The thing people don't seem to get though, is if you have knowledge of how to detect an infection, an AV program does little good for you. You can do those "heurestics" yourself. You can check signatures yourself. You can do all that yourself. There is literally nothing an AV program does that you can't do on your own with a few scripts and knowing where to check, and what kind of problem behavior to look for. Those of us who want complete control of our systems may desire this. Most admitedly do not.
The best thing AV programs do is automate the process and remind the user to do a "scan." A degree of realtime scanning may be provided as well so you don't have to check your process list constantly. But not running can and is a legitimate choice. I choose it. I am not a problem. And I don't need to (nor should I have to) prove it.
I don't agree with this for one main reason; real-time scanners do just that, they scan in "real time". And most importantly, they scan what is in memory in real-time before any potentially malicious code is written to our drives, before payloads are delivered. You're human. You are way too slow.
Another flaw in that logic is you are assuming you already know every trick in the bad guy's book. If it were that easy, there would be no such thing as zero-day exploits.
If it were as easy as you suggest, don't you think Microsoft would have created those few simple scripts to look for that "known behavior" you claim is easy for anyone to look for
? Since Microsoft already knows where to look, they could just put those scripts in Windows and never have to worry about malware again. Piece of cake!
If you are that clever, why don't you submit a proposal to Microsoft? You could be a billionaire in no time. Seriously! I am NOT being facetious. There would be no need for MS to spend $millions every year on WD development or with developing, testing and distributing critical Windows Update patches for newly discovered critical vulnerabilities as rapidly as possible. It would be a boon for Microsoft shareholders, corporations, governments, universities, and all of us consumers too.
But not running can and is a legitimate choice. I choose it. I am not a problem. And I don't need to (nor should I have to) prove it.
Sorry, R-T-B, but you are not smarter than the smartest bad guys. You've just been lucky thus far and have not been targeted by them. But should they decide to focus on you, and your system is compromised, you then do indeed become a problem, and a threat to the rest of us. And you can't, even if you wanted to, prove otherwise because you do not know what tomorrow will bring.
Microsoft does not demand you run an AV solution. They don't make you agree to it, they never have tried to and they likely won't for the reasons above.
No body said they did. The question was, "Who gave Microsoft the right to make changes to our systems?" The answer is, we did when we agreed to abide by the EULAs.
Nope! More important than the choice of anti-malware products is just using one, keeping it and the OS current, and avoid being click happy on unsolicited downloads, popups, attachments and links. And funny thing, all those are
user disciplines - which then boils down to education.
