6 ms·

I worked in Geek Squad for 5 years (finally started making a enough money doing freelance development to quit this past december). I've done malware removal on

by learc83 15y ago

I worked in Geek Squad for 5 years (finally started making a enough money doing freelance development to quit this past december). I've done malware removal on 5-10 computers a day, 5 days a week for most of that time. So I've seen thousands of malware infections on the average consumer's computer. I've seen more different malware infections than just about anyone outside of an antivirus research lab. When I first started most of malware came from users downloading files from P2P sites. However, for the last 2 years nearly all the malware I found was installed via a drive-by download that happened without user input. You can talk all you like about avoiding porn sites and installing AV software, but it's not that simple. The majority of the computers I worked on had current AV programs--they weren't able to prevent the infections. The situation with malware and windows is absolutely terrible, and it doesn't only happen to idiots who stuff their drives with porn. Macs have security flaws--they aren't perfect, but when compared to the malware ghetto I've dealt with over the years, calling this a mac malware problem an "explosion" is just ridiculous.

jbri 15y ago
> and it doesn't only happen to idiots who stuff their drives with porn. Instead, it only happens to people who don't keep their browser up to date so that it's actually vulnerable to drive-by downloads. Right?
- learc83 15y ago
  I've seen plenty of the same fake AV malware that installs itself via drive-by downloads on computers with up to date firefox installs. Security patches aren't instant. Updating your browser helps sure, but it's not a real solution. There is a tendency for people like us to assume every time we see someone with a malware infection that it must be because the user is a moron who: still uses Kazaa, doesn't know about the good porn sites, is browsing on IE6 and installs anything that a popup asks him too. That just isn't true. It's not just idiots, the average non-moron windows user is massively vulnerable to malware. In my experience (I'll limit it to friends and family b/c of the obvious selection bias of including Geek Squad customers), nearly every (non developer) windows user I know has had at least one malware infection over the last few years that required either my help, or a system restore.
  - lallysingh 15y ago
    So what are us developers doing differently?
    - learc83 15y ago
      I would guess that some of that is b/c my developer friends are less likely to need my help with malware, so they don't tell me about it. Another guess but the rest of it is probably behavior based. Developers are less likely to spend all day on facebook playing flash games, more likely to have flashblock and adblock installed etc..
- yardie 15y ago
  Why is it the browsers job to secure your system? It doesn't matter if it's IE 1 or Chrome 12 if any application tries to install itself without user intervention the system should stop it by default.
  - trezor 15y ago
    If you have a modern OS (anything newer Vista, be it Windows or not), it will. Saying Windows is insecure because a decade-old version of it didn't have rigths-elevation is pretty silly.
ZoFreX 15y ago
> and it doesn't only happen to idiots who stuff their drives with porn What is this based on? What the customer tells you? To quote House: Everybody lies! I am being partially serious, I don't have AV installed, I run Windows, and I haven't had a virus in... a long time. I think the last one was Sasser!
- learc83 15y ago
  Based on the general state of the computer, and many times customers asked me to try to identify the source of the infection. To do this I checked the history for recently visited sites. Before most browsers had private browse modes, and the ability to only delete recently browsed data, a non empty history with no obvious porn listings could usually be taken at face value.
  - ZoFreX 15y ago
    In my experience a lot of users, those that know more than nothing but aren't quite adept enough to not get malware, know how to selectively delete their history. That's no to say that dodgy porn sites are the only vectors. In fact I find the most common vector for viruses these days is stupidity. The nastiest viruses to remove are the ones that can't install themselves, spread themselves, make no attempt to hide from antivirus, but have a whopping huge payload ready for whoever will run omg_awesome_kitten_pic.jpg.exe (which they've downloaded from Limewire, or Bittorrent, or has been IM'd to them over MSN).
josephcooney 15y ago
Selection bias? Your conclusion that windows is a malware ghetto based on your experience at the geek squad is like a Doctor saying 'everyone is sick, because all I see everyday are sick people'.
- powrtoch 15y ago
  I think the meaning was that Windows is a malware ghetto compared to Mac. More akin to a Doctor noticing that 95% of his patients are blondes and declaring that blondes tend to get sick more. The significance of this is offset by the base rate though: unlike Windows PCs, blondes don't constitute 90% of the sample group.
- learc83 15y ago
  Definitely a selection bias--I mentioned that previously in a post down below. I'm not saying everyone is sick though. I'm saying I've seen thousands of windows machines with malware and a lot of the time it wasn't just an uneducated user problem. My first store was also about an hour away from the nearest mac store so I also saw a pretty fair amount of macs while working there. They came in all the time for hardware issues so obviously they aren't perfect--But I never once saw one with malware--not in 5 years. I don't think that they are magically immune to malware and some of it can be explained by smaller market share, but whatever the reason from my experience dealing with thousands of windows pcs and hundreds of macs--malware on macs is so insignificant that it doesn't exist. 5 years ago people were saying that malware for macs was coming (In fact Best Buy was pushing AV installs for macs when we first started carrying them), but it didn't materialize. For the average user--if you buy a windows machine you will probably have to deal with malware, but if you go with a mac the chance is so low that is virutally nonexistent.

by learc83 15y ago

jbri 15y ago

> and it doesn't only happen to idiots who stuff their drives with porn. Instead, it only happens to people who don't keep their browser up to date so that it's actually vulnerable to drive-by downloads. Right?

learc83 15y ago
I've seen plenty of the same fake AV malware that installs itself via drive-by downloads on computers with up to date firefox installs. Security patches aren't instant. Updating your browser helps sure, but it's not a real solution. There is a tendency for people like us to assume every time we see someone with a malware infection that it must be because the user is a moron who: still uses Kazaa, doesn't know about the good porn sites, is browsing on IE6 and installs anything that a popup asks him too. That just isn't true. It's not just idiots, the average non-moron windows user is massively vulnerable to malware. In my experience (I'll limit it to friends and family b/c of the obvious selection bias of including Geek Squad customers), nearly every (non developer) windows user I know has had at least one malware infection over the last few years that required either my help, or a system restore.
- lallysingh 15y ago
  So what are us developers doing differently?
  - learc83 15y ago
    I would guess that some of that is b/c my developer friends are less likely to need my help with malware, so they don't tell me about it. Another guess but the rest of it is probably behavior based. Developers are less likely to spend all day on facebook playing flash games, more likely to have flashblock and adblock installed etc..
yardie 15y ago
Why is it the browsers job to secure your system? It doesn't matter if it's IE 1 or Chrome 12 if any application tries to install itself without user intervention the system should stop it by default.
- trezor 15y ago
  If you have a modern OS (anything newer Vista, be it Windows or not), it will. Saying Windows is insecure because a decade-old version of it didn't have rigths-elevation is pretty silly.

ZoFreX 15y ago

> and it doesn't only happen to idiots who stuff their drives with porn What is this based on? What the customer tells you? To quote House: Everybody lies! I am being partially serious, I don't have AV installed, I run Windows, and I haven't had a virus in... a long time. I think the last one was Sasser!

learc83 15y ago
Based on the general state of the computer, and many times customers asked me to try to identify the source of the infection. To do this I checked the history for recently visited sites. Before most browsers had private browse modes, and the ability to only delete recently browsed data, a non empty history with no obvious porn listings could usually be taken at face value.
- ZoFreX 15y ago
  In my experience a lot of users, those that know more than nothing but aren't quite adept enough to not get malware, know how to selectively delete their history. That's no to say that dodgy porn sites are the only vectors. In fact I find the most common vector for viruses these days is stupidity. The nastiest viruses to remove are the ones that can't install themselves, spread themselves, make no attempt to hide from antivirus, but have a whopping huge payload ready for whoever will run omg_awesome_kitten_pic.jpg.exe (which they've downloaded from Limewire, or Bittorrent, or has been IM'd to them over MSN).

josephcooney 15y ago

Selection bias? Your conclusion that windows is a malware ghetto based on your experience at the geek squad is like a Doctor saying 'everyone is sick, because all I see everyday are sick people'.

powrtoch 15y ago
I think the meaning was that Windows is a malware ghetto compared to Mac. More akin to a Doctor noticing that 95% of his patients are blondes and declaring that blondes tend to get sick more. The significance of this is offset by the base rate though: unlike Windows PCs, blondes don't constitute 90% of the sample group.
learc83 15y ago
Definitely a selection bias--I mentioned that previously in a post down below. I'm not saying everyone is sick though. I'm saying I've seen thousands of windows machines with malware and a lot of the time it wasn't just an uneducated user problem. My first store was also about an hour away from the nearest mac store so I also saw a pretty fair amount of macs while working there. They came in all the time for hardware issues so obviously they aren't perfect--But I never once saw one with malware--not in 5 years. I don't think that they are magically immune to malware and some of it can be explained by smaller market share, but whatever the reason from my experience dealing with thousands of windows pcs and hundreds of macs--malware on macs is so insignificant that it doesn't exist. 5 years ago people were saying that malware for macs was coming (In fact Best Buy was pushing AV installs for macs when we first started carrying them), but it didn't materialize. For the average user--if you buy a windows machine you will probably have to deal with malware, but if you go with a mac the chance is so low that is virutally nonexistent.