Eyes Above The Waves

I did this 10 years ago...

Yeah I haven't installed any real antivirus for ages...an occasional MWB and Superantispyware sweep is all I've needed.

Did this about 4 years ago. Had no issues even before MS - just need to exercise patience and general knowledge.

Same here @johnnyCache.

This was meant for 3rd party antiviruses. Leave Windows Defender on.

if your laptop's running slow uninstall software you don't need and make sure your main hard drive is in good condition. also go to windows search and type up misconfiguration turn off all startups you don't need you can do the same in services, but i recommend you leave Microsoft services on

as that article shows , its not a political issue its a functional one , essentialy anti virus breaks apis and makes their results unpredictable.

What version of Malwarebytes? In case you are unaware the recent version of Malwarebytes has been riddled with thousands of bugs and issues. You can look at their forum

No. I just wanted to make sure Mozilla doesn't get blowback.

I'd use whatever Apple offers; if they don't offer anything, then "nothing" is probably better than the usual A/V vendors. MacOS is locked down reasonably tightly already.

If you are a business, Bromium. Not quite AV, but something better, imo, as it doesn't use signatures, but looks for aberrant behaviour; e.g your email should not be trying to access your customer database. Best of all, the way it works is to let the infection think it's succeeded, while recording what it's trying to do, and that can be shared without exposing your security.

Mac's do not require any antivirus.

Sir, i hope you never have children

heheh... Yeah that is it.. Mac don't require antivirus.. They are immune to all digital threats.. You might want to search that on snopes.com!!!

My wife is a graphic designer and uses nothing but Macs. Her company uses Macs. None have security on them. Is there Mac malware? Yes but far and few between. http://www.pcadvisor.co.uk/how-to/security/do-apple-macs-need-antivirus-os-x-security-explained-2016-3418367/

Mac's don't usually require antivirus software, because they have three significant deterrents. First is Malware Check, which functions similarly to Windows Defender, but runs silently in the background without any user interface. 99% of users never know that it's there. The second is GateKeeper. It's default configuration requires that any binaries be signed by a developer with an active developer account with Apple before it will run. (This can be disabled on an app-by-app basis or globally, but it is on by default). This allows malicious apps discovered in the wild to be disabled by Apple unless the user specifically re-enables them. The third is that any app sold through the App Store undergoes a code review and also is required to be sandboxed from other processes. So, while it's not perfect, given those three mechanisms, and the fact that the Mac installed base is less than 10% of windows, means that malware and viruses are virtually nonexistent on the Mac.

Just to be clear, if I'm not mistaken, Gatekeeper started with Lion (10.7), so those of us using Snow Leopard this advice is not relevent.

"Mac's don't usually require antivirus software, because they have three significant deterrents." BS! Macs don't have as many issues with malware because they have such tiny market share, and malware creators don't target it as much. The simple fact is as an OS Windows is more secure and has fewer exploits. This isn't even debatable. http://www.businessinsider.com/android-most-vulnerable-operating-system-in-2016-2017-1

I don't know much about it. Being open-source means it's probably less crazy-bad than the others. Still, I'd be skeptical that it's a significantly better recommendation than Windows Defender, for Windows 10 users.

As far as I know, it is the only free (as in freedom) antivirus. If you need more security than that, just go free software full way and ditch MS Windows altogether in favor of a free OS such as GNU/Linux.

1. ClamAV has poor virus detection rate 2. it is only a virus scanner (to be used on files or folders), it does not provide a resident shied checking the files before you open them.

ClamAV is an AV solution you need to run manually. It is therefore a nice enough "stick behind the door" for tech savvy users, not your average Joe. There are ways to make ClamAV work as a real-time AV scanner, but that software isn't made by the people behind ClamAV, and the last time I tried it, my CPU had a continuous load of 30%. SO I use ClamAV sometimes, I use online AV scanners more often and monthly malware scans. No virus or malware on my system for 10 years. That said, I run a strictly configured router/firewall on a completely separate PC and every device that connects through my LAN is on a separate VLAN with even stricter rules. All of the computers I use have mostly PortableApps tools and browsers are as vanilla as possible, with the exception of 'uBlock Origin' and 'uMatrix'.

Try this link to improve detection rate of ClamAV : https://www.securiteinfo.com/services/anti-spam-anti-virus/improve-detection-rate-of-zero-day-malwares-for-clamav.shtml?lg=en

You should stick to applications that are good at updating themselves. For example there's no need for Heimdal to update Firefox or Chrome, and getting it involved adds potential for catastrophic bugs. So it depends on what applications you use. If a random person asked me with no further information, I'd probably play it safe and say no since there's potential for badly-implemented updates to do great harm.

EMET ius being discontinued on July 2018

Windows 10 has EMET features built in.

Not all of them... https://betanews.com/2016/11/24/windows-10-security-emet/

For now....

Linux fan boys are as bad as Mac fan boys.. Mark my words, when you get hit.. It will be bad.

Yes, you are very much right. In fact, running bit defender and something like McAfee together will cause the OS to become unstable. Just my experience after doing thousands of virus cleanings.

That is why most real time scanners will disable Windows antivirus software. (And McAfee is utter garbage these days)

On-demand file scanners are certainly a lot less problematic.

I can't imagine why you'd allow regular users to attach BYO devices to your corporate network. That aside, what evidence is there that any third-party AV is a net security win over Microsoft's built-in stuff? I haven't seen any, even with all the comments around this post.

Calling the major vendors' products "anti virus" kind of highlights a lack of research, on your part. Apparmor/SELinux, for example, is pretty much considered best practice in the Linux world, so why is it that similar third party functionality in the suites that you dismiss as "AV" suddenly becomes worthless in the Windows world. There's much more to the major - let's call them what they are - HIPS software packages than you give them credit for.

SELinux has all kinds of problems. However, at least it has defined interfaces; the source is open and operates in a transparent fashion; distros take responsibility for configuring it and making it work with their application packages; and it hasn't been a source of egregious security bugs. Windows AV on the other hand is a crazy mess of closed-source code doing random patching, hooking, parsing arbitrary complex data formats in ring 0 and other blunders, changing unpredictably, with practically no coordination.

windows is different to linux in this respect because software vendors are considered potentially hostile to the OS as they are frequently not aligned to its goals. linux distros on the other hand tend to provide software that is more closely matched to the OS because of its maintainers including or packaging them instead of vendors.

"Defense in depth" does not mean that the answer to "should I install this 'security' product?" is always "yes". Each product you install adds vulnerabilities to your system as well as protecting you from some set of threats. The sets of threats overlap (e.g. if you're scanning email on the mail server, scanning it again on the client doesn't do much). > But to recommend either nothing or Microsoft built in offering is not the best approach if you care about the things you need to protect. I'd like to see an independent evidence-based evaluation of this. I haven't, and one hasn't turned up in all the comments around this post. Lacking one, and given the egregious blunders of the major AV vendors that have come to light, I still think being conservative in what you install, as I have advised, is perfectly reasonable for the average user.

I guess that one could then argue that since Microsoft also includes IE and/or Edge in their operating systems, one should not install Firefox, Opera, or Chrome either. After all, you are adding more software with more bugs and we do want to be conservative in what we install, right?

If IE/Edge are installed but you don't use them, no problem.

> The average Joe on the street is better served with anti-virus on their computer than not. I believe you may be right about that which is why I suggested Microsoft's stuff.

EICAR-like tests are mostly meaningless for browsers. By the time malware has been around long enough to be analyzed and its signature(s) (binary, behavioural, whatever) blocked by AV tools, modern browsers will have already fixed whatever holes they were exploiting. Firefox doesn't need to explicitly detect Web-bourne viruses; Firefox's job is to make sure that all such content is harmless. For modern browsers that are kept up to date your real threats are zero-day exploits, which can easily evade any AV product.

I think I need a good AV also because a few weeks ago, i've been on a TV streaming webpage and there was a trojan into the page. It has been detected by my AV but not by Firefox. What could you advise in this case?

I thought I was clear before. Without more details it's probably not worth me saying anything more.

I mentioned it in the post. Based on the data I've seen, I have a much higher opinion of Microsoft's people and processes than the other AV vendors. Also, because Microsoft's stuff ships with Windows they are more likely to get the integration right and be held to reasonable quality standards.

Avira: https://bugzilla.mozilla.org/show_bug.cgi?id=844714 Bitdefender: https://bugzilla.mozilla.org/show_bug.cgi?id=1310629 Firefox and Chrome use Google Safe Browsing for URL filtering so it's not "non-existent". Scanning Web content adds very little value. By the time malware has been around long enough to be analyzed and its signature(s) (binary, behavioural, whatever) blocked by AV tools, modern browsers will have already fixed whatever holes they were exploiting. Firefox doesn't need to explicitly detect Web-bourne viruses; Firefox's job is to make sure that all such content is harmless. AV products interfering with Firefox has historically made that more difficult --- including Avira and Bitdefender, as you can see above. Justin Schuh says it's the same for Chrome. This all assumes users are using up-to-date OSes and browsers, as I updated my post to make clear. Windows Defender may not be very good at the metrics you're talking about, but at least it does relatively little harm.

Well what if you never enable the plugings those AV products try to push onto your browser?

That doesn't necessarily stop them hooking and patching browsers; i.e. that wouldn't stop all the bad stuff they do.

"Windows Defender may not be very good at the metrics you're talking about, but at least it does relatively little harm." For the test suites that look at false negatives, Microsoft's consumer solutions are generally the king of the hill. How is that "relatively little harm"?

See http://robert.ocallahan.org/2017/01/a-followup-about-av-test-reports.html about test reports.

OK for the sake of time I'll just focus on https://www.av-comparatives.org/wp-content/uploads/2016/12/avc_prot_2016b_en.pdf. > That don't even bench the Microsoft built in av because of its low scores. This report does include Microsoft. In that test, MS got 97% (1570 out of 1619) ... lower than most of the other products, but the actual difference is very small. The major problem with tests like this is that they are designed to fit the strengths of AV products and avoid their weaknesses. The report doesn't say how they acquire their malware samples, but I guess they get them from the same sources AV vendors do. (They're not writing their own since they say they independently verify that their malware samples "work" on an unprotected machine.) So what they're testing here is the ability of AV software to recognize malware that's been in the wild long enough to be recognized and added to someone's database. That's exactly the malware that AV systems detect. But in the real world users will often encounter malware that hasn't had time to be classified yet, and possibly (e.g. in spear-phishing cases) will never be classified. A more realistic test would include malware like that. The test writers should cover that by generating a whole lot of their own malware that's not in any database, and see how AV products perform on that. My guess is that the detection rate would be around 0% if they do it with a modicum of skill. Of course in the real world, some malware authors can and do iterate on their new malware until they're sure the major AV products won't detect it. So for the sake of argument let's suppose 20% of the attacks in the real world use new unclassified malware and 80% use old malware and none of the 20% is detected by AV products. That would be 405 additional malware samples not detected by any product. Now Microsoft scores 77.6% and F-Secure is 79.9%. That difference doesn't look so important now. The other major issue with this whole approach is that it takes no account of the downsides of AV products. If a product slows down your system massively (more than other products), that doesn't show up here. If a product blocks all kinds of valid content, that doesn't show up here. If a product introduces huge security vulnerabilities --- even if they're broadly known --- that doesn't show up here. If a product spams the user incessantly with annoying messages, that doesn't show up here. Because of these systematic issues, this approach to testing actually does more harm than good because to the extent AV vendors care about these test results, they'll optimize for them at the expense of those other important factors that aren't being measured. There are also some issues with this particular test report. For example they say how important it is to test up-to-date software, and then test "Microsoft Windows 7 Home Premium SP1 64-Bit, with updates as of 1st July 2016" and Firefox version 43.0.4. But on 1st July 2016, the latest versions were Windows 10 and Firefox 47.0.1. Another issue I have with this particular report's product comparisons is that I suspect all it's really measuring is how closely their malware sample import pipeline matches the pipelines of other vendors. Maybe F-Secure won that benchmark because they happen to get their malware samples from exactly the same sources as AV-Comparatives and the other products use slightly different sources. The source of malware samples is critical here and I can't find anywhere they say what it is.

I agree with that, but it's not all I was trying to say.

This paper says ESET is especially bad about its TLS interception: https://jhalderm.com/pub/papers/interception-ndss17.pdf