Be careful of Windows update

On Tue, 6 Oct 2009 18:17:48 -0400, "First of One" <root@127.0.0.1>
wrote:

>A few things make daily AV software updates overkill:

Only takes about 20 seconds to update so is not overkill at all. You
do it your way and I will do it mine, the smarter way.

On Wed, 07 Oct 2009 06:17:00 +0100, Benjamin Gawert <>
wrote:


>Updating your AV software daily only takes seconds and is done
>automatically.

Well, in my case I do it manually but still daily.

* First of One:

>> Just because you were lucky so far doesn't mean your approach is sensible.
>
> Then I've been lucky for 12 years and counting. Not a bad track record. :-)

Well, if it is 12 years or 20 years is irrelevant as malware got only
really really bad within the last 5 to 7 years. Before that it was very
easy to avoid malware, however this is not the case anymore.

>> In fact, you can be infected without knowing it.
>
> Your system may be infected, too. The only difference is you can say your
> system is clean with 99.9% confidence, while I can say it with 99.8%
> confidence.

Updating your antimalware program once a month does in no way give you
even 90% confidence, in reality you are probably more down to 70%, if at
all. Timely updates are critical for antimalware tools, updating once a
month is barely batter than not updating it.

>> Updating your AV software daily only takes seconds and is done
>> automatically. There is absolutely no sane reason to not do it.
>
> Except no single AV app is completely effective anyway. Depending on whether
> the developer gets the virus sample before or after it's in the wild, there
> may be a lag in getting the signatures prepared.

Right. So what? Just because a virus program is not 100% effective or
that there might be a delay between new virii and new signatures there
is no reason to add another, even longer delay.

Following your logic, a cancer patient would only get his medications
once a month when he is supposed to take it daily, simply because there
is a delay in development and diagnostics of cancer, and despite the
treatment he might die anyways.

> Different dev houses get
> different virus submissions, too, which affects their detection ability.

Not really. Today, antivirus companies and security experts works quite
closely together and exchange virus signatures and malware information
quickly.

> Occasionally I get infected spam email attachments that penetrate Yahoo
> Mail's Symantec virus scanner, but they scan positive using Avira with my
> weeks-old definitions.

Well, "Symantec" says it all.

> What's more important? A good scan engine or
> daily-updated definitions?

It is not one or another. One is worthless without the other. Simple as
that.

> If you work in a particularly high-risk environment, you would need to scan
> files on-demand with at least two AV programs (they obviously cannot run in
> the background simultaneously). "Zulu" from alt.2600.cracks advocated this,
> using some metaphor about contraceptives...

If you use files from what you call "high-risk environments" then the
safest way is to only use them is in locked-down virtual machines.

But that makes regular timely updates of your antimalware tool not less
important.

Benjamin