PC Virus Scanners - Which is the Best?

Posted by: David Stewart on 26 March 2004

My existing version of McAfee (V4) is now no longer supported, so I need to upgrade or buy another anti-virus product.

McAfee ViruScan 8.0 looks pretty good and is the default option, but before commiting the credit card, I thought I'd ask for other forum-users experiences on this and other virus scanners.

So let me have your views and recommendations on anti-virus software you use.

David
Posted on: 27 March 2004 by JeremyD
John,
While undetectable new viruses do spread rapidly they are also, as result, discovered and made detectable rapidly - at least they have been so far.

Consequently, an AV-protected PC is vulnerable to a new and undetectable virus for only a short time, while an unprotected PC relies on having a knowledgeable error-free user to keep it safe.

BTW, the viruses I am currently receiving every day are exclusively mydoom and netsky, and I started receiving them long after they had become detectable.
Posted on: 28 March 2004 by Jez Quigley
quote:
I wonder if this means that viruses are harvetsing e-mail addresses


quote:
A virus/trojan could be silently using your machine for all kinds of nefarious activity e.g. denial of service attacks and harvesting of personal details.


No comment.
Posted on: 28 March 2004 by Jean-Marc
following the advice from a work colleague, I'm now using Avast anti virus.
It is FREE for private use, seems to be quite powerful and self-update itself at each connection.

Downloadable at www.avast.com

I'm also using the ZoneAlarm firewall, also free and downloadable from www.zonelabs.com

10 days, and it has already blocked 1652 suspicious intrusions!

Hope this helps
Jean-Marc
Posted on: 28 March 2004 by matthewr
Jez said "No comment"

I'm not 100% sure what you are getting at becuase, well, becuase you didn't actually say. Anyway the two statements you quoted are not in any conflict in the way you seem to be implying -- at least if you quote me fully and include the clause "from whois entries".

As I said earlier I am 99% certain that I do not have any viruses or trojans on any of my PCs becuase it requires a series of highly improbable events to occur and me to be more than a bit stupid.

Matthew
Posted on: 28 March 2004 by Jez Quigley
Matthew,

We can't know exactly what is going on because you don't have a virus checker installed. However, the way some trojans work is to silently (i.e. they don't let you know they are there) harvest your address book and /or passwords, and then use them for whatever purpose the villain wishes. The fact that you are getting targeted emails, and phony email headers from the same domain name even though you say you are very careful suggests that your PC, or one or more of your friends/collegues is infected. Not certain of course, but you don't know, and if so, you are the PC equivalent of Typhoid Mary.

ps. you don't have to do anything stupid to get a virus.
Posted on: 28 March 2004 by matthewr
Jez,

"We can't know exactly what is going on because you don't have a virus checker installed"

Whilst that is in the final analysis true it takes no account of the real, practical risks of infection and so is ultimately rather banal.

Can you give me some specific examples of viruses that might have infected my machine and the means by which they might have done so? I am fairly sure that anything you can come up with will either not be applicable to me (for one reason or another) or else be so obscure as to be of negligable risk.

"the way some trojans work is to silently"

I think you are in some danger of a grandma egg sucking lecture here.

"The fact that you are getting targeted emails, and phony email headers from the same domain name even though you say you are very careful suggests that your PC, or one or more of your friends/collegues is infected"

It doesn't suggest I am infected at all -- at least no more than the arrival of Viagra spam suggests that I wish to buy some.

Some of my friends and colleagues have indeed had viruses and these viruses have forwarded said viruses to me via e-mail. My nephew sends me a bunch about every other month. This has no bearing on whether I am infected or not.

With regard to my original comment, I have recieved viruses via the address matthewrobinson@whatever.com Since I have never used the address "matthewrobinson" this struck me as odd. ISTM there are three possibilities:

1. It was some malicious individual who knowing my name and domain name tried to guess my e-mail address (Given the nature of the message this is unlikely)

2. The e-mail address was acquired via some automated means similar to the techniques usd by spammers. I suggested that, for example, it could have been gathered from a whois entry -- that being a programmatically accessible public database that links my full name and my domain name.

3. The magic power of viruses.

"you don't have to do anything stupid to get a virus"

The vast majority of viruses are caused by people clicking attachments and not fixing widely known flaws in their operating systems. Since most people know both of these are foolish things to do I contend they did something stupid. Of course there are other means of acquiring viruses but I suggest they are actually very rare.

Matthew
Posted on: 28 March 2004 by Peter C
Matthew

Why not visit an online virus checker, you'll find out if your PC is Virus free

http://www.pandasoftware.com/activescan/
Posted on: 28 March 2004 by matthewr
Because my PCs are virus free. Or rather I am 99.9% certain that they are.

Matthew
Posted on: 28 March 2004 by Phil Barry
Matthew,

I suggest you download Ad-Aware or Spybot Searh & Destroy to check for spyware and malware.

And get an online virus scan.

Today.

Yeah, you may be free of viruses and malware, but you owe it to your correspondednts to verify your situation.

Regards.

Phil
Posted on: 28 March 2004 by John Sheridan
quote:
Originally posted by Phil Barry:
Matthew,

I suggest you download Ad-Aware or Spybot Searh & Destroy to check for spyware and malware.

And get an online virus scan.

Today.

Yeah, you may be free of viruses and malware, but you owe it to your correspondednts to verify your situation.

Regards.

Phil


and while you're at it, Matthew, you better pop off to the doc just to be 100% certain that you don't have typhoid. You owe it to your friends and colleagues to verify your situation Wink
Posted on: 28 March 2004 by matthewr
I, or rather my friends, am really touched by all your concern for my IT well being but I can assure you there is no need.

"I suggest you download Ad-Aware"

I have had it for some time although I rarely run it these days as all it finds are a small number of harmless ad-tracking cookies about which I am not desparately worried.

"Yeah, you may be free of viruses and malware, but you owe it to your correspondednts to verify your situation"

I'll happily get a virus check if someone will give me a reasonable explanation as to how I am at risk of acquiring one. I'll even stump up the cash for an AV subscription if someone can demonstrate that its likely enought o happen to be worth £30 a year (or whatever it is).

FWIW I do actually have AV software at work as my employer requires it -- I'm not sure what I gain my it telling me something which is very obviously a virus is indeed a virus or by having it churn through my disks looking for stuff that isn't there every now and again.

I also note that despite everyone at work having AV software I have never had a virus or sent one to a colleague but my colleagues frequently get viruses themselves and send them to me.

Matthew
Posted on: 29 March 2004 by JeremyD
Matthew,

You are at risk of acquiring a virus through human error.

The probability of this may be low but given that some AV programs [Panda and AVG, I think] are free for personal use, it doesn't seem to me to be a big deal to bother with one.
Posted on: 29 March 2004 by Laurie Saunders
quote:
Norton is effective, but bloated and slow


I would agree. Before Norton, I used AVG (free) and it kept causing my computer to crash...never found out why; it took me ages to discover this as the cause, too

laurie S
Posted on: 29 March 2004 by Rana Ali
Back to the original question, I found that McAfee was troublesome and also slowed down my PC somewhat especially when downloading mail. I then swapped over to the now-deleted InnoculateIT from Computer Associates which was free and worked very well indeed; so well that I am now trialling CA's "eTrust" paid antivirus and firewall products which I will probably purchase after the free period expires.
Posted on: 29 March 2004 by Jez Quigley
Matthew,

Sorry if I came over as patronising - not my intention, but I got the impression that you thought that clicking on dubious email attachments is the only way to get a virus. My apologies.

Why not download AVG and run it once? It's free. Then uninstall it if you are clean and I could shut my fat mouth! Smile
Posted on: 29 March 2004 by jpk73
Best AntiVirus software: uses 2 engines. Free trial.

Matthew Robinson: please tell us why you are sure that your PC is not infected! Even to display a website can infect your PC with malware, trojans or virus. To preview Email also enables your PC to get any sort of varmint.

- Jun
Posted on: 30 March 2004 by David Stewart
The problem is that Matthew is 'all-seeing' and 'all-knowing'. There is no room in his world for doubt and certainly no place for views or opinions that conflict in any way with his own. He will continue to do things his own way until hell freezes Wink

David
Posted on: 30 March 2004 by matthewr
"Matthew Robinson: please tell us why you are sure that your PC is not infected!"

Because:

-- My computers are always up-to-date with the latest security patches (which prevents 99% of all infections that require no explicit user action)

-- I never open e-mail atttachments unless it comes from someone I know and I am expecting it or it is accompanied by an e-mail obviously written by the sender.

-- I do not install software from dubious sources.

-- All my PCs are physically reasonably secure and are protected with strong passwords.

-- I am deeply suspicious and never do anything grossly stupid (at least with regard to computers -- I can't make this claim with regard to woman, drink and fast cars).

-- Where possible I do not use software with a history of poor security and that is known to be highly targeted by viruses.

-- I am behind a hardware firewall.

-- Most of my web activity and e-mailling is from a secondary PC that does not have my most sensitive personal details.

-- I flatten and rebuild my PCs from scratch every three months or so. (It is good practice and ensures that one's backups, product keys,etc are in order and that one can cope with a catatrophic hardware failure).

AFAICT this covers all known viruses with a very high degree of confidence. Remember that virus writers do not need to be particularly imaginiative or skilled as the world is full of vulnerable computers and idiot users -- in practice I only need to be significantly more secure than the average to keep myself effectively free of risk.

Overall if someone can explain why I am not eliminating 99% of all risk I would be more than happy to install and maintain a virus checker.

"Even to display a website can infect your PC with malware, trojans or virus"

This is actually extremely unlikely even with IE. Since I use Mozilla Firefox it's almost inconceivably unlikely.

"To preview Email also enables your PC to get any sort of varmint"

Again not with patched software, generally not with Outlook (Outlook Express is the one that gets targeted and is completely different code) and certainly not with my main mail client Thunderbird.

Matthew

PS I do appreciate that this approach is not for everyone and if my Mum asked me what to do I'd tell her to install a virus checker.
Posted on: 30 March 2004 by Paul Ranson
quote:
Even to display a website can infect your PC with malware, trojans or virus. To preview Email also enables your PC to get any sort of varmint.

Explain the infection vectors (!).

I've received dozens of viruses over the last few weeks. I'm not infected and I don't have any AV software installed. IMO it's worse than the problem it purports to solve, it always irritates and interferes whereas a virus just sits in the inbox waiting to be deleted.

OTOH anybody on the internet but not using a dedicated firewall is asking for trouble. It's far more reckless than not using AV software.

Paul
Posted on: 30 March 2004 by throbnorth
Matthew is quite right - in the general way of things, and if you know a fair bit about computers and their ornery ways, you really don't need AV software. However, most people don't, therefore they do. It's really not some machismo thing, just plain common sense. Viruses are executable programs and someone has to execute them. It's likely to be you.

Most AV products take a fair performance hit, and some [McAffee, I would suggest] I actually find to be as bad as a virus - they creep all over your system, are almost undeletable and are generally inscrutable and crap. AV software manufacturers have a very big axe to grind and levels of paranoia to maintain for healthy sales.

Firewalls are different [you do need one of some sort - and a hardware one is ideal], but even the generally sound ZoneAlarm could give the uninitiated sleepless nights with the ludicrous number of 'attacks' it detects, which are nothing of the sort.

I use Computer Associates EZ-Trust for scanning downloads etc and general virus protection [it hasn't caught one yet before me!]- it seems to have a minimal effect on system performance, is cheapish [£14 a year] and has a standard and unobtrusive Windows interface. You never get the feeling it's up to anything you don't know about, and is very well behaved.

I gave up on Zone Alarm Pro - too tricksy to configure for a home network, and a bit neurotic - and rely [and I know this is dreadfully controversial] on the standard XP firewall. No problems since XP was introduced [whenever that was]. Used in conjunction with something like Spybot, the average user is pretty well protected. No problems here, at any rate.

throb
Posted on: 30 March 2004 by Rico
I gave up on Norton Antivirus, it was time to update from 2002, finding my way through their marketing to upgrade or establish how much it would cost me to buy another year's subscription from an OEM version of 2004 I was considering was just all too much - it was akin to walking down a third-world street with hawkers pitching their wares at you from every direction - all from the privacy of my own PC! It felt good uninsatlling NAV, and woaaaaaah - turbocharging and NO2 kicked in - my trusty Athlon 1200 picked up speed. Weeeehhhhhheeeeeh this is infectious (no pun intended).

So I downloaded and installed free AVG (I follow much of Matthew's practices, yet am not confident I am sufficiently attentive and hence use AV as an airbag to my precautionary safety belt) following many recommendations from friends. It works very well thanks.

Firewall-wise, I used Zonealarm for a few years. I now run a smoothwall box (www.smoothwall.org), and will check out IPCop 1.3 (www.ipcop.org) some time soon. Easy enough for a novice user like me to set up and configure on an old PC anyone can pick up from an auction site (or in your cupboard) for £10 or so.

Rico - SM/Mullet Audio
Posted on: 31 March 2004 by Jez Quigley
About time too! (from BBC News)

Microsoft is preparing an update to Windows XP that is intended to make the operating system more secure.
Dubbed Service Pack 2 (SP2) the update will close some loopholes that virus writers and malicious hackers have exploited to infect or take over PCs.

The add-on for XP will also include extras that block pop-up ads by default and give users a clearer picture of how secure their system is.

The update is due to be finished and released to users by the end of June.

CHANGES DUE IN SP2
Pop-up ads blocked
Revamped firewall on by default
Outlook Express, Internet Explorer and Windows Messenger warn about attachments
Origins of downloaded files logged
Web graphics in e-mail no longer loaded by default
Some spyware blocked
Users regularly reminded about Windows Updates
Security Centre brings together information about anti-virus, updates and firewall
Protection against buffer over-runs
Windows Messenger Service turned off by default

Microsoft has been working with chip makers AMD and Intel on ways to stop so-called buffer over-runs that can help an attacker take over a target PC.

Changes have also been made to the underlying Windows technologies that the Blaster worm exploited to spread so fast.

Also added to Internet Explorer are download watchers that stop "spyware" being trickled on to a PC via background downloads.

Internet Explorer, Outlook Express and Windows Messenger will also warn about attachments to messages or downloads to prevent viruses or other malicious programs being installed.

Outlook Express will no longer automatically download graphics for web-formatted messages to foil spammers trying to harvest live mail accounts.

In addition, all programs will have to be given explicit permission to use the web. None will get default access.
Posted on: 31 March 2004 by Rico
Slightly off-topic, but there you go.... I've just upgraded (yes folks, it is an upgrade) to mozilla firefox 0.8 from internet exploder. Ahhhh, the (net) world just looks so much nicer now... and it's snappier. And tabbed browsing, man this is cool. Should have done it ages ago.

Smile

Rico - SM/Mullet Audio
Posted on: 01 April 2004 by Chris Brandon
Good to see others trying ( and liking) Firefox 0.8 ( I have been using it since the day it came out,and,with the exception of one banking site have not been near IE since I installed it).

Mozilla also have a standalone Email client....Thunderbird 0.5 (Yep,you guessed it,not been near Outlook express since I installed it).

Both are available totally free of charge (& spyware) from ...

http://www.mozilla.org/

Regards

Chris
Posted on: 01 April 2004 by matthewr
I am very close to ditching Firefox until tehr eis a patch and going back to Firebird 0.7. It keeps losing its scrollbars and the download manager is broken and is annoying and useless anyway.

BTW this approach strikes me as a better idea to AV protection than the current approach at least in principle.

Matthew