Good point nuorder - I would say the best function of any AV would be it's ability to maintain an effective integrity check of the system.
Though if I'm not mistaken Heuristics also plays a function in being able to determine undocumented malware.
With elements such as the "sandbox" in use by an AV as well, there is some sense of safety. But then again sometimes which seems to occur more often then not, the Sandbox concept doesn't work as effectively as one would like. If the concept was extremely effective Bagel/MyDoom/Nimda all would have been controlled instead of making its worldwide debut.
So just what exactly is needed to make an AV effective? Depends on who you ask and if their willing to give you a straight answer or one that would prevent them from having a resume generating moment.
InfoSec mag had a pretty decent article back in
May 2002 regrading some of the myths of AV. The CISO Strategies article
The Great AV Myth from InfoSec mag also had some interesting points.
Regarding Integrity Checkers
Dmitry Mostovoy wrote an interesting peice as well.
With all the malware being created can one element stay on top? My opinion is no. If there was one AV that did the ultimate job in identifying, removing, cleaning, renaming, or isolating malware there would not be AV Vendors- Trojan Scanners- or Hardware to ride within an enterprise to detect worm anonmolies.
All we can do is the best with what we have before us. Me I use Nod32 and have had pretty good luck with it. Not saying I think it's the best but just haven't had any major issues with it. With the
DMON being added to Nod32, I think it packs a good punch.
Result summary: 28 passes / 3 fails
Performance graph: - Success / Failure / No Entry
Vendor website:
http://www.nod32.com/
:D:D
