Is antivirus software really necessary?

Quote:

---

I'll freely admit that you know more about security than I do...by far and away a helluva lot more. I'm even happy to admit I've LEARNED by reading some of your posts. But, and I've said THIS before...you come across as one of the most condecending (ie abrasive) people I've ever seen. If you've got a problem with us "stupid people" asking questions then stay the **** out of our threads...

---

Well, I am happy that you've found value in my threads... I ask would you have found as much value in them if I just posted the same crap as everyone else?
Would there be any value in "yeah, run an AV." ?

Now to be honest, most of what I say about security is perfectly logical and really quite simple... save one factor. It requires most people to unlearn all the crap they already know about security. I don't think it is reasonable the to expect me to re-educate everyone, though I have no issues educating someone to the specifics of whatever their question may be.

I just don't feel like going over why application based security is garbage, and consequently why application exploits have nothing to do with a secure system. And all that goes with that, the uselessness of filtering firewalls, why running more security results in lower assurance, why AV protection is a bad remedy for bad architecture.

I think you'll agree that each of those points is likely to raise at least dozens of questions, and most security people fancy themselves as the greatest hacker to have ever lived and just want to argue... so why bother? I give what I give and I don't give newbie answers, hundreds of other people here offer that service... if anyone has further questions my inbox is always open, and many users have taken advantage of that.

cheers,

catch

(I made this post hidden because I'm going to get a little of topic)

I like to keep it simple, it runs better that way. I don't run AV on any of my machines (6). Why should I run a lot of untrusted code and extra processes on them? Because I'm not confident in my cognitive content and configuration with the tools supplied and integrated within the OS? I do my taxes each year on my machine etc... That being said, four of those machines are running 24hr. prime95 (mersenne prime), I'm going to solve that 10,000,000 digit prime one of these years. And when I build that Beowulf cluster it still won't run Av or FW. ;) I'm sure they're in needment somwhere in some situations, just not here at my house. I do have a Cisco though. I watched a friend run symantexc on his laptop for over 40 minutes. I could of backed up and reinstalled in that time. Of course I broke out my Windows NT shell scripting book by Tim Hill in the 90's and made up a load of .regs and .bats so with a few clicks, I'm configured and ready to go. Total time, a little over 30min(from boot install). But I can't help him if he pretermits the RUN AS feature. Last I heard his start button is permanently depressed and won't work. Yeah how's that Norton working out for ya on Admin?

Quote:

---

The experience of the user doesn't matter, anti-virus protection is flawed in concept and consequently should not be relied upon. Where is the sense in teaching two types of security, the right way and the common/easy way?

---

Wrong on both counts:

1. If all AVs were 100% effective, and everybody had one, there would be no viruses, other than in laboratory conditions. The issue is one of performance NOT concept.

2. As I said before, talk to your CPA colleagues in General Audit. There are two methods of preparing consolidated accounts; the "classical" and the "net equity". Use "net equity" in an exam and you will fail; use "classical" in real life and you will be fired :D Theory and practice frequently diverge.

Quote:

---

If the virus isn't incurring a cost on your organization, why care? If it is incurring a cost, you should know how and how much.

---

Weeeeeeeeeeel, a lot of countries have the legal concept of due diligence. That concept does not rank pari passu for all the players. So, if you are a small guy you will not be expected to be as smart as a big guy, because you don't have the resources.

If you allow your system to spew out malware and it harms someone else, you will have a cost because you have not exercised due diligence. You won't know the cost, because the courts will decide it for you.

If you can go to court and say I was running XYZ software and that should have stopped it but it didn't work like it said on the box, you have the makings of a good defence.

Demonstrating that you paid good money for something that happened not to work is a lot sounder defence than all the fancy theories in the World (no matter how correct they are) if only because you will not be judged by IT cognaisant people ;) ....................I am afraid that you have to accept that there is a "herd mentality" at play here?

I strongly suspect that a lot of IT managers install AV more to protect their a$$es than their systems.

For the small guy with no expertise, AV is better than nothing, even though it is by no means 100% reliable.

Quote:

---

1. If all AVs were 100% effective, and everybody had one, there would be no viruses, other than in laboratory conditions.

---

Where did I say otherwise?

Quote:

---

Weeeeeeeeeeel, a lot of countries have the legal concept of due diligence.

---

Well in that case it fall under a cost.

Quote:

---

If you allow your system to spew out malware and it harms someone else, you will have a cost because you have not exercised due diligence.

---

Again that is a cost. :)

Quote:

---

Demonstrating that you paid good money for something that happened not to work is a lot sounder defence than all the fancy theories in the World (no matter how correct they are)

---

Not if the something you paid ofr isn't certified to fill the role you are using it for and the procedure you are using is.

Quote:

---

I strongly suspect that a lot of IT managers install AV more to protect their a$$es than their systems.

---

Totally.

Quote:

---

For the small guy with no expertise, AV is better than nothing, even though it is by no means 100% reliable.

---

All depends on their requirements, suffice to say, an AV is never NEEDED as the original question posed.

cheers,

catch

Quote:

---

...you come across as one of the most condecending (ie abrasive) people I've ever seen. If you've got a problem with us "stupid people" asking questions then stay the **** out of our threads...

---

I have to disagree here. I guess it's the way some are reading the post aloud inside their head and maybe fabricating mixed emotions. I have made some drunk, well below par in mental acumen PM's to him before, about some PDF's regarding TOS metaknowledge. He was still quite polite and longanimous. I think he knew I had been drinking. Boy they missed the HDC threads, those were classics.

Off Topic:
Well, for starters, I'm going to take a very odd approach to this and say that viruses have actually benefited me in the long run. The first time I had to sit down and deal with a real bitch of a virus, is the first time I really started learning about the more intricate details about the operation of a PC. Dealing with things like the win.in file, the registry, boot-up processes, using the command prompt for file management, etc. Yeah, all those things that sound "alien" to a inexperienced user.
Now on to the topic at hand:
Some of you guys have just about confused the crap out of me in this thread. I didn't know it was possible to lock down a system to the point where you could prevent viruses from doing too much damage via propogation, etc. without the use of an AV. I do understand that there exists ways to prevent many viruses from dropping their payloads by simply using a registry monitor (from most of the removal details I see on antivirus websites, many viruses will make some type of registry change at some point or another). Maybe add to that, a nice process monitor that can watch for unwanted boot-up processes, running tasks, etc. Add to that, a correctly configured firewall that can will notify you of any applications attempting to connect to the internet that aren't on your 'accepted application' filter list. But to me, it just seems that some viruses maybe be clever enough to circumvent these security measures. Apparently there are more ways to lock down a system, that are practical?
I don't consider myself an expert by any means. On the contrary, I have much to learn. But if you couple this thread with Poo's thread (I couldn't find the exact thread to link it) about not needing a firewall on a properly configured system....well, it seems that with a 'properly configured' system, you wouldn't need an AV or a firewall? Just some time, patience, and an educated user?
In any event, I do enjoy the peace of mind that comes with using AV software. It's not that I'm lazy or stupid and don't want to learn how to lock down a system. I simply don't have the time to. When I can, I try to use multiple methods (process monitors, registry monitors) to prevent the network from getting infected, I don't soley depend on the AV. But in a small business environment, like mine, where we don't have/can't afford a full time IT staff, it's simply not feasible for me to allocate that kind of time. I'm the only IT guy they have and I'm strecthed thin as is. Using an AV product seems like a practical solution for me.
So, I'm going to have to agree with all those who emphasized the notion that there really is no answer. It's relative to your situation.

i remember a paper about viruses and anti - viruses how they work and stuff
there was a famous guy in the business who said
you don't wanna rely on a commercial software to protect your computer
therer are lot of stuff if released, antivirus will be inefficace with them
i think he was right, cuz even with antivirus running and updated ... our systems keeps getting infected

but having antivirus is good but not enough alone , u must have good habits

personnaly, if a computer is not connected to the internet or network and if it has very low specs, running and anti virus slows ur system
this is the only case i prefer not to have it (of course i am the main one using this pc not everybody putting removable media into it :D )

i wanted to post you how to run norton without buying it(looks like u are a needy guy)
but i prefer not to do so.. cuz 1st u may screw up.. and mods will delete the topic :D

Quote:

---

I didn't know it was possible to lock down a system to the point where you could prevent viruses from doing too much damage via propogation, etc. without the use of an AV.

---

Would you run an AV on Linux or FreeBSD or Solaris, etc? Of course not, so why run one for NT which has at least the security capabilities of those other systems?

cheers,

catch

Quote:

---

Would you run an AV on Linux or FreeBSD or Solaris, etc? Of course not

---

I understand that some people do, apparently to protect Windows clients that are connected? I suspect that they are mostly mailservers?

Quote:

---

I understand that some people do, apparently to protect Windows clients that are connected? I suspect that they are mostly mailservers?

---

Well that is an aside... usually they are proxies that have virus detection capabilities, but not an AV in the sense of protecting the system from viruses.

cheers,

catch