Author Topic: The last time your AntiVirus saved you! (Read 25,516 times)

Mark0 · « **on:** May 22, 2008, 03:47 PM »

Seriously.
Can you tell when it was the last time your resident (as in actually intercepting file open / executing, etc.) AntiVirus fired up a big red warning and / or stopped some kind of virus / trojan / malware to actually take over your system?

Bye!

Josh · « **Reply #1 on:** May 22, 2008, 03:49 PM »

I have inquired in my mind to this very same phenomena. I havent had one hit up that was an actual VIRUS as opposed to spyware in forever. The last time was the w95.cih virus back when I was running Win95 OSR2.5 (Remember that 18 different releases of win95 ;-) ). I am half tempted to uninstall that and leave an on creation scanner like adaware running because nowadays, virii just arent in the majority.

Lashiec · « **Reply #2 on:** May 22, 2008, 05:17 PM »

Heh, although I advocate the use of an antivirus as the first line of defense, I think I catch about 20 virus in 10 years, most of them caused by my own lack of sense at the time.

The two last ones were one trojan hidden in a "picture" than a random guy send me over IM, avast! promptly warned me about it. Later I examined the file, and it turns out it was not even a picture, but a executable, maybe a embedded presentation, but I decided to shred it.

The other one was another trojan that was served via JavaScript, I encountered it because I misclicked in a spammed wiki. Careful with where you point the cursor

About virus, I had tons of boot viruses (the same every time, though) in my floppy disks during the years, after visits to internet cafes whose owners forgot to do the basic homework.

f0dder · « **Reply #3 on:** May 22, 2008, 11:05 PM »

The only times my own box has been infected, I either haven't had AV installed, or it didn't catch the virus - but I knew my system well enough back then to manually track down and nuke the infected files. Never had a trojan infection. Oh, and one of the viruses I had was CIH as well, got rid of it a few days before it would have nuked my flash bios - thankfully I didn't know about that nasty feature until after I had removed it

Kaspersky does keep the museum safe, though, and it saves them at least a few times a month (and if it wasn't for anti-spam, it would be several times a day, probably).

Edvard · « **Reply #4 on:** May 23, 2008, 12:13 AM »

About 6 years ago.
I was looking for some software on the freeware sites, and a link to something I was interested in went to a warez site instead of a valid homepage.

Just going to the page dropped about 20 different viruses down my pipe, all swiftly dealt with by Antivir (it was called something else back then...). This was shortly after I ditched my buggy-and-never-worked-right OEM PC-Cillin 2000 that came on the motherboard driver disk.

I trusted Antivir ever since then, but I can't recall such an attack after that either...

f0dder · « **Reply #5 on:** May 23, 2008, 12:17 AM »

Quote from: Edvard on May 23, 2008, 12:13 AM

About 6 years ago.
I was looking for some software on the freeware sites, and a link to something I was interested in went to a warez site instead of a valid homepage.

This can also all-too-easily happen when people do domain-name squatting. FireFox with adblock plus does take care of a lot of those problems, though

Target · « **Reply #6 on:** May 23, 2008, 12:54 AM »

short answer, never

interestingly though I appear to have had the opposite experience

I have always had an AV tool installed, but rarely used it. I recently ran a scan (for no other reason than that I hadn't done so in about 2 years) and found a nasty - the app (AVG) 'cleaned/healed' it, but the result wasn't what I was expecting...

on rebooting there was no desktop - apparently explorer wasn't starting for some reason. I could use an alternate shell no problems, but explorer was a no go.

Googling didn't turn up any answers so the end result was another rebuild...

Tekzel · « **Reply #7 on:** May 23, 2008, 01:09 PM »

Its hard to remember the last time I had an anti-virus program installed on my PC. Sometime in the mid to late 90s I would guess. Back then it wasn't as big a problem and these days I know how to not get infected. I don't suggest people roll the way I do though.

Carol Haynes · « **Reply #8 on:** May 23, 2008, 04:04 PM »

Occasionally when it has been my own (deliberate) fault and sometimes false positives (usually thinking keyloggers or password grabbers are present when actually they are applications I use - most NirSoft utilities which I know are OK).

I think I have only ever had one real virus stopped - caught in an email attachment from a friend whose system had been infected.

Deozaan · « **Reply #9 on:** May 23, 2008, 08:13 PM »

The only virus I can remember being infected with was because my mother didn't know any better and opened e-mail attachments on her computer. When all they did was load up a console window and shut down, she just thought it didn't work and went on with life.

It was on her own computer, but I had networked a drive or two to get quick access to files, and my computer ended up with it too. But that was probably close to 7 years ago.

EDIT: Oh and by the way. The AntiVirus didn't catch it and save me. I only found out when someone e-mailed me saying I was sending out viruses. I had to manually get rid of it somehow.

tuntis · « **Reply #10 on:** May 23, 2008, 08:32 PM »

It's ironic that whenever I've been infected by a virus, it's not the antivirus that's rescued me, it's some small utility designed specifically to remove the virus in question. Instead of removing viruses with your antivirus software, remove them with standalone tools made by the people behind your antivirus!

wraith808 · « **Reply #11 on:** May 23, 2008, 09:13 PM »

The only time by box was ever infected was by code red. I lost a *lot* of stuff then. I had stopped running AV because I hated (and still hate- even more!) the whole subscription model. Since then, I've been running it continuously, but when I think about it, even if I *had* AV installed, I'm not sure it would have stopped Code Red...

wr975 · « **Reply #12 on:** May 23, 2008, 11:14 PM »

Common sense is most likely good enough to avoid virus/trojan infection, but one error and ... $:-\$ . It's good to have a "backup".

I never used a resident AV, but manually checked suspicious files. This was good for many years. But two months ago I stopped thinking for a moment and clicked on a wrong file. Booom... A trojan installed with defense capabilities. Disabled AV. Made sure I couldn't launch anti-Trojan tools and so on. Very clever. Very annoying. Instead of wasting hours to get rid of it, I made a backup of the system partition and restored an old image + wasted some hours to reconfigure my system configuration. Avira found the trojan in numerous places in the backup image. I felt a bit stupid. I've 2 gigs of RAM and a Intel Dual Core. It's not like I'm running a 800 Mhz machine with 256 MB memory. I think my machine can spare some CPU cycles for a resident AV. But I disabled it and had to pay the price. So, now I run a resident AV (Avira Personal with nags disabled). To answer this thread's question: My AV didn't save me, because I disabled it, but it would have.

Dirhael · « **Reply #13 on:** May 23, 2008, 11:18 PM »

Quote from: tuntis on May 23, 2008, 08:32 PM

It's ironic that whenever I've been infected by a virus, it's not the antivirus that's rescued me, it's some small utility designed specifically to remove the virus in question. Instead of removing viruses with your antivirus software, remove them with standalone tools made by the people behind your antivirus!

Hmm...well the thing is, the whole point should be not to get infected in the first place. Your approach really only works if you know that you have a virus (and which one), and I would say that the most dangerous ones are the ones you don't notice but just quietly keeps sending out data from your system without destroying or slowing things down...like account information/credit card info.

f0dder · « **Reply #14 on:** May 23, 2008, 11:20 PM »

Common sense is not good enough anymore, with all the exploitable software components on a normal PC. You don't even even need to visit naughty sites, you can be hit by cross-site scripting, hacked banner servers delivering malware, etc.

Not running IE, using an adblocker, optionally disabling flash, and running a 64bit system... that will get you a far way. But you still won't be untouchable.

Grorgy · « **Reply #15 on:** May 23, 2008, 11:58 PM »

I have never had a virus found. But I still install AV as the first thing, I like the sense of security, (i am using eset smart security these days - 50% student discount here in Aus anyway)

I only run a full scan very occasionally and every so often, every month or two, will run spybot or Asquared free just to make me feel good

And an antirootkit (blacklight and/or panda) They never find anything either apart from a few cookies, and i clean my cookies regularly and only keep the ones I want/need.

dantheman · « **Reply #16 on:** May 24, 2008, 12:09 AM »

Quote from: Tekzel on May 23, 2008, 01:09 PM

Its hard to remember the last time I had an anti-virus program installed on my PC. Sometime in the mid to late 90s I would guess. Back then it wasn't as big a problem and these days I know how to not get infected. I don't suggest people roll the way I do though.

I don't think you're the only one to do so.
With AVG8 hogging up so much energy I've decided to do without (even though i've tried AVAST free edition which did quite well), so i've been doing away with one now for about a week.
If you share your PC with others, then that can make it a must.
Haven't had a virus attack in about a year (then again, it was AVG's own mistake which mistook a k-meleon.exe file as a virus - of all things!).

wreckedcarzz · « **Reply #17 on:** May 24, 2008, 01:25 AM »

I don't think any of my antivirus progs ever stopped something actively, except for avast!... but avast! gives so many idiotic false positives that I stopped using it.

I usually end up installing Spyware Terminator (w/ ClamAV) AFTER an infection, and doing the work afterward. More fun ripping it out than just blocking it

- I haven't been infected on this PC yet, I got 3 false positives from game trainers, but that's all...

I used to use PC-Cillin 2007, but it sucked a big one, so I now use PC Tools Internet Security, but I start it up once a month or so to scan, then turn it off and reboot again. Great blocking power, but I don't need it. It is enabled on my dad's PC though, he tends to collect viruses and trojans and whatnot out of the blue. I got it configged to pretty much block everything but what he uses, so I have to give PC Tools a

for that.

tuntis · « **Reply #18 on:** May 24, 2008, 08:39 AM »

Quote from: Dirhael on May 23, 2008, 11:18 PM

Hmm...well the thing is, the whole point should be not to get infected in the first place. Your approach really only works if you know that you have a virus (and which one), and I would say that the most dangerous ones are the ones you don't notice but just quietly keeps sending out data from your system without destroying or slowing things down...like account information/credit card info.

What I really meant was that the antivirus I've used in the rare situation I've been infected (I've been using my new computer for 6 months without any infections) has almost never been able to delete the virus by itself: it's always been some tool specifically designed to remove the virus in question. The only thing the antivirus did was name the infection for me!

dantheman · « **Reply #19 on:** May 24, 2008, 09:38 AM »

BetaNews describes AdAware8 as an AV program at freeware level (correction needed i believe).
Anyone use this program with success?

Josh · « **Reply #20 on:** May 24, 2008, 12:02 PM »

I actually just purchased a 3 year license to adaware. Yes, it might use about 4-5MB more of memory for the main module, but it is highly accurate in my experiences. I am testing the A/V functions of it as well. As such, I have uninstalled NOD32 and am running soley on AAW. I will keep everyone posted on my results.

oldfart · « **Reply #21 on:** May 24, 2008, 12:36 PM »

I used Norton up until about four years ago, then switched to Spy Sweeper when they offered AV. Back around the turn of the century I was regularly receiving viruses as my family all started getting computers and had to be trained in AV protection.
Beginning in '02, spyware became more of a problem than viruses. I was flooded with complaints about IE crashing and severely slow internet speeds. AdAware, Spybot and a couple other free programs cleaned out most of the trash [my brother-in-law had over 900 pieces of spyware on his system--not counting cookies].
Lately I've not had problems with either. I use Firefox with NoScript and Ad Block Plus and stay away from the back alleys of the Internet.

Josh · « **Reply #22 on:** May 24, 2008, 12:42 PM »

oldfart: How can you HONESTLY claim that you stay away from the back alley's of the internet? Surely donationcoder.com is one of the darkest walkways in the back alley of the internet!!!

f0dder · « **Reply #23 on:** May 24, 2008, 01:56 PM »

Quote from: Josh on May 24, 2008, 12:02 PM

I actually just purchased a 3 year license to adaware. Yes, it might use about 4-5MB more of memory for the main module, but it is highly accurate in my experiences. I am testing the A/V functions of it as well. As such, I have uninstalled NOD32 and am running soley on AAW. I will keep everyone posted on my results.

I've stayed away from adaware ever since it was revealed that
1) they load the entire file they scan into memory in one chunk
2) they lie about the number of threats they detect (multiplying the amount of entries in the database by some constant number).

They might have improved their ways, but I'd rather run a decent piece of antivirus software with behavioral blocking, like Kaspersky - should take care of most of the spy/adware nasties as well.

dantheman · « **Reply #24 on:** May 24, 2008, 05:24 PM »

As we await Josh with his comments about AA eh!

I don't want to go away from the AV issue,
but from the looks of it, the major threats are no longer "really" related to AV issues.
Perhaps someone could give his/her 2cents worth about SpySweeper?