Best antivirus software for 2005
564167
Viruses and worms just keep getting smarter and more devious. While the best defense is not opening e-mail attachments, you still need a solid antivirus program.
214305
Could integrating antivirus software into Windows be the key to solving Microsoft&#39;s security woes or could the technology create more problems than it solves?
455054
Trend Micro, a rival anti-virus firm to Symantec, made an announcement stating that it will offer its anti-virus and anti-spam security software for free to users until June, 2005.
360875
The Web site for Indian antivirus vendor AvSoft Technologies has been hacked and is being used to install malicious software on visitors&#39; computers, security researchers said Thursday.The download section of AvSoft&#39;s S-cop Web site hosts the malicious code, according to Roger Thompson, chief research officer with security vendor AVG. &quot;They let one of their pages get hit by an iFrame injection,&quot; he said. &quot;It shows that anyone can be a victim.... It&#39;s hard to protect Web servers properly.&quot;The technique used on the site has been seen in thousands of similar hacks over the past few months. The attackers open an invisible iFrame Window within the victim&#39;s browser, which redirects the client to another server. That server, in turn, launches attack code that attempts to install malicious software on the victim&#39;s computer.The malicious software is a variant of the Virut virus family.The iFrame pages are commonly used by Web developers to insert content into their Web pages, but because it is possible to create an invisible iFrame window, the technology is often misused by hackers as a way to silently redirect victims to malicious Web sites.AvSoft, based in New Delhi, sells an antivirus product called SmartCOP and has sold a second antivirus product called Smartdog. The company, which is not well-known in the U.S., also specializes in recovering data lost due to virus attacks. The company could not be reached for comment Thursday afternoon.That data recovery service could come in handy for some, as Virut is known as a &quot;parasitic infector&quot; virus that is extremely difficult to remove. &quot;It infects all of your programs on your local hard drives, and then it starts hitting your network drives as well the first time you run,&quot; Thompson said.Fortunately, the malware used to install Virut exploits only well-known bugs, meaning that users who are running antivirus software on fully patched systems will probably not be infected by the attack in its current state, security experts say.Nobody knows how the malware got onto the Web site in the first place. News of the hack was reported on the Full Disclosure security discussion list on Thursday.McAfee Security Research Manager Dave Marcus believes that the site was compromised by exploiting a Web programming error, most likely in the site&#39;s SQL or PHP code. Security experts say that criminals have written automated programs that scour the Web for these types of flaws and then automatically infect sites, making this an increasingly common problem.
503690
(InfoWorld) - Antivirus software is frequently tested for performance, so picking a top product should be straightforward: Select the No. 1 vendor whose software kills off all of the evil things circulating on the Internet. You're good to go then, right? Not necessarily. The increasing complexity of security software is causing vendors to gripe that current evaluations do not adequately test other technologies in the products designed to protect machines. Relations between vendors and testing organizations are generally cordial but occasionally tense when a product fails a test. Representatives in both camps agree that the testing regimes need to be overhauled to give consumers a more accurate view of how different products compare. "I don't think anyone believes the tests as they are run now ... are an accurate reflection of how one product relates to the other," said Mark Kennedy, an antivirus engineer with Symantec. Representatives of Symantec, F-Secure,Â and Panda SoftwareÂ agreed last month at the International Antivirus Testing Workshop in Reykjavik, Iceland, to design a new testing plan that would better reflect the capabilities of competing products. They hope all security vendors will agree on a new test that can be applied industrywide, Kennedy said. A preliminary plan should be drawn up by September, Kennedy said. One of the most common tests involves running a set of malicious software samples through a product's antivirus engine. The antivirus engine contains indicators, called signatures, that enable it to identify harmful software. But antivirus products have changed over the last couple years, and "now many products have other ways of detecting and blocking malware," said Toralv Dirron, security lead system engineer for McAfee Inc. Signature-based detection is important, but an explosion in the number of unique malicious software programs created by hackers is threatening its effectiveness. As a result, vendors have added overlapping defenses to catch malware. Vendors are employing behavioral detection technology, which may identify a malicious program if it undertakes a suspicious action on a machine. A user may unwittingly download a malicious software program that is not detected through signatures. But if the program starts sending spam, the activity can be identified and halted. Also, a program can be halted if it tries to exploit a buffer overflow vulnerability, where an error in memory can allow a bad program to run. Host-based, intrusion-prevention systems, which can employ firewalls and packet inspection techniques, can also stop attacks. The ways in which a computer can be infected also make comprehensive testing complex. For example, users may infect their computers by opening malicious e-mail attachments or visiting harmful Web sites designed to exploit known vulnerabilities in a Web browser. The different modes of attack also involve different defenses, all of which would need to be tested to arrive at an accurate ranking, analysts said. By contrast, signature-based tests can take as little as five minutes. "This is a very basic test," said Andreas Marx of AV-Test.org, who wrote his master's degree thesis on antivirus testing. "It's easy, and it's cheap." Other concerns remain, over sample sets of malicious software, the age of the samples and the relative threat those samples pose on the Internet as they become older. Security vendors also think tests should check how well security applications remove bad programs, a process that can affect a computer's performance. For vendors, a failed test can be embarrassing, since the testing companies often issue news releases highlighting the latest results. Testing companies make money in various ways. AV-Test.org is often commissioned by technology magazines such as PC World (a magazine owned by IDG). Virus Bulletin licenses its logo to companies for use in promotional material and publishes a monthly online magazine. Earlier this month, Virus Bulletin announced that its latest round of testing produced some "big-name failures," including products from Kaspersky Lab and Grisoft SRO. The company's VB100 tests antivirus engines against malware samples collected by the Wildlist Organization International, a group of security researchers who collect and study malware. To pass the VB100, products must detect all samples. Kaspersky briefly removed a signature for a worm out of its product for "optimization" purposes on the day of the test, wrote Roel Schouwenberg, senior research engineer for Kaspersky, in an e-mail. The signature has since been put back in, he said. "Obviously, we would have rather passed than failed," Schouwenberg wrote. "Had the test been conducted a day earlier or a day later, we would have passed." Similarly, F-Secure initially failed its test also because of a technicality, but the failed rating was later reversed. All vendors are told after testing which samples they failed to detect, thus most end up adding signatures to their products. So what should a user do? John Hawes, a technical consultant for Virus Bulletin, cautioned that the signature-based tests are "not enormously representative of the way things are in the real world." But Hawes also noted that signature-based tests can indicate the reliability and consistency of a vendor's software. Virus Bulletin also writes reviews of AV suites, which take into account aspects such as usability, which may be just as important as detection for consumers. The company is developing more advanced tests that will test new security technologies. AV-Test.org is already performing more comprehensive tests, although it uses between 30 to 50 malware samples, a much smaller sample set compared to the Wildlist, which uses more than 600,000 samples, Marx said. Those tests may give a better indication of how a security software suite performs. At a bare minimum, through, users should install some security software, as computers without it can face high risks, Marx said. Several free suites are available that may be fine for light Internet use, he said. Ironically, Marx doesn't use any antivirus software. That's because AV-Test.org collects malware for its testing, most of which comes through e-mail from other researchers. "I'm getting about 1,000 viruses a day," he said. "It [antivirus software] would be counterproductive." Â
439602
Antivirus software is now generally sold as a subscription-type service, which is helpful for keeping users up to date but potentially nightmarish when it's time to cancel accounts.
94834
When your antivirus, spyware stopper, or firewall keeps you from getting your work done, find an alternative.
463174
Intuit, Best Software offer new features, prices with 2005 editions.
480779
Malware arrives in the form of a game, disables antivirus protection.
541532
A new release is available of ClamWin Portable, the popular ClamWin AntiVirus utility packaged as a portable app, allowing you to carry your antivirus with you on an iPod, USB flash drive, portable hard drive, CD or any other portable media. You can plug it right into any Windows computer (or UNIX/Linux computer with Wine) and use it just like you would on your own. It has all the same great features of ClamWin, but there's nothing to install. It all fits in under 20MB. And it automatically integrates with the PortableApps.com Suite and menu.      New in this version:   - ClamWin updated to 0.92 (better Vista compatibility, Windows styles integration, more) - Launcher and installer improved - Digitally signed to ensure integrity   More About ClamWin Portable:   http://portableapps.com/apps/utilities/clamwin_portable     SourceForge.net Project Page:   http://sourceforge.net/projects/portableapps     What is a portable app?   http://portableapps.com/about/what_is_a_portable_app
501625
McAfee's 2005 product line has hit the store shelves. According to McAfee, its security solutions have been tweaked to hone in on identity theft, phishing scams, spyware and other malicious threats. The line includes: McAfee VirusScan, McAfee Personal Firewall Plus, McAfee SpamKiller, McAfee AntiSpyware, McAfee QuickClean, McAfee Internet Security Suite and McAfee VirusScan Pro. Products may be purchased online at McAfee.com. Boxed copies are available at participating retail outlets.
122796
Comprehensive security programs that include firewall software, spyware defenses and diagnostic and repair tools are necessay to keep a PC in good health these days. -The Washington Post
575664
Secure and Reliable Email, IM, Calendaring
74903
Microsoft releases two free programs designed to help users keep PCs secure of viruses and spyware.
751091
Security researcher Jose Nazario says the concept of antivirus as the last line of defense has been thrown out the window. What should replace it?
681770
AOL has launched its 9.0 Security Edition, which includes McAfee&#39;s VirusScan Online application, offering protection against infection from peer-to-peer file sharing, Web site downloads, CD-ROMs and disks, or multimedia files.
236872
Over the past month, a new type of malicious software has emerged, using a decades-old technique to hide itself from antivirus software.The malware, called Trojan.Mebroot by Symantec, installs itself on the first part of the computer&#39;s hard drive to be read on startup, then makes changes to the Windows kernel, making it hard for security software to detect it.Criminals have been installing Trojan.Mebroot, known as a master boot record rootkit, since mid-December, and were able to infect nearly 5,000 users in two separate attacks, staged on Dec. 12 and Dec. 19, according to Verisign&#39;s iDefense Intelligence Team. In order to install the software on a victim&#39;s computer, attackers first lure them to a compromised Web site, which then launches a variety of attacks against the victim&#39;s computer in hopes of finding a way to run the rootkit code on the PC.Once installed, the malware gives attackers control over the victim&#39;s machine.The group behind this latest rootkit is the same one responsible for the Torpig Trojan, and it is believed to have already installed more than 250,000 Trojan programs, iDefense said in a report on the rootkit published Monday.The interesting thing about Trojan.Mebroot is that it installs itself on the master boot record (MBR). This is the first sector of the computer&#39;s hard drive and it is the place the computer goes to first whenever it wants to boot up the operating system. &quot;Basically, if you can control the MBR, you can control the operating system and therefore the computer it resides on,&quot; wrote Symantec researcher Elia Florio in a blog posting on Trojan.Mebroot.The criminals are using several different versions of this attack code, some of which are not currently being detected by some antivirus products, iDefense said.&quot;At the moment the AV detection is hit and miss across the board, however in the last day a number of vendors have added detection for it already,&quot; said Andrew Storms, director of security operations with nCircle Network Security. &quot;As for penetration, so far many people are showing it as having a low overall distribution. The concern is that the group which may be preparing to distribute the rootkit is well-prepared.&quot;Malicious software that infected the master boot record was common during the MS-DOS era, but it has not been used much in attacks in recent years.In 2005, however, researchers at eEye Digital Security gave a talk at the Black Hat security conference, showing how a rootkit could hide itself on the MBR. This Trojan.Mebroot software is derived from that code, iDefense said.Getting this kind of malicious software to work reliably is a technical challenge, and there have generally been easier ways for the bad guys to take over PCs in recent years, said Marc Maiffret, an independent security researcher who was chief technology officer at eEye when the code was first developed.Attackers were given a hand last year, however, when researchers at NV Labs published a proof of concept MBR rootkit.Maiffret said that while we may soon see more of these MBR rootkits, &quot;it won&#39;t take long for all the antivirus companies to react.&quot;&quot;It&#39;s not some new attack vector that&#39;s going to be hard to prevent,&quot; he said. &quot;It&#39;s just something that people haven&#39;t really paid attention to.&quot;