full-disclosure - Re: Av, spyware, ddl trojan assesment

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <43340F59.19453.519E83F1@gmail.com>
Date: Fri Sep 23 03:21:26 2005
From: nick at virus-l.demon.co.uk (Nick FitzGerald)
Subject: Re: Av, spyware, ddl trojan assesment

Sherwyn Williams wrote:

> Hey list, I know this is not a how to protect your pc list. But I would 
> like to know what are some good AV, spyware, adware, and software 
> firewalls to use. I have to come up with a plan for a few of my clients 
> who are always being infected.

If your clients really are "always being infected" then none of these 
reactive, updated-to-detect/handle-the-thing-after-the-event approaches 
will actually help your clients much.

If they really are "always being infected" then the problem is that 
they [double-]click on pretty much everything.

If they really are "always being infected" then their behaviour and 
belief-sets are the problem, not the brand choice of anti-
<whatever>ware is installed (or not) on their PCs.

If they really are "always being infected" then they will continue to 
get infected regardless of which brand[s] of anti-<whatever>ware you 
install because they will continue to keep giving the new <whatever>s 
free reign on their machines before the recommended anti-<whatever>ware 
has been updated to detect/intercept/handle/block these new versions.

Reactive solutions such as you have asked for recommendations for are 
continually sidestepped/deactivated/bypassed by new <whatever>s 
because, BY DESIGN, those reactive "solutions" let the bad guy play 
first.

If your clients really are "always being infected" then they will 
continue to "always be infected" so long as they are allowed to use 
computers that trivially allow them to run arbitrary code from 
unauthorized sources.

There is, today, no really useful anti-
arbitrary_code_from_unauthorized_sources-ware, so you are stuck with 
clients that will always be infected.

> All help is welcome.

My pleasure...

-- 
Nick FitzGerald
Computer Virus Consulting Ltd.
Ph/FAX: +64 3 3267092