Is anti-malware software effective?

Question

I have heard claims that anti-malware software isn't really effective and will "only catch 33% of malware", and so it's best to "get rid of them; you don't have to pay, and your system will be faster".

---

It is right here on my favorite blog, Coding Horror:

Not only does anti-virus cripple your machine's performance, it doesn't even protect you adequately!

A quote Jeff uses in his article from here:

Let me give you the answer: it is 33%. In other words, the average detection rate of malware from these "solutions" was 33%, with the maximum at 50% and the minimum at 2%. Keep this number in mind, that shiny anti-virus product you just bought might be protecting you from just 2% of currently active and common malware (not some esoteric and custom uber-haxor stuff)!

---

EDIT: I found this, and it looks like 60% is the highest "new malware" detection rate. I do not know if they are scanning or actually protecting you real-time, though.

---

While it is true that the second best protection is your brain (the best being not turning your computer on at all), my PCTools SpywareDoctor with Antivirus has caught some trojans; it even cleaned it of a Rogue Antivirus application. Mind you, it definitely slows my system down noticeably, but I'm happy enough for now ("640K ought to be enough for anybody.") so I have switched to the best Antimalware program in history, avast!, which is the fastest program with a >95% detection rate.

The brain argument doesn't always hold true for non-geeks (even if they may have some amount of brains). One I considered to be tech-savvy (somewhat, at least) stared at a web page saying "Your computer is infected!" for a minute at school, in IT class, throwing his hands up in exasperation, and getting every other student to look at it. (I of course, having been infected by Scareware before, immediately recognized it, and told him to close it.) He continued to be exasperated until the teacher came around and told him to close it. He did (too late, of course), and a few minutes later, it took over the Windows XP computer.

---

For geeks (and other people with brains), how true are these claims [con-AV]? What about "normal" people?

Answer 1

The claim is mostly not true, and in my opinion perpetrated by people who just want a justification for not caring about security.

Here's a test on the detection rates. Here's a snapshot from this report:

Note that this graph plots the missed samples, so the worst efficiency is 82%. The above graph applies to known viruses. Of course, it is impossible to say how effective any given anti-malware software is on zero-day attacks. To prevent these, heuristics are required that detect malicious or suspicious behavior such as one program inserting code into another executable file. While these will not prevent a dedicated and personalized attack, they can at least prevent some common pathways of attack.

My attention was brought to another graph for "real world" efficiency of malware detectors: It also shows quite a high detection rate.

This all being said, it is indeed highly dependent on the user's behavior how relevant anti malware software is. A professional user keeping her system up to date and avoiding potentially dangerous sites (porn- and warez-sites come to mind) might not need anti malware software. A "casual" user who does not hesitate to click on random links sent to him by email or on social networking sites and who unquestioningly install apps found wherever in the web, on the other hand, will catch some malware infection with high probability, although anti malware software might at least safe him from the most common dangers.

Answer 2

Short version A virus program will do a good job in protecting the user against himself, simply because:

• Your not likely to be the first person to get XXX virus/malware, likely hood that AV company finds it first is very high.
• Assuming you have a god anti virus software its gonna update serveral times a day, basicly faster then application vendors are gonna close X exploit that Y virus/malware uses. ( Link to changelog to show update rate)
• You the user are very likely to download and try to install something that contains malware.
• Malware creators / virus creators are lazy and often build new malware/virus based on existing one, this means that virus software CAN detect the shared code sometimes.

Longer version Its importent to understand what a AV protects you against. The majority of virus programs mainly detect threats it knows about before hand ( http://en.wikipedia.org/wiki/Antivirus_software ) they do not detect virus like a human can ( IE knowing a .exe is out of place and "knowing" the .exe name is randomly generated ).

So if your a avarage user, needing protection then a AV is going to do a great job detecting the vast majority ( If not all after a while ) of malware. But if your trying to protect against a target attack on you/your organisation then they will not be that effective if the attacker writes custom code for "you", as most AV software is not designed to hanlde this.

In response to comment il link to the tests. http://www.av-comparatives.org/en/comparativesreviews

And taking a good result from: http://www.av-comparatives.org/images/stories/test/ondret/avc_od_feb2011.pdf

You can see detection rates over 98% if you pick the tests that virus programs are good at ( IE detecting knows viruses ), if you pick tests that they are not so good at like have a virus program not able to update for 1 month but get viruses/malware from this period their detection rate will drop alot ( Link to NOD32 AV producer, claiming they can detect 50ish % of "unkown" viruses, as proof that detection are lower when the virus/malware is not known )

Link collection: Changelog from AV to show update rate, and the fact that commen virus/malware has families: http://www.eset.com/us/threat-center/threatsense-updates
Link to search engine to show that "tool kits" to generate viruses exist: http://duckduckgo.com/?q=virus+creator+toolkit