Desktop antivirus - it's dead

[cbgerry]

============================>
That's some expected reply. Did you know that these independent test
centers lie and not me and they lie for illicit gain like magazines
they sell ??? If anybody is lying it would be them and if anybody's
head is full of it (lies) it would have to be you and not me..... and
I will tell you why.

This is easily going round and round - a round robin - and you are a
part of that. If there were labrotories with all these "unknown
threats" they use as tests to prove the weaknesses of software - any
type of test program - it would have been stolen and used a long time
ago by the underworld in malware spybots that are currently
responsible for up to 70 percent of world spam and 4 percent annually
of ID Theft in just America and are currently clocked in control of 4
to 11 percent of world computers.

The security industry is well aware of that and do know everything
possible that is used by these independents and for two reasons. Are
they attempting at some time to be running extortion by producing a
proof-of-concept scenario. Number two - are they "selling" to the
underground and what ? Would it surprise you that security software
can purposely give "false readings" to test equipment for these very
reasons ? Are you aware of anti-cracking technology that is software
as well that can be purchased and how this protects security products
against "probes" for reverse engineering and piracy ?

What you are replying to basically is the part of the discussion about
heurisitics fail maybe 50 percent of the time - even if for sake of
arguement you might call that a worst case scenario as opposed to a
conservative estimate. Specific products I have used for over four
years now were Norton Antivirus - 2 years Webroot Spysweeper and Trend
Micro Antispyware which also have heurisitics technology for spyware
and related malware. Several times I have manually inspected every
single file and registry entry in my computer looking for malware.
None was ever found though I have been hit hundreds of times.

Now according to your perspective that heuristics don't work - I
should have found at least 150 malware applications. The hits I am
talking about are not malwares that were removed after scans. I am
talking about drive by installations. Were are they ? There is not so
much as a trace present.

You said...
""QUOTE""> someone has been filling your head with lies, i'm afraid...

"UNQUOTE""

...well you can be afraid all you want but here you can stop telling
LIES as you are doing. There is NO ONE filling my head with lies - not
even me. What I have posted here is the truth - I don't lie where pc
security is concerned. I do know what I am talking about and I am a
groups owner specializing in malware removal and webmaster/creator of
thewww.BlueCollarPC.Net/website for the same which is approaching
one million hits by people who look towards information and advice I
provide as a source of their computing security needs. Not one of my
Visitors and Website Users believes I am a liar.

Now the bottom line here is that I am positively sure you will agree
that any traces or variants of threats from a couple of years ago
would finally have had defintions written for them to remove them in a
scan, that for sake of argument where "missed by heurisitics" ? Okay,
for sake of arguement ? This is what I am telling you - there is no
such thing. The products ARE that good.

You had some kind of problem with the statement about these products's
heurisitics catch virtually ALL malwares. Well they do and did. Why
would I - me as who I am with nothing to gain - why would I lie or be
wrong about that ? Who would believe YOU ?- Hide quoted text -

- Show quoted text -

============================>
You are a "doomsday prophet" ???

....meaning there approaches or is achieved that there is no such thing
as pc security and we should all just go back to playing
solitaire ???

Who in the hell is going to buy that or into it ??? I presume you
did ??

 

[optikl]

============================>

<snippped rant>.

You would project a more credible, coherent argument if your spelling and
grammar weren't so awful.

 

[Fenton]

Virus Guy wrote


Exploits/viruses don't come from casual browsing of 'normal' websites.
They come from wank/warez sites & spam mail. If people are stupid
enough to visit those sites/open spam mail they're gotta get shit, time
after time.

Wasn't the NFL's web site carrying a payload recently? Or maybe superbowl.com
-- something sports related and legit, as I recall.

 

[Dustin Cook]

On Apr 6, 3:45 pm, George Orwell <Use-Author-Supplied-Address-
Header@[127.1]> wrote:
PC Worldhttp://elfurl.com/qympl

Some industry analysts are proclaiming the traditional antivirus
method for detecting and eradicating viruses, trojans, spyware and
other baneful code by matching it against a
signaturehttp://snipurl.com/crapwaretobe "dead."

They say signature-based checking can't keep up with the flood of
virus variants manufactured by a criminal underworld that is
beating the antivirus vendors at their own game. And they are
arguing it's time for companies to adopt newer approaches, such as
whitelisting or behavior- blocking, to protect desktops and
servers.

"It's the beginning of the end for antivirus," says Robin Bloor,
partner at consulting firm Hurwitz & Associates, in Boston, who
adds he began his "antivirus is dead" campaign a year ago and
feels even more strongly about it today. "...The approach
antivirus vendors take is completely wrong. The criminals working
to release these viruses against computer users are testing
against antivirus software. They know what works and how to create
variants."

..Instead of antivirus software, he says, users should be
investing in whitelisting software that prevents viruses from
running because it only allows authorized applications to run.

Whitelisting products are available from SecureWave, Bit9, Savant,
AppSense and CA, the first traditional antivirus vendor to see the
light, in Bloor's view.

They mean "heurisitics" in all descent antivirus paid protection ?
Duh.... heurisitics. This is activated meaning real time protection
in paid subscription antivirus software programs. Heurisitics is
the ability to identifiy the malware threat by typical behavior
without having the definitions yet written for removal and blocking
of the particular threat - worm, virus, many trojans.

""QUOTE""
They say signature-based checking can't keep up with the flood of
virus
""UNQUOTE""

...and it never did and never will. For newbies these idiot editors
are writing to (and I am not the only one recognizing this) - for
newbies / novice information here, the writer is calling a system
scan with your antivirus as "signature-based checking" - like duh
a-hole. Why would you do a scan, find and remove malware and then
turn around and say that the PC was protected in the beginning as
"signature-based checking" ??? How the h*ll was the PC ever
protected by "sinature- based checking"?"?? Duh !!!

So where's the distinction that something is or did die ???? Idiot
Editors playing with new people's minds. Malicious bad information
even intentionally. I have caught some of the4se creeps before
giving out bad information and responded to it.

""QUOTE""
they are arguing it's time for companies to adopt newer approaches,
such as ... behavior- blocking
""UNQUOTE""

...You mean BUY some antivirus protection ??? to activate real time
protection - - Duh !!!

This is the result of trolls, criminal elements, idiots, plain
newbies, and bragging rights malicious persons giving the constant
idea of freeware security as your silver bullet. That is absurd and
even for the most new person. Anybody new to computers instantly
realizes that the software business is a multi-million and multi-
billion dollar industry. You can't even miss that one on TV News
always informing the public of the amount of trade done over the
internet if you are not a computer owner/operator. I believe it is
in the neighborhood of 16 billion dollars yearly or more. So point
is the "newbie" knows better and are taking their chances and they
know it. They know you are only getting what they pay for in the
worst ignorance of software or computers.

A little knowledge spread around stops all of this in a very, very
great degree.

Hell, you don't even have to buy any. You can download avast for free
and it does real time checking, even scans incoming email.

Of course the most common path of infection can be easily blocked by
simply turning off html rendering in your mail client. No text
message has ever infected a machine without the help of that
machine's user.

cmsix

========================>
And what protection does free antivirus offer when browsing the
internet ? Free open source Clam AV has an Outlook plug-in to scan
email. But you are only talking about being protected with email
scanning. What about browsing ? That is absurd to just use a computer
for email - cell phones do that. I have never heard of such a thing
that someone pays up to and over 2 thousand dollars for a computer and
then not use it because free antivirus only scans email. Strange
answer.

Ehh, If you don't mind me asking, what makes you think free antivirus
only scans email? Most resident antivirus scans files after
creation/during, when opening, before execution etc. In those cases, if
the malware is known to the scanner, it should flag it and provide you
some options for dealing with it, depending on your setup.



--
Dustin Cook
Author of BugHunter - MalWare Removal Tool - v2.2a
email: (e-mail address removed)
web..: http://bughunter.it-mate.co.uk
Pad..: http://bughunter.it-mate.co.uk/pad.xml

 

[Virus Guy]

You are clueless. The site you refer has used a shitload of
AVP's ...

You are truely stupid.

You made a statement that exploits don't come from casual browsing of
"normal" websites.

I show you an example where a normal web site (Asus.com) was hacked.

Why don't you respond to that?

That was the point of my response. Why don't you admit that you are
wrong about exploits NOT being present on "normal" sites?

 

[Virus Guy]

virus guy's contention that anti-virus products don't detect
exploits on their way in is demonstrably false - there are
products that do have technology for scanning things as they
come off the wire (nod32 is one of the ones that implements...

I don't recall that it was ever shown that any AV product prevented,
for example, IE from crashing when exposed to test samples of the VML
vulnerability.

Can you point to a URL that describes how (or where) nod32 situates
itself such that it's able to be the first process to intercept (scan)
ethernet packets before that data is passed to a higher layer?

Does NOD make such a claim?

 

[What's in a Name?]

After much thought,Virus Guy came up with this jewel:

I don't recall that it was ever shown that any AV product prevented,
for example, IE from crashing when exposed to test samples of the VML
vulnerability.

Can you point to a URL that describes how (or where) nod32 situates
itself such that it's able to be the first process to intercept (scan)
ethernet packets before that data is passed to a higher layer?

Does NOD make such a claim?

From the Nod32 help files on "Internet Monitor-IMON" module.

Enable HTTP checking - if enabled, all traffic through HTTP is scanned.

Ports used by the HTTP protocol - a list of ports used by the HTTP
protocol.

Automatically detect HTTP communication on other ports - enables
automatic detection of HTTP communication also on other than the ports
specified.

In the Actions section you can specify how IMON will act if an incoming
infiltration from the Internet is detected.

Display warning window with action selection - IMON will show up a
warning window and allow the user to terminate the connection with the
particular server.

Automatically deny download of infected file - IMON will automatically
terminate the connection.

Compatibility Setup
Client compatibility setup provides an option to toggle between active
and passive mode (better efficiency and better compatibility
respectively) used for a particular application.

IMON works in two modes: "passive" and "active". In passive (higher
compatibility) mode, portions of a downloaded file are continuously
passed on to the target application whilst IMON stores a temporary copy
of each of the fragments. When the last fragment is detected, the whole
file is scanned for viruses. If an infiltration is detected, a warning
window appears and the connection with the particular server is
terminated. A disadvantage of that is that the already downloaded
portion of the file may already contain a fundamental portion of a
malicious code. What's more, if the application repeatedly attempts to
download infected file, it may use the already downloaded data and
request only the rest of the file. In such case, IMON may not find
nothing suspicious in the remaining portion.

In active (higher efficiency) mode, IMON first downloads and scans
whole file and then passes it on to the target application. This
procedure is safer because in the case of an infiltration the
application does not receive any portion of the downloaded file. A
disadvantage is that the application receives all data at once,
therefore it cannot show the download status properly. Therefore, if
the download lasts for more than 5 seconds, a small window showing the
dowload progress pops up beneath the system tray. Active mode is not
suitable for certain types of data which requires a continual data flow
(e.g. multimedia, streaming video/audio).

The Server compatibility option enables you to set Higher compatibility
mode for particular servers regardless of the mode set for the
particular browser.

Switch to passive (compatible) mode for files larger than ... KB - if
enabled, files larger than the specified size will be downloaded in
passive mode automatically.

Switch to passive (compatible) mode for files being downloaded that
take more than ... seconds - if enabled, files being downloaded will
switch to passive mode after the specified time has elapsed. This
setting is useful for larger files or for slower connections.

 

[Peter Seiler]

optikl - 09.04.2007 04:27 :

<snippped rant>.

You would project a more credible, coherent argument if your spelling and
grammar weren't so awful.

and if he would shorten his unnecessary quotings.

 

[Far Canal]

Virus Guy wrote

You are truely stupid.

You made a statement that exploits don't come from casual browsing of
"normal" websites.

I show you an example where a normal web site (Asus.com) was hacked.

Why don't you respond to that?

That was the point of my response. Why don't you admit that you are
wrong about exploits NOT being present on "normal" sites?

It's a hacked site. Now go find a hundred more like it, where an AVP
doesn't pick up the virus.

 

[Far Canal]

Fenton wrote

Wasn't the NFL's web site carrying a payload recently? Or maybe superbowl.com
-- something sports related and legit, as I recall.

AVP's found the payload?

 

[kurt wismer]

I don't recall that it was ever shown that any AV product prevented,
for example, IE from crashing when exposed to test samples of the VML
vulnerability.

i don't recall it either, but that doesn't mean it didn't happen...

Can you point to a URL that describes how (or where) nod32 situates
itself such that it's able to be the first process to intercept (scan)
ethernet packets before that data is passed to a higher layer?
http://www.microsoft.com/msj/0599/LayeredService/LayeredService.aspx

Does NOD make such a claim?

nod32 does have a layered service provider... i've run afoul of it's
imperfections in my professional life...

 

[kurt wismer]

That's some expected reply. Did you know that these independent test
centers lie

that's some claim... do you have proof to back it up?

and not me and they lie for illicit gain like magazines
they sell ???

av-comparatives.org doesn't sell magazines...

If anybody is lying it would be them and if anybody's
head is full of it (lies) it would have to be you and not me..... and
I will tell you why.

This is easily going round and round - a round robin - and you are a
part of that. If there were labrotories with all these "unknown
threats" they use as tests to prove the weaknesses of software - any
type of test program - it would have been stolen and used a long time
ago by the underworld in malware spybots that are currently
responsible for up to 70 percent of world spam and 4 percent annually
of ID Theft in just America and are currently clocked in control of 4
to 11 percent of world computers.

?? i'm finding your prose very hard to follow... are you making an
argument against the existence of labs with collections of malware that
is unknown to an anti-virus? if so then i would have to point out how
retrospective testing works - they use a slightly old version of a virus
scanner (say 3 months old) and without updating test it against viruses
that have been discovered since it came out... these are viruses the
product probably would detect if the product was up to date, but since
retrospective testing tests the heuristics specifically the
non-heuristic parts of the scanner are kept out of date so that only the
heuristics would be able to raise an alarm...

The security industry is well aware of that and do know everything
possible that is used by these independents and for two reasons. Are
they attempting at some time to be running extortion by producing a
proof-of-concept scenario. Number two - are they "selling" to the
underground and what ? Would it surprise you that security software
can purposely give "false readings" to test equipment for these very
reasons ? Are you aware of anti-cracking technology that is software
as well that can be purchased and how this protects security products
against "probes" for reverse engineering and piracy ?

ugg... it's getting harder and harder to make sense out of this... if
you're making an argument that there's some nefarious or illicit
ulterior motive behind the independent testers i would have to point out
that av-comparatives.org is actually a well respected (even among the av
vendors) independent testing organization...

What you are replying to basically is the part of the discussion about
heurisitics fail maybe 50 percent of the time - even if for sake of
arguement you might call that a worst case scenario as opposed to a
conservative estimate.

actually 50% is the best case scenario... on average it fails even more
than that...

Specific products I have used for over four
years now were Norton Antivirus - 2 years Webroot Spysweeper and Trend
Micro Antispyware which also have heurisitics technology for spyware
and related malware. Several times I have manually inspected every
single file and registry entry in my computer looking for malware.
None was ever found though I have been hit hundreds of times.

Now according to your perspective that heuristics don't work - I
should have found at least 150 malware applications. The hits I am
talking about are not malwares that were removed after scans. I am
talking about drive by installations. Were are they ? There is not so
much as a trace present.

this is a deeply flawed logical conclusion... just because heuristics
fail doesn't mean you would find malware that heuristics has missed...

You said...
""QUOTE""
"UNQUOTE""

...well you can be afraid all you want but here you can stop telling
LIES as you are doing. There is NO ONE filling my head with lies

y'know what, you're right... your point of view seems to be quite
unique... i don't think anyone else can take credit for it...

- not
even me. What I have posted here is the truth - I don't lie where pc
security is concerned. I do know what I am talking about and I am a
groups owner specializing in malware removal and webmaster/creator of
the www.BlueCollarPC.Net/ website for the same which is approaching
one million hits by people who look towards information and advice I
provide as a source of their computing security needs. Not one of my
Visitors and Website Users believes I am a liar.

well i never accused you of being a liar, only of being wrong...

Now the bottom line here is that I am positively sure you will agree
that any traces or variants of threats from a couple of years ago
would finally have had defintions written for them to remove them in a
scan, that for sake of argument where "missed by heurisitics" ? Okay,
for sake of arguement ? This is what I am telling you - there is no
such thing. The products ARE that good.

retrospective testing says otherwise...

You had some kind of problem with the statement about these products's
heurisitics catch virtually ALL malwares. Well they do and did.

retrospective testing says otherwise...

Why
would I - me as who I am with nothing to gain - why would I lie or be
wrong about that ?

why would you be wrong? people are wrong all the time about all sorts of
things... they don't generally need reasons...

Who would believe YOU ?

well, it's not so much about believing me as it is about believing
independent testing organizations that even the anti-virus vendors
acknowledge, as well as the words of anti-virus vendors and
professionals themselves... do a google groups search in alt.comp.virus
(or comp.virus, come to think of it) for names like alan solomon, jimmy
kuo, dmitry gryaznov, frisk, etc (there are actually quite a few more
but those are the ones that immediately came to mind) and see if any of
them claim as you do that anti-virus products detect virtually all
malware...

 

[Virus Guy]

i don't recall it either, but that doesn't mean it didn't happen..

Why don't you try something then.

Swap out your patched vgx.dll for an older one, then try this page:

http://209.85.165.104/search?q=cach...tvml.htm+testvml.htm&hl=en&ct=clnk&cd=1&gl=ca

It's the google cached version of this:

http://zert.isotf.org/testvml.htm

or this:

http://www.isotf.org/zert/testvml.htm

Which doesn't seem to exist any more, but was designed to trigger the
VML vulnerability.

Presumably NOD-32 should intercept the code before IE is crashed by
it.

 

[What's in a Name?]

After much thought,Virus Guy came up with this jewel:

Why don't you try something then.

Swap out your patched vgx.dll for an older one, then try this page:

http://209.85.165.104/search?q=cache:fbdJRQS1FxwJ:zert.isotf.org/testv
ml.htm+testvml.htm&hl=en&ct=clnk&cd=1&gl=ca

It's the google cached version of this:

http://zert.isotf.org/testvml.htm

or this:

http://www.isotf.org/zert/testvml.htm

Which doesn't seem to exist any more, but was designed to trigger the
VML vulnerability.

Presumably NOD-32 should intercept the code before IE is crashed by
it.

I just checked it out (with an unpatched W2K) and Nod alerted and
blocked loading of page! I guess it works!

max

 

[Virus Guy]

I just checked it out (with an unpatched W2K) and Nod alerted
and blocked loading of page! I guess it works!

All right, very good then.

What other AV software currently performs the same feat?

 

[kurt wismer]

Why don't you try something then.

Swap out your patched vgx.dll for an older one, then try this page:

http://209.85.165.104/search?q=cach...tvml.htm+testvml.htm&hl=en&ct=clnk&cd=1&gl=ca

It's the google cached version of this:

http://zert.isotf.org/testvml.htm

or this:

http://www.isotf.org/zert/testvml.htm

Which doesn't seem to exist any more, but was designed to trigger the
VML vulnerability.

Presumably NOD-32 should intercept the code before IE is crashed by
it.

yeah, well, since i'm not a nod32 user the above experiment won't really
tell us anything...

 

[kurt wismer]

After much thought,Virus Guy came up with this jewel: [snip]

Swap out your patched vgx.dll for an older one, then try this page:

http://209.85.165.104/search?q=cache:fbdJRQS1FxwJ:zert.isotf.org/testv
ml.htm+testvml.htm&hl=en&ct=clnk&cd=1&gl=ca

It's the google cached version of this:

http://zert.isotf.org/testvml.htm

or this:

http://www.isotf.org/zert/testvml.htm

Which doesn't seem to exist any more, but was designed to trigger the
VML vulnerability.

Presumably NOD-32 should intercept the code before IE is crashed by
it.

I just checked it out (with an unpatched W2K) and Nod alerted and
blocked loading of page! I guess it works!

thanks for the verification... i think it's safe to say now that nod32
qualifies as a first line of defense at the end-point
(http://anti-virus-rants.blogspot.com/2007/04/defensive-lines-in-end-point-anti.html)

 

[Virus Guy]

Just to make things clear - even if NOD displayed a detection message
- did IE crash, or did it give a "page not found" error? What exactly
was IE's behavior when it was pointed at that page?

thanks for the verification... i think it's safe to say now
that nod32 qualifies as a first line of defense at the end-point

Does anyone else find it interesting that Google served up that page
without any warning, especially since it came from their own cache?

It's sad that after all this time, that Google still has little to no
ability (or they choose not to deploy) more sophisticated exploit
detection and warning mechanisms on their search page.

 

[What's in a Name?]

After much thought,Virus Guy came up with this jewel:

Just to make things clear - even if NOD displayed a detection message
- did IE crash, or did it give a "page not found" error? What exactly
was IE's behavior when it was pointed at that page?

IE did not crash,but I do not remember what was displayed. I use the
mvp hosts file and get a lot of "page not found" in the ad boxes. Sorry
but I let the auto-updater run last night.

Does anyone else find it interesting that Google served up that page
without any warning, especially since it came from their own cache?

It's sad that after all this time, that Google still has little to no
ability (or they choose not to deploy) more sophisticated exploit
detection and warning mechanisms on their search page.

I don't think it is feasible for google to check on every link provided
in a search,nor do I want them to.

max

 

[Virus Guy]

I don't think it is feasible for google to check on every link
provided in a search,nor do I want them to.

What do you think Google and it's army of web robots do all day?

They scour the internet day and night. Their machines vacuum up every
piece of net-available content they can find.

If they can put up a list of results to a search, they certainly have
the ability to check the underlying code for the presence of exploits
in those results.

And even if they didn't, they could at least be more of an active
participant at discovering and sharing exploits with AV companies.
I'm not aware if they do that - or not.

If anyone is in a position to offer web security software products, it
would be a search engine company, and google is the biggest and best
funded of them all. It's strange that they don't leverage their
talent and their assets more effectively. Not only are they in an
incredibly good position to discover web-based exploits in a near
real-time manner, but they could integrate those discoveries into a
commercial browser-security add-on product, and could update domain
blocking lists on a dynamic basis.