4 ms·
1. This is bad for antivirus vendors who want to continue doing the same ol' thing. McAfee, AVG, and others are still terrible, and Norton has got such a bad re
by thaumaturgy 15y ago
1. This is bad for antivirus vendors who want to continue doing the same ol' thing. McAfee, AVG, and others are still terrible, and Norton has got such a bad reputation that even though its recent products have improved (somewhat?), it will be a long time before independent consultants start recommending it again. So this is going to put pressure on these companies to do something newer and better, which is great.
2. But, it likely won't change what actually ships with new PCs, since PC vendors these days (Dell and Acer directly, Best Buy, Staples, and others) make their margins by shipping computers with a free trial version of McAfee or Norton in the hopes that the customer will be snookered into paying for the software. In our experience, most customers do end up buying it, since they don't know any better.
3. Although we recommend and love Microsoft Security Essentials, it is not perfect. Just last week we had to do a manual cleanup of infected register systems for a local business where both MalwareBytes and MSE missed major components of the virus. The leftover components were sufficient to re-infect the systems -- while running in Safe Mode. (This was XP, for those wondering.)
4. Malware developers still have a lot of tricks they haven't even tried yet, that honestly I'm surprised haven't shown up already.
5. Malware is largely a commercial industry now, so there will be financial pressure on malware developers to adopt new tactics to defeat the bundled antivirus.
6. But, antivirus technology also still has a lot of room to improve. Microsoft especially is in a unique position to do this because they can legally do things like repair infected or damaged components of Microsoft software from clean copies, which might be a legal gray area for independent companies. (I am not a lawyer and all that.) Microsoft has the capability and resources for example to develop software which can examine key operating system areas for anything that looks suspicious -- something which most antivirus software doesn't do now.
7. In our end of the business, it could be a mixed blessing. On the one hand, we lose money on every single virus cleanup that we do, and I hate charging people for it anyway. On the other, it does drive new customers to us and gives us the opportunity to really make a strong first impression. But I won't cry into my pillow at night if Microsoft somehow manages to eviscerate the malware industry.
8. But, I'm skeptical about rapid adoption. What we're seeing right now is more and more people trying to keep their computer-related costs down. We're still doing significant XP support -- probably over half of our Windows users, if I had to estimate -- and, earlier today, the only reason we were able to convince a client that they would actually be better off buying a new replacement system is because decent IDE hard drive upgrades right now just aren't worth it. If this trend continues, and if Windows 7 continues to be "good enough" for most people, it'll be years before we see enough adoption of Windows 8 to make a dent in malware, which gives the malware developers plenty of time to adapt. (But, I could be surprised. Then again, what I've seen so far of Windows 8 isn't exactly compelling.)
9. Finally, the best place right now to stop malware, in our opinion, is still the browser. Chrome + AdBlock Plus by itself typically prevents repeat malware cleanups. The major exception to this was Limewire.
So, basically: I don't think this will really have that much of an impact any time in the near future, but if it does, it will probably make malware nastier and antivirus software better, and it will still be business-as-usual for support companies, which means it won't really improve consumers' lives much.
- nodata 15y ago> Chrome + AdBlock Plus by itself typically prevents repeat malware cleanups. That's interesting because Chrome is installed as the user (and so writable by the user), not as admin (like everything else). Chrome should be easier to infect. Got any numbers?
- thaumaturgy 15y agoNo, unfortunately. :-( One of my 2012 projects is to build us a system that can keep track of all this stuff so I can publicly provide real data on what we see instead of winging it. Web-wise, there seems to be two primary sources of infection: malicious ads on legitimate websites, and poisoned search results. (Compromised websites were all set to be a strong third source, but Wordpress cleaned up its act and we haven't seen as much of that this year.) AB+ takes care of the ads, which seems to be the biggest source of infections. Chrome seems to be pretty resilient to direct attacks against the browser so far, if statements from people at CanSecWest are anything to go by. (With at least one known exception [1].) We make guesses about the source of the infection based on the type of infection, what we find in which temp folders, and the client's browsing history -- if they're OK with us looking into that. edit: I should explain that we've seen the same results from Firefox w/ AB+. [1]: http://www.geek.com/articles/geek-pick/googles-chrome-browser-has-finally-been-hacked-2011059/ http://www.geek.com/articles/geek-pick/googles-chrome-browse...
- kijin 15y agoThanks for the info. I use AdBlock Plus and I love it too. On a related note, what do you think about NoScript? Does it really help prevent attacks these days, or are NoScript users just being paranoid? I use NoScript with AdBlock Plus, but so many websites rely on JS these days, it gets annoying pretty quickly.
- rkudeshi 15y agoI wanted to love NoScript, but it broke too many web pages. Trying Ghostery now, seems much more user-friendly.