Are AV's obsolete

[SuperDave]

An interesting article here concerning using an AV on one's computer.

[evilfantasy]

But while anti-virus software isn’t foolproof, it’s “a long way from useless,”

That's the only thing about antivirus and malware that hasn't changed in many many years. Antivirus is a layer of security, not an answer to malware.

Whitelisting alone won't work. Once a website is whitelisted then the malware will have a free pass to load remotely. Like software installers that "phone home" to deliver the malicious payload.

[Geek-9pm]

The is strong stuff. They say it is getting worse.
But we still need AV software.

[DaveLembke]

Please correct me if I am wrong, but its my understanding that malware and virus's cant infect a system that is run with USER level lowest level permissions, so isnt the best antimalware / antivirus the practice of operating with lesser privileges and only elevating to admin when absolutely necessary such as to install an Adobe update ( verified to be from Adobe and not a fake site ) on top of running a better Antivirus such as AVG and Malwarebytes scans on occasion to make sure that nothing slipped in?

I am not aware of any malware or virus that can spread to a user level privileged system that is patched from exploits. Are there any that can attack a user level lowest privileged system?

As far as whitelists go, it is not a somewhat perfect solution unless the IP address is verified for the origin vs the URL which the URL can be too easily spoofed. But still content from a whitelist should still be scanned for proper checksum for downloads etc. Everything else should go through extensive scans.

There are current whitelists in systems now. Microsoft Updates, as well as other software that update such as from Adobe and multiplayer games are trusted. I am really amazed that no one has found a way to mimic any of these sites to push out a malicious update.

[evilfantasy]

Most malware is installed by the user so gaining system privileges isn't really a problem. There are those who don't know they are installing it and then those who either ignore the warnings or think they are too smart to get infected.

I am not aware of any malware or virus that can spread to a user level privileged system that is patched from exploits. Are there any that can attack a user level lowest privileged system?

It's software so the possibilities are endless and yes it's been done. An article from 2003 talking about methods used to load the malware at system startup. If the malware loads first then it is harder to be detected. Are You Infected? Detecting Malware Infection

[BC_Programmer]

Please correct me if I am wrong, but its my understanding that malware and virus's cant infect a system that is run with USER level lowest level

That depends on what you mean by "infection" though. malware will have a difficult time of it not running as an administrator, however, it can still 'survive' in a low-privilege environment. For example, A piece of software can still add itself to the auto-start in the registry under HKEY_CURRENT_USER, and it can perform some limited logging. I'm not sure if it's possible to create a keylogger this way, but it might be possible to do so to monitor keypresses in other applications run under the limited account, which is still pretty bad.

permissions, so isnt the best antimalware / antivirus the practice of operating with lesser privileges and only elevating to admin when absolutely necessary such as to install an Adobe update ( verified to be from Adobe and not a fake site ) on top of running a better Antivirus such as AVG and Malwarebytes scans on occasion to make sure that nothing slipped in?

Well that should work for preventing more major infections, it has two flaws- the first is that the person verifying things are legitimate is a human, and we aren't known for our error-free judgement, and the second is that it won't prevent "minor" infections which are still infections.

I am not aware of any malware or virus that can spread to a user level privileged system that is patched from exploits. Are there any that can attack a user level lowest privileged system?

The common strategy of malware to install themselves as part of another product via a Trojan horse is common for admin programs.  The installer get's admin rights, so the trojan installer does too.

But they can still be added to software that does not get admin permissions. Browser exploits can allow a website, script, or other entity to reach outside of the browser from within the browser's own security context, so even though they are reaching outside the browser, they are still restricted by the fact that the browser was run with lower privileges. This does not prevent problems, since with that level of permission they can easily write executable files to the temp or application data folders and add them to the autorun key of the current user, which means they will launch on next boot. Add in a fake signature and publisher and a Application manifest and the next time the system boots it could request elevation with a prompt that disguises as- to follow your example- Adobe updater. There is a high chance in that situation the user would than allow it, and then the malware that was previously only restricted to user privileges is now running as an admin, installing services, and adding scheduled tasks to run under the even higher privileges SYSTEM account, possibly even installing kernel drivers.

There are current whitelists in systems now. Microsoft Updates, as well as other software that update such as from Adobe and multiplayer games are trusted. I am really amazed that no one has found a way to mimic any of these sites to push out a malicious update.

trusted by whom?

[evilfantasy]

BC explained it much better than I did.

[Geek-9pm]

Apparently Mal ware does get through the permissions.
The only methods that stop Malware are so Draconian* that they are not used.
* dra·co·ni·an
1 . (of laws or their application) :
harsh, severe, strict, extreme, drastic, stringent, tough;
cruel, oppressive, ruthless, relentless, punitive;
authoritarian, despotic, tyrannical, repressive

People just do not welcome very severe security measures.

[soybean]

Well, I'm sure not going to stop using avast! Free Antivirus.  Its Web Shield has detected and blocked malicious websites numerous times over the few years I've been using it. 

But, anti-virus alone is not enough.  Malware protection software such as Malwarebytes Anti-Malware and SuperAntiSpyware should also be used along side an anti-virus program.

And, of course, prudent surfing can help avoid getting trapped by some social engineering scheme.

[patio]

Methinks they simply needed to fill out some editorial space that week...musta been a slow one.

[DaveLembke]

Thanks for the clarification with examples to permission levels not a catch all block even at the lowest privilege account access level!!!     Just learned something new through this. 

I also use WinPatrol on my systems which is similar to the TeaTimer that Spybot S&D had that I use to use years ago. Is WinPatrol the best for stopping unwanted code execution and registry alterations or is there a better solution to preventing code execution or registry alterations in realtime?

http://www.winpatrol.com/

[patio]

Scotty is THE DOG ! !
I use it...

[BC_Programmer]

Is WinPatrol the best for stopping unwanted code execution and registry alterations or is there a better solution to preventing code execution or registry alterations in realtime?

This is going to be very ranty, so take it as appropriate.

My Premise: WinPatrol is useless.

As far as I can tell, It's primary purpose is to tell you when registry keys change. Basically, It's a UI surrounding  RegNotifyChangeKeyValue, and appears to be affected by the limitations thereof- for example, any software that uses RegRestoreKey() to change registry keys will not cause winPatrol alerts, so it's practically trivial to workaround and avoid Winpatrol if a piece of software wanted to do so.

It's also 32-bit, which means it doesn't track changes to the 64-bit registry.

Overall it seems to be a sort of "software toy". Most of it's features would only appeal to the overly technically grizzled power user, but I would find it more of a nuisance than anything, and preventing some operations as listed can prevent software from working properly, too- which of course causes support calls for that other product, and the support has to find out what WinPatrol did. Then support says the problem was caused by WinPatrol. Any insinuation that WinPatrol did anything even slightly related causing a problem causes the developers inferiority complex to flare up. He even documented one case on his own blog, trying to show that symantec is "after the little guy" by showing a customer who had an infected copy of WinPatrol have that infected copy removed by symantec. Obviously the reason is because they are jealous of his awesome program and not because the software, like any software, was infected.

[Geek-9pm]

This is going to be very ranty, so take it as appropriate.
My Premise: WinPatrol is useless.
...
As far as I can tell, It's primary purpose is to tell you when registry keys change. Basically, It's a UI surrounding ...

Point made.
As I said earlier,the definitive solution is so harsh,
- most users will not want to use it.
 The sever solution would require everything available on the web be certified by a central agency. Of course, that is near impossible. 

[BC_Programmer]

As I said earlier,the definitive solution is so harsh, most users will not want to use it.

Or, alternatively, users might not be knowledgable enough to know the answer.

One of the best examples I can think of, is actually pretty old. It was either Windows 95 or Windows 98 setup.

Basically, the installation process would detect when a file already existed. If the file already existed, it would prompt- "The file blah.dll already exists and is newer than the file being copied. Replace this file?" or something similar.

Now, in many situations, this prompt would appear frequently. So your typical user would get the prompt- and say Yes. Then they would get it again- they would say yes again, but start to wonder. By the third or fourth, they might think this was the 'wrong' answer, because the computer keeps asking them questions- so they start to say no. and so on. Basically what ended up happening was a hooped install that had a mismatched set of files.

That's kind of what we have here. In general, most users consider dialogs like this "bad"; they just want them to go away. The only people that would get value out of being bombarded with more dialogs are the tech-savvy.

What makes it worse, in the case of WinPatrol (in comparison to say UAC) is that a lot of what get's monitored, you really don't know the reason for the change. If something changes a registry key, you'll have to be knowledgable enough to know that it is an undesirable change but also whether the change is required for certain software capabilities. I've seem people use software like winpatrol almost like the aforementioned windows installer. Their systems are a hodgepodge of mismatched entries and incorrectly installed or configured software because whether they allow or deny a change can come down to whether the icon the software shows is "friendly".