For non technical people reading this thread, the general sentiment of other commentators is correct. Most AV is garbage. It will protect you from about a 1/3 of what is out there at the cost of computer performance. Make an educated decision about whether to run it at home or not. On your corporate network, do whatever your security guy tells you to do.
1. I've been doing virus and malware cleanups for people since -- well, since 1995 or so, at least.
2. I've recently begun presenting seminars on basics for novice computer users.
3. I was among the first to clean up the rather nasty kbiwkm rootkit a while back. One of my clients was infected with it before there had been an a/v response, and before anything could be learned about it anywhere.
4. I've recently begun to get contacted internationally (well, from Canadian individuals, anyway) to clean up websites infected with various sorts of nasty bugs.
5. Most importantly, I follow the results and reports from av-comparatives.org religiously; they're not affiliated with any particular antivirus vendor, product, or group, their tests appear to be very thorough, their methods appear to be fairly rigorous, and they provide reasonable results for a number of different metrics related to antivirus products, all in a regularly-released report that's quite readable.
6. I started a company three years ago to address the various flaws that I saw in the I.T. industry, one of which was the number of people that got hit with viruses over and over again. I have a very, very low rate of repeat virus cleanups for my clients, many of whom are novices that are particularly susceptible to multiple computer virus vectors. You might feel like being snarky and saying that I never hear back from them because they don't care for the service, but then again, I'm currently experiencing my third straight year of 300% growth, and most of my "marketing" comes from word-of-mouth.
But, I don't have a blog, so of course I'm not an expert. Carry on.
edit: ohbtw, two of today's systems that were infected with rogue antivirus also had up-to-date and active McAfee installations, which isn't at all unusual. But, yeah, you're right, it's much better now than it used to be.
In regards to AV Comparatives, I responded to why their tests aren't relevant in in the real world here: http://news.ycombinator.com/item?id=1284321. The bottom line is that detection rates as high as 97% are generally regarded by industry experts as inflated (John Viega says in one of his books that some people estimate actual detection rates to be around 30%). AV companies themselves would never use that number as a part of their marketing campaigns. You'll note that on the product pages of the AV products tested, the numbers aren't listed. If a 99.6% detection rate was actually. valid, don't you think it would be displayed in large and bold letters on the product page?
I'm not saying people shouldn't run AV, but we need to be honest about the actual capabilities of these products. Even if actual detection is only 30%, 30% is better than 0%.
* the task manager
* Quicken
* ATI Drivers
* the GIMP
* other antivirus programs (including products from Kaspery, ESET, Avast, and Trend Micro)
* VLC
* Cygwin
* Acrobat reader
* text editors (including Notepad2 and Notepad++)
* TrueCrypt
AV run in the real world on these settings would be disastrous.
Issues with the samples used by AV Comparatives:
* The malware sample size is only around 1 million.
* The sample size of clean programs is far too small.
* The malware samples used aren't public. We don't even know if the malware used by AV Comparatives are found in the wild anymore.
More generally, evaluations like those done by AV Comparatives and similar organizations are misleading. What actually matters is the vulnerability window. This window is generally a week or two and occurs after a piece of malware is released into the wild. It is the amount of time it takes AV vendors to get a signature distributed. Most damage is done during the vulnerability window, during which infected machines will have their AV disabled by the virus. The fact that your AV can detect viruses released years ago actually doesn't have any bearing on your security; it's a meaningless evaluation of the product.
You have to ask yourself, why don't AV vendors report numbers like the percentages found in AV Comparatives? They don't because they know it's bogus. Sure, most AV vendors will list AV Comparatives and others as an "award" or a "certification", but they'll never list the actual number. I think that should tell you something. In the real world no one is experiencing detection rates like those in the report. If they were, you can be sure the numbers would be part of an AV marketing campaign.
Then I'd say you probably have a virus ;-)
I don't open attachments from strangers, I don't have warez on my computer, and I call / confirm when I get a word doc. (It doesn't matter because I do the conversion on googledocs anyway).
I know not everyone is fortunate enough to do all of that, but it is entirely possible to avoid viruses if one really wants to.
That you know of.
I can say the same thing, but I always put in that little caveat at the end. Same for being hacked. I've looked for evidence, and never found any reason to believe otherwise.
I've done too many cleanups for people, for whom I have the upmost respect, who said similar things for me lose my humility on that score.
Care to list some please? I don't use Windows, but I'm sick of my dad's PC being infected by the "Windows Security" scam application every 4 months. Not to mention the set of other viruses I find when trying to clean it up...
http://www.cnet.com.au/microsoft-security-essentials-3392988...
http://free.avg.com/ww-en/free-antivirus-download
ClamAV for windows is ok too:
Hell, just running housecall once in a while manually can do wonders:
- McAfee has been crap for a long time now; they're not much better than Norton's products from the last few years.
- Corporate networks are running McAfee because McAfee (and TrendMicro, and other garbage a/v vendors) provide incentives to VARs, consultants, resellers, etc.
- However, this is a far cry from "all antivirus is bad". There are plenty of good products available, some of them are free, and they don't have serious negative impacts on system performance. The on-demand catch rating of some of these products exceeds 97% in independent lab testing, which is pretty damn good.
- If you use a company computer, and you have disabled antivirus on your system because you don't like it, you are putting not just your company's computer, but your company's network at risk. In most "serious" companies, this would be grounds for termination, and I don't blame them. I would also like to emphasize that the workstation you use belongs to your employer, not you.
- I don't care how smart you think you are, if you're running Windows, you're at risk. Even current versions of Firefox are vulnerable to remote exploits, and we've been seeing a hell of an uptick recently in website infections. That blog that you've been visiting for years might try to hit your computer with something nasty tomorrow, and you'll never even notice. For that matter, a lot of website administrators don't realize they have a problem for a long time.
- Rootkits are getting very quiet and very sneaky. I think we're starting to see a trend where computers are coming in with a couple of different infections: one is a recent rogue antivirus infection which drives the user to get help, and the other is an older rootkit that's been running quietly in the background for a while.
You guys should know better.