What is the purpose of Anti-virus software?

[derickdub]

I've recently seen a lot of posts asking what anti-virus software they should get for their macs, and I agree with most of the answers. None. But why are people so concerned with getting anti-virus software? Even on a Windows computer I can't see a need for it. To me it's just a resource hog and gives users a reason to do irresponsible things with their computers.

I've had my own computers since I was 10 years-old and I am going on 21 now so thats almost 11 years. I have never once had a virus in that time period. That's even after pirating games, movies, music, software, ect. There have been times I have downloaded malicious files, but it never got passed that.

A lot of people think I'm tech-savvy and always ask for my help with their computers when they are running slow or not responding. Every time I go to help them I find the only thing wrong with their computer is the mass amount of trial software and free-ware that was installed with other programs bogging down their computer. Like they don't think to 'uncheck' the 'Install Ask Toolbar' when installing something else. I think if people would take the quick second or two to read the dialog box before spamming the 'next' button they wouldn't have so many problems with viruses.

I seriously feel like an @$$ when people ask me for anti-virus software recommendations because my only honest answer is stupidity is the only reason to use it. Sorry for the rant, but do others get where I am coming from? Is there really a legitimate reason to use it? Because even when people do it never seems to help.

 

[shyam09]

actually i do see your point. it all comes down to common sense.

on a mac, there is literally no need for it. i guess it is just paranoia because of the number of Windows Users meeting a virus, and maybe not enough familiarity with the OS X environment?

to be honest, it has been a really long time since i had a virus, not sure if i remember what a virus does in the first place [well i know it replicates and spreads and all, but i forget the purpose, etc lol]

but im curious what do you say to an anti-malware program say something like Malwarebytes Anti_Malware [for Windows of course]

 

[kasakka]

Its main purpose is to protect the user from his or her own stupidity. It's unfortunate but a big portion of computer users have a hard time grasping even the simplest things when it comes to working with computers. These are generally smart, well educated people too.

I don't use an antivirus software on Windows Vista/7 and haven't had any malware for years.

Of course it doesn't help that Microsoft has ****ed up two things: the installation paradigm and the security dialogs. The security dialogs don't give enough info and on Vista they popped up so frequently that you got used to just clicking ok no matter what. The installation paradigm is just ******. It requires tons of confusing (to the average user) choices and clicking the next button way too many times. By comparison the Mac "drag to applications, configure later" method is much better.

 

[antonis]

The real reason that antivirus s/w exists on Mac platform (same goes for Linux platform as well) is for the scenario where your Mac connects to a corporal windows environment. Some companies enforce the usage of antivirus, not because your Mac maybe infected, but because you may get infected files from a windows machine and pass them to another windows machine, infecting it as well.

 

[summitRun]

The answer is...

To make money...pure and simple. Companies like Norton spread fear and scare people into thinking they need something they dont. Thats Capitalism...its up to each person to sift through nonsensical information and decide if its relevant for their use.

 

[wpotere]

On a mac there is no need as there really aren't any viruses for OSx. However, you stated that you see no need to run it on a Windows machine and that is where you will have issues. All it takes is a spam message with a payload or you to click the wrong link and your computer could be infected. With some viruses all it takes is your computer to respond to a ping for it to become infected (blaster via RPC) so even if you think you are being safe you could easily have multiple viruses on your Windows machine. As for hogging resources, Microsoft Security Essentials is very light and has little to no affect on the system performance. Better to be safe than sorry. The last thing you want is your computer sending out your information or to be used in a DoS attack.

People that don't think they need it on a Windows machine are foolish. I had a customer that said the same thing until I loaded MSE up on the machine and cleared off 154 viruses.

 

[CylonGlitch]

People that don't think they need it on a Windows machine are foolish. I had a customer that said the same thing until I loaded MSE up on the machine and cleared off 154 viruses.

Very true, if you don't run any anti-virus applications, how do you know you don't have one? Ignorance is not bliss.

 

[MisterMe]

I've recently seen a lot of posts asking what anti-virus software they should get for their macs, and I agree with most of the answers. ...

The purpose of antivirus software on a Mac is to prevent your Mac from acting as a relay for Windows viruses. The purpose of antivirus software on Windows is to protect your system and your information from the many viruses and other malware on the Windows platform.

The Windows users who claim that they don't have antivirus software and have never had a virus are kidding themselves. They labor under the delusion that the purpose of a virus is to bring down their own personal computer. This is a characteristic of a malicious prank or, more likely, a badly written virus. However, the major reason to write viruses to make money for the developer. You can't do that by calling attention to yourself.

I would love to do a scan on the Windows computer owned by someone who is "too smart to get viruses."

 

[arjen92]

I would love to do a scan on the Windows computer owned by someone who is "too smart to get viruses."

Well, I thought I was too smart to get any viruses But as you said, how would I know? This computer had been running for three years without any virus protection. Very few serving on the web though. After installing AVG (this was 2 years ago) NO virus was detected.

Well, there you go. I was "too smart to get viruses" and the virus scanner proved this to be right.

 

[wpotere]

Well, I thought I was too smart to get any viruses But as you said, how would I know? This computer had been running for three years without any virus protection. Very few serving on the web though. After installing AVG (this was 2 years ago) NO virus was detected.

Well, there you go. I was "too smart to get viruses" and the virus scanner proved this to be right.

You were simply lucky.... Viruses don't need user intervention to load on a machine. This is the main reason that some people are saying what they are saying. Your computer can simply be infected by being connected to the Internet without you ever knowing. Like I said, I have installed and scanned computers of people that stated they were "too smart" to get a virus and this one person had 154! Can it happen? Absolutely, if it couldn't then the blaster virus would have been ineffective.

 

[old-wiz]

To make money...pure and simple. Companies like Norton spread fear and scare people into thinking they need something they dont. Thats Capitalism...its up to each person to sift through nonsensical information and decide if its relevant for their use.

Spreading fear and misinformation is very profitable these days. The more people they can scare into buying their products, the more money they earn.

Home security companies give you the impression that it is common for burglars to break into your home in the daytime while you are there, which is not common at all. Plus in quite a few states breaking in like that is an invitation for a very unpleasant, possibly fatal, meeting with a Smith and Wesson or 90 pounds of dog with sharp teeth.

The government does it as well.

The anti-virus companies give you the impression that simply opening any website on your up-to-date Mac will give you a terrible virus that will cause the HDD to disintegrate, the keyboard to melt down, and the screen to explode, blinding you with flying glass and finally the battery will explode as well. Or maybe that is a slight overstatement.

 

[Penn Jennings]

I've recently seen a lot of posts asking what anti-virus software they should get for their macs, and I agree with most of the answers. None. But why are people so concerned with getting anti-virus software? Even on a Windows computer I can't see a need for it. To me it's just a resource hog and gives users a reason to do irresponsible things with their computers.

I've had my own computers since I was 10 years-old and I am going on 21 now so thats almost 11 years. I have never once had a virus in that time period. That's even after pirating games, movies, music, software, ect. There have been times I have downloaded malicious files, but it never got passed that.

A lot of people think I'm tech-savvy and always ask for my help with their computers when they are running slow or not responding. Every time I go to help them I find the only thing wrong with their computer is the mass amount of trial software and free-ware that was installed with other programs bogging down their computer. Like they don't think to 'uncheck' the 'Install Ask Toolbar' when installing something else. I think if people would take the quick second or two to read the dialog box before spamming the 'next' button they wouldn't have so many problems with viruses.

I seriously feel like an @$$ when people ask me for anti-virus software recommendations because my only honest answer is stupidity is the only reason to use it. Sorry for the rant, but do others get where I am coming from? Is there really a legitimate reason to use it? Because even when people do it never seems to help.

If you are running Windows and you have no anti malware software how do you know that you don’t have a root-kit on your system? (rhetorical)

On the Windows platform, your position seems to be supported by a good amount of dumb luck and lack of exposure. You can get malware very easily through no fault of your own on Windows. There have been case of people getting malware by simply receiving email or visiting what appears to be a legitimate website. If you work with other people, sooner or later you will have to work with files that are sent to you from other people. There have also been a few rare cases of people getting malware from store purchased software.

If you don’t work with other people and don’t do much in a Windows environment luck may be with you. If you actually work with other people, you have to interact with other websites, people and files that you have no control over and not having some sort of anti-malware is an unnecessary risk, since you can get free anti malware software.

I’d also add, if you perform any sort of financial transactions for a company, not an individual, and your account gets drained by malware, the bank will NOT reimburse you.

Being that you are 21 years old, I don't think that your 10 years of experience is really applicable to most people that make a living with their systems.

 

[MisterMe]

Well, I thought I was too smart to get any viruses But as you said, how would I know? This computer had been running for three years without any virus protection. Very few serving on the web though. After installing AVG (this was 2 years ago) NO virus was detected.

Well, there you go. I was "too smart to get viruses" and the virus scanner proved this to be right.

Without stating where your computer has been, your anecdote is meaningless. Is the computer at our home, school, or work? Many businesses today have antivirus protection on their firewall. They do not rely on having smart employees, employees who volunteer to install and maintain antivirus software, or employees who engage in only safe computer practices.

Email is just one vector for distribution of malware. However, my firm's antivirus software detects and removes any identified malware before it ever reaches my Mac [where it would do no harm anyway]. Also, malware email attachments can't reach the vast majority of computers in my firm that are Windows PCs. Before this software was installed, my firm was a major distribution point for Windows viruses. We have even been blacklisted at least once.

 

[derickdub]

On a mac there is no need as there really aren't any viruses for OSx. However, you stated that you see no need to run it on a Windows machine and that is where you will have issues. All it takes is a spam message with a payload or you to click the wrong link and your computer could be infected. With some viruses all it takes is your computer to respond to a ping for it to become infected (blaster via RPC) so even if you think you are being safe you could easily have multiple viruses on your Windows machine. As for hogging resources, Microsoft Security Essentials is very light and has little to no affect on the system performance. Better to be safe than sorry. The last thing you want is your computer sending out your information or to be used in a DoS attack.

People that don't think they need it on a Windows machine are foolish. I had a customer that said the same thing until I loaded MSE up on the machine and cleared off 154 viruses.

Clicking the wrong link or opening a message that is spam is what I can't understand people doing though. Most browsers have status bars that will display what a link directs to just by doing a mouse-over. There are extensions for almost every web browser that blocks scripts and remove advertisements. To me anti-virus and anti-malware programs do nothing but tell you have a virus and attempt to remove it. I can't see how people could get them in the first place if they used common sense and simple tools like script blockers or ad blockers, which is still even over-the-top and unnecessary if you had enough common sense.

When I used Windows I kept good tabs on what processes were running, what files were in folders which contained core O.S. files, and connections to and from my PC. All were overkill practices that never led me to anything. I have used tools such as MSE, Norton, and a plethora of other anti-malware/virus programs all to give me nothing but false-positives.

 

[Ap0ks]

I can't see how people could get them in the first place if they used common sense and simple tools like script blockers or ad blockers, which is still even over-the-top and unnecessary if you had enough common sense.

Common sense is fine if you are talking about something that is common to everyone, however in this big world of ours, computers and the correct usage of them aren't common.

That is what makes people vulnerable, why would a user suspect anything if a link that should go to "www.mybank.com" goes to "www.myfakebank.com" if the link text said "My Bank" and the webpage that loaded looked the same as normal? End users don't always understand or care about the inner workings

You may think that you don't need AV, but there are plenty of people that would rather pay $50 a year for AV software instead of $75 per hour to get their PC fixed after an "incident"

 

[GGJstudios]

That is what makes people vulnerable, why would a user suspect anything if a link that should go to "www.mybank.com" goes to "www.myfakebank.com" if the link text said "My Bank" and the webpage that loaded looked the same as normal? End users don't always understand or care about the inner workings

You may think that you don't need AV, but there are plenty of people that would rather pay $50 a year for AV software instead of $75 per hour to get their PC fixed after an "incident"

Antivirus software won't protect you from visiting bogus or spoofed websites. If you're buying AV with that intent, you're wasting your money.

 

[wpotere]

Clicking the wrong link or opening a message that is spam is what I can't understand people doing though. Most browsers have status bars that will display what a link directs to just by doing a mouse-over. There are extensions for almost every web browser that blocks scripts and remove advertisements. To me anti-virus and anti-malware programs do nothing but tell you have a virus and attempt to remove it. I can't see how people could get them in the first place if they used common sense and simple tools like script blockers or ad blockers, which is still even over-the-top and unnecessary if you had enough common sense.

When I used Windows I kept good tabs on what processes were running, what files were in folders which contained core O.S. files, and connections to and from my PC. All were overkill practices that never led me to anything. I have used tools such as MSE, Norton, and a plethora of other anti-malware/virus programs all to give me nothing but false-positives.

What you are talking about is Malware mainly, not a virus. A virus can attack your machine without user intervention copy itself, deploy itself and then move on without you ever knowing. What AV does is protect you from this. Blaster actually change the RPC service and looked like a regular service. Without AV you would never know you were infected. On a Windows machine AV is a must and is free. It would be foolish not to use it.

On a Mac, AV is pointless and I don't even run it. Heck, even my Solaris servers don't run it. Could there be a virus for Mac eventually? Sure, but until it becomes a constant common sense will do.

On Norton, I would never run it. Norton hasn't been good since Symantec got their hands on it. Microsoft Security Essentials is light as are a few others out there and they work fine.

 

[Omniver]

The purpose of AV, the common albeit not technically accurate term generally used to refer to anti-malware software, is to prevent known-bad or suspected-bad software from acting on your computer. Your need for AV is a function of the likelihood of 1) an exploitable weakness existing on your system, 2) software has been crafted by an attacker to exploit this weakness, 3) attacker has a delivery mechanism to get the software to run on your system, and 4) the AV vendor would have a signature or good heuristic method of detecting the malware.

Believing that Macs somehow are void of security vulnerabilities and are not susceptible to (#1) is complete ignorance IMO, and is clearly disproven by challenges such as PWN2OWN where Safari was the first to fall.

(skipping #2 for a minute)

Personally, I feel that #3 is one of Mac's strengths. Apple does a good job of having reasonable base security defaults in their software (good, not great - e.g. Pwn2own). Also, in my experience people install fewer third-party (non-apple) packages on Macs, e.g. no Adobe acrobat, which reduces the opportunity for vulnerabilities (most Windows malware does not attack Windows, it attacks insecure apps). Fewer opportunities = reduced likelihood and reduced reward for the effort to attack, which leads back to #2. Apple's quarantine function and the new sandboxing in Lion are great controls to reduce the likelihood of exploit as well.

On #2, I really do believe there is also less focus on Macs from the exploit community. Fewer users, therefore fewer potential targets, less malware.

#4 is the crux. For 0-days, like what we've seen in pwn2own, no AV is going to have a known signature. A good heuristic-based tool *might* catch one, but I've not seen and good heuristic-AV systems for Mac (Windows has a few). For the other currently known Mac malware, Apple seems to be doing a fairly decent job updating their own blocking signatures (yes, you are likely running AV, apple's built-in one that phones home regularly for new signatures) and I am meticulous at keeping my software patched.

As long as the malware volume stays low and Apple is taking active steps to mitigate the Mac malware that is out there, I'm comfortable currently running without third-party AV - but I'm not close-minded about the value and I would absolutely install Norton or another package if there was a known unpatchable exploit that there was an AV signature for.

Don't come down too hard on Microsoft, they currently, in my and many others' opinion, have the most advanced secure software development practices in the industry (get hit enough times, you build up some defences). Most of the windows malware today comes from vulnerable Acrobat, Flash, Java, and other third-party software. Also, systems are only as secure as they are administered and the windows world is absolutely full of millions of unmanaged, unbaselined, and unpatched systems.

 

[Ap0ks]

Antivirus software won't protect you from visiting bogus or spoofed websites. If you're buying AV with that intent, you're wasting your money.

It was a simple example, no need to argue semantics. I guess I could have just as easily written "why would an end user stop and think about opening a virus-ridden zip file if it was labelled something harmless?"

The whole point of my post was about common sense not always being applicable, which you seem to have missed entirely :s

 

[GGJstudios]

It was a simple example, no need to argue semantics. I guess I could have just as easily written "why would an end user stop and think about opening a virus-ridden zip file if it was labelled something harmless?"

The whole point of my post was about common sense not always being applicable, which you seem to have missed entirely :s

Antivirus won't protect a user from their own poor decisions. To rely solely on AV, rather than exercising safe computing practices, isn't the wisest course of action. Safe computing will protect a Mac OS X user when antivirus software won't. The reverse is not true. That's the point that you appear to have missed.

 

[gorskiegangsta]

It was a simple example, no need to argue semantics. I guess I could have just as easily written "why would an end user stop and think about opening a virus-ridden zip file if it was labelled something harmless?"

The whole point of my post was about common sense not always being applicable, which you seem to have missed entirely :s

If the end user in question exercised caution and only downloaded files from trusted sources, they wouldn't have to worry about disguised malware. What you're talking about is analogous to hiring a bodyguard to help your child cross the street instead of teaching that child to cross the street on their own. At some point in life said person will have to acquire some degree of independence and be able to look out for themselves.

The point is, you have to have some sort of awareness when comes to cyber security. If you download a lot of crap from unknown/untrusted sources without consideration, solely relying on your AV program, one day you may receive a rude awakening. Even though I have Bitdefender Internet Security running on all my (and my family's) PCs, they rarely even raise an alert because I've taught my family the basics of exercising caution online. AV software is designed to complement common sense, not replace it.

 

[Penn Jennings]

Antivirus won't protect a user from their own poor decisions. To rely solely on AV, rather than exercising safe computing practices, isn't the wisest course of action. Safe computing will protect a Mac OS X user when antivirus software won't. The reverse is not true. That's the point that you appear to have missed.

Anti-virus can save you from poor decisions. If you download a file with known malware, any decent anti-virus software will prevent you opening it. It just won't save you from all poor decisions.

Being smart is not 100% protection from malware. There are stories everyday of people that do everything right and still get compromised.

 

[GGJstudios]

Anti-virus can save you from poor decisions. If you download a file with known malware, any decent anti-virus software will prevent you opening it. It just won't save you from all poor decisions.

Being smart is not 100% protection from malware. There are stories everyday of people that do everything right and still get compromised.

As an example, when the MacDefender issue first appeared, no antivirus recognized it as malware, but those practicing safe computing knew better than to install it when prompted. There is not one case of Mac OS X malware infection that couldn't have been prevented by prudent decisions on the part of the user.

 

[Penn Jennings]

As an example, when the MacDefender issue first appeared, no antivirus recognized it as malware, but those practicing safe computing knew better than to install it when prompted. There is not one case of Mac OS X malware infection that couldn't have been prevented by prudent decisions on the part of the user.

I don't have first hand knowledge of every MacDefender infection, and I doubt that you do either so I won't comment on that.

That fact still remains, doing everything perfectly as an end user is not 100% protection from malware unless you work in a vacuum. Not on a Mac and certainly not on Windows. Pretending that it will does not make it so.

 

[GGJstudios]

I don't have first hand knowledge of every MacDefender infection, and I doubt that you do either so I won't comment on that.

That fact still remains, doing everything perfectly as an end user is not 100% protection from malware unless you work in a vacuum. Not on a Mac and certainly not on Windows. Pretending that it will does not make it so.

Name one Mac OS X malware infection that can't be easily avoided by exercising reasonable care in what software you acquire and install.