Why are people still recommending antiviruses?

It’s obvious that antiviruses are based on a flawed principle. All security experts know that default deny is the only sound protection method.

Antiviruses are mainly blacklisting technology, they are reactive, the company needs to get a sample of the new malware , analyse it and create a signature first before it can detect.

In today’s world this is too slow. Plus there are so many none-replicating malware that never get into the hands of AV analysts anyway.

Even a newbie like me has modified a known worm with some hex editing and packers and it is undetectable!

Heuristics? Let’s face it heuristics are a joke, they always have being, in retrospective testing, even the best AV (NOD32) detects only 50% and most are far worse.

It is futile to try to identify every single bad guy, with malware increasing exponentially, antiviruses cannot keep up.

Why don’t people use or recommend sandboxing apps or behavior blockering or anti-exes?
Real world tests show that antiviruses are not very effective. See http://winnow.oitc.com/AntiVirusPerformance.html

These are stats obtained by human analysts who actually encounter malware and load it up for real time checking on virustotal.com

Tests by virus.gr and anti-comparatives.org do not reflect real world performance! The test bed is dubious, many are harmless junk and most are zoo malware, malware that is not spreading.
What i ask goes for antispyware too. They are basically using the same scanner signature technique anyway.

Don’t you experts always say use more than one antispyware cos one can’t get them all? This just shows the failure of a signature blacklist based approach!

Share and Enjoy:
  • Digg
  • del.icio.us
  • Facebook
  • NewsVine
  • Reddit
  • StumbleUpon
  • YahooMyWeb
  • Google Bookmarks
  • Yahoo! Buzz
  • TwitThis
  • Live
  • LinkedIn
  • Pownce
  • MySpace

Tagged with:

Filed under: Tech News

Like this post? Subscribe to my RSS feed and get loads more!