Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

This question already has an answer here:

Are anti-viruses useful nowadays ?
Given the number of viruses that are developed and spread monthly, and given the fact anti-viruses are based on virus signatures, I wonder how much it is useful and effective to use an anti-virus ?

share|improve this question

marked as duplicate by Adnan, schroeder, TildalWave, Xander, Mark Jul 28 at 19:38

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

1  
Over the last ~half dozen years my AV's blocked one or two threats/year from legitimate sites that were either hacked or hosting tainted 3rd party ads; and had one infection slip past an out of date filter about 2 years ago. As others have said it's not fool proof; but will cut down on your total risk a good bit. –  Dan Neely Jul 28 at 15:30
    
Very similar to Are signature based antivirus or antimalware effective? –  Adnan Jul 28 at 18:14

8 Answers 8

Yes, there are also near infinitely many possible vulnerabilities and exploits on your system, but applying system updates is still advisable. Good security includes a concept called defense in depth. The idea is that you do what you can with multiple tools in order to make it harder for an attacker to penetrate all your lines of defense.

The effectiveness of anti-virus software may not be as high as it once was, but it still protects you from a far larger set of threats than ever before. It is foolish not to use AV software as a component of your defense. Keeping current on virus definitions, good network security and patching your system regularly, as well as good password security and avoiding risky websites are all also important to keeping a system secure.

The more barriers you put up, the harder it is for an attacker, even if none of your defenses are 100% foolproof (which is really ALWAYS the case).

share|improve this answer

Yes, you should have an antivirus installed for the following reasons:

  • protection against old malwares
  • protection against new, widely spread, malwares

You will get some malware eventually (depending on your usage), but significately less than without an AV, and with less impact on your usage.

share|improve this answer

You will likely see a wide range of answers on this question, and even though this question is quite subject I'll answer it anyways.

I believe that anti-viruses do still serve a purpose, however it's peoples mind-sets that need an adjustment. The common misconception among many computer users is that if they install an antivirus that they are untouchable and their computer has become bullet proof. We know this is not true. I view AV software in the same light as car insurance - something you need to have but hope to never have to rely on.

I will say that I think signature based AV is an antiquated notion and largely ineffective. Behavioural based AV (such a Webroot) can block actions in addition to traditional signature based methods, making it almost impervious to code morphing or subtle variations of the code. I would certainly recommend a behavioural based approach as opposed to simply signature based.

I believe AV is still an essential weapon in combatting malware, but it needs to go hand-in-hand with a users education on how to spot and avoid threats. I've found that once I told people how to spot threats that they relied on their AV solution significantly less.

share|improve this answer

YES

But you have to adjust your expectations to reality. Anti-virus likely will not protect you from a brand-new virus, but WILL likely protect you from well-known viruses.

Think of Anti-virus (Anti-malware) as a "background radiation shield". It's there to protect you from the background radiation of the Internet. It's not going to stop all threats.

share|improve this answer

Given the number of viruses that are developed and spread monthly, and given the fact anti-viruses are based on virus signatures, I wonder how much it is useful and effective to use an anti-virus?

Let's turn that around.

Given the number of viruses that are developed and spread monthly, and that there are specialised programs who keep databases of these viruses to detect and counter them, I wonder how viable it is not to have an anti-virus program on a system.

Not very viable.

Now, you make a good point, and that is that threats evolve, but so does the AV software, even if it is sometimes a step behind. AV isn't perfect--never will be--and it will at times be insufficient, but it remains an important part of your defense. Leaving it out is a big risk I wouldn't advise anyone to take.

share|improve this answer

If you are using a Personal Computer just for your own purposes and you are not browsing or using unknown sources. Then updating your Operating System on time and keeping your Firewall on is enough. While on the business side it is always a good idea to have an Anti Virus to cut down any remaining potential risks. Operating Systems are sometimes slower in releasing updates.

share|improve this answer
1  
Known sites have been known to spread viruses if they have something not properly sanitized. I think AV is a must. –  Travis Pessetto Jul 28 at 19:25

Yes... Sadly.

There is a lot of fairly dumb, automated malware floating around (especially for the Windows desktop platform) that is very nasty if allowed to install. Antivirus software can generally detect this stuff before the installer executable, dropper, or whatever runs. Most AV software also comes with transparent filtering proxies to detect exploit shellcode, and other layers of defense.

But there are problems here.

a) This is against generic, spray-and-pray attacks mostly aimed at desktop users. If the attack is customized, novel, highly obfuscated, or targeted specifically at you (e.g. spear phishing attack on a company) then an antivirus has a good chance of missing it.

b) Antivirus engines are privileged processes, and perform various types of analysis (often involving disassembly or virtualized execution) on possibly malicious code. That is a huge potential attack surface.

c) The entire concept of antivirus as real-time defense is not very smart or very future-proof. It detects possible maliciousness by signatures and heuristics; so false negatives are common, and it needs to be updated frequently.

d) The main part of an antivirus, the on-access engine, only kicks in once an attack has already started. Its job is to stop payloads. The memory or program logic exploit that triggers the payload generally goes undetected.

e) There are several modes of attack that an AV engine will not intecept, e.g.

  • Stuxnet-type kernel exploits
  • Non-persistent snooping in program memory

In summary:

  • Antivirus is not the be-all and end-all of security
  • It is a specialized type of security software for dealing with specific types of attacks
  • It is hugely helpful in some situations, but that does not make it invariably helpful

and about all, it is not a first line of defense. Your applications (via exploits) and your brain (via social engineering) are what get compromised, so they are always the first line of defense. Your AV is there as a fallback measure. That does not mean it's useless, but that does mean you shouldn't rely on it too much.

And now some disclaimers:

  1. I am an IT worker, not a security consultant, so don't take what I say at face value.
  2. I have a vested personal interest in antivirus software disappearing as a popular concept, because I believe the approach is unsustainable, and commercialized to a harmful degree.
share|improve this answer

It depends what OS you gots, if Linux then none is needed, if Windows then yes, you need it.

Windows- if you won't pay for antivirus (fair enough) go AVG free. Linux- built on UNIX system so no need for any. MAC OS - same as Linux, though Apple suck ;) haha

share|improve this answer
1  
Why do you need it on one OS but not on others? –  PiTheNumber Jul 28 at 16:02
    
Because Linux and MAC OS are built on UNIX systems (OS's that were for big companies so it had ultimate security) –  IBTrey Jul 28 at 16:03
4  
Linux won't protect your user's data from malware that exploits a vulnerability in Firefox anymore than it would on Windows. In reality, much of Linux's "security" on the desktop comes via the obscurity of it. Also, the notion that UNIX provided "ultimate security" is an utter myth that ignores how insecure the big Unix systems actually were- the threats were just largely nonexistent in a pre-Internet world). –  Kitsune Jul 28 at 16:08
4  
Check the myths about malware on Unix/Linux. These systems are not immune, just rarely targeted. –  JvR Jul 28 at 16:09
    
I think UNIX systems do have bugs, too. Also they often run cross compiled software where Linux and Windows Versions do have the same bugs. Sure, with UNIX you are less of a target. –  PiTheNumber Jul 28 at 16:09