71–80 of 87 posts
Earlier quoted context omitted.
So once a month something gets past the antivirus. How often does the antivirus block (not notice something that wouldn't work on your system, block) malware?
If I had to estimate, at least 95% of the website malware gets caught by MSE. This is a typical day reviewing new ad placements: http://i.imgur.com/gvtY9.png
That effectively solves the virus problem since the worst that can happen is that something unwanted runs as the user privileges or deletes/infects files in home directory. The machine itself stays clean and you can avoid full reinstalls.
If the user gets a virus then all you need is restore his home directory from a clean backup. And if you want, possibly run some antivirus on anything that gets backed up, to try to make yourself feel good about backups being clean.
Well, if you will dabble away in Windows, this is bound to happen. Stop writing for it and it'll go away. Man: "Doctor! Doctor! It hurts when I do this!" Doctor: "Well, stop doing that ..."
Doctor: Furthermore, start doing the same thing (developing software) to the other one (Linux) because it's .. Er.. fresh. Man: Wait, but won't the other one start hurting because I'm using it more? Doctor: Oh right, I guess if everyone switching to use Linux tomorrow, then the malware authors would begin targeting it more aggressively. I supposed my anti-Microsoft rant was misplaced.
Why it can't keep a list of known good DLLs and then not rescan them, I don't know...
There seems to be a lot of hate for antiviruses here on HN. I have this question, then - what kind of features would YOU want from an antivirus? If a startup was to launch tomorrow with some sort of antivirus or similar product, what would it need to have for you to buy/subscribe/etc.?
Earlier quoted context omitted.
Until you get hit with a zero-day browser exploit that doesn't need you to install an exe to run.
how will AV help against zero-day browser exploit? Zero-day, by their very definition, have no antivirus definition that will catch them yet. On my personal machine, I don't run any anti-virus software, but I also don't use adobe pdf and enable flash only on sites I trust.
The business of antivirus, especially, has a huge incentive to shove it IN YOUR FACE that the software is detecting things whether they're false positives or not. This scares people into re-upping their subscription. Most computer users don't understand there can even be such a thing as false positive. For all those support calls you get, there are probably 10x that number that simply take the security software on it…
They throw up these scary pop-ups that basically say "this is a nice computer you have isn't it? It would be... terrible if something were to happen to it, wouldn't it?"
Interestingly, the best AV I've found seems to be the one from microsoft.
Earlier quoted context omitted.
Question: if he's hit with a zero-day exploit, how does having AV installed help?
Answer: Good definitions are crafted so that are intended to detect not only all existing versions seen but also allows room for change and file characteristic changes so that future versions of the malware family can be caught with the same definition. Good definitions will go on killing items in the wild well past the date the initial zero-day came out (the one that caused the need for the definition in the first p…
Earlier quoted context omitted.
I did ask my dad to call. Nothing seemed to come of it. I was working in a hurry and didn't think to simply change the exe name, making the presumption that such a simple thing shouldn't influence the AV decision.
The name of the .exe certainly matters. When going through airport security, do you think it matters at all if your name is Osama Bin Laden? Such a person is going to experience a much larger degree of scrutiny from TSA then a person named John Smith.
Neither is it the least bit surprising that support personnel and developers consider the shear number and consistency of false positives as "fear-mongering".
It would only take a further small step to then consider, what is the point of having AV at all in the first place since the best it can do is fill an increasingly small hole in prevention for ordinary user behaviour and a static role for precursor forensics (actual forensics would not need the service).
TL;DR. AV industry has a LOT to answer for, to the point where it maybe should not exist in its current form.