5 ms·

Many of my customers run the common free anti-virus programs and I can assure you that they are not snake oil. The logs and alerts from blocked infection attemp

Many of my customers run the common free anti-virus programs and I can assure you that they are not snake oil. The logs and alerts from blocked infection attempts are testament to this. I certainly would say that most of the free anti-virus is pushy, hungry and generally not a particularly great marketing exercise.

hutzlibu 9y ago
Sure they do things - but they promise real security and protection - which is a laughable claim, when you look at detection statistics. They are not much better than defender. But unlike defender, they themselves act like spy/adware sometimes. Showing advertisement on the desktop etc. and communicating with the server a lot and not for updating. Oh and my experience with most of their logs is, that they log and alert allmost everything - even when it is trivial as a tracking cookie - but make it look like a real threat to the ordinary user to show what good work they are doing. And especially on older computer really slow things down. So I cannot recommend them and rather stress the importance of updates and not mindlessly install/click random things. (but with updates allmost everything important does that automatically now anyway)
freeflight 9y ago
> The logs and alerts from blocked infection attempts are testament to this. Infection attempts by what? Scans of phishing mail attachments they wouldn't have opened anyway? At least if they know what they are doing. In addition, many AV have this annoying habit of reporting quite a bit of false-positives based on sys-calls or some weird heuristics, this leads to the situation where even totally legit software, from a trusted source, triggers a warning. Which then conditions people to just click past the warning, at that point you might as well not even run the AV at all and instead just scan individual files online through some virustotal-like service and teach proper user behavior. Due to this dynamic installing a good ad-blocker will probably do more for the security of the average windows user than any AV software ever would.
- proactivesvcs 9y ago
  > Infection attempts by what? In January I've seen logs blocking drive-by malware attempts, lots of infected email attachments and an infected USB stick. These are not false positives. They were not legitimate software from trusted sources. The logs I read were real-world true positives and they were not inconsequential trivia like tracking cookies or the like. I don't think that in any of the cases the user would have had a warning to blindly click through. Not entirely sure how an advert blocker can stop email or device-carrying malware.
  - freeflight 9y ago
    > They were not legitimate software from trusted sources. Infected email attachments, unless they come from a trusted sender, I consider "useless positives" because nobody, with the appropriate training, should be opening them in the first place. Kinda along the same lines of tracking portscans and counting those as "thwarted cyber attacks", like many government agencies tend to boast about, it's nice for padding stats but is it a real security gain? Afaik by now one of the most common successful attack vectors is drive-by kits [0], increasingly served trough advertisement channels. Ad-blockers/disabling Java minimize this risk quite a bit, with low overhead, while having the added comfort of making the web more user-friendly. Which to me is the most sensible solution, unless one really likes opening weird email attachments and/or plugging in untrusted devices. > I don't think that in any of the cases the user would have had a warning to blindly click through. If the user is already careless enough to connect untrusted devices and/or opening random email attachments, then I have no trust in said user to heed any of the following warnings, as he/she already had to ignore previous best practice warnings to get there in the first place. [0] http://www.securityweek.com/internets-big-threat-drive-attacks http://www.securityweek.com/internets-big-threat-drive-attac...
    - marshray 9y ago
      > nobody, with the appropriate training, should be opening them in the first place How many users do you administer again?
Hello71 9y ago
https://en.wikipedia.org/wiki/List_of_rogue_security_software https://en.wikipedia.org/wiki/List_of_rogue_security_softwar...
- hutzlibu 9y ago
  No no, it was original antivirus. But it's been a while(I got hesitant doing maintenance), so I can't tell for sure which ones.

hutzlibu 9y ago

Sure they do things - but they promise real security and protection - which is a laughable claim, when you look at detection statistics. They are not much better than defender. But unlike defender, they themselves act like spy/adware sometimes. Showing advertisement on the desktop etc. and communicating with the server a lot and not for updating. Oh and my experience with most of their logs is, that they log and alert allmost everything - even when it is trivial as a tracking cookie - but make it look like a real threat to the ordinary user to show what good work they are doing. And especially on older computer really slow things down. So I cannot recommend them and rather stress the importance of updates and not mindlessly install/click random things. (but with updates allmost everything important does that automatically now anyway)

freeflight 9y ago

> The logs and alerts from blocked infection attempts are testament to this. Infection attempts by what? Scans of phishing mail attachments they wouldn't have opened anyway? At least if they know what they are doing. In addition, many AV have this annoying habit of reporting quite a bit of false-positives based on sys-calls or some weird heuristics, this leads to the situation where even totally legit software, from a trusted source, triggers a warning. Which then conditions people to just click past the warning, at that point you might as well not even run the AV at all and instead just scan individual files online through some virustotal-like service and teach proper user behavior. Due to this dynamic installing a good ad-blocker will probably do more for the security of the average windows user than any AV software ever would.

proactivesvcs 9y ago
> Infection attempts by what? In January I've seen logs blocking drive-by malware attempts, lots of infected email attachments and an infected USB stick. These are not false positives. They were not legitimate software from trusted sources. The logs I read were real-world true positives and they were not inconsequential trivia like tracking cookies or the like. I don't think that in any of the cases the user would have had a warning to blindly click through. Not entirely sure how an advert blocker can stop email or device-carrying malware.
- freeflight 9y ago
  > They were not legitimate software from trusted sources. Infected email attachments, unless they come from a trusted sender, I consider "useless positives" because nobody, with the appropriate training, should be opening them in the first place. Kinda along the same lines of tracking portscans and counting those as "thwarted cyber attacks", like many government agencies tend to boast about, it's nice for padding stats but is it a real security gain? Afaik by now one of the most common successful attack vectors is drive-by kits [0], increasingly served trough advertisement channels. Ad-blockers/disabling Java minimize this risk quite a bit, with low overhead, while having the added comfort of making the web more user-friendly. Which to me is the most sensible solution, unless one really likes opening weird email attachments and/or plugging in untrusted devices. > I don't think that in any of the cases the user would have had a warning to blindly click through. If the user is already careless enough to connect untrusted devices and/or opening random email attachments, then I have no trust in said user to heed any of the following warnings, as he/she already had to ignore previous best practice warnings to get there in the first place. [0] http://www.securityweek.com/internets-big-threat-drive-attacks http://www.securityweek.com/internets-big-threat-drive-attac...
  - marshray 9y ago
    > nobody, with the appropriate training, should be opening them in the first place How many users do you administer again?

Hello71 9y ago

https://en.wikipedia.org/wiki/List_of_rogue_security_software https://en.wikipedia.org/wiki/List_of_rogue_security_softwar...

hutzlibu 9y ago
No no, it was original antivirus. But it's been a while(I got hesitant doing maintenance), so I can't tell for sure which ones.