Paid For AV

[Paddypix]

With all these cyber attacks we're hearing about I wonder if it would be a good idea to buy an AV rather than relying on the free versions? If you thought it a good idea, which one would be best? If possible I'd like it to be used on both laptops and netbook or would I have to buy three licenced products?

[Workingman]

Liz, I am not one for suggesting "best" for these sorts of things, especially as I take a bit of an off-road approach to such things.

However, what I would strongly suggest is that you have a look at some independent testing of AV suites - free and commercial. Here are a few testing sites:
http://www.av-test.org/en/home/
http://www.av-comparatives.org
http://www.dennistechnologylabs.com

It is interesting that the same names crop up over and over again for home users and businesses alike. I am thinking that businesses would not be paying to use them if they were rubbish.

As for costs/licences, I can only think that each company will have its own policy on that one.

[Paddypix]

Thanks Frank. I'll do a spot of research and then decide what to do.

[Suff]

Hi PP,

I ran out of time and connection over the weekend to respond. Not to mention network, I don't have internet where I'm staying and I've used my 2gb internet on the phone plus a 1gb £6 top up in less than two weeks....

I have looked at the links WM sent and I have issues with all of them.

Let me try and explain my issues. Companies spend thousands and often millions of £ on what they call "defence in depth". So they have smart firewalls, smart proxies and spend huge amounts of time and energy in blocking links which can be accessed from the company website. So their main concern is files which have been put on the machine by CD/DVD or USB key. They are not so concerned about websites as such.

so any review of AV, for personal use, where we do not have thousands of hours or millions of £ to spend protecting ourselves, cannot focus on file detection rates. Any test which puts file detection at the forefront is a complete waste of time.

Why? Because most viruses now infect the machine with a combination of two things. One smart code in the webstie to make you think you are doing something sensible, but are actually automatically letting malware into your system. Two social engineering. Like getting someone to click on a link which injects a virus into the system. If the user says yes, then the browser will let you.

The protection for this is with broad spectrum AV suites which protect the browser, the system memory, programs loading, anything trying to write to the hard drive and, last of all, looks for viruses already the disk.

This is what I wrote on Sunday but ran out of time.


The top two personal AV suites are Kaspersky and Norton360, in that order.

Kaspersky gets the better detection rate, but Norton has done me very well over the last decade. My machine is much more at risk. For instance if I wanted to connect to your machine, no matter what is running, I can't, unless your machine invites me. This is due to your router firewall. My machine, on the other hand is very visible. For instance I can just connect to it from work from a browser.

According to my #3 son, who uses Kaspersky, he tells me it has quite a lot of effort and knowledge to set up well. On the other hand Norton only needs one or two key things done to make it completely usable. Sadly we lost the old Norton 360V3 setup I created on the old site. Most of it is still valid.

As for multiple computer, both Kaspersky and Norton360 have 3 machine licenses. The key thing is not to buy them from either Kaspersky or Norton. I've just bought a new key for one of my subscriptions ( I have two). I bought it from ebay for £19. The renewal for one from Norton is heading on for £70. The key with ebay is to get the supplier who provides both key and software download link. The reason they can do it so cheaply is that they get the Norton introduction offers, sign up to them and then sell the key with the download link.

My son does the same for Kaspersky.

If you want to go for one of the others, I'd only offer one piece of advice. Don't go for McAffee. It slows down the machine to a crawl and every corporate infection I've seen, on protected machines, was whilst protected with McAffee.

If you look at the tables on the sites WM linked, look closely at both detection rates and false positives. False positives are where it detects valid programs as malw3are. Anything less than 99.7% in the first and 1% in the latter and you are at risk. For the first, massively at risk with McAffee.


There are some other suites out there. But consider this. The reason I'm already protected from the viruses which you need Microsoft patches for is that Norton creates so called "honeyput" machines. They let them become infected then they pull them off the web and analyse the viruses in the lab. They do look for "signatures" or things which can directly identify them, but they also look at what they are doing. Then they write programs which can detect what Viruses do and block them.

As you can imagine, with millions of viruses out there and billions of malware/phishing links on sites, this takes a huge amount of effort. Small companies may be bang up to date on the day the test is done, but, critically, could be a week out of touch when the next large virus comes down the line. The larger suites don't have to react so fast because they are already blocking 99.99% of the viruses simply by working out what they do.

It's not something I am comfortable even thinking about playing around with "cheap" software to save myself a few $. This last week, we'd have a power failure plus some of my appliances had overheated in the 30c plus heat. I had to come home and recover them before I could even sit down and have a drink. Imagine how much worse to find that all my home systems were infected and it would take me days to get the infection out. I can't just install them again, that also takes days....

Just some thoughts.