4 ms·

I don't understand why people install antivirus software on their machines. I read once that their catch rate is something like 20-30% which strikes me as no be

I don't understand why people install antivirus software on their machines. I read once that their catch rate is something like 20-30% which strikes me as no better than 0% for all the good it does most of their customers. It just seems to slow down computers a lot and yield little benefit other than protection for the IT staff when things go wrong. I could make antivirus software that does nothing and probably make people happier by virtue of the fact that I'm not taking their system's resources.

goodmitton 17y ago
I don't understand how even having a 20% detection rate isn't better than 0%. Am I missing something? Are there a lot of viruses popping over the net that even the 20% detection is already too late?
- jswinghammer 17y ago
  Given the cost in equipment purchases, user annoyance, lost productivity and purchasing the software itself it strikes me that you need much higher success rates to be worth all that.
- dirtbox 17y ago
  The 20% figure that was "once read" about is pure fiction. Any up to date test figures reveal something closer to 99.8% of a 3 million sample testbase for the better AVs. It's all a bit moot though as before this happened, McAfee was probably worse than anything a PC can get infected with. Now it's gone and proved it beyond any doubt.
  - mattmanser 17y ago
    But that's totally meaningless! Think of it in another way, at any point in time you have x number of virus that you are likely to come across through whatever means. If all those viruses are in the 0.2%, then the catch rate isn't going to be 99.8% it's going to be 0%. So being able to catch 99.8% of 3 millions viruses when new ones are released all the time is a pointless comparison for efficiency.
    - dirtbox 17y ago
      20% is totally meaningless as well, but you posted it.
      - scott_s 17y ago
        No, he didn't. But that doesn't change his point.
  - kalid 17y ago
    The 99.8% includes a known test set for historic viruses from the 80s and 90s. The stuff you really care about are the new things that sweep the web (Blaster, Slammer, Code Red, etc.). AV is inherently reactive, and that .2% you miss is likely the latest stuff.
    - smallblacksun 17y ago
      Old (meaning a year or two) viruses are still around, and can still do a lot of damage. A large part of the reason they don't is because people run virus scanners that catch them, and stop them from spreading.
      - boredguy8 17y ago
        Well, I mean, patching...
mattmaroon 17y ago
You read Hacker News, which means you probably know more about computers than at least 99% of the population, and far more than 98%. Seriously, consider that. Take something you don't know about. For me it's cars. If prevailing wisdom was that unless you bought some $40 item for your car, it could easily be stolen, you'd probably buy it right? This is what people are told: Windows is insecure and anyone with a clue can just steal your credit card number. I know that if I just don't install crap from the internet, and have a reasonable firewall, I'm not going to get a virus. I haven't had antivirus in over a decade, though I've run some web-based ones on occasion to check, and have never had a problem. I know that, and you know that. My dad (who is much closer to the other 98% of the population) doesn't know that. (As for corporate use, you answered your own question. IT staff installs it for no reason other than to be able to prove to their boss that it isn't their fault when stuff goes wrong. )
- ominous_prime 17y ago
  > If prevailing wisdom was that unless you bought some $40 item for your car, it could easily be stolen, you'd probably buy it right? Oh, you mean "The Club", which slows down a car thief by about 10 seconds ;)
- Periodic 17y ago
  For the IT staff, the fact that your computer slows down is an externality; it is not their problem. If the anti-virus can catch a few viruses and doesn't result in many help-desk tickets, then it makes their lives easier. Cleaning up a virus is a tedious task, as even a simple re-imaging can take a while, and that's if you can use a standard image. They also don't know how smart their users are. Some of them are great, and might read HN, but others will go download any game or smiley pack they can find. If IT staff were paid based on how smoothly the computers run, they might have a different opinion. Their current goal is usually just to make sure it runs at all.
  - furyg3 17y ago
    > Their current goal is usually just to make sure it runs at all. Indeed. I'm the lead of the "IT Staff" at a small non-profit (~70 users) running mostly on second-hand desktops. Two-thirds of our staff is unpaid, usually interns who are here a few days a week for 3 months, and then they're gone and someone new takes their place. Training proper computer behavior is hard. So... we run A/V (not McAffee), because we have to. We also lock down the systems hard, not because I think that's a nice thing to do to your users, but because we have to. Imaging all these different desktop models is difficult, and we have very limited resources for doing re-imaging/re-installs/virus cleaning/whatever. My goal is to enable you to sit down at your computer and be able to perform your job. A 20% performance hit on all computers is worth it if it means that 20% of the computers aren't down for maintenance. :)
FlorinAndrei 17y ago
Or you could just install the free AVG, the cost is zero (if money is what worries you), the impact on performance is negligible (I do photo and video processing, the antivirus doesn't seem to make Vista slower than it already is), and it's definitely better than nothing (caught a few cockroaches trying to sneak into my system already). But what do I know, my laptop is running Ubuntu, my primary desktop has always been Linux since 1997.

goodmitton 17y ago

I don't understand how even having a 20% detection rate isn't better than 0%. Am I missing something? Are there a lot of viruses popping over the net that even the 20% detection is already too late?

jswinghammer 17y ago
Given the cost in equipment purchases, user annoyance, lost productivity and purchasing the software itself it strikes me that you need much higher success rates to be worth all that.
dirtbox 17y ago
The 20% figure that was "once read" about is pure fiction. Any up to date test figures reveal something closer to 99.8% of a 3 million sample testbase for the better AVs. It's all a bit moot though as before this happened, McAfee was probably worse than anything a PC can get infected with. Now it's gone and proved it beyond any doubt.
- mattmanser 17y ago
  But that's totally meaningless! Think of it in another way, at any point in time you have x number of virus that you are likely to come across through whatever means. If all those viruses are in the 0.2%, then the catch rate isn't going to be 99.8% it's going to be 0%. So being able to catch 99.8% of 3 millions viruses when new ones are released all the time is a pointless comparison for efficiency.
  - dirtbox 17y ago
    20% is totally meaningless as well, but you posted it.
    - scott_s 17y ago
      No, he didn't. But that doesn't change his point.
- kalid 17y ago
  The 99.8% includes a known test set for historic viruses from the 80s and 90s. The stuff you really care about are the new things that sweep the web (Blaster, Slammer, Code Red, etc.). AV is inherently reactive, and that .2% you miss is likely the latest stuff.
  - smallblacksun 17y ago
    Old (meaning a year or two) viruses are still around, and can still do a lot of damage. A large part of the reason they don't is because people run virus scanners that catch them, and stop them from spreading.
    - boredguy8 17y ago
      Well, I mean, patching...

mattmaroon 17y ago

You read Hacker News, which means you probably know more about computers than at least 99% of the population, and far more than 98%. Seriously, consider that. Take something you don't know about. For me it's cars. If prevailing wisdom was that unless you bought some $40 item for your car, it could easily be stolen, you'd probably buy it right? This is what people are told: Windows is insecure and anyone with a clue can just steal your credit card number. I know that if I just don't install crap from the internet, and have a reasonable firewall, I'm not going to get a virus. I haven't had antivirus in over a decade, though I've run some web-based ones on occasion to check, and have never had a problem. I know that, and you know that. My dad (who is much closer to the other 98% of the population) doesn't know that. (As for corporate use, you answered your own question. IT staff installs it for no reason other than to be able to prove to their boss that it isn't their fault when stuff goes wrong. )

ominous_prime 17y ago
> If prevailing wisdom was that unless you bought some $40 item for your car, it could easily be stolen, you'd probably buy it right? Oh, you mean "The Club", which slows down a car thief by about 10 seconds ;)
Periodic 17y ago
For the IT staff, the fact that your computer slows down is an externality; it is not their problem. If the anti-virus can catch a few viruses and doesn't result in many help-desk tickets, then it makes their lives easier. Cleaning up a virus is a tedious task, as even a simple re-imaging can take a while, and that's if you can use a standard image. They also don't know how smart their users are. Some of them are great, and might read HN, but others will go download any game or smiley pack they can find. If IT staff were paid based on how smoothly the computers run, they might have a different opinion. Their current goal is usually just to make sure it runs at all.
- furyg3 17y ago
  > Their current goal is usually just to make sure it runs at all. Indeed. I'm the lead of the "IT Staff" at a small non-profit (~70 users) running mostly on second-hand desktops. Two-thirds of our staff is unpaid, usually interns who are here a few days a week for 3 months, and then they're gone and someone new takes their place. Training proper computer behavior is hard. So... we run A/V (not McAffee), because we have to. We also lock down the systems hard, not because I think that's a nice thing to do to your users, but because we have to. Imaging all these different desktop models is difficult, and we have very limited resources for doing re-imaging/re-installs/virus cleaning/whatever. My goal is to enable you to sit down at your computer and be able to perform your job. A 20% performance hit on all computers is worth it if it means that 20% of the computers aren't down for maintenance. :)

FlorinAndrei 17y ago

Or you could just install the free AVG, the cost is zero (if money is what worries you), the impact on performance is negligible (I do photo and video processing, the antivirus doesn't seem to make Vista slower than it already is), and it's definitely better than nothing (caught a few cockroaches trying to sneak into my system already). But what do I know, my laptop is running Ubuntu, my primary desktop has always been Linux since 1997.