New: PlaceboAV (LOL!)

I belatedly came across this blog post by Andrew Clover:

http://www.doxdesk.com/updates/2008.html#u20080129

Hugely amusing and tongue in cheek of course, but definitely with serious undertones...

 

Awesome product. Have to test

 

Sweet! Now where's my credit card...?

 

Finally the best AntiVirus. And some where saying it will never come.

 

I lol'd

 

Perhaps - but like most strident statements on either side of this debate (must have an AV vs. AV is rubbish), he really misses the point and renders what could have been a productive statement pure caricature that simply adds noise to an existing cacophony.

Blue

 

Why is this the best antivirus?

 

Are you serious?

 

Well, it is certainly way over the top, but I simply found it too funny not to share.

That said, although admittedly he doesn't provide a 'solution' he certainly touches on a very real issue.

 

Considering the amount of complaining I have seen around here about some recent version updates of popular AV products, plus the growing feeling that signature based AV's are no longer good protection, this is not so much of a joke.

 

Just installed! Works great with my current setup!

 

Yes, Mr. Clover does touch on real issues, but the implication that current AV technology provides only a placebo comfort is very misguided at best.

Yes, given the current situation (rapidly evolving, very quickly disseminated malware with economic objectives (and therefore the resources and reason to recruit "professional" programmers)), AV's are certainly a much less complete solution than they were even in the recent past. The underlying issue has not changed - they deal most effectively with material that they've already seen - but the time dependency and volume of material available has changed dramatically.

Some of what we see here - constant changing of approaches, layering on of multiple products to plug the leaking boat, paranoid worry of what could be - are really all symptoms of a situation in which a decent solution has not been fully articulated.

I believe that Mr Clover is quite correct in emphasizing that

However, one needs to ask whether that will resolve all the issues or if it simply shifts the playing field?

I think that it's a very worthwhile approach, but ultimately people download executables/active content from the internet. Those sites may or may not be well controlled. Content they host may or may not be well controlled. The hosts themselves can reside virtually anywhere. How does a user even start to attempt to validate that content?

One way - despite the acknowledged limitations - is to treat an AV as an expert advisory system. Like any expert system or even live expert, the answer obtained may not be correct all of the time. However, it does provide some measure of informed feedback. For most users that feedback is much more informed than anything that they will develop on their own, at least at the current time and given that many people are routinely swindled everyday in the course of normal live commerce, I don't see this changing a whole lot even if each and every user gets educated until their heads are ready to explode. Education does not make one a subject matter expert, and that's really what is required - the detail is whether that is practiced at an end user level or at a higher point in the food chain.

We've already seen some of this migration occur as ISP's have found it to their benefit to implement mail server level filtering of email. But again, as already mentioned above, that's only shifted the playing field from delivered content to a delivered link to the content and so on. It's a beginning, but certainly not an end solution.

In an environment in which user capabilities span complete novice who know nothing of the inner workings of a computer (it's a very useful appliance) to genuine expert (can readily disassemble software/hardware at will), the one-size-fits-all answer is a pure delusion. It will always be a pure delusion. Many users will always need the crutch of an expert advisor to appeal to. Right now, that's an AV. At some point in the future it may be called something different, but that a difference in descriptive language only. The essential function will really be the same.

Blue

 

From a theoretical point of view whitelisting is the safest method. HOWEVER. There is a huge difference between theory and praxis. Look around Vista Users and spend attention how many have disabled UAC (User Access Control) because it's "annoying". There we go. Whitelisting expects a lot of user interaction (and no, you can't whitelist all software even if you think that's possible!) There will be always a "not in database shall we start it or not?" question. More than 25 percent of users will just click "Run at own risk" and start a malware as long as the program doesn't explicitly states "IT IS MALWARE". Because nobody is willing to wait for a vendor reply on every file.

Similar Situation with a behavior blocker. And a behavior blocker is not suitable to detect all kinds of malware!

So it all boils down to one thing: The user wants to know FOR SURE that something is malicious. That helps him much more than just a statement that something tries to access the internet! There are so many things that do that . HOWEVER. For the more experienced user the behavior blocker is a nice addition ASSUMING THAT HE KNOWS HIS OWN SYSTEM! And that doesn't apply (sorry to say that) for most of the ordinary home/office users that just start the computer to do their work.

 

I have not heard of a behavior blocker/sandbox/etc. similar software that is capable of cleaning already infected computers. I also believe it's not possible to get any assistance from these, unlike with your av-vendor that would probably at least try to give you the tools or manual instructions how to remove the malware. Something people always forget when praising their new, free, trendy, sandboxing, behavior blocking, virtualizing, "no-av needed approaches."

 

How about a virustotal-listing? To always practice this safe manner as long as your files are less than 10mb. I agree and computer education is vital in this era. I see more young people using computers and the more knowledge they have, the better they are protected. This is not to discourage the older generation like Sr. Bellgamin.

 

I downloaded it and ran it. Never have I seen an AV install so smoothly on my system! It's like it's not even there, what can I say? Lighter than NOD32, Avira, or Win OneCare! It's a keeper!

Jim

 

I really liked this part:

...in total peace of mind because there's a little icon in your system tray so you must be safe....

 

Installed and running now, this is security at it's finest!

I suggest all of you at least try it

 

I think this little program certainly has a future - the gui is very easy to understand but I don't like the icon - could they not come up with something snappier?

 

Switched from NOD32 to Placebo.

 

Did you get a migration discount on that?

 

Yes!

 

Great value for its money. The updates also seem to work extremely fast. I can barely catch the update bar loading when clicking on "Check for updates".

And to think it can even update with my internet connection off
Try beating that Dr.Web!

 

The best thread ever can't wait to test this av program out!