Are antiviruses still useful?

Question

Are anti-viruses useful nowadays ?
Given the number of viruses that are developed and spread monthly, and given the fact anti-viruses are based on virus signatures, I wonder how much it is useful and effective to use an anti-virus ?

Answer 1

Yes, there are also near infinitely many possible vulnerabilities and exploits on your system, but applying system updates is still advisable. Good security includes a concept called defense in depth. The idea is that you do what you can with multiple tools in order to make it harder for an attacker to penetrate all your lines of defense.

The effectiveness of anti-virus software may not be as high as it once was, but it still protects you from a far larger set of threats than ever before. It is foolish not to use AV software as a component of your defense. Keeping current on virus definitions, good network security and patching your system regularly, as well as good password security and avoiding risky websites are all also important to keeping a system secure.

The more barriers you put up, the harder it is for an attacker, even if none of your defenses are 100% foolproof (which is really ALWAYS the case).

Answer 2

Yes, you should have an antivirus installed for the following reasons:

• protection against old malwares
• protection against new, widely spread, malwares

You will get some malware eventually (depending on your usage), but significately less than without an AV, and with less impact on your usage.

Answer 3

You will likely see a wide range of answers on this question, and even though this question is quite subject I'll answer it anyways.

I believe that anti-viruses do still serve a purpose, however it's peoples mind-sets that need an adjustment. The common misconception among many computer users is that if they install an antivirus that they are untouchable and their computer has become bullet proof. We know this is not true. I view AV software in the same light as car insurance - something you need to have but hope to never have to rely on.

I will say that I think signature based AV is an antiquated notion and largely ineffective. Behavioural based AV (such a Webroot) can block actions in addition to traditional signature based methods, making it almost impervious to code morphing or subtle variations of the code. I would certainly recommend a behavioural based approach as opposed to simply signature based.

I believe AV is still an essential weapon in combatting malware, but it needs to go hand-in-hand with a users education on how to spot and avoid threats. I've found that once I told people how to spot threats that they relied on their AV solution significantly less.

Answer 4

YES

But you have to adjust your expectations to reality. Anti-virus likely will not protect you from a brand-new virus, but WILL likely protect you from well-known viruses.

Think of Anti-virus (Anti-malware) as a "background radiation shield". It's there to protect you from the background radiation of the Internet. It's not going to stop all threats.

Answer 5

Given the number of viruses that are developed and spread monthly, and given the fact anti-viruses are based on virus signatures, I wonder how much it is useful and effective to use an anti-virus?

Let's turn that around.

Given the number of viruses that are developed and spread monthly, and that there are specialised programs who keep databases of these viruses to detect and counter them, I wonder how viable it is not to have an anti-virus program on a system.

Not very viable.

Now, you make a good point, and that is that threats evolve, but so does the AV software, even if it is sometimes a step behind. AV isn't perfect--never will be--and it will at times be insufficient, but it remains an important part of your defense. Leaving it out is a big risk I wouldn't advise anyone to take.

Answer 6

If you are using a Personal Computer just for your own purposes and you are not browsing or using unknown sources. Then updating your Operating System on time and keeping your Firewall on is enough. While on the business side it is always a good idea to have an Anti Virus to cut down any remaining potential risks. Operating Systems are sometimes slower in releasing updates.

Answer 7

Yes... Sadly.

There is a lot of fairly dumb, automated malware floating around (especially for the Windows desktop platform) that is very nasty if allowed to install. Antivirus software can generally detect this stuff before the installer executable, dropper, or whatever runs. Most AV software also comes with transparent filtering proxies to detect exploit shellcode, and other layers of defense.

But there are problems here.

a) This is against generic, spray-and-pray attacks mostly aimed at desktop users. If the attack is customized, novel, highly obfuscated, or targeted specifically at you (e.g. spear phishing attack on a company) then an antivirus has a good chance of missing it.

b) Antivirus engines are privileged processes, and perform various types of analysis (often involving disassembly or virtualized execution) on possibly malicious code. That is a huge potential attack surface.

c) The entire concept of antivirus as real-time defense is not very smart or very future-proof. It detects possible maliciousness by signatures and heuristics; so false negatives are common, and it needs to be updated frequently.

d) The main part of an antivirus, the on-access engine, only kicks in once an attack has already started. Its job is to stop payloads. The memory or program logic exploit that triggers the payload generally goes undetected.

e) There are several modes of attack that an AV engine will not intecept, e.g.

• Stuxnet-type kernel exploits
• Non-persistent snooping in program memory

In summary:

• Antivirus is not the be-all and end-all of security
• It is a specialized type of security software for dealing with specific types of attacks
• It is hugely helpful in some situations, but that does not make it invariably helpful

and about all, it is not a first line of defense. Your applications (via exploits) and your brain (via social engineering) are what get compromised, so they are always the first line of defense. Your AV is there as a fallback measure. That does not mean it's useless, but that does mean you shouldn't rely on it too much.

And now some disclaimers:

1. I am an IT worker, not a security consultant, so don't take what I say at face value.
2. I have a vested personal interest in antivirus software disappearing as a popular concept, because I believe the approach is unsustainable, and commercialized to a harmful degree.

Answer 8

It depends what OS you have. If Linux, then none is needed. If Windows then yes, you need it.

Windows - if you won't pay for antivirus (fair enough) go AVG free

Linux - built on UNIX system so no need for any

MACOS - same as Linux