28

I have heard claims that anti-malware software isn't really effective and will "only catch 33% of malware", and so it's best to "get rid of them; you don't have to pay, and your system will be faster".

It is right here on my favorite blog, Coding Horror:

Not only does anti-virus cripple your machine's performance, it doesn't even protect you adequately!

A quote Jeff uses in his article from here:

Let me give you the answer: it is 33%. In other words, the average detection rate of malware from these "solutions" was 33%, with the maximum at 50% and the minimum at 2%. Keep this number in mind, that shiny anti-virus product you just bought might be protecting you from just 2% of currently active and common malware (not some esoteric and custom uber-haxor stuff)!

EDIT: I found this, and it looks like 60% is the highest "new malware" detection rate. I do not know if they are scanning or actually protecting you real-time, though.

While it is true that the second best protection is your brain (the best being not turning your computer on at all), my PCTools SpywareDoctor with Antivirus has caught some trojans; it even cleaned it of a Rogue Antivirus application. Mind you, it definitely slows my system down noticeably, but I'm happy enough for now ("640K ought to be enough for anybody.") so I have switched to the best Antimalware program in history, avast!, which is the fastest program with a >95% detection rate.

The brain argument doesn't always hold true for non-geeks (even if they may have some amount of brains). One I considered to be tech-savvy (somewhat, at least) stared at a web page saying "Your computer is infected!" for a minute at school, in IT class, throwing his hands up in exasperation, and getting every other student to look at it. (I of course, having been infected by Scareware before, immediately recognized it, and told him to close it.) He continued to be exasperated until the teacher came around and told him to close it. He did (too late, of course), and a few minutes later, it took over the Windows XP computer.

For geeks (and other people with brains), how true are these claims [con-AV]? What about "normal" people?

Improve this question
9
  • 2
    Depends on your operating system, too. You don't need AV-software on Linux Desktops.
    – user unknown
    Apr 15, 2011 at 5:45
  • True and windows vista/7 are usually considered more secure than XP.
    – apoorv020
    Apr 15, 2011 at 6:45
  • 9
    Avoiding dangerous sites is a lot more difficult these days. Any site that sells ad space is vulnerable to malware in the ads, and this did indeed happen to New York Times readers not that long ago. Brains are not as useful as they once were.
    – David Thornley
    Apr 16, 2011 at 14:28
  • It's 'anti-malware' not 'antimalware' I think. The latter is not very readable. I can't suggest an edit because of the six character limitation.
    – Martin Scharrer
    Apr 18, 2011 at 7:04
  • Some of these tools are indeed useless and do nothing. Others work very well indeed. And for the average Joe it's sometimes hard to tell the difference from the advertising for them.
    – jwenting
    Apr 26, 2011 at 8:44

3 Answers 3

Reset to default
23

The claim is mostly not true, and in my opinion perpetrated by people who just want a justification for not caring about security.

Here's a test on the detection rates. Here's a snapshot from this report: enter image description here

Note that this graph plots the missed samples, so the worst efficiency is 82%. The above graph applies to known viruses. Of course, it is impossible to say how effective any given anti-malware software is on zero-day attacks. To prevent these, heuristics are required that detect malicious or suspicious behavior such as one program inserting code into another executable file. While these will not prevent a dedicated and personalized attack, they can at least prevent some common pathways of attack.

My attention was brought to another graph for "real world" efficiency of malware detectors: real world test of malware software It also shows quite a high detection rate.

This all being said, it is indeed highly dependent on the user's behavior how relevant anti malware software is. A professional user keeping her system up to date and avoiding potentially dangerous sites (porn- and warez-sites come to mind) might not need anti malware software. A "casual" user who does not hesitate to click on random links sent to him by email or on social networking sites and who unquestioningly install apps found wherever in the web, on the other hand, will catch some malware infection with high probability, although anti malware software might at least safe him from the most common dangers.

Improve this answer
17
  • 7
    Ah, but these are known threat samples used by a company. There's no knowing how many are unknown, or how well these products would do on if we take frequency-weights into account.
    – apoorv020
    Apr 15, 2011 at 6:43
  • 9
    There are a gazillion malwares out there, and only the most recent few are relevant most of the time. These comfortably fit into a 0.2% non-detection rate: I don’t care whether an AV software recognises 100% of the viruses from five years ago since these rely on security holes that are now fixed. I care about the 10 viruses that came out this week, and which the software doesn’t recognise yet. That is to say, the graph you show is completely irrelevant in assessing the protection gained from AV software against current threats.
    – Konrad Rudolph
    Apr 15, 2011 at 10:46
  • 4
    Of course there are unknown viruses. I think I mentioned that in my answer. Thing is: The virus doesn't care if it's 5 years old. If you don't have proper protection, you will catch that virus. It's like not getting a measles vaccination for the reason that it doesn't protect against Ebola.
    – Lagerbaer
    Apr 15, 2011 at 14:47
  • 7
    @Lagerbaer My point is that up to date operating systems and softwares tend to protect against older viruses no matter whether an AV software is present or not. Their detection rate is therefore completely irrelevant, and highly misleading if presented as above. The only relevant detection rate is for current viruses and I don’t think the statistic would look nearly as good then. Your answer actually suggests that AV software works very well. I claim that the opposite is true, or at least that your answer does not demonstrate this claim.
    – Konrad Rudolph
    Apr 16, 2011 at 12:21
  • 4
    @Arjang This is just an anecdote. How do you know that you never had problems with Malware? There could be spyware on your computer, or you could be part of a botnet. How do you know? Apart from that, anecdotes are not evidence.
    – Lagerbaer
    Apr 18, 2011 at 23:35
8

Short version

A virus program will do a good job in protecting the user against himself, simply because:

  • You are not likely to be the first person to get XXX virus/malware, and the likelihood that AV company finds it first is very high.
  • Assuming you have a good anti-virus software it is going to update serveral times a day, basically faster than application vendors are going to close X exploit that Y virus/malware uses.
  • You the user are very likely to download and try to install something that contains malware.
  • Malware creators and virus creators often build new malware/virus based on an existing one, and this means that virus software can detect the shared code sometimes.

Longer version

It is important to understand what a AV protects you against. The majority of virus programs mainly detect threats they know about before hand. They do not detect viruses like a human can (e.g. knowing a .exe is out of place or deducing the .exe name is randomly generated).

So if you are an average user needing protection, then an AV is going to do a great job detecting the vast majority, if not all, after a while, of malware. But if you are trying to protect against a target attack on you/your organisation then they will not be that effective, especially if the attacker writes custom code for "you", as most AV software is not designed to handle this.

In response to comment I will link to the tests.
http://www.av-comparatives.org/en/comparativesreviews

And taking a good result from:
http://www.av-comparatives.org/images/stories/test/ondret/avc_od_feb2011.pdf

You can see detection rates over 98% - if you pick the tests that virus programs are good at (i.e. detecting known viruses), but if you pick harder tests - like using a virus program which is out of date by a month against current viruses/malware, then their detection rate drops a lot (e.g. see this Link to NOD32, claiming they can detect ~50% of "unknown" viruses, as proof that detection rates are lower when the virus/malware is not known)

Link collection:
Changelog from AV to show update rate, and the fact that commen virus/malware has families: http://www.eset.com/us/threat-center/threatsense-updates
Link to search engine to show that "tool kits" to generate viruses exist:
http://duckduckgo.com/?q=virus+creator+toolkit

Improve this answer
12
  • This is a pseudo-answer. Where is the evidence that “a AV is going to do a great job detecting the vast majority … of malware”? Lagerbaer also has no evidence for that, and in fact the security expert cited by Jeff Atwood in the question says the opposite.
    – Konrad Rudolph
    Apr 18, 2011 at 10:30
  • The fact that Jeff Atwood posts it does not make it true. I linked to the repots showing dection rates of 98%+
    – EKS
    Apr 18, 2011 at 13:12
  • 1
    @EKS Of course not, that was not what I said. But at least one renown security expert says the opposite of what you said. In fact, AV comparatives also cite such low figures in their retrospective/proactive tests. Arguably, these are the only important statistics.
    – Konrad Rudolph
    Apr 18, 2011 at 13:57
  • I never linked to AV sites, these are to be best of my abilties the highest quality AV tests out there. But i also try to explain in the beginning of my reply what a AV is likely to protect you again.
    – EKS
    Apr 18, 2011 at 14:46
  • @EKS “I never linked to AV sites”– you really need to read my comments more carefully, this is the second time (out of two) that you have misinterpreted my comment in a fundamental way. I said that you linked to “AV comparatives” which is the name of the website you linked to.
    – Konrad Rudolph
    Apr 18, 2011 at 15:11
-2

Update : This is an excerpt from http://cbl.abuseat.org , when look up information about a infected computer that had AV software installed on it: "Pay very close attention: Most of these trojans have extremely poor detection rates in current Anti-Virus software. For example, Ponmocup is only detected by 3 out of 49 AV tools queried at Virus Total.Thus: having your anti-virus software doesn't find anything doesn't prove that you're not infected." cbl.abuseat.org Once a program is executed there is no way of having any guarantee that is not a virus, This is a mathematical fact that is thought in Introductory Computer Science courses. c.f. : http://www.computingbook.org/ch12-computability.pdf , Exploration 12.1: Virus Detection

The idea of AV is outdated, and they are no longer effective: http://codeinsecurity.wordpress.com/2012/06/13/the-anti-virus-age-is-over/

Improve this answer
7
  • 3
    That's an opinion piece without empirical evidence that concludes they do have a role.
    – Oddthinking ♦
    Jul 22, 2013 at 1:33
  • 1
    Despite edits, this answer remains very poor. It quotes from a page that doesn't include the quote. There's no way provided of verifying the claim or showing it is widely true. Linking to the text book on computability doesn't demonstrate there is no practical way of detecting viruses. You will need to make a more explicit argument there. (Facetious example, even after my formula has been executed on my desktop calculator, I guarantee there are no viruses.) The final link remains an opinion piece that draws the opposite conclusion to your summary.
    – Oddthinking ♦
    Aug 7, 2013 at 7:06
  • Thank you oddthinking,1.The page was from network audit of an Ip address, I could not include the ip as well, 2.Linkning to text books that proves mathematically that it is impossible to have an algorithm that detects all viruses, only leaves the possibility of detecting viruses by a database of their signature, which is why all the modern AV's are completely useless against polymorphic viruses. Lastly, there is a you tube video of some Symentec head huncho admitting that they have no clue about stuxnet.
    – jimjim
    Aug 7, 2013 at 8:53
  • @Oddthinking : Added the screenshot from the page without exposing private details to get to that page.
    – jimjim
    Aug 7, 2013 at 23:15
  • 1
    3) This essay summarises that AV systems have holes in them. If you only read the title and first paragraph, you would think that AV systems are "dead", but if you read to the conclusion you'll see the author admits that AV systems still have a place. I use this to conclude that they don't.
    – Oddthinking ♦
    Aug 8, 2013 at 0:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .