RE: Anti-Virus

["John Taylor" <lists@xxxxxxxxxxxxxxxxxxxx>]

> The other very interesting software from these people is 
> anti-executable, which basically whitelists what programs can 
> run on your machine.  This seems like a very nice addition to 
> any anti-spyware scenarios.

This can be setup within Windows itself using Group Policy objects. I have
our corporate network locked down in that manner. Nothing is able to run
unless specifically authorized through a Group Policy object.

> I'm just looking at options right now.  Since I'm convinced 
> that the spyware writers are funded by the anti-spyware 
> companies, I find it galling to have to buy this stuff 
> anyway.  Hell, if Microsoft wrote code that passed CS101 and 
> didn't have buffer overrun exploits, 99.8% of the viruses 
> would be nullified and this industry wouldn't exist.

I don't think it's as simple as that. Today's software is so complex that
it's astoundingly easy to trick the average user into installing anything
you want them to. You don't need to take advantage of a buffer overrun. Just
pop up a message telling them that their Flash player is out of date, and
that it will be automatically updated if they click "Ok". Nine times out of
ten, you'll end up owning their system. The virus scanner helps mitigate
this by essentially keeping a catalog of malicious software.

This is not really a Windows-only problem.   


John Taylor