Anti-virus software...is it *really* necessary?

A question I've been mulling over recently. I have McAfee installed, and my computer has a Core 2 Duo CPU and 2GB RAM, so it runs Vista Home Premium like the clappers, but how much faster could it be if I got rid of McAfee?

I've often wondered if the best protection against viruses is sound browsing practices. I use Firefox and only really browse 'professional' websites. To put that in context, I don't search out free music from any old website, and I certainly don't download porn on it.

To add to that, I have a firewall router, currently set to Low (blocks most attempts to access my network, save for pinholes, NAT servers, etc ie. Xbox Live, Limewire and Bittorrent, which I've granted access).

Is there not a case for saying that I could confidently get rid of McAfee, and rely solely on a combination of safe internet practice, my router firewall and Windows Vista's firewall to see me through? The whole 'Big Brother' virus scanning thing just seems a bit excessive to me.

 

AV isnt required for most of the little things, but when big nasties come along (lsass anyone?) You better hope you have AV.

 

That's like asking if you should lock your car before going into the supermarket. 99.9% of the people won't steal it or screw with it. (Hey, you're not in the ghetto, are you?) But what would you say if you come back and your radio is missing, your seats are slashed or someone has done mechanical damage to your car? Better yet, what would your insurance company say?

Another example: You first meet someone, they seem classy & respectable, pass all of your tests and even met the parents. You decide it's time to "consummate" the relationship and don't use contraception/protection, or get tested first. Hey, she probably won't give you anything or get pregnant, right? You might be OK, but can you live with the risk?


I know it's kind of a crude analogy, but what I'm trying to say is...it's not worth the risk. If your computer runs properly now, why change anything.

Here are a few tips though, if you decide you want more performance (even though the new core chips are great at running more than one task a night)

-Set your anti-virus scan to run when you're not around (middle of the night, church service, etc)
-Turn the anti-virus when doing something intenstive offline (gaming)
-Look into less bloated A/V solutions (AVG, avast!, there are more I'm sure)

 

That's all true I suppose. I hear Norton and McAfee are the biggest system hogs, so I'd be interested in trying out AVG, Avast, Kapersky, etc, in order to make an already fast system go even faster! Problem is, I have little confidence in free AV software. After all, you get what you pay for, right? In any case, which of the free programs are best, and why? Useful criteria includes and is not limited to performance and resource usage.

 

Well a little common sense goes a long way. I wonder if you had a decent firewall (whether free/paid) that was set up correctly and you had responsible surfing habits, whether you'd need an a/v?

AVG Free is plenty fine. But again, that's speaking from some one who doesn't even use torrents, even though for the most part they are mostly clean. I have moved onto AVG Pro + firewall, but only for the small ram use and all inclusive package. I don't even bother doing an a/v scan any more. Waste of time. Trust me, I know my system is clean I don't even let cookies stay on my system longer than 2 min after I'm done with the www I'm that paranoid!

 

I dunno let the internet world know some key numbers like IP and stuff and we'll let you know :laugh:

 

i say not only a good AV is imp like McAfee and Norton, but a good firewall is also imp in this age of internet yaHoos.

I am using NAV corporate edition and ZoneLabs Firewall Pro. and i am one of the happy users on the net.

I know some ppl dont install these, because it slows the system, But i have a solution for that. Install 2 XPs on ur system, One for ur daily work/gaming/entertainment etc with AV less settings so system can run great, and 1 OS i mean XP for Net. where i have installed AV with good settings and firewall and other spyware utilities and i only do net on this window. so external threats are eliminated right away.

 

Limewire and Bittorrent are not super secure. Anything you download comes from another user, so not having an AV is taking a big risk. If it was solely a browsing/email machine then maybe, but even then there's junk mail and phishing.

Get NOD32 or Kaspersky. These will be virtually unnoticed. With 2 gb of RAM I doubt you'll notice a big speed difference though.

 

It's not really necessary. I've run without antivirus on my (Windows XP) computer for quite a while now, with nothing to show for it except faster boot times and a lower average CPU load. I've family members who have run with antivirus software, and through bad browsing habits, managed to render their computers unusable, such was the state of infection.

If you're fairly savvy, and cautious, I can't see the difference in risk from not having an antivirus to having one being that large (after all, they're not likely to catch the 0-day exploits anyways, and they won't protect you from actively trying to get infected).

It's probably a good thing to have around, all the same, especially if you download a lot of files from public places.

 

I run my AV software crippled. I use an older version of Norton with most of the services turned off. It still autoupdates and runs a virus scan in the middle of the night, every night, but it's not permanantly scanning stuff in the background. Basically if I somehow get a virus (only one I've gotten to date came from Microsoft.com, dl'ing SP2 update), Norton isn't gonna pop up and alert me, but I should find out about it the next morning after the scan's run. Figure it's an acceptable compromise between resource hog and nothing.

 

Necessary vs unneccessary is somewhat different for every person. Like others said, it is better to be safer with some AV than sorry later because you have none. If resource consumption is a major issue, there are ways to reduce it without necessarily reducing your AV protection. Other AV products like NOD32 exist which are equal if not better than Mcafee overall while being less taxing on your system. HIPS protection can also be highly effective against threats also, but requires a greater amount of work on the users part in order to use well. Getting rid of AV products entirely is somewhat extreme since you never know if you will ever need them later, but there are alternatives which can ensure protection without taking as much resources.

 

AV is becoming less necessary these days imo, but there is still a big risk from not having one.

One example is for email. Mainly if you use a e-mail client instead of going to the site. Avast does a good job at scanning my emails as it is downloaded from POPPeeper or Outlook.

Most AV apps now focus on the AD/SPY/MAL wares too along with viruses. So if you don't use a AV it would be wise to use a Spyware app like AD-AWARE PRO or SPYBOT and use their real time resident watcher option. Closest best thing to a AV imo.

Even with Vista's UAC I would still have some sort of back-up, cause once some virus or spyware gets inside it might be a "B" to get it out. But with Vista's UAC I would be most worried about installing a app your interested in that just might also have malware in it. Being that you already allowed the UAC to do so.

And Of course use a AV & Anti spyware app to at least scan your drives one a week or two. You could have something and not even know it's there. EX: loggers usually don't take much resources and can be well disguised. So the average user will not suspect anything.

 

In the last 5 years I have had 2 viruses get caught by AV.

I prob wouldnt use the sytem without something.

That being said I agree you just have to figure out what fits you best and if you want to live with the risk.

I don't like the Internet blocking features though and disable some of those as well as make it so the system doesn't scan your drive 24hrs a day.

 

Waste of system resources if you ask me. If you're not doing, downloading, or installing anything dodgy, or visiting em phishing sites with ActiveX enabled, you're in the clear. Always be aware of the types of files that could potentially contain virus code, and always verify attachments your contacts send you before downloading and launching them. You should follow these steps even if you have AV software, as most of them are 75% effective at best.

Finally, if you must run something and it's from a suspicious site, then download VPC or VMWare and run it in a virtual OS and track your network connections. That way, if it starts phoning home unexpectedly or wiping your files, it'll be doing so in a contained and expendable environment.

 

If you feel you don't need it, by all means, disable the real-time protection and save yourself a bit of resources. But I would recommend keeping an on-demand scanner available just in case (especially if you download questionable files, always a good idea to scan 'em before executing).

 

Uh no. you need antivirus.

That is a contradiction. Getting rid of Antivirus is not safe internet practice (Swapping McAfee for something that doesn't slow down your system almost as badly as Norton is acceptable though)

Either that, or you are one of the tens of millions of PC's in various botnets, and where the owner *thinks* it's clear.
Thank you for contributing to the spam in my inbox. (That's why I'd say it's neccesary for everyone. You're not just screwing over your own system. Also the millions of others who are drowning in spam sent from computers just like yours, where the owner *thinks* he doesn't need antivirus, and *thinks* he doesn't have a virus.

Why *not* allow antivirus to run in the background?
What system resources does it consume? CPU cycles? Only when it has to scan something (when you ask it to scan, or when you receive a file) - Should be acceptable.
Memory usage: Only when it's actually burning CPU cycles. The rest of the time, it can be pushed to the pagefile, which means you have all the free RAM you need.

 

Wow, nice one Jalf. You managed to ignore half my post while simultaneously accusing myself and others of spamming your email address, despite the fact you have no idea what software I use and what precautions I take without a software AV. Here's a hint:

Also, a lot of AV software behave in the exact same way as viruses and trojans, with the exact same symptoms. For example, if you have Norton installed, it will 1) become a permanent memory resident on your computer, hog system resources, and slow down your computer in general, 2) throw BSOD's and corrupt system and registry files when something goes wrong, 3) phone home without notifying you before hand with data that you may or may not find sensitive or personal, and 4) corrupt files when attempting to "clean them", thus forcing you to either delete the file or repair your OS if it is a system dll.

Furthermore, most AV's have a relatively low and unsafe hit rate with respect to detecting and neutralizing harmful code in the files on your computer. I liked vespoli's analogy the best; would you be happy if a certain type of contraceptive was only 70-80% effective?

So you know what I *think*? I *think* you need to pay more attention to people's posts in their entirety, instead of *thinking* people don't know as much as you and are "just screwing over your own system... Also the millions of others who are drowning in spam".

 

I have pretty much run w/o AV software for nearly 10 yrs now...not a single infection, ever. Like mentioned common sense and learning to recognize where these programs come from and how they propagate. But, it is not for the average semi-knowledgeable user. It takes some understanding of what is safe and what is not safe.

First, never open email in anything other then text mode, do not display pics in emails (from anyone), no torrents of any sort...gotta have a hardware firewall (I would add a software firewall as well...whatever is good and free at the time.) Last you should block potential probs by specifically blocking access to them using a HOSTS file. You can read about that here:

http://www.mvps.org/winhelp2002/hosts.htm

Of course there are other things you need to keep an eye on...my biggest issue is at renewal $50/year here and $75/yr renewal there suddenly owning a PC is just like owning a boat...it's a hole in the water you just keep throwing money into...and those "renewals" are nothing more then a monthly software rental fee. And $5 adds up fast if you are doing that with several pieces of software each year...btw, 99% of those "upgrades" offer little to no actually improvement in the software. Most are just getting bloated with more ways to restrict the use of the software you thought you were buying.

And you still should run a free scan every so often just to make sure you are doing a good job.

You should also adjust cookie handling to not allow 3rd party cookies. This and temp files is an area where the HOST file adds a nice layer of protection. I probably clear everything 5+ times/day...but I am on every day for hours at a time.

There are also the issues of ActiveX, browser plug-in's...java, and other stuff too...but in therory those are things you are already paying attention to...right?

The problem with AV and even firewalls is the causual user seems to assume that is all they need to do...not even close really. The software really gives them a false sense of security.

But, like I mentioned I have been doing this the same way for a looong time and it works for me...but, for the novice or casual user you need all of it...why do I suggest that? To keep ME protected, I could care less about your data, it's my data I care about...

 

You definitely havent tried Norton Internet Security 2007 for Vista. Definitely NOT a resource hog. I tried it with 2 Ghz Core Duo, 2 GB and Vista Business everything feel as fast as before the installation. And it occupies only 49 MB of your harddisk.

I installed it to another PC (it sold with 3 user license per package) with 1,6 GHz Core Duo, 1,5 GB RAM and Vsta Home Premium. Everything also as fast as before the installation.

I kept repeating the same post about NIS 2007 in various thread in this forum because i was the-not-satisfied customer of Symantec. It is a very big surprise for me to see that their 2007 release of NIS is really slim and good. I think they have re-written the code.
Just hope they have not decrease any scanning ability.

 

nowadays, an AV is not really required anymore (especially since it is a waste of resources)... as long as you have the following:

- Good Firewall (Hardware, or ZoneAlarm Free Edition)
- One or two free Malware removers (Ad-aware, SpyBot) that are manually used so that resources arent wasted since these dont need to be in the background all the time.
- use a good browser (Firefox 2), Internet Explorer is prone to have exploits, even in the newest versions.
- (optional) if you are using an email client (DO NOT use Outlook Express), use Thunderbird or normal MS Outlook that comes with MS Office

I personally never have had probs with viruses, only gay worms/malware... which was easily remedied with Spybot/Ad-aware scans, and double check with HiJackThis.

I still have Symantec Corporate AntiVirus installed, but its disabled to startup with Windows, I only use it to scan when needed... which has not been the case for many years.

 

Why worry about resources? Just use Avast, Very low resource usage and it's free.

 

Currently I do not have any ant-virus because I cant find anything free with decent low system resources and that wont give me errors.

AVG and Avast gave me errors.

 

...you can do without antivirus software only if you stay away from the interweb...

Also, what kind of errors are you getting?

 

So you think viruses can't reach your computer, but other kinds of malware can? If antivirus isn't neccesary, ad-aware shouldn't be either. And if Ad-Aware is neccesary, antivirus should be too.

So is Firefox and Opera. Not as much, but still far from safe.

Again, far from safe.

You mean you have never *found* any viruses on your computer. There's a difference.

Again, you mean without *noticing* a single infection. Probably true. It can be hard to spot viruses without programs to detect them.

Of course, with a decent firewall, you'll render botnet-kinda viruses harmless because they won't be able to do anything online. But that still doesn't solve the problem of viruses that just affect your own computer.

Well, I can't very well take into consideration anything you didn't write in your post, can I?

Viruses don't neccesarily do any of those.

I suggest using different AV software then.

Example? The difference here is that AV software comes with EULA's you can choose whether or not to accept. If you have any examples of AV software violating their own EULA's, please provide an example or two.

Again, use different AV.

A lot happier than without, which gives you 0% effectiveness. I'm not saying AV software is perfect, but that it is a good start.

I *think* you missed my point a bit.
You may or may not have avoided viruses. I don't know that (and no, you don't either). My point is simply that it's a fact that tens of millions of computers *are* being used by hackers and spammers, and that a large proportion of them belong to "computer-savvy" people who think they know
so much they don't need AV.

Some of them are right. And some of them get lucky. But a lot of them end up infected without even knowing it.

 

Just get an on-demand scanner, like bitdefender 8 (free), and run a scan like once a week if you don't wanna waste resources.

 

[Translation]"Well, I can only take into consideration anything you did write in your post."[/Translation]
Well my friend, you didn't take into consideration half of my post explaining what you should do without an AV, then went on to group me into one of "tens of millions of PC's used by hackers and spammers". That's nice.

As an example, viruses can do any of those.

As an example, many AV do exhibit those traits. It's up to you to experiment with them on your computer and find the one that annoys you the least.

Sure, look up WinFixer, WinAntiVirus, ErrorSafe, SystemDoctor, DriveCleaner, Pest Trap, SpyAxe, AntiVirus Gold, SpywareStrike, Spyware Quake, WorldAntiSpy, Spy Sheriff, Spy Wiper, PAL Spyware Remover, PSGuard. I'd say their EULA's differ greatly from their behavior.

Meanwhile, you're stumbling around trying to find an AV that doesn't BSOD your system everyday, and you install one of them on your computer. And to your surprise, it works fine, and catches all these "viruses" in memory. And you think "yay, an AV that works and protects me from those nasty viruses Gator is sending out!".

Or do you mean to say we should just download the well known AV's like Norton instead? 'Cause you know the virus makers are tailoring their code to evade detection by the well known AV's, right?

Again, it was just an example. I can't give you all of the cases without writing a novel, which I do not intend to do since it doesn't help further the understanding of software in the NBR community.

So again you missed my point. If you take care of your system and use common sense, as well as follow my advice, you would have close to 100% effectiveness without an AV.

I can bring up all sorts of examples of viruses or worms or spyware that would prevent your AV from running or even from being installed, such as Gromozon. No, safemode doesn't work either because *surprise surprise* it hides in Windows critical processes that start in safemode. Mix in a typical rootkit implementation and you're going to be hard pressed not to reformat your computer.

All of which can be avoided if you run the thing in a virtual OS.

You know what, I do know that I don't have any viruses. I control what programs are installed on my computer. I don't visit suspicious websites. I don't have some naive notion that just because I have AV that I am protected somehow from my own responsibilities as a computer user. It's people who think that just because they have AV, they can do anything they want, visit all the dodgy websites, install all the cracked software they want...those types of people who are contributing to the botnet of DDos ready PC's.

I did some virus scans just to prove my point, using TrendMicro, Avast, Avg, and RootKitRevealer. It took a little while, because they couldn't all run at the same time---which is another problem with AV's, in that only one can be in active memory at any time. My logs came up clean, and I'm not one bit surprised.

Finally I agree. Only that I agree people with AV who don't exercise precautions end up infected a lot more often than people like myself who do.

 

Jalf, what do you think? My feeling is a little closer to Gator's than yours:

Antivirus software isn't the be all and end all to freedom from virus infections. You can be running it, and still manage to get your computer messed up badly. By the same token, you can run without antivirus software, and manage to keep your system clean. If you do a lot of risky stuff (warez, shady porn sites), you will get a malware infestation. You might anyways, due to some software vulnerability, or something less exotic, like a friend passing you a bad file, or even from google or apple.

Once you have a virus, the virus scanner will probably catch it. It might save you, or it might miss the virus because its database hasn't been updated with the signature yet, or you might be out of luck at that point anyways.

So, the question is, what's the tradeoff? Is it worth the inconvenience in system resource usage (apparently minor if you choose the right software) and money (there are free virus scanners of lesser prowess) to have the extra-but-not-complete protection against viruses? And, especially, what's the difference in risk between being careful with a virus scanner, and being careful without a virus scanner? (Premise being, if you're not being careful, you're screwed anyways.)

My own feeling is that I'm savvy enough and paranoid enough that the difference in risk is small, since I'm probably only going to get caught with the esoteric, evil type infections anyways. (And, I guess I could always put suspicious files on my work computer first, just to be safe )

 

Heh a long thread. Although I admire jalf's knowledge (he showed a great experience in many posts on NBR), I must say that I personally don't use any AV and am absolutely sure I can track down and get rid of the most of the vermin. If I cannot - I am pretty sure I will find a tool that will help me at that given moment. I found no reason whatsoever to have the service that slows my machine down for nothing. I managed to get rid of many viruses, malware, adware etc... using task manager, management console, regedit, notepad, windows explorer or in worst cases safe mode with command prompt. And Windows Defender seems to be a pretty good ally when th s..t hits the fan. It gives you a chance to track it down. Repair function on XP SP2 disk also helps after some of the system files are compromised.
It sounds radical - but I have my Documents and settings on my D disk. So I can format C whenever I want and soon I have clean Windows. It is a quick edit in registry.
I must admit that I personally cleaned only two viruses on my comp(s) in my 15 years experience and it was more that 10 years ago. Other tens of current viruses were cleaned from my friend's computers that usually had some kind of protection. The worst ever battle I fought was with Norton Av. I finally killed the bastard. And just to mention what a small hidden autorun.inf can do in your volume root is a real menace that no AV will find and most of the people will swear that it is a virus everytime they start explorer shell. I really don't understand that people - if one AV can't find it - they install 2, 3. And more AV programs actually make things worse.

Gator and others here sound reasonable too and in a way I agree with the most of their thoughts. I would say that common knowledge or common idea of what a virus/worm/trojan is and how to avoid infection helps a lot. Windows security is also powerful if you know how to use it. Windows firewall is in my opinion very good. Why would I disable it and install ZA for instance? What is the purpose of firewall? Ask 100 people and 10 will know. But 90 would say that you should install ZA because it is better than WF. And WF is a good firewall. Put aside advanced stuff that use only those who MUST. And they know why and how. And I did some advanced stuff with it, having absolutely no issues.
One good tip for people who want to protect themselvers from themselves (literally) is to surf the net logging in as a guest. It is easy (just click on switch user). I believe that account should be so restricted that infection should be minimalized. And when I come to the National library and find that I can delete, move, rename, change pass, disconnect, log as an administrator on literally hundreds of computers in a wireless network I feel bad. Because someone will eventually do that. It seems that people don't actually care about their home photos (even kinky stuff), porn movies on disks, installations of cracked software, business and confidental data (check how many laptops FBI lost last year). Do they? How many people check their permissions on disks? Do you have "everyone"? Do you like that "everyone" can "read, browse or execute" your programs, folders, files? No? Why do you have it enabled then?

Internet you say? Browser will just help you be a bit more secure. And nothing can help you if you download some exe from www.verynastystuff.com and start it (while logged on as an admin). Firefox is very secure. Statistically. Wait until it becomes no 1 (if MS doesn't buy it before).

I am not against AV, I like some of those programs - they are helpful, but no way it is an obligatory software on a comp. It is recommended at most in my opinion. It is better to know your enemy and know how to kill it. But it depends on your experience, so many people have just AV. In that case I hope AV software becomes better and faster and I hope OS becomes more secure. Vista is more restrictive in that sense. We'll see, we'll see....

Cheers,

Ivan