

Re:No S**t

"The program was the most obscene resource hogs I've ever had the displeasure to use"

The home editions are a resource hog. The enterprise edition (at least of mcafee) has a very small footprint and is lightning fast. Mcafee should consider using the same build on their home editions.

Re:No S**t

Maybe you would have gotten more viruses if you hadn't been using it. You'll never know since you had it running the whole time.

That's the same logic that keeps me from throwing away my anti-vampire rock. Ever since I've had it I haven't seen a single vampire so that proves it must work.

The AV app would tell him

Most AV apps pop up a warning whenever they detect a virus. They like to remind you that they're doing their job.

More than once, Symantec AV has told me that it's detected and neytralized a Web page with the WMF vulnerability. I guess that's interesting to know, even though my system was fully patched so I wouldn't have been vulnerable anyway. It's also told me that my PC was being probed by hacking scripts, though (again) I was already protected through patches and not having the necessary ports open.

The real question is, how do any of us know that we're not already infected by a super-devious rootkit that no AV apps recognize?

Re:The AV app would tell him

The real question is, how do any of us know that we're not already infected by a super-devious rootkit that no AV apps recognize?

This is an excellent question. Mostly, you notice a well-hidden rootkit by using tcpdump on some other machine to sniff all of the traffic from the suspect machine [1], and then concentrate on stuff that's not local to your subnet.

If you don't have a user on the machine running a chat program, seeing traffic to or from the IRC port, 6667, tends to be a very common sign that the machine is giving or receiving orders as part of a botnet. Forcing the machine to do all web access via a proxy and then checking the proxy logs after a day or two also tends to be revealing.

[1]: This should be done where both machines are connected on the same hub, or perhaps using the "monitor" or "span" port that newer intelligent switches have for diagnostic testing.

Did I miss something?

Or are both of these articles the same thing? And not much of anything, either. Two paragraph blurbs on the sad state of AV software.

Nothing to see here, move along please.

And they are both wrong.

Think about it for a moment. What is the intent of anti-virus software ("anti" + "virus")? Isn't it to stop apps that you don't want running on your computer? Apps that were written by the "bad guys"?

So, the reason that anti-virus software sucks is because the "bad guys" are writing BETTER "viruses" that can bypass the anti-virus programmers' software.

And the reason for that is that anti-virus software is REACTIVE.

A proactive system would patch the holes that are being exploited.

A reactive system issues patches to remove all the specific threats encountered so far.

That approach will ALWAYS result in the "good guys" being behind the "bad guys". Like DUH!!!

Re:And they are both wrong.

The biggest hole existing right now is the user. Any thought otherwise is simply whistling in the wind.

Once a user runs software, if that software is malicious, that computer is compromised. Period.

Linux is not a silver bullet.

Linux isn't a silver bullet. A virus can still install itself in user space, and from there it can:

  * Delete files
  * Read confidential files from that one user (a typical computer might only have 1 or 2 users)
  * Send out spam
  * Install a keylogger
  * Read the users contact list and forward itself to all users on that list.
  * Install itself to start up with user priveleges when the computer boots (by modifying the users configuration files)
  * Pretty much anything...

However having separate users does limit the damage and it makes it a lot easier to clean up since no executable files are affected, root should be safe, and the system should still be stable and consistent once the virus is removed. (This is not true if the virus has gained root priveleges, and really you should assume that it has, if you really want to be safe).

Much of the security of Linux comes from:

  * The peer review process.
  * The speed that the most serious holes are patched and the ease of applying these patches on most distribution.
  * Vulnerable services are not usually open to attack after a default install.
  * 'Biodiversity' - an attack against a specific application will not affect all users.
  * New install media with latest bug fixes issued regularly and easy to obtain.
  * Large amounts of software is available from the distribution repository so you don't need to download and run installers from third-party web pages.
  * Smaller market share gives attackers less incentive to attack.

I'm not saying that ALL software for Linux is secure, and that ALL distributions respond promptly to security vulnerabilities, but it is possible to be reasonably secure if you choose the right vendor and don't be stupid by installing random screensavers from dodgy websites.

Re:Linux is not a silver bullet.

Most end-user linux installs have one user who admins the maching with sudo. Anyone with any skill who writes a linux virus would simply make his code wait for the user to sudo, then install the rootkit.

The one reason viruses aren't a problem in linux: fewer gullible users.
The one reason worms aren't a problem in linux: the small number of diverse builds.

User seperation has very little to do with it.

Re:And they are both wrong.

A proactive system would patch the holes that are being exploited.

The problem here is that virus don't typically exploit any hole. They are simply programs that run with the privileges of the user who executes them.

A typical (old school) virus would do three things:

• When executed find files that can be written to - pick one at random.
• Update that program to append itself to the end of it. Patch the header so that execution starts at the newly appended code.
• Work out where the currently infected program should have started execution from - jump to it.

There are only two things you can do to protect against this, in general:

• Don't run infected programs.
• Don't allow the current user to modify binary files.

In Windows it is the second issue which allows viruses to spread - typically the local user would have write access to the system binaries, so eventually Notepad.exe would get infected, etc. Under Linux/Unix root generally is the only person who can write to system binaries, so a typical user can't infect them.

However Linux viruses do exist, and are trivial to write. The reason they don't spread is partly because users are used to getting their binaries from trusted sources, partly because they download things from source, and partly because most users don't run with the ability to modify system files. (Sure you might be able to infect ~/bin - but there isn't a big gain)

Windows is getting better at allowing non-Administrators to work properly, so sooner or later the ability of joe-random-desktop user to modify system binaries will disapear and at that point viruss will stop. Still there will be worms, trojans, and all the other nasties left!

I've gone on a bit much, but I wanted to drive the point home : Viruses do not exploit security holes. (In general)

Re:Did I miss something?

They are standard Web articles: Two paragraph summaries.

At the rate things are going, article writers won't even bother with the body of the story any more, it will just be a title and ads.

Just follow a few basic steps...

1. Firefox with popup blocker

2. Firewall software

3. Sit behind router

4. Use AV software

5. Don't click on anything that pops up without read it!

http://religiousfreaks.com/ [religiousfreaks.com]

Re:Just follow a few basic steps...

You can't run Linux because you're not experienced in using it... but you were born knowing how to use Windows? Or what?

Re:Just follow a few basic steps...

1. Firefox with popup blocker

2. Firewall software

3. Sit behind router

4. Use AV software

5. Don't click on anything that pops up without read it!

You ignore the three most important:

Remove administrative priviledges from your everyday account.

Keep your software and OS updated.

Do not run software with a bad security record.

Re:Just follow a few basic steps...

Also: Don't connect your computer to the Internet.

I don't use Norton..

I don't use Norton not because I feel it's poor at catching/preventing viruses, but for the level of intrusion that comes with it. The Norton name, and especially Norton Ghost, are just a headache waiting to happen for anyone who installs it. I very happilly use FireFox 1.5 and the latest version of Nod32. Additionally, I don't open e-mails that promise a glimpse into Paris Hilton's private area. -ACA

Re:I don't use Norton..

Additionally, I don't open e-mails that promise a glimpse into Paris Hilton's private area.

Hm. You can call that area on Paris Hilton a lot of things, but "private" isn't one them.

Kaspersky?

FTFA:

One vendor Ingram did mention was Russian outfit Kaspersky, which in the same tests managed to block around 90 percent of new malware.

So what's Kaspersky doing that's making it so much better? Or was the study paid for by Kaspersky? It sounds suspiciously like FUD to me.

you are not supposed to cure the symptoms

But the disease [slashdot.org] .

Dedication to QA

testing their code on the most popular anti-virus software before release.

Now that's good quality assurance. Many programmers have much to learn in this regard, though I suppose virus writers are motivated by doing what they love and not having to put up with PHBs, which are two amenities a lot of programmers have to do without. :)

Anti-virus Programs Aren't Up to Snuff

I currently run the free edition of Avast! as my real time virus scanner, and ClamAV as a second layer of protection on Windows XP. I recently got infected with an Aol IM worm, which neither program could root out or detect...ended up having to get a free specialty program, AIMfix, to get the crap off my computer.

Windows XP, Windows Defender, Windows Firewall, or Avast! should be able to prevent the worm from installing itself...Heck, my Ubuntu installation wouldn't let me install some stupid .inf type file without the correct permissions...

Re:Anti-virus Programs Aren't Up to Snuff

XP is a huge pain to use without admin rights due to braindead apps

I'm not sure if that is all that true anymore at least. Granted I don't run a vast amount of software but in my experience it seems more recent software tends to be non brain dead at least in the gaming industry. What was once one of the worst offenders, nearly everything used to write to the program files dir but now all the ones I have had experience with write to the user space. Every other program I run allows a choice of where to save data so they work perfectly as well. However, like I said I don't have every software title at my disposal and really it could just be luck in the programs I run. Aaron Margosis does an excellent job of providing all the information needed to run as non-admin on his blog: http://blogs.msdn.com/aaron_margosis/archive/2005/ 04/18/TableOfContents.aspx [msdn.com]

Why is...

...the endless repetition of the obvious considered news?

Ummmmm...

Aw crap. Sorry, forgot which planet I was on again.

Please move along.

Mac AV Software

If anti-virus software on WIndows is bad, anti-virus software on the Mac is doubly so. And you don't even need it (on the Mac), except that some of us work in IT and the end-users refuse to believe the tech support staff and instead choose to believe the hyped-up newspaper reports about viruses being a problem on the Mac (sorry, no, they aren't). So, we have to have a "solution" present on their computers to make them feel "safe". Except the major A/V makers' products on the Mac side don't even do the job of appearing to work. A prime example is McAfee Virex and its virus definition update functionality. It gives an error message even when it works correctly (but of course an end-user is going to be put off by the error message and call tech support). Do you feel safe when your anti-virus software can't even report the status of virus definitions updates correctly?

Signature-based recognition was doomed

The whole concept of recognizing known viruses was fundamentally flawed. It had a good run, but that was because virus writers were mostly trying to get attention, not steal. Now that viruses are an ongoing criminal enterprise, the old dumb tactics won't work.

We're going to have to give up on recognition and put more effort into partitioning. We need setups where each web page renders in its own jail, and it doesn't matter if the browser is insecure - when the page closes, a program exits and any corrupted info goes away.

Of course, this will break Active-X, toolbars, downloads, etc. Then again, on business systems, you want those things broken.

Once the browser is locked down like that, you need a "guard" program. When you want to move a file out of a browser's jail, it has to go through a program that "sanitizes" it. Often, a translation to a well-documented format that doesn't contain execution capability will do the job. Converting incoming .doc files to Open Document XML format, for example.

It's quite possible to completely solve this problem.

What I do

Require all users to run as a limited user as per Principle of Least Privilege [microsoft.com]. This is the key. I once had a computer lab for inner city youth with no AV software at all, just limited user accounts and a simple router. Once we could afford Symantec AV Corporate (I work for a non profit) and ran the scans, no viruses. If anyplace was bound to get one, that would have been it.

Default Deny

Say it with me people Default Deny, Say it louder now so that Microsoft can here it. Operating systems need to by default deny the right to execute. This whole let anything run unless it looks like a virus crap is not working. Oh and Microsoft that doesn't mean make a pop up so that someone can click "Yeah run it already." Every program shipped with the OS gets to run, every program you add to the list gets to run, maybe every program on a white list maintained by a person or company you trust gets to run, and thats it. Now before you all freak out and starting talking about linux and how you can already do this let you remind you that, everyone switch to linux, is not a valid solutions because its not going to happen anytime soon. Sure it works on a case by case basis but I still need to go in to work and be able to keep 30 or 40 computers safe and clean that are going to run on windows because thats what our software will run on. So Microsoft do you let anyone into every room in every building you own unless security sees them on a list or do you determine who can go where and then keep everyone one else out? Why is it that we are forced to use security that anyone can see hasn't worked in the past and has no hope of work in the future?

AV stuff serves it purpose

I routinely get files [or browse for files] on random homebrew sites where "smart" people try and sneak a virus in there.

AV isn't supposed to make your computer stupid-proof. If you download and run every single application you can find no AV in the world will help.

If you happen to stumble on a 4 week old virus that either got bot-mailed to you or stored in a public archive they're a godsend. Specially since most AVs scan archives so before you even open it you're good.

Tom

Antiviruses are flawed by design

What does an antivirus? It scans files and memory for known patterns in order to erase some bits. If 10 different viruses exploit the same flaw in 10 different ways, an antivirus requires 10 signatures to recognize them all (heuristics *are* signatures). Why don't antivirus vendors focus on providing workarounds for the actual Windows security flaws instead?

But...

Aren't most of the viruses and worms that are out there just variants of other viruses? It seems like most of the time that I hear about a "new" terrible virus, it's really a slightly modified version of one that's been around for awhile, and usually if you're up to date on your antivirus and security patches the new virus won't do anything anyway. And let's not forget that there are still plenty of old viruses on non-secured machines that an antivirus application will protect you from.

I can see their point where people developing a new virus are concerned, but as the lifecycle of a virus is often longer than the time it takes to update the signatures, I think that they are overstating their case by saying that the AV apps "don't work."

The Black Hats are winning...

...by testing their code on the most popular anti-virus software before release.

It's a sad state of affairs that worms, trojans and viruses are probably more tested before release than the anti-virus software.

Same with spam

It's exactly the same with spam. SpamAssassin is a great tool for ensuring that your unsolicited commercial e-mail doesn't get flagged as spam.

I know this, you should know this

Once malicious code enters the "perimeter", so to speak, AV software is a rather weak stopgap measure. Software design flaws that result in holes can seldom be fixed by adding more surface area, it only becomes a matter of time before the attacker figures out the next step. The AV software companies know that most of their customers have no idea how computer security works. Antivirus provides some shallow peace of mind for Joe Average. It is not a very serious security measure and it should not be relied on as thus.

I'm sure other posters will provide the real answers to security, like limited user access, a good firewall, not running intrusted code, and using a web browser that isn't garbage.

I went for 3 years using just these precautions, but used no antivirus whatsoever. I never become infected by a single thing. I only recently grabbed ClamWin [clamwin.com], a port of ClamAV, for my Windoze box because I wanted to scan a program I got via P2P.

What do these guys think signatures are, anyway?

Both these articles read like they were written by an idiot. They do not make the distinction between the detection of known viruses, and the detection of unknown viruses via heuristics. And if you start calling heuristics a signature, you are going to confuse the heck out of everyone. Don't mix terminology.

Honestly, I do not know anyone who believes that an AV program is going to protect them from unknown viruses! The whole point of AV software is to give you protection from viruses as they are discovered. I mean everyone knows that if they do not update their virus signatures on a constant basis (several times a day on my mail servers), they may as well not be running virus protection at all. OK. Maybe some people are dunces about this, but honestly, even my 81 year old grandmother knows that she has to keep her AV current, or she's unprotected.

I mean, for crying out loud, what are these signure updates for? For catching known viruses. Mega duh!

Security thru obscurity endorsement?

Almost sounds like an endorsement for Security thru Obscurity. To some extent it works for Mac and Linux. If either of those become predominant, you can rest assured that far more virus writers would tarket them.

F-Secure

I do follow basic common-geek-sense, but so far F-Secure hasn't failed me. Completely anecdotal, mind you...

Antivirus programs fail...

...because theres hardly any virus out there. The virus days are gone. The Internet is clean of virii now.

Maybe thats why antispyware programs are so popular nowadays. Thats also why firefox is popular. And firewalls too.

Eye-Candy

That's why: there is too much eye-candy!

I gave up a long time ago on NAV because it had a heavy interface -- fancy background, fade in/out, and all the other stuff that don't really contribute to its operation, especially for an application whose GUI you don't really pop or see very often.

Simple buttons and windows are enough, coupled with a good proper operation within a restricted account -- i.e. good communication with the service that runs in the background.

That is why I like the free AVG option.

A blinding glimpse of the obvious

TFA claims that AV software doesn't work because malware writers testing their code on the most popular anti-virus software before release. All that really means is that they make sure that the AV programs can't already spot it. Once their malware's out in the wild, it will get spotted, analized, and the definitions rapidly updated to deal with it. All TFA actually says is that no AV softaere is going to spot/remove a new piece of malware on the first day. No fooling.

I Tell My Clients the Following

For home users, I tell them the following:

1) You're not a company that gets thousands of virus-laden emails a day. You don't need to pay for Norton or McAfee. A 98-99% detection rate is perfectly adequate for a home user.

2) Install AVG or Avast AV. They're free, they update automatically, they're light on resources and they work.

3) Install Spybot Search and Destroy, SpywareBlaster, Ad-Aware and Windows Defender.

4) Install a software firewall like Kerio or just use Windows XP's firewall. If you install Kerio, use V2.1.5 because it's non-intrusive. The later versions are too picky and get in your face.

5) Stop using IE and use Firefox.

6) Lately, since trojans are on the upswing, I say install A-Squared anti-trojan which is free with manual updates.

7) Don't click on popups. Don't even click on the "No" button - click the window close button.

8) Don't install anything offered you by a Web site unless the site is a general freeware or shareware site that explicitly states it checks for spyware and adware.

9) Keep up with Windows updates and updates for the malware detector software.

10) Run a scan once a week or if you see any popups at all.

I've used these rules on Windows 98, 2000 and XP for four years with virtually NO spyware getting through - and that's with porn site visits and whatever else the Web can throw at me.

The single most important rule is number 5 - use Firefox. With no ActiveX, the stuff can't get in unless you have an OS vulnerability or you deliberate install it in response to a prompt you don't understand.

Finally, if they really want to be secure, switch to Mac or Linux.

They don't work in more ways than one

I'd just be happy if they wouldn't turn up so many false [wireshark.org] positives [google.com].

It's not a sad state of the AV market

It's a sign that people need to start focusing on the real problem - releasing operating systems with security holes in the first place. All antivirus companies have ever done is cover the problem up, anyone who thinks they are a permanent fix to anything are giving them waaaaay too much credit.

It's always been sad

The best you can say about the AV industry is that we finally found out, more or less, that the AV companies themselves aren't behind the malware.

I wish I was a sleazy ruthless person. I could make millions off this idea: check your HKLM/Software/Microsoft/Windows/CurrentVersion/Run registry keys. Know what should be in there. 90% of the time you can detect when a virus or spyware is installed by looking there for things that don't belong.

The Best AV App: Google

There are two kinds of viruses, really; Good ones, and bad ones. The bad ones are easy to erases - your AV will do it for you. It's the good ones, written by experts and people who know the software industry like the back of their hands, that are troublesome. None of your lame anti virus software apps, like AVG or, if you're stupid enough to pay for it, Norton, will get rid of them. However, chances are, if it's a good enough virus, you're not the only one in the world who has it. Chances are, millions upon millions of people like you have not only gotten it, but also defeated it. And, they're helpfull folks. They've posted their sollutions on the internet, step by step. So, all in all, use Google to rid yourself of your problem. (If your belive a process like exaple.exe keeps starting your system, just type that into google, select a few keywords like "virus" or "help", and you're set.) PS. They say that if you're stupid enough to get a virus, you deserve it. I say, if you're stupid enough to PAY for AV software, you deserve the virus.

Don't Run As Admin!

One of the easiest ways to protect yourself on Windows is to not run as Admin. Only log into admin when you want to install new software, or when you want to update Windows, etc. In my opinion this is way more effective than any AV software (although I would recommend AV anyway). I would say that 50% (at least) of the nasty things that happen to Windows machines are caused by the fact that people tend to run as Admin by default.

People would never dream of running as root all the time on their Linux machine, yet those same people often run as an admin in Windows XP.

In a related story. . .

Scientists discover that polio vaccines don't work against other diseases. Details at 11.

Seriously, this isn't news. This was obvious from the time where any signature updates were ever required, or when viruses, scumware, etc. included code to disable/corrupt/uninstall/otherwise cripple antivirus and antispyware software. They're merely admitting it now.

Security through obscurity?

So; what they're really saying is that, statistically speaking, security through obscurity is more effective.

Now, that kind of irony I find downright amusing.

-=Geoskd

Munir is a mole.

He always has been and always will be. His articles are practically marketing material for Kaspersky labs. First of all, write an article stating the obvious and then back it up with some arbitrary figures without displaying any real results.

For your reference (I made sure to use the Google cache so you can see the highlighting):
Hmmmm...what sole vendor was interviewed for this article? [64.233.167.104]
I wonder who the focus of this article is... [64.233.167.104]
My goodness! Another article from Munir which focuses on Kaspersky. Who would have guessed? [64.233.167.104]
Which company did Munir get a virus analyst from to comment on this article? [64.233.167.104]

Now that is some quality, unbiased reporting for you. Don't believe Munir's BS, it's a load of crap.

No S**T

Default Permit and List Bad Only are the two dumbest ideas of 'security' ever implemented. Here's an idea: buy software that blocks apps that you do not specifically permit. Bam, instant virus/spyware protection.

Unfortunately

So far McAfee is the only product I can find certied to run on Windows Server 2003 (64 bit). I would love to use something else, so please--someone tell me if I have missed something. I have heard and read anecdotal evidence that other smaller apps do work, but to cover myself it needs to be explicitly listed as a supported OS.

If truth be told, I think its silly to have to run anti virus software on a machine that nobody ever logs into and that is 2 firewalls away from the Internet, with no Internet access in or out--but such is life when we have credit card companies telling us how to secure out servers.

Common sense isn't it?

Of course the AV tools don't block viruses with unkown signatures. To do that you need either

a)Crystal ball
or
b) An Intrusion Detection System, which is not easy on windows.

Malicious activity is not easy to spot on windows because of crappy monolithic OS design that makes distinctions unclear, and the only thing the AV people can do is be on alert for new viruses, emulate them, produce signatures and update you as necessary. They cannot protect you from a non-generic malicious piece of code if it hasn't yet been written.

So if you want to know why AV tools fail, here's a hint: they run on wind.. nah. My karma matters more than my conscience.

The real purpose of anti-virus software

Anti-virus software only exists to prevent people from having to learn about malware. It is a purchase of knowledge. If even 20% of viruses are blocked with it, that is worth the price to some people, because they don't know how to avoid it any other way. Browsing and interactive techniques need to be encouraged before anyone could attack anti-virus software...

What? Virus?

Whats that? a new implementation of daemons?

Why current anti-virus will fail

Speaking only for a Windows world....

As currently written, all anti-virus software will fail. The simple reason is that because anti-virus depends on a signature or a synthisis of actions to identify what is "bad" and what is "good". Last time I looked, using a moral imparitive in programming wasn't a system call. Like spam, viruses are not a technical problem, it is a human problem.

The chief problem is that anti-virus is a defensive posture. Sooner or later, any defense will fail, if only because it becomes outmoded and/or out flanked. Defend only the walls, you leave yourself open for an air attack. You see the quandry here: It is impossible to know all the various ways to mount an attack and defend against all of them.

You can do what many companies have started to do: Prohibt execuitbles in AD policy that are not specifically allowed. This protects (mostly, somewhat) corporate america, but doesn't protect the home user that doesn't have an active directory server, and likely wouldn't put up with that kind of restriction anyway.

virtualization + detection

every application that runs on your computer should have its own address space and it should not be allowed to cross into other applications' address spaces, however this is not the case in MS Windows OS.

I gues we may want to rethink what a computer actually is.

I guess it should be possible to write (or use existing) virtualization software and run each application in its own virtual computer, give each application its own 'harddrive' without access to the rest of the disk, and most importantly make sure that the application cannot cross its VMs boundaries. Obviously each application that is not the OS itself should have run as a user and not as an administrator, but in a VM it shouldn't even matter that much.

To share data between applications that really need sharing, it should be possible to open 'network' connections.

In case when Intel or some other chip manufacturer will come up with multi-core processors (real multi-core, something like 10-1000 cores per CPU,) each application could also run in its own real processor space. A CPU could be rated something like: 100 simultaneous processes, and actually really run 100 simultaneous processes without time-slicing. Wouldn't that be a day? To accomodate memory per process, there could also be another independent administrator process runing, that would detect real time memory requests and manage memory accordingly (it could prepare memory ahead of time to avoid bottlenecking.)

It also should be possible to run an image of the OS per process (but this should be optional, depending on the tasks at hand.) Of-course a CPU like that would also be great for parallelizing threads in processes (if there are resources.)

In a computer like that, with each program only being able to affect its own computer space (CPU, RAM, disk space, network,) it should be possible to detect unwanted behaviour that could be caused by a virus. Attempts at 'networking' to the administration process, attempts at gaining unauthorized disk space, attempts at 'networking' with any other processes in the computer can be intercepted. In case when a virus (or a poorly written piece of software) behaves suspiciously or deadlocks or crashes or whatever, the rest of the machine should be protected and unaffected. The misbehaving process can be killed by the administration process and restarted or scanned and repared etc.

I don't think the future of the home computers is in bigger gigahertz numbers, it is at parallelizing, virtualizing, making the software more stable and less dangerous for everyone.

Security through Obscurity

So does this mean that I'm better off using an AV that isn't widely used? Is this one case where security through obscurity is actually valid?

obscurity

security by obscurity is still one of the best ways to keep yourself secure. whether it be macintoshes, or just leaving your house's spare key in a really good hiding spot, obscurity is one of the oldest security features around.

obviously, what you need is an obscure anti virus app that's also really protective (as in put your spare key in a safe and hide it).

of course problem with that is that if an antivirus product works well, it doesn't stay obscure for long.

man i'm really stating the obvious here. i'm done now.

How AV *can* work

..or how Microsoft can beat them to it.

Can someone explain to me (I am not a programmer) if Microsoft has it in their easy to reach power to allow users to do the following, if they choose:

1a. Blacklist any executable the user desires from running, no exceptions.

1b. And make this very easy by simply right-clicking on a process and selecting "Don't allow to relaunch".

2. And break down all the SVHOST.EXE programs into their individual component processes so when a virus adds itself under the svhost.exe, that virus is seen as a seperate process.

2a. Stop writing the Windows program to name several processes the same damned name (i.e. SVHOSTS.EXE)

Joe

Pivx Preempt

It's surprizing that no one wrote about PixV Preempt [pivx.com] as an alternative to antivirus software. It tries to fix the causes instead of the symptoms.

AV letdown

The biggest problem I have found with my friends and family is simply letting the software work. They shut down the scanner because 9 out of 10 use Norton and it always starts scanning in the middle of something and it hogs so much resources that you can't ignore it. I have convinced a few to switch to AVG which can run on a modern system(and some vintage too) without robbing them of the power they need to run IE but most just want me to shut off Norton and leave them be. I never answer the phone when those people call(no prizes guessing why)

I have never have run AV

I have never run AV in the 12 years I've had computers at home - it just seems like too much hassle. And because there's obviously money to be made in conning people into thinking that it'll solve all their problems, I mistrust AV companies immensely.

I'm probably an idiot, but AFAIK I've only been infected twice in 12 years. Each time I simply re-installed.

 

ran into this one myself

I was a strong supporter of the Symantec stuff. IT admin and programmer, paranoid about adware and spyware and spam crap. Kept up to date, subscriptions current, the works. The POP3 email scanner used to nail all kinds of nasties. Several per day.
Then, all of a sudden, the nasties stopped. They stopped for a long time. But I was complacent, never bothered to run any other checks. I was a PC God, I knew it all. Had never been hit. Until I moved house, to an area where high speed internet access wasn't available, and I had to switch back to dialup. Everything was grindingly slow, I blamed the dialup, until I noticed after a couple of days that the 'send data' light on my modem was permanently on, regardless of what I was doing. Suspicious, I did a full system scan (with Norton Antivirus), it came up empty. On a whim, I loaded up ad-aware (which I hadn't touched in several months) and did a full scan. It went bananas! Turned out I'd managed to pick up a keyboard logger and some sort of other spyware goodness (fsck knows how, I browse with firefox, maybe my gf did it without realising). Couldn't get rid of it all though. So I promptly tossed out the symantec stuff, installed AVG free, and I've been clean ever since.
Lesson learned. Complacency is as bad as having no protection.
Oh, and my gf has her own VM now, if she needs to use the net :)

Foolproof AV

Well not quite foolproof but I remember reading an article that claimed to be an interview with one of the original AV software creators. I apologise in advance for getting the specifics messed up.

Basically he said the first incarnation was like a whitelist of processes that were allowed to run. I guess that when you installed myFavProg.exe you had to add it to the list somehow. He claimed that this made the computer nigh impossible to pwn. The problem was they couldn't find a business model that would allow them to make enough money off of it so they created what became one of the big AV apps and adopted the subscription model for virus signature updates; Evil bastards. I wonder if their original concept is still workable?

MOD PARENT DOWN. Bad Link.

MOD PARENT DOWN. Bad Link.

Official Clam Anti-Virus for Windows link: ClamWin [clamwin.com]. ClamWin is free and excellent, but slower at scanning than commercial products, in my experience.

Re:What is Anti Virus?

Having a firewall probably helps. Being very lucky also.