Originally posted by: mechBgon
If you don't use P2P programs and use a little common sense about what you download and don't open email attachments, I don't really see where the threat is coming from for a sophisticated computer user.
There are plenty of threat vectors you're not accounting for. Hacked websites, zero-day exploits, non-viral threats, malware that self-executes from burned CDs or USB drives upon insertion... I could be up half the night laying out details, but just to cite a real-world one I encountered the other day:
Microstar's site hacked. And Asus's was. And the Dolphins Stadium site was. And once my own employer's site was. For the CD/USB ones, look up the Fujacks family just for starters. For zero-days, check up on the QuickSpace worm and just the whole QuickTime vuln situation in general. Or WinAmp and its exploits. Or Adobe Reader.
Not that I'm saying antivirus is the surefire cure. It isn't. It's mostly a reactive solution that leaves a potential window of vulnerability, for the obvious reason: the time lag between discovery, signature creation, and signature deployment. Heuristics are of some value as long as the new threats are somewhat like old ones... but if they're not, then what? Behavior analysis has some merit too, but again, it isn't necessarily a cure-all.
My recommendation starts by putting everything into a safety cage with a
non-Admin user account. Then build on that foundation. If you can use a
Software Restriction Policy on your version of Windows, then try that out. Keep ALL your software patched, including the third-party stuff like QuickTime, Adobe Reader, media players, browsers, etc. And the rest of the strategy does include an antivirus program and firewall protection, and certainly common sense too
I've never had antivirus software and have had maybe 1 actual virus ever in 10+ years.
How do you know your system doesn't have a nice modern rootkit-hidden malware on it right now? Rootkits will make your system scan "clean," you know. That's what they do. Best to have a security strategy that is not going to let one in the door in the first place, and an antivirus program is part of that strategy.
Granted antivirus programs theoretically identify new viruses that exploit bugs that aren't patched yet
That is not their primary role. Some of them can do a bit of that stuff.
but all the most damaging viruses I've read about have exploited bugs that there were already patches for.
Keep reading malware descriptions. Start by reading every one published by Symantec, every day, including the technical details section. One thing you'll notice is that most of them don't work on Windows Vista OOOPS did I say that? :evil: ...and that most of them fall flat when they're running in the context of a non-Admin user (see
this pic for an example, the red NOs show the various ways a non-Admin account would inherently thwart this malware). You'll also notice lots of Trojans, which rely on the unpatchable vulnerability: the human being.
Anyway, that is my position: use a defense-in-depth approach and don't shun the antivirus software.
good free antivirus software to look at. And when I say "good," I mean
this good :camera:. Still not good enough alone, but about as good as it's going to get.
Facebook
Twitter