4

Let's say I buy a computer and use the internet for services but rarely download anything and when I do it is from legitimate sources with a minimal to non-existent chance of malware.

What benefits can an antivirus program provide me other than detecting or preventing those few downloads from containing malware?

Or I guess more generally - Is antivirus needed if a computer doesn't download files but only uses web applications?

  • Do not allow your browser or another program on your computer to automatically download files. I have found that people will miss a few, and their kids or accidental clicking will open a piece of malware. If your browser DOES download something even after you have configured it not to, then something is seriously wrong and should be investigated by a professional, such as your workplace security-operations center. You will also want to submit a bug to the browser vendor. – atdre Dec 22 '14 at 13:46
3

An antivirus program is always useful. The problem with your logic is that you're assuming that you are in control of everything that is downloaded to your machine. Using web applications will invite all sorts of different possibilities into the mix.

Unknown Downloads
Lots of different things are downloaded to your machine without your knowledge. I just recently visited a site for holiday shopping and SilverBells.wav was immediately downloaded to my machine without any kind of prompt. Data masquerading as session cookies, images, all are downloaded without prompting to the user.

"But I don't run the browser as an administrator, how can malware do any damage without privileges?"

It turns out that Malware really doesn't need very high privileges to get its job done. Any kind of initial foothold into the system is all it needs to run rampant. It might not be super advanced, and hard to remove. But the annoying Adware types usually don't care all that much.

Browser Exploitation
Browsers are large applications with tons of attack vectors for exploitation. See my answer here that includes links to the main browser security bug fixes. You don't even need to visit a malicious site if an ad somewhere contains a piece of code to exploit the browser. In these cases files can be downloaded to your computer, or browser extensions can be installed; all without your knowledge or consent.

Web Protection
Nowadays antivirus products are a lot more than just scanning your system for malicious pieces of code. A lot of times now they provide real-time web browsing analysis. If a malicious script is running on a web page it will alert your first before displaying the web page itself.

They can also scan for malicious URLs and possible phishing attempts. Just because it's displayed on Google doesn't mean that you should click it. Some phishers will do a lot to push their website up the chain of Google returned searches.

The bottom line is that there is a lot more out there to worry about than just downloading files when it comes to malicious pieces of code. Using an antivirus program is always suggested; better to have it and not use it than unprepared.

  • I have two problems with your answer : first, downloaded files mean nothing as long as they aren't manually run by the user, so the ability of websites to force downloading files isn't a security risk in itself. Second, the injection of antivirus code into browsers doesn't seem to be so beneficial lately ; for example see this tweet from a Google Chrome security dev : twitter.com/justinschuh/status/802491391121260544?lang=fr . I'm skeptical of the need for an antivirus on a well-used system nowadays. – Elzo Jul 21 '17 at 20:28
3

Of course, you will always need an anti malware program even if you do not download files by yourself. Why ? Because a simple visit to the most innocent website you know, may trigger an attack and install you malware (more likely spyware) that can lead even to a total control of your machine.

I advice you to read about drive-by download attacks that can exploit the vulnerabilities of your browsers and or their plugins and install without your consent or knowledge more or less dangerous malware.

When is an antivirus program needed/useful?

As I said, always. Unless if your computer is totally disconnected from internet and you never use any external media (USB sticks, external HDD, CDs ...) to read data (in which case, your computer is useless)

  • Spyware is often user installed, albeit unwittingly along with another program. Maybe replace this word with malware or a virus. – SilverlightFox Dec 21 '14 at 9:59
  • @SilverlightFox Thank you, I edited my answer (even if drive by download attacks almost always start by installing a spyware first). – user45139 Dec 21 '14 at 10:03
1

An antivirus may help against malware that exploit vulnerabilities to install themselves without user interaction, like browser vulnerabilities, PDF viewer ones, Flash player or Java plugin ones, in which case the antivirus would prevent the payload from executing.

This of course assumes the payload is already known to the antivirus, which isn't the case with a brand new virus or a targeted attack.

Since there are free and non-intrusive antivirus software such as Microsoft Security Essentials you may as well install it, every bit of protection helps.

1

In the year 2015, most malware will spread via two mechanisms, the primary being USB (or derivative, which nearly all hardware is) and the second being TDS (often a combination of adware, parasite hosting, and blackhat SEO) via exploit kits. Yes, the second vector is over the web and the targets are browsers and browser plugins especially Java, Flash, and Silverlight applets. Neither of these require you to download anything!

You can't stop either of the above attacks with antivirus, however antivirus is still very important to have installed regardless. There is one technique (available via at least one free tool that I know about and one commercial product) that provides near-complete control over infection. This technique is exploit protection in the form of advanced canaries and ASLR such as provided by Microsoft EMET or Invincea Freespace. Many in the security industry will claim that these can be bypassed -- and while there is truth to this, it often requires knowledge of the target environment that goes beyond what exploit kits currently allow.

Let's pretend that you do have an advanced piece of malware that uses a hardware vector or an extremely-advanced web vector. Antivirus, such as McAfee, will not catch the malware -- but it can help a forensics investigation. Not only does McAfee leave behind BUP files that can be analyzed, it also can leave event logs or other artifacts that leave a trail of malware behaviors available to an investigator.

Summary: Install Microsoft EMET, configure it for maximum security adding all of your browsers and browser plugins, and advance its configuration further with tools such as EmetRules. Also install antivirus -- my recommendation is McAfee because forensics investigators are familiar with it -- and it appears to be useful during after-the-fact investigations because of its logging capabilities. If you are very worried about malware spread via hardware means, then do not plug hardware such as USB (any, not just flash drives), CD/DVD media, or SDcards into your computer -- and protect your computer by removing or epoxying (i.e., gluing shut) these hardware components.

  • Why doesn't antivirus help against these? Doesn't the antivirus program scan both the usb and flash/java applications before allowing them to run? – Hjulle Dec 22 '14 at 17:46
  • @Hljule: It's not just a matter of breadth across supported OS or non-OS file and protocol handlers -- but antivirus must deal with errors such as false negatives, an issue that requires much depth through continuous, yet often manual, improvement (i.e., it takes time and money) – atdre Dec 24 '14 at 21:15
0

Visiting shady websites and downloading files are common ways that a computer could get infected, but they are by no means the only ones. Drive-by downloads that exploit vulnerabilities in the browser, operating system, or plugin (Flash, Java, etc.) can infect your computer if you merely visit a malicious webpage, with no other interaction on your part and no indications that anything was downloaded.

Even big-name sites can sometimes spread malware. For example, earlier this year researchers found that some Youtube ads were linking users to drive-by downloads and infecting anyone who clicked on them with a banking trojan. The drive-by download relied on zero-day exploits in IE and Flash, so people who were infected would see no indication that anything malicious happened.

Then there are viruses that spread via infected USB flash drives, over the local network, etc. etc. In short, visiting only major websites and downloading from legitimate sources will reduce your chances of getting malware, but it does not mean that you can skip installing antivirus.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.