6 ms·

"Oh, the business of fear mongering." couldnt agree more. I am using PC with XP/7 for years now and never had a virus. I go online into some questionable websi

"Oh, the business of fear mongering." couldnt agree more. I am using PC with XP/7 for years now and never had a virus. I go online into some questionable websites and downloads sometimes but if user uses a common sense, he wont open that AllPrinterDrivers.exe from unknown source just to install drivers to his printer. I never needed and I think I never will need an AV.

freehunter 15y ago
Until you get hit with a zero-day browser exploit that doesn't need you to install an exe to run.
- politician 15y ago
  Question: if he's hit with a zero-day exploit, how does having AV installed help?
  - jgmmo 15y ago
    Answer: Good definitions are crafted so that are intended to detect not only all existing versions seen but also allows room for change and file characteristic changes so that future versions of the malware family can be caught with the same definition. Good definitions will go on killing items in the wild well past the date the initial zero-day came out (the one that caused the need for the definition in the first place). This is why brand new generations of malware drop and they are detected by a few security guys. This is also why some people have huge #'s of FP's -- because they allow so much room for flexibility to catch future malware - that they accidentally kill off legit files in the process.
    - politician 15y ago
      Well, ok, that makes sense; I thought the OP was trying to say that AV provides protection against brand new zero-day exploits which seems like wishful thinking.
      - freehunter 15y ago
        No, I meant basically what jgmmo said, the AV scanners pick up a lot more than the virus they were written to prevent. Anything that triggers virus-like behavior will let you know you're infected (might not be able to clean it though). That's one of the points made in the article about false positives.
- polymatter 15y ago
  how will AV help against zero-day browser exploit? Zero-day, by their very definition, have no antivirus definition that will catch them yet. On my personal machine, I don't run any anti-virus software, but I also don't use adobe pdf and enable flash only on sites I trust.
  - freehunter 15y ago
    One of the reasons the author is complaining about AV is the very reason an AV will likely catch a browser exploit that runs local code. The program the author tells you to write in C doesn't have a definition either, but the code matches an signature that the AVs will look for, same with browser exploits. Native code running without the OS knowing why will usually end up being flagged.
  - DanBC 15y ago
    Safe Hex is an important part of keeping a machine clean. (See, for example, RSA being hit because someone opened an Excel attachment.[1]) But as malware authors find more holes and use more exploits it becomes harder to know what's safe or not. Having some weird defaults in operating systems (don't show file extensions; perform an action based on the extension and not the type of file; build a web-browser into the OS; use a preview pane that auto-opens a lot of things so you don't need to "open" an email message it's been opened for you by the pre-installed email client etc etc) really didn't help. There's also a problem with users. (This comment in not aimed at you!) Some operating systems have very many users who believe themselves to be clueful but who really really are not. The arrogant 19 year old who can slot together a motherboard and GPU and PSU and put them in a case, who can connect his aunt's computer to the Internet, who can install add-ons to his web browser. These are people who think they know what they're doing, who think that the pirated OS they use is fine because they checked an MD5 hash, and who think the pirated software they use is fine because someone would have said something in the torrent comments if it wasn't. And then, if they have a problem, they'll download a pirate AV and hope that isn't infected. These are the people most mocking of the "wipe and re-install; that's the only safe option" philosophy. They'll spend a day using various bits of anti-malware and scanners and web-searching. And they won't find the infected WMV file and they'll get re-infected a few days later. [1] (http://blogs.rsa.com/rivner/anatomy-of-an-attack/ http://blogs.rsa.com/rivner/anatomy-of-an-attack/)

freehunter 15y ago

Until you get hit with a zero-day browser exploit that doesn't need you to install an exe to run.

politician 15y ago
Question: if he's hit with a zero-day exploit, how does having AV installed help?
- jgmmo 15y ago
  Answer: Good definitions are crafted so that are intended to detect not only all existing versions seen but also allows room for change and file characteristic changes so that future versions of the malware family can be caught with the same definition. Good definitions will go on killing items in the wild well past the date the initial zero-day came out (the one that caused the need for the definition in the first place). This is why brand new generations of malware drop and they are detected by a few security guys. This is also why some people have huge #'s of FP's -- because they allow so much room for flexibility to catch future malware - that they accidentally kill off legit files in the process.
  - politician 15y ago
    Well, ok, that makes sense; I thought the OP was trying to say that AV provides protection against brand new zero-day exploits which seems like wishful thinking.
    - freehunter 15y ago
      No, I meant basically what jgmmo said, the AV scanners pick up a lot more than the virus they were written to prevent. Anything that triggers virus-like behavior will let you know you're infected (might not be able to clean it though). That's one of the points made in the article about false positives.
polymatter 15y ago
how will AV help against zero-day browser exploit? Zero-day, by their very definition, have no antivirus definition that will catch them yet. On my personal machine, I don't run any anti-virus software, but I also don't use adobe pdf and enable flash only on sites I trust.
- freehunter 15y ago
  One of the reasons the author is complaining about AV is the very reason an AV will likely catch a browser exploit that runs local code. The program the author tells you to write in C doesn't have a definition either, but the code matches an signature that the AVs will look for, same with browser exploits. Native code running without the OS knowing why will usually end up being flagged.
- DanBC 15y ago
  Safe Hex is an important part of keeping a machine clean. (See, for example, RSA being hit because someone opened an Excel attachment.[1]) But as malware authors find more holes and use more exploits it becomes harder to know what's safe or not. Having some weird defaults in operating systems (don't show file extensions; perform an action based on the extension and not the type of file; build a web-browser into the OS; use a preview pane that auto-opens a lot of things so you don't need to "open" an email message it's been opened for you by the pre-installed email client etc etc) really didn't help. There's also a problem with users. (This comment in not aimed at you!) Some operating systems have very many users who believe themselves to be clueful but who really really are not. The arrogant 19 year old who can slot together a motherboard and GPU and PSU and put them in a case, who can connect his aunt's computer to the Internet, who can install add-ons to his web browser. These are people who think they know what they're doing, who think that the pirated OS they use is fine because they checked an MD5 hash, and who think the pirated software they use is fine because someone would have said something in the torrent comments if it wasn't. And then, if they have a problem, they'll download a pirate AV and hope that isn't infected. These are the people most mocking of the "wipe and re-install; that's the only safe option" philosophy. They'll spend a day using various bits of anti-malware and scanners and web-searching. And they won't find the infected WMV file and they'll get re-infected a few days later. [1] (http://blogs.rsa.com/rivner/anatomy-of-an-attack/ http://blogs.rsa.com/rivner/anatomy-of-an-attack/)