OT: Poll - which antivirus software?

As do most these days...

Indeed - well MS now rather than sysinternals since they bought them (shame!)

You were done! ;-)

What's the "root-kit" stuff all about - as it seems to be one of the few reasons for shelling out my hard-earned rather than using the freebie version, do I need it?!

The other one is the IM screening thing, as my kids do use IM and I'm certainly concerned about stuff getting through that way. Am I nuts to even consider the free AVg for their PC? Without the screening module in place though, why wouldn't/doesn't the free AVG pick up any IM-borne nasties anyway, as soon as they try to do something... nasty?

David

Lobster gurgled happily, sounding much like they were saying:

A rootkit is malicious software which replaces the base operating system files with modified versions incorporating some kind of malware, effectively hiding the malware within the normal system processes.

- because anything being run as a normal user shouldn't have the ability to change any of the base OS files. But, since Windows defaults to users being administrators, they do.

If you routinely log on as a user with admin privileges, then you may need anti-rootkit protection. But there's a much better way to ensure you don't need it.

A root kit is a bit of malware that attempts to infect the OS at a low level. It will often patch system calls and utility programs to withhold information that they may otherwise normally give you. For example concealing the presence of files or directories, system processes etc. Changing the values returned from system calls so that the presense of the malware is hidden. This can impede the AV scanner from even seeing and opening the dodgy files in the first place.

The most famous example was released into the wild (intentionally) by Sony BMG:

There s a fair chance that a malicious file would be detected by the on access scanning when it is written to the hard drive. However this may be prevented by compression/encryption.

Buy a Mac.

Not on my kids' PC it doesn't!

Thanks David

Lobster gurgled happily, sounding much like they were saying:

Windows still does. The fact you've changed that default is a different matter...

"Other Mac OS X Rootkits are; osxrk, Togroot and WeaponX, all of which probably can still be found at

Seven year old windows does.. vista and seven don't. If I said Macs did it would be as true as your statement as 7 year old Mac OS defaulted to admin too.

In message on Sat,

I'm quite surprised to see no other recommendations for ESET's NOD32 so I will add my vote for it. I've used it on four or five machines for several years now without any problems - it has an excellent track record for detecting real viruses. and is interesting reading.

Colin

"dennis@home" gurgled happily, sounding much like they were saying:

Vista most certainly does. OK, so you have to click a (massively over- frequently displayed) "Oooh, are you _sure_?" dialogue - but that can be (and frequently is) turned off. In 7, it can even be turned off by malware with no notification to the user.

palatable by allowing certain applications to make changes to the OS without first prompting the user for permission."

It is a beta so who knows what the final will allow.

There is a compromise between security and usability. Unix is biased towards security, windows to usability. Most users want usability as can be seen by the protests about UAC which actually has very little day to day impact.

"dennis@home" gurgled happily, sounding much like they were saying:

They've already said they have no plans to change it.

You say that like it's a bad thing?

Because they don't understand the severity of the compromise they're making.

If it is a security problem they will fix it.

Bad? I expressed no preference.

"dennis@home" gurgled happily, sounding much like they were saying:

Oh, the touching naivety...

At the risk of starting a war or a rant. The best antivirus software is Fedora, Ubuntu or OS X. The latter only tends to run well on rather expensive hardware.

In message , Adrian writes

You're not saying that dennis could possibly be wrong, are you ?

perish the thought

And can hold out for nearly two whole minutes:

In simple terms, if you imagine a timeline from booting the computer to looking at the desktop, a rootkit is a program that loads "before" Windows.

The problem is that Windows can only see stuff loaded BY or AFTER Windows, so the rootkit can stay safely tucked away doing god knows what without you being able to find out reliably that it even exists...