canuckster

(Okay, the title's a bit overdramatic, but I couldn't resist the allusion.)

I've been living without any antivirus software on my home computers for over 4 years now. (It all started when my upgraded version wouldn't work except in Safe Mode; after many futile hours of attempted fixes, I finally said to hell with it.) With one exception -- when I deliberately unzipped a file I knew carried a virus just because I wanted to see what it looked like -- I've been completely virus-free all this time (I use HouseCall or Kaspersky a few times each year for good measure).

Anyone else out there compute 'naked'?

On the surface, it seems like such a risky thing to do, but -- in my opinion -- it only takes about an hour of attentive study to learn all you need to know to avoid getting infected. Stuff like being suspicious of unexpected, attachment-carrying emails from friends, knowing the basics of file extensions, and knowing how to open a suspicious file into a text editor to see what's really there. It's certainly not rocket science.

In place of antivirus software, I've enjoyed a faster computer and a few hundred extra dollars left to spend.

Makes perfect sense to me, and yet I feel I'm in an extremely small minority.

So -- opinions? Admonitions? Support from fellow anti-anti-virus types?

percepts

I don't have any anti virus or spyware software. I checked a couple of times with freebies over the years and never found anything that needed getting rid of.

Switching off many of the default windows services closes many potential holes and running a firewall (zonealarm) stops external connections. Also I don't allow any activex downloads in IE and java is off.

The biggest security is me trusting only the right sites for software downloads.

No virus software can protect against anything it doesn't know about so no PC is truly secure.

And remember "Curiosity killed the cat!".

__________________
An old dog learning new tricks

Neal

I use Nod32 anti-virus all for about £25 or so each year, and no slow down what so ever.

I don't use a firewall, just use Windows default and my router. Also use Windows Defender which is free, and Spybot.

ngray

Well I've had my Mac a month now and haven't got around to checking out AV software, in the fingers crossed approach that I've been safe with all my actions and browsing.

But wow, 4 years, that's a lot of trust in yourself! Have you NEVER opened an email that came from a friend that had "hey look at this" and an attachment?! Honestly?

I certainly wouldn't recommend a lay-user running AV free nor firewall free. But if you REALLY know what you're doing then yes I guess it helps not getting bogged down with all that extra demand on the CPU. I've still got my firewall running, I wouldn't run without that despite being behind a router on a NAT address, never know who's trying to get into my WIFI LAN.

__________________
Splattt there goes the 8:15 pie right on time. I hate mondays (Garfield)

If you drive you should be Smart Driving

Paranormal ghost map of the UK Thames Valley Paranormal Group

MrBen

I don't have an on-access virus scanner running on my laptop either. The Windows Firewall is running and I think Windows Defender is installed too (just because it was pushed down my AU). I do have the ClamWin on-demand scanner installed which if I download a file I'm not sure about I use to check.

Only I have access to the laptop and I have it locked down pretty well so there is little risk of a network. I share the desktop PCs and do have an anti-virus scanner running on that just in case. Never needed it though.

With server-side virus scanning of email it's not so much of a problem now. When was the last massive email virus? A long time ago.

All the PCs here have firewalls running and file sharing is disabled which greatly reduces the risk of viruses spreading over the LAN. So all that leaves really is rogue file downloads from the net but if you're careful you'll be alright.

Ben

__________________
Veterinary Practice Management System by SoftFooding
Internet Data Usage Calculator: Estimate your monthly bandwidth usage for your Internet connection.

canuckster

The short answer to your question is yes.

First of all, I use Yahoo mail for everything (friends know my address hasn't changed in 9 years), so I've never been susceptible to having an attachment automatically opened (ie by Outlook, for example) -- I have to do it myself.

Secondly, on the few occasions when I receive an email from a known source with both a) an attachment that isn't something obviously safe (jpg, txt) and b) subject or body text that sounds way too generic ("here's that file you asked for" or "check this out"), I save it to disc, then open it into a text editor where its first few characters will tell me whether it is what it says it is. Takes maybe 10 seconds more, doesn't cost me a thing, and I don't have to worry about whether my antivirus definitions are up to date.

Once I even phoned the person to ask if they'd really sent me the email.

All in all, I've probably needed to take these steps maybe a grand total of a dozen times in four years -- every other piece of virus/worm-containing email was so easy to spot that I just deleted it sight unseen.

One other thing I should mention is that I am behind a router, so I certainly benefit from its protection (and without a router I would definitely use something like ZoneAlarm) -- but that to me is a different issue from anti-virus software.

And now please excuse me while I step onto this soapbox:

In my opinion, the overwhelming majority of problems due to computers' becoming infected by viruses or worms can be blamed more on overdependance on AV software than on the viruses themselves. I'm a perfect case in point; with the one exception I mentioned in my first post (never to be repeated, I can assure you!) I've lost zero time to viruses -- except for the ones other people let into the systems I was using (ie the network at my place of work).

Why did they allow these systems to be compromised? Because they believed that the AV software would take care of everything for them. There's nothing they need worry about; they don't need to be suspicious of any attachment or download because the software will prevent them from harming themselves, right?

And all it took me -- and I don't think I'm any sort of Wunderkind here -- was about an hour's worth of keen attention (and of course I actually had to find the info all by myself, since computer manufacturers don't even try to help you -- I guess there'd be potential liability issues).

I don't advocate that everyone dump their AV software; I realize I'm in a minority of people who aren't afraid to be called a geek for something as simple as this. But the alternative -- which 97% of the computing world seems to follow -- just seems an unnecessary extreme. It just seems like so many sheep following the path of least resistance -- which ironically often rewards them with more problems than if they'd just paid some extra attention to how they use computers.

Okay, I'm finished.

philsi

I'm guessing that in these days of high awareness about computer security its generally possible to get away without Anti virus. I have AVG, but to be honest its pretty pointless most of the time: I use "gmail for your domain" for my email, which scans emails for viruses: you can open everything and it'll tell you if its a virus, and have a look etc. I mainly use AVG to scan my bittorent downloads, but most of these I get from the same source every week, so I can trust.

If you're sensible with your websurfing and stick to the "light side" of the web (i.e. no porn / warez / general questionable material) I think you're alright...

Para_Normal

Original post compressed for brevity...

I wouldn't go so extreme, even on a browser-based e-mail PC - I think you need SOME software that is watching out for you in real time - in and outbound...

I recommend to people that they use the FREE VERSIONS of various software packages and NO - NOT BECAUSE THEY ARE FREE but because they typically just do 'the basics' which is actually where you get the greatest benefits for the least downsides - blocked or failing web sites, erratic behaviour, dreadful performance etc..

I always use (a very old! version of) ZoneAlarm and the two AVG products - in my experience that combination has very little effect on anything with a 1GHz processor and 128MB for Win98, 256 for XP Home and certainly no problem 512 for XP Pro. On the latter two I would also run MS Defender but it did have a glitch or two in Feb'07? - used tons and tons of CPU... seems to be fixed now.

In terms of learning and not relying on AV software - absolutely right - I wouldn't dream of opening an attachment that I was not explicitly expecting on that day from a known-to-be-competent user. Most times I would run a scan if the user was 'questionable' and occasionaly I do like yourself and peek inside the file.

Tweaking setting in IE or just using Firefox to avoid Active-X and all the other open-ended xxxx that MS used to establish dominance at the desktop is another absolute must.

I would also justify ZA as well as the firewall in the router - I personally always like to know when code is trying to 'call home' (i.e. outbound traffic) and if it wasn't blatantly associated with something that I have requested (and I want 'it' to call home) then I would block the interaction without question... bear in mind that most routers rely quite heavily on SPI (Stateful Packet Inspection) which means that if a request starts from your PC then the router won't block any of the responses in return and that could be all sorts of xxxx coming down to an executable! on your PC - Not Good!

__________________
Brian R.
http://net-business-goals.co.uk

Samizdata

I have been doing it for about 8 years - since I got my first Mac.

Your point, though, is perfectly valid (see this recent Guardian article). An increasing number of people now use a router with a built-in firewall and are generally more tech-savvy, and I see very few virus problems these days on Windows boxes. Spyware and dialler hijacks are also down significantly.

It is also true that Windows is more secure since XP Service Pack 2 - though even Windows 98 is fine if you apply the updates and don't visit porn sites, download warez, or click absolutely anything without thinking.

However, I would not advise anyone with children in the house to throw caution to the winds - even if you set them up with a restricted account they will often learn how to bypass it. Links in instant messages are responsible for a lot of intrusions, and MySpace has had its problems too.

Anyone on this forum presumably qualifies as "tech-savvy", but the most recent problem I had to deal with involved a "rogue" anti-virus program that an unwitting friend had installed in order to protect himself...

...

peterd

It's the only way to go - if you know what you're doing. I've been anti-virus free since W2K - it slowed my old PC down way too much. Using Linux on the desktop has also helped.

If you also play it safe, like someone mentioned by avoiding porn, warez and P2P sites and software, you shouldn't have anything to worry about either, regardless of your OS. If you're into risky activities do it in a VM which you can revert to it's original state.

Vger

Not possible I'm afraid. A few weeks ago I went to a website I'd been to before to download an up to date version of some php software they issued. The company had folded and the domain had been bought up by a porn operation.

A few months ago I was sent an e-card from a customer, to say "Thank You" for some work done. I knew the email address was valid, and the customer did send it, but when clicked on the link to the e-card site it started trying to download a virus to the computer which AVG Pro quarantined. It got past the hardware firewall, and the Windows XP firewall, it was only AVG Pro that stopped it.

If you've been running for years without anti-virus without ill effect - you've just been very lucky!

Vger

__________________
Working with computers is a bit like getting old - the longer you're around the more wrinkles you find!

percepts

Wrong. There is no way any web site can install anything on your PC unless you authorise it. That means if you have NOT closed all the holes then you have authorised it. Of course you need to know how to close all the holes but if you do it properly then nothing can install from a web site without your authorisation.

You don't need antivirus software to do that.

__________________
An old dog learning new tricks

canuckster

If I can say this without sounding smug (cause I really don't mean it that way), Vger's ecard must have been a potentially unsafe attachment. What I mean is that the only ecards I've ever received are flash movies (of the .swf variety -- not the .exe kind) which play in the browser. I keep Java turned off except for those rare times when a (trusted) site requires it, so I can only assume that, had I received the ecard in question, I would have found something else about it to be leery of.

Of course, maybe not; maybe I really have been lucky.

I must say, though, that over the years I've visited a few porn and warez sites as a result of clicking on the wrong link or because a domain name had changed hands as Vger described. But because I a) don't use Intenet Explorer, b) have Java turned off, and c) close suspicious popup windows using a keyboard shortcut instead of risking clicking on a fake close button (ie that actually communicates a 'yes, please install that thingy' message instead) -- the only things I've picked up have been some tracking cookies and innocuous worms (innocuous because they don't end up infecting my system; they're merely found residing in files inside the browser cache). Nothing harmful.

desquinn

I think you have been. It's akin to riding a motorbike without a helmet, or driving a car without seatbelt. You may think you are a safe enough driver and can anticipate all eventualities but there is always that other driver, pedestrian, rabbit, or some other unknown quantity that is going to screw your day up.

Perceived risk is whats at play here, and if I was driving the car then I would put on my seatbelt. If I am using a pc then I would use a copy of Nod32 for £15..... A bogus windows update, a windows vulnerability, a man in the middle attack, or some other thing that the bad person knows about that you dont..... Defense in depth, its just another layer of protection to reduce your actual risk.

percepts

lets keep a sense of perspective here. Not implementing antivirus software is not recommended for everyone but only for those who are comfortable with the concept and understand how to protect themselves without the AV sofware. For those who are more susceptible to STD's (software transmitted deseases) should protect themselves using the recommended methods.

It's all about fear which you can buy into or educate yourself out of.

__________________
An old dog learning new tricks

Vger

That comment hardly warrants a reply.

Vger

__________________
Working with computers is a bit like getting old - the longer you're around the more wrinkles you find!

desquinn

I consider myself a well educated, and experienced IT professional. I am responsible for the protection and security for a number of businesses networks. I think my perspective is crystal clear, and for the sake of the unknown vulnerability or other attack vector it is worthwhile to have a certain amount of protection.

In my mind if you browse from a machine then it needs AV protection.

Vulnerabilities in vrml, images, java runtime, firefox, or more importantly the app that you do not know is compromised is the thing that AV software protects you against.

consider this

Speak to any security professional of note and they will say use AV software on the desktop.

canuckster

I don't know how one would go about this, exactly, but it would interesting to find out what proportion of those who have made conscientious decisions not to use AV software have been given cause to regret it.

I do promise to eat my words and inform this thread if and when I elect to start using AV again.

TygerTyger

It does also raise the interesting question of how you know you don't have any viruses if you have nothing to detect them. Perhaps I've just missed out hearing about those keyloggers that announce their installation with an informative bulletin.

__________________
Check your accessibility and web page quality

corenominal

I totally agree. I can't quite remember that exact name of it [Red something or other] but it went from IIS to IIS infecting every ASCII file it could find. I was running IIS on my works development server at the time and it put a serious downer on my week. Tens of thousands of files infected and simply by visiting an already infected site. That was my first major virus experience. I have no intention of repeating it. Horrible horrible horrible.

P.S. It's also akin to not wearing a rubber when visiting a sheep pen. Don't do it