It's time to toss out your antivirus software

[Lord_of_the_Dense]

Source: TechRepublic
By George Ou
May 26, 2006

There's been plenty of debate lately that maybe with the release of Windows Vista, we might be able to get away with not using antivirus on our computers. Well I'm about to make an even bolder assertion, that running antivirus or even additional third party security software such as firewalls on your computer makes you even less safe! Now before you start the flaming, hear me out first.

It's well understood in the security community that every additional piece of software on a computer system is another potential target for attack. That's why it comes as no surprise that another antivirus package is open to a massive attack that can affect 200 million Symantec antivirus users running Symantec Antivirus 10.x or Symantec Client Security 3.x. This is actually nothing new and virtually every Antivirus vendor has had their share of remote exploits. Even an extra security feature such as compressed file scanning opens the user up to additional vulnerabilities and all the major AV solutions have had their share of malformed compressed file vulnerabilities. Just the mere act of decompressing a ZIP or ARJ file to see what's inside of it could set off a malicious payload.

Every third party firewall product such as ZoneAlarm and Kerio have exposed the very users they're suppose to protect to complete system level compromise. Ironically the built in Windows XP SP2 firewall which always gets unfairly picked on has never had any remote exploits. Sure it doesn't provide any outbound packet filtering which is only relevant if my computer is already owned in which case any firewall could be disabled anyways, but at least it doesn't leave me wide open to a remote attacker. With the Windows Vista built-in firewall, outbound packet filtering is now supported but the pundits are already jumping on it because it doesn't turn on outbound blocking for user actions by default and requires command line manipulation to access the outbound controls. What's left out is that the XP SP2 and Vista firewall can be centrally managed via Microsoft's Active Directory group policy whereas the third party firewall vendors want you to buy an expensive enterprise management and policy deployment system. But with Microsoft's personal firewall and its superior security track record, and the fact that it doesn't cost anything extra, one has to wonder what the point of third party firewalls is.

Read entire blog here.

[lifehacker]

It wont last. People will find ways to get around Vista's protection just like they did with XP. And I doubt the protection Vista will have to offer is better than some of the secondary software out today anyways.

[shawners]

Actually this is microsofts plan all along.. Building a system thats entirely secure while allowing other third party software to be compromised or to run scripts or put a virus on the machine.

[Malakai1911]

I'll stick with Windows XP SP2, Nod32 AntiVirus, Ewido Anti-Malware, Outpost Firewall.... I feel quite secure.

And Outpost 4.0 is coming... with insane security, absolutely insane security features: http://outpostfirewall.com/forum/sho...435#post123435

[iShadowcat]

I'll stick with Mac OS X.

;)

Sure, I have to use Windows, but simply with the Windows Firewall, the latest Opera beta and Thunderbird for e-mail, my Windows machine never got a virus, with a little basic networking knowledge you don't need to dump $65 on Norton every year...and sure, you could argue the flaws of the Windows Firewall, but what firewall isn't flawed? Look at the recent vulnerability in Symantec's software, there's your hole right there, spending $65 for protection for a program with holes when you could've gotten that with regular Windows XP and Windows Update...

[Lehk]

I'll stick with Windows XP SP2, Nod32 AntiVirus, Ewido Anti-Malware, Outpost Firewall.... I feel quite secure.

And Outpost 4.0 is coming... with insane security, absolutely insane security features: http://outpostfirewall.com/forum/sho...435#post123435

you don't need all that

run behind a NAT
use firefox
launch every internet facing application (Web browser, Instant messaging, EMail) using dropMyRights

[lifehacker]

I'll stick with Windows XP SP2, Nod32 AntiVirus, Ewido Anti-Malware, Outpost Firewall.... I feel quite secure.

And Outpost 4.0 is coming... with insane security, absolutely insane security features: http://outpostfirewall.com/forum/sho...435#post123435

Same here. You have an excellent security setup by the way.

you don't need all that

run behind a NAT
use firefox
launch every internet facing application (Web browser, Instant messaging, EMail) using dropMyRights

NAT is not nearly as good as a firewall, and does not even pass all leaktests, it also gives you no control. For example if you have a trojan such as SubSeven on your computer and somebody is trying to establish a connection, the NAT does not stop it. However a firewall does. Firefox helps but NOD32 and Ewido in real-time offer you much better protection.

[DigitalJunkie]

I agree with lifehacker, protection from Windows Vista won't last long. Microsoft, has always try to make things easy for all end users so it would make compromises on security to run Windows!

[Auggie2k]

A good router setup with XP ICF, an Anti-Virus program for scanning only and Ad-Watch works perfectly. I haven't got a bit of spyware installed on my computer since I accidentally installed it while fiddling with it.

Any AV program that always runs in the backround slows down the computer something terrible. It's not nessecary for always on but just for scanning.

[.:sp00ky:.]

I havn't had a anti virus on my pc for years, viruses are for silly people.

[BigRIGG]

I use a hardware firewall, firefox and nod32, i get no viruses (Id be lieing if i said i dont surf porn and warez tho) last time I had a virus was on my older pc. Now I know you can get viruses just cause but if you dont surf stupid your good IMO. And I cant stand those anti trojan programs like ewido, they just plan suck, most virus programs will catch that without the extra crap software.

I know people thta dont even use a anti virus software, they have no problems.

[lifehacker]

I use in Real-time:
-NOD32
-Look n' stop firewall
-Process Guard
-NAT
The setup does not use many resources, and leaves my system well secured.

And I cant stand those anti trojan programs like ewido, they just plan suck, most virus programs will catch that without the extra crap software.

Ewido offers some of the best protection against malware available. What are you basing this opinion on?! Ewido's OD scanner catches things that many AVs dont including the top ones such as KAV, NOD32, BitDefender, etc.

[que-em]

I remember when they advertised XP as the most secure Win OS ever. Then not long after they had to patch a flaw, it's been a constant flood of patching ever since. I do think MS needs to handle their own security even if third parties get upset, though.

I've been playing around with SUSE, Mepis and Ubuntu and am starting to slowly get the hang of things(Hell I didn't learn Windows overnight). I think I'll be heading in that direction before Vista.

The only two program I use are NOD/Kaspersky and Outpost. Unfortunately NOD must be bumping heads with some other program, the computer starts blue screening everytime I install it so I use Kaspersky 6 now.

I've read a couple George Ou articles and everytime he's kissing MS ass.

[Malakai1911]

Same here. You have an excellent security setup by the way.

Thank you. Computer Security is going to be my specialty when I complete my CS degree :-). (I'm a first year student, so I'm no expert quite yet).

NAT is not nearly as good as a firewall, and does not even pass all leaktests, it also gives you no control. For example if you have a trojan such as SubSeven on your computer and somebody is trying to establish a connection, the NAT does not stop it. However a firewall does. Firefox helps but NOD32 and Ewido in real-time offer you much better protection.

Exactly, NAT is okay, but not nearly good enough. By the way, Outpost 4.0 is going to be integrating alot of ProcessGuard functionality, so definately keep an eye on it.

you don't need all that
run behind a NAT
use firefox
launch every internet facing application (Web browser, Instant messaging, EMail) using dropMyRights

I have a WRT54G with Thibor firmware. NAT is covered.
I use Firefox.
And holy christ, DropMyRights is amazing, its in my "must have" utilities now (unless I find it to suck, but so far it looks amazing). I'll be using it extensively soon. I cant believe how simplistic it is in design.

And I cant stand those anti trojan programs like ewido, they just plan suck, most virus programs will catch that without the extra crap software.
I know people thta dont even use a anti virus software, they have no problems.

You think you know, but you dont. Ewido is very, very well written piece of software, and is very effective against Trojans. Nod32 is, IMO, the best AV on the market right now, but even it can't possibly catch everything.

[lifehacker]

Exactly, NAT is okay, but not nearly good enough. By the way, Outpost 4.0 is going to be integrating alot of ProcessGuard functionality, so definately keep an eye on it..

I prefer Look n' stop as my firewall but I'll test Outpost 4 and try it out all the same.