Forum Home
Press F1
 
Thread ID: 105403 2009-11-30 21:38:00 Free Microsoft Antivirus mzee (3324) Press F1
Post ID Timestamp Content User
835411 2010-07-14 07:45:00 The only way you can really be sure is to use a HIPS such as Comodo D+ or Threatfire, and then use whitelisting to only ever allow applications which have been independently reviewed and certified as OK.

Only problem is that would be incredibly inconvenient...
Agent_24 (57)
835412 2010-07-14 07:47:00 Or check and see what it is / and does before you install something Speedy Gonzales (78)
835413 2010-07-14 07:53:00 Noticed in the current Aus PC user mag MSE is listed as an anti malware program and not an AV gary67 (56)
835414 2010-07-14 08:05:00 Or check and see what it is / and does before you install something

That doesn't work for drive-by download attacks on browsers though
Agent_24 (57)
835415 2010-07-14 08:09:00 Well keeping things up to date might fix that Speedy Gonzales (78)
835416 2010-07-14 08:12:00 It appears "AV Security Suite" is installed via a compromised website.

I might go back to AVAST ... that seems to have a Webfilter to intercept JScripts.
KiwiTT_NZ (233)
835417 2010-07-14 09:14:00 Well keeping things up to date might fix that

There's usually at least a couple of days between malware release and detection\definition update however. There will always be people who get infected before their antivirus\browser\whatever gets updated.

That is why a block all unknown is better, because it does not matter what the malware is, it will always be blocked because it is not certified as OK (and never will be!)
Agent_24 (57)
835418 2010-07-14 09:21:00 If you say so Speedy Gonzales (78)
835419 2010-08-10 12:51:00 If you say so

The basic facts of how the virus detection updates happen always means the virus scanner will be behind the virus writers:

1) The virus writer creates a virus

2) The virus is released out into the internet

3) X amount of time later (which could be anything), someone notices a virus which isn't detected, and submits it to an antivirus vendor.

4) The AV company gets the sample, analyses it, and writes a new defintion file. (I wonder how many AV companies will share this discovery with the others? Or do they keep it to themselves to make their product look good with higher detection rates?)

5) Another arbitrary amount of time later, the new virus definitions are pushed out and those with automatic updates, their PCs on, and their internet connected get them.

As you can see, during this cycle, there is a certain amount of time where computers can (and do) get infected before the new definition files are out.


As a side note of personal experience when I still had Norton AV (and yes, we know how bad it is, so this shouldn't surprise anyone)

I had a file which I quarantined because I knew it was a virus. It looked and acted exactly like a virus, yet Norton didn't detect it. It wasn't until 2-3 WEEKS later that a new virus definition update finally made NAV realise that the file was indeed a virus.

What's worse, I even submitted the file to Norton the same day I suspected it as being dodgy.

I don't know if this is a testament to how bad Norton is, or a good example for my argument, but I know I no longer trust definition-based antivirus as my first line of defense.
Agent_24 (57)
835420 2010-08-11 07:45:00 Yeah Agent_24's on the money there. In fact, some AV / Anti-Malware companies even just copy off of each other.

I remember back in the day that Spybot was being copied, they found out by deliberately putting a spelling mistake in their database in a few places.
Chilling_Silence (9)
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22