Malware Evolving Too Fast for Antivirus Apps

H

HardOCP News

[H] News
Joined
Dec 31, 1969
Messages
0
Experts say that malware is evolving too fast for antivirus programs. Th best antivirus software out there only blocks about one in four unknown malicious programs. Gee, that’s encouraging.

In our tests of how well security software blocks unknown malicious programs, the best performer detected only one in four new malware samples. In contrast, February 2007 results from similar heuristics testing showed that the best utilities caught about half of new samples.
Click to expand...
 
Hmm what about those 99% safe claims from AV companies :rolleyes:

Sad how much money people can make off of identity theft and such :(
 
jmackay said:
Hmm what about those 99% safe claims from AV companies :rolleyes:
Click to expand...

I supect that they count all malware ever, so you are safe from the vast, vast majority.

Just not anything recent :p
 
I have been hitting some stuff within the past year that NO av or antispyware program can get rid of. Really nasty stuff. If it comes to that I usually format/re-install.
 
The best antimalware remains the education of the user. AV software is no substitute for common sense and some general knowhow.
 
AbsintheCommando said:
The best antimalware remains the education of the user. AV software is no substitute for common sense and some general knowhow.
Click to expand...

Exactly, just use common sense and avoid downloading if the source is unknown or potentially dangerous...

 
if i get a totally fucked pc, i run some software, i NEVER install antivirus, im against anti virus, but i do run avgfree, just to detect.

if i get virus, i dont clean, i reinstall windows, delete ANY infected files to later download them..


But my reccons is:

http://technet.microsoft.com/en-us/sysinternals/bb963902.aspx

its for andvanced users, and MS could not ever create anything smart as that themself :p

also i reccon ccleaner, and some other smart apps.

try it.
 
And people think the UAC in Vista is a pain in the butt. Is it worse than having to clean up after an infection or worse yet identity theft?

Granted you still have to be smart enough not to just click through, but it's better to give users more than one chance to consider the installation than it is to not ask at all...
 
Programs depend too much on signatures now, they can catch almost everything that is known, but fail to catch anything new.

As for those of you that DON'T run active antivirus software on a Windows PC I would say you stand a GOOD chance of being infected.

Just this Christmas I picked up a digital picture frame for my Dad that had built in memory. I connected it to my PC in advance to preload some pictures as part of the gift only to be prompted by Avast that the device was infected. I had to delete 3 executables that where on the device and an autorun.ini file. I didn't get infected but if I hadn't been running an active scanner at the time I would have.

Things like this along with reports of Maxtor hard drives shipping infected keep me running active protection.
 
Virus is a good word for it....

Just like real life, virus' mutate, and infect, and only AFTER infection can you develop the antibodies to fight it in the future.

It will take a new paradigm to break the cycle, whatever it ends up being (if anything) will make a SHITLOAD of $$ for someone. :eek::p:D
 
I never feel the need to run an AV. If I don't trust the source of the software and only need to run it once *cough* A virtual xp machine that just reverts back to default after a single run is perfect :p
 
I use Sandboxie to run Firefox in a sandbox.
Every so often I delete its contents.
Nothing gets to touch my OS through the browser.

The only bind is that saved files need to be copied out of the sandbox or Sandboxie allowed to write to the actual hard drive. I copy them out manually.
 
Luthorcrow said:
Avast? You set your AV bar kinda lower there.;)
Click to expand...

Avast has a feature that I have yet to see on any other Antivirus. Pre-boot scanning. Runs in the same space that CHKDSK does when you schedule it to run. This way its able to clean up any viruses in those pesky restore and other protected areas without you having to reboot into Safe Mode to do it. Why no one else implements this, I have no idea...

I use NOD32 myself though. Its heuristics abilities is what keeps me tied to it. That and its unobtrusive nature and speed.
 
Blackforge said:
Avast has a feature that I have yet to see on any other Antivirus. Pre-boot scanning. Runs in the same space that CHKDSK does when you schedule it to run. This way its able to clean up any viruses in those pesky restore and other protected areas without you having to reboot into Safe Mode to do it. Why no one else implements this, I have no idea...

I use NOD32 myself though. Its heuristics abilities is what keeps me tied to it. That and its unobtrusive nature and speed.
Click to expand...
plus, it has a free version for Vista64. free AV software is hard to come by for Vista64
 
Luthorcrow said:
Avast? You set your AV bar kinda lower there.;)
Click to expand...

Of the Free options out there it is the only one that:
- That only asks you ONCE a year to renew the free license or upgrade
- Has an auto updater that runs in the background and updates both the definition and the engine with out popping up a huge ass dialog during login. (it does have a small reminder when it is ready to reboot or has completed an update)
- Its offers active detection for IM, P2P and Email

Antivir offers the highest level of detection among the free products, but its update system in the free edition annoyed the hell out of me daily
 
Lazybones said:
…Antivir offers the highest level of detection among the free products, but its update system in the free edition annoyed the hell out of me daily
Click to expand...
Exactly. All of the freeware AVs have lower detection rates and higher false positives than most of the commercial products. None of the free AVs can keep up with the top 5 commercial AVs. Their false positive rates tend to be very high, which most AV experts consider a bigger issue than lower detection rates. This because false positives may cause even experienced users to take unnecessary actions that often can damage data or render the OS damaged or inoperable.

Further the real value of a commercial AV is how often it updates. As you can see from this article AVs primarily are good at catching known viruses so AVs are only as good as their signature DB. Kaspersky updates every couple of hours and when I saw update I don’t just mean it checks but new signatures are being updated every couple of hours. A free AV, is not likely to update more than once a day and maybe even less than that.
 
You must log in or register to reply here.
Back
Top