Safety Without Active Av Protection

Moderator: This topic was started in the topic Bitdefender Free Version. The topic was split, because it went in another direction.

Also, this was transformed in a Poll, with the question: "Can a computer connected to the internet stay clean without an active, realtime antivirus protection?"

What security measures to you take to protect your PC? Do you use the full protection (AV+FW+AntuSpy+HIPS+etc...), or you just rely on common sense, and the Windows Firewall? What do you think are th top10 rules a user has to follow to keep the system clean of any infections?

Please post you opinion on this matter. Also, please don't transform this topic into a pros and cons of a specific security solution.

Cris.

=========================================================================

If someone knows of a REAL on-demand virus scanner, I'd like to know about it. A program which runs four processes behind your back even though you specifically told it not to load on startup is classified as malware in my books. I'm uninstalling BD this instant.

All I want is a program which allows me to do right mouse click -> scan if I have any doubt about a file I'm about to open. And just shut up the rest of the time. It doesn't seem to exist. Online scanning is just not practical, though it's a move in the right direction.

pcbugfixer, anyone who knows anything about viruses will tell you that common sense is the first and best safeguard against viruses. I too would like a program that scans files which I know to be a potential threat, and doesn't clog up my computer by constantly scanning files which couldn't possibly have been infected.

Find more posts tagged with

Comments

alexcrist

Hello glop,

I understand that you only want an on demand scanner.

But there is one thing in your post that I'd like to comment on.

I too would like a program that scans files which I know to be a potential threat, and doesn't clog up my computer by constantly scanning files which couldn't possibly have been infected.

Practically, any file in your computer can be infected by the right malware. Yes, most malware come in an executable form, EXE, COM, SCR, DLL, etc... because this way, they can be ran as standalone infections, and don't depend by the user to open them.

But still, there are also malware that infect pictures (JPG, GIF, etc...), documents (DOC,DOCX, etc...) and other types. Last, but not least, an executable file (EXE, or whatever) can be named as a non-suspicious file (mp3, for instance), but it would still be a malware, and can still be ran as a plain application.

So, as I said, actually there are no "safe" files. Any file can be a malware suspect.

Still, antivirus products also have settings to filter the scan to only just some types of files (let's say, executable files). This will very much decrease the scanning times and increase the scanning speed. Also, you can ignore from scan some folders in your computer, the ones that you think have the least chances of getting infected and this will decrease the scanning times even more.

It all depends on what you want and how you configure the protection to best fit your needs.

Now...back to the On-Demand antivirus. Yes, I agree that BDv10 is not very well made to fit the description of a 100% passive scanner. I also hope that BitDefender will release a free version that doesn't need all these running processes, but beeing a free product, it has a very low priority.

Cris.

glocal

But still, there are also malware that infect pictures (JPG, GIF, etc...), documents (DOC,DOCX, etc...) and other types. Last, but not least, an executable file (EXE, or whatever) can be named as a non-suspicious file (mp3, for instance), but it would still be a malware, and can still be ran as a plain application.

So, as I said, actually there are no "safe" files. Any file can be a malware suspect.

I can't see how a .gif (or a renamed .exe) can be active malware if it can't be executed directly. It can contain data used by a virus, but this assumes there is already a virus running on your system that you would presumably have detected. In any case, when a new file enters your system, even a .gif, you can always scan it manually. That's what I've been doing with various AV apps for two decades and I never had a virus infection, although I download stuff like mad. Unsurprisingly, even the latest PCs I see are slower than my old but lean PC. So, I agree with glop and I uninstalling BitDefender right now, in search of a real on-demand scanner. I wish ClamWin was more effective at detecting viruses!

alexcrist

A gif can contain code that exploits a certain vulnerability (an example would be the ANI Exploit). This kind of exploit doesn't need to run all the time. It just has to be opened by the user (to see the picture/animation) and the code inside might be executed by the file viewer itself (of course, if the viewer is not protected against code execution).

Also, any type of file which contains executable code can be injected in system processes and be ran by them (explorer.exe, rundll32.exe, winlogon.exe). An exploint on a webpage can download such a "harmless" file and add it to registry so it will be ran as a part of one of the system processes.

And don't think that if you visit only official websites, then you are safe. There are many attacks, which compromise many legit sites. They simply add a single line in a webpage, and that page becomes a "zombi" and infects everyone who visits it. An example is this: http://a11news.com/95/winzipices-cn/ (clean page, contains only the news about a virus). BitDefender added detection for this virus in the last few days.

Extensions are just a way for the Operating System to know what to do when you double-click a file. But, "under the hood", all files are the same, and any file (regardless it's extension) which contains executable code can be executed and ran in the system.

Cris.

glocal

A gif can contain code that exploits a certain vulnerability [...]

All this may be true but it is relevant if

a ) your system is unpatched, or the malware is brand new

b ) you don't have any other protection

c ) you don't scan files manually when possible

d ) you use mainstream bad software like Outlook Express.

I know there are many zombie machines out there, but going by my own experience if you don't do any of the above the risk is minimal. I don't have a reference right now, but as I said I've been working like this for 20 years with various AV apps, downloading files like mad, and I never had a single infection -- I easily stopped several attempts though. This leads to me to think the risk is hugely exaggerated if you don't do stupid things. On most of my friends' machines I install full-blown AV products because they are not necessarily confident users.

In short, some of us choose to take what we see as minimal risk in return for PC efficiency and frankly I don't understand why developers don't wish to accommodate this. It wouldn't cost them anything to attract more users by changing their app slightly. This feature could also come with various warnings for novice users. I can't complain about BD of course. It's a free product. After all if you didn't like it, even if it was paid-for, you could go elsewhere. That's what I am doing anyway.

glop

But there is one thing in your post that I'd like to comment on.

Practically, any file in your computer can be infected by the right malware. Yes, most malware come in an executable form, EXE, COM, SCR, DLL, etc... because this way, they can be ran as standalone infections, and don't depend by the user to open them.

But still, there are also malware that infect pictures (JPG, GIF, etc...), documents (DOC,DOCX, etc...) and other types. Last, but not least, an executable file (EXE, or whatever) can be named as a non-suspicious file (mp3, for instance), but it would still be a malware, and can still be ran as a plain application.

So, as I said, actually there are no "safe" files. Any file can be a malware suspect.

Hi Cris. Thanks for this precision. I should have been clearer though: When I mention files that couldn't possibly be infected, it has more to do with where I got them than what type they are. That's part of the "common sense" approach to virus protection. If I get a file, any file, from an unreliable source, I will scan it for viruses.

I fully agree with glocal. Of course there is no method that is 100% safe and I could still be fooled by a seemingly safe source or lower my guard on a bad day at the wrong moment, but I would wager that with said approach I am more likely to be killed on the road today than for my computer to be infected by a virus. That is good enough for me. (Besides, I frequently back up my important data and I am never reluctant to do a good old format of my system drive once in a while , which means I'm not even sure I actually need an antivirus at all <img class= " />).

glop

One question for you Cris:

How do you execute an application (.exe) which has been renamed as an mp3? I just cannot see how the code inside would get run by the machine, considering that people will try to open it with their music player, which will most likely reject it as invalid. I'm curious.

alexcrist

Yes, I understand. But as I said below, there is no "safe source" also. You can end up with a virus in your system, and you wouldn't even know about it.

Now, I'm not trying to convince of anything. You just said that you know that some files are clean (or can't be infected), and I wanted to comment on this. If you managed to stay all this time without an active AV solution, then you have my congratulations. But I also have to add that there was a lot of luck in the middle. Common sense alone cannot keep you clean, in today's world when nothing is sure. The latest threats don't even need to get insive your computer in order to attack you.

For instance, there is the methong called network spoofing. If a system in your network has this kind of infection, then that virus (which is NOT in your system) can monitor the network traffic and modify the requests. Practically, you will end up requesting a certain address and receiving a totally different one. Common sense just cannot override this behavior, only luck can.

You want to see how an apparently non-executable file can be executed? Simple: download the attachment, un-zip it, and run Launcher.exe. After that, open TaskManager, and you'll see a process named app.mp3 running, on it's own.

Yes, you need a launcher for this. But the actual launch of the file is made by a basic Windows API: CreateProces. It can be done by any application, and by any exploit.

Manually, I don't know if you can execute it (I didn't look for a way to do this). But it's enough something like this. I think you realize that if I did this in an application smaller than 6K, it can be done by anyone with the least programming knowledge.

Cris.

/applications/core/interface/file/attachment.php?id=1976" data-fileid="1976" rel="">release.zip

release.zip

glocal

Commonsense reduces the risk dramatically. Some defences and knowledge of your own setup makes the risk minimal. I can't believe my experience was down to luck. I surf a lot and some of the sites I go to are nowhere near as innocent as bbc.co.uk etc and I am convinced they have some of the latest malware (that Firefox NoScript will stop anyway). In fact you might even say I am asking for an infection. Because of this, I am convinced the risk is hugely exaggerated by the industry and terrified users.

What you said about the mp3 may be technically true, but it involves an exe there is no way I would run. Even if I did, I am sure my security policy would prevent the exe from doing anything without my permission (which I wouldn't grant) anyway. As for the network spoofing, surely, if it's not on your PC no AV will detect it anyway. Actually, I think the false sense of security an AV can give people can actually be worse. There is by definition always a time lag between a new virus coming out and the fix -- in the meanwhile blissfully unaware users may lose their data.

The point remains that if you look at the number of users opting for ClamWin (one of many free options), which does only on-demand scanning, it is clear there is demand for on-demand scanners. Imagine how much more popular ClamWin would be if it didn't have a bad reputation for low detection rate. You may also look at the AVG forum and the current v8 'First Impressions' thread.

glop

I think, in the end, it all boils down to one question. How likely is it that you will be affected by a virus? Is it worth paying money and computer resources to (hypothetically) lower that risk? There is absolutely no way of objectively evaluating that risk, since all information on viruses is provided by software companies who sell antivirus solutions. I think though that a resident protection is in itself more harmful than many viruses (especially if it's Norton ), and you don't even get 100% safety. I just prefer running a slight risk of infection rather than installing the malware myself and possibly paying for it...

I used a PC for many years without ANY form of virus protection. Not even common sense, as I downloaded all sorts of junk without fear. I just got a couple of infections which weren't that harmful or difficult to eradicate. And I don't think I'm especially lucky. In fact I don't know anyone who ever was seriously and durably troubled by a virus, even though I know plenty of people who are going mad with pre-installed security suites which constantly pester them with messages asking them to renew their long-deceased subscription, or hinder their internet browsing (even though they have nothing on their computer actually worth protecting). I still cringe every time I do a system restore of my laptop and Norton Security gets re-installed. It makes me think of those people in Switzerland and elsewhere who maintain costly anti-atomic shelters under their houses, just so they can survive a miserable 6 months extra in case of a nuclear holocaust.

Getting back to the topic at hand, I'm trying Antivir, and it's roughly the same as BD free. You can disable the resident protection but there's still a system tray icon, god knows why...

alexcrist

Commonsense reduces the risk dramatically. Some defences and knowledge of your own setup makes the risk minimal. I can't believe my experience was down to luck. I surf a lot and some of the sites I go to are nowhere near as innocent as bbc.co.uk etc and I am convinced they have some of the latest malware (that Firefox NoScript will stop anyway). In fact you might even say I am asking for an infection. Because of this, I am convinced the risk is hugely exaggerated by the industry and terrified users.

Hey, I have never said that common sense is useless.

I said, and I quote: Common sense alone cannot keep you clean. And also, I want to add this: An AV solution alone cannot keep you clean. You always have to have both. If either one is missing, then the thing that replaces it (common sense or AV) is pure luck.

What you said about the mp3 may be technically true, but it involves an exe there is no way I would run. Even if I did, I am sure my security policy would prevent the exe from doing anything without my permission (which I wouldn't grant) anyway. As for the network spoofing, surely, if it's not on your PC no AV will detect it anyway. Actually, I think the false sense of security an AV can give people can actually be worse. There is by definition always a time lag between a new virus coming out and the fix -- in the meanwhile blissfully unaware users may lose their data.

No, it doesn't necessarily need an EXE. It might be a ****** (an autorun.inf on a USB stick, or on a disk), it might be an exploit attached to a well-known webpage or to an e-mail, it might be whatever, and you don't really need to run it yourself.

Also, it's not only about mp3-s, it's about any type of file. Executable code in mp3-s can be, by mistake, executed by the mp3 player that you use (if it's vulnerable at this)... for instance, my mp3 player (no, not Winamp) was vulnerable at this kind of exploit, until someone posted the problem on the forum. Then, the author fixed it in a few hours. But what if there are still people using the older version? Or what if there are people using something else, that is STILL vulnerable at this?

I'm not talking mainly about you, because you've made it clear that you know what you're doing, and you're sure that your applications are all patched. But are they?

I've heard recently about a serious exploit in PDFs, and Adobe Reader is vulnerable at it. Also, Microsoft Word is vulnerable at a lot of things, so any DOC (or other document) that you open can very easily be "patched" with an exploit that would infect your computer. And so on, and so forth...

The point remains that if you look at the number of users opting for ClamWin (one of many free options), which does only on-demand scanning, it is clear there is demand for on-demand scanners. Imagine how much more popular ClamWin would be if it didn't have a bad reputation for low detection rate. You may also look at the AVG forum and the current v8 'First Impressions' thread.

Yes, On-Demand scanners are useful. But, in my opinion, they are useful when you need a second opinion, and they are NOT designed to replace a realtime protection.

I think, in the end, it all boils down to one question. How likely is it that you will be affected by a virus? Is it worth paying money and computer resources to (hypothetically) lower that risk? There is absolutely no way of objectively evaluating that risk, since all information on viruses is provided by software companies who sell antivirus solutions.

It very much depends. Just look on the Malware Section, how many users complain about infections, even with AVs installed. And keep in mind that on that section there are not only users of BitDefender, but users of all kinds of AVs. And the situations are different for each one.

The risk of getting infected?

By malware that YOU have to download and run: minimal, if you have common sense

By worms that spread on their own, through the network, without anyone's help: it depends by your luck. If you are in a clean network, behind a router of if you have a firewall (HW/SW), the risk drops (but doesn't disappear). In other situations... good luck staying clean.

By exploits: same as worms, except there is not alternative protection (like routers). Some exploits can be stopped by small tools like NoScript, but not all. Especially if a site that you trust, you visit it regularly and you added it to the Exceptions list, gets infected, the nothing will stop the exploit. Also, there was yesterday a member (Despotic) that posted a serious vulnerability in the forum software. A few other users with IE became "victims" of the example, and their IE crashed (the topic was moved to an invisible area, to prevent other "accidents"). Think what would have happened if YOU visited that topic, and it would have contained a real exploit... you would have gotten infected right on the BitDefender forum. Figure that

And the examples can go on...

I used a PC for many years without ANY form of virus protection. Not even common sense, as I downloaded all sorts of junk without fear. I just got a couple of infections which weren't that harmful or difficult to eradicate. And I don't think I'm especially lucky.

Also, before I found BitDefender (about 4 or 5 years ago, when I didn't know this much about anything related to computers), I was using many AV solutions, I didn't even have internet connection, and I had to reinstall the system every 2 weeks because of infections. All infections came on CDs and other medias.

So, again I say: you kept yourself clean without protection? Congratulations. But don't trust that you'll always be clean. You can't prevent all infections with just common sense, mainly because malware is getting smarter and smarter every day.

Again, I post the link to the latest exploit discovered: http://forum.bitdefender.com/index.php?showtopic=5569 This might have been blocked by NoScript. But, as I said, what if you trusted the site? Could you have blocked the exploit by common sense?

Just to be sure nobody misunderstands me: I'm not trying to convince you of using an AV solution if you really believe you don't need it. But I like this discussion, it became somehow interesting in the way "can I stay clean without an AV solution"? Also I'd like to see other members participating in this topic, to say what they think.

Also, because we went very much offtopic from the main subject, tomorrow I'll split this topic in two, so that this discussion will have its own topic, if nobody has anything to argue about this.

Cris.

alexcrist

As promised, the topic was split and also it was added a poll.

I was the first to vote, and I voted "it depends" for the reasons I already posted. I hope other users will join this discussion.

Cris.

glocal

As promised, the topic was split and also it was added a poll.

The general issue is dominated by media scaremongery and industry claims. I would like to see the results of truly independent studies evaluating the actual risk. To tell you the truth, in the absence of such a study, I don't think polling people's subjective perceptions in this forum would tell us very much. People in this forum are by definition disproportionately concerned about malware. If however we had to do it this way, a more appropriate (in terms of getting slightly less subjective responses) set of questions would be:

1. How many times did your on-access AV software prevent a malware infection that wouldn't have been stopped by other measures (caution, on-demand AV/malware scanning, patched system, less mainstream/vulnerable software, hardware/software firewall, NAT enabled, switched off unnecessary Windows services, ******-blocking, anti-phishing tools, blocked referrals/redirections, a HOSTS file, security software intercepting and blocking system processes etc)? [NB: most of these speed up, rather than slow down a PC]

2. Did your system get infected despite your on-access AV software in a way that could have been prevented by a security regime involving the above? (false sense of security)

3. Considering the responses to (1) and (2), the actual damage and costs (potential fee, maintenance, performance hit, false positives, incompatibilities), do you consider on-access AV software essential?

As I said before, in my experience, the risk is hugely exaggerated. Email is scanned by senders and ISPs these days -- and there is always on-demand scanning, often run by mailer plugins when needed. Drive-by attacks may be common according to the media and the industry, but somehow I've been missing them for two decades despite my efforts And, no, I don't believe in luck.

Another example: today a friend was complaining there was something wrong with her AV software. I checked and discovered the last time the sigs database had been updated was 12 months ago! I removed AVG, installed Avast and ran a full scan expecting to see several thousands of pieces of malware. As you may have guessed by now, the user was not exactly computer-savvy (so no preventative caution there), but she is a very active surfer. Guess what! No sign of malware at all!

Another friend: again an active user running on-access AV software. Not a single alert in years.

Suddenly, my faith in ClamWin is restored and I think I am going to install that with its on-demand-only scanner. I see now why so many people have been using it happily for years (according to their forum) despite it being rubbished by the industry.

I used to run occasional on-demand malware detectors and except for the occasional cookie (which I am convinced apps like Ad-Aware and Spybot flag up just to make a point), nothing is ever found. Now I only run such things once a year or so because I don't see the point.

alexcrist

I'll make some short answers to your questions, after that I'll elaborate.

1. How many times did your on-access AV software prevent a malware infection that wouldn't have been stopped by other measures (caution, on-demand AV/malware scanning, patched system, less mainstream/vulnerable software, hardware/software firewall, NAT enabled, switched off unnecessary Windows services, ******-blocking, anti-phishing tools, blocked referrals/redirections, a HOSTS file, security software intercepting and blocking system processes etc)? [NB: most of these speed up, rather than slow down a PC]

Practically, everytime I go to school (University) and use a USB stick. The computers there are infected with a polymorphic virus (Almanahe.D), and absolutely nobody tries to even clean them. They all run Norton AV, but it was never updated, the subscription expired, etc... Practically, those systems were installed, configured, and left at the mercy of the students. <img class= " />

And now, everytime someone connects a USB stick to take home something (a lesson, a homework, whatever), he/she also takes home a "friend" (and only God knows how many of my friends had big troubles with these infections, and how many systems I had to clean till my friends learned how to protect themselves against this thing).

2. Did your system get infected despite your on-access AV software in a way that could have been prevented by a security regime involving the above? (false sense of security)

Mine, never. But my friends' computers had serious problems, as I said.

3. Considering the responses to (1) and (2), the actual damage and costs (potential fee, maintenance, performance hit, false positives, incompatibilities), do you consider on-access AV software essential?

Yes!

And now, the rest of the story.

You see, glocal, the real problem isn't that the user can't really protect the system without an AV. Most of the times, you can stay clean. But most users just prefer not to bother with all that customizing, setting, configuring, etc, etc, etc... It's just too much for the normal user. Personally, I have a big knowledge about threats and infections (I'm not saying this to brag), but I DO use an AV just because I don't want to be the slave of the computer, to be careful what I do, to stay much time to configure it, to manually make it "bullet-proof", and so on and so forth. Instead, I just install an AV, and go on with my life. Simple as that. And also most of the user prefer this approach.

But, as I said, not all infection can even BE prevented. As a real example: I'm a student, and I currently live in a campus. Our network is divided on buildings.

A few weeks ago there was a HUGE infection in one of the buildings network, with a worm that was infecting and corrupting the network traffic, modifying all requests and redirecting them to an infected page (network spoofing, as I said above). Everyone was having big problems, the connection wasn't working anymore AT ALL in all building, the AV products were constantly alerting the users that they are under attack, and this situations went on for a couple of weeks. It was a hole nightmare, and all because one user didn't have protection, downloaded some junk from the web, and infected ALL NETWORK!

Also, a more general example: take a small peak on the Malware Talk section. Look and see how many troubled users are there, with various problems. All users there are using AV protection (not only BD) but still they got infected more or less.

Take a look at the Vundo reports on that section. Those topics have 2-3 (maybe more) pages, just to clean ONE user! Do you really think that they infected themselves because they wanted to? Or do you really think that they were attacked by someone, on purpose?

You say you don't believe in luck. Then just explain to me the above.

Now, for your #1 question:

NAT enabled: Not everyone can afford a router for this. And, especially, not everyone knows how to configure the router correctly. Also (and I quote from Wikipedia), "NAT can introduce complications in communication between hosts and may have a performance impact."

switched off services: Again, this requires a big study. What services do i need? If it safe to stop this one? How about that one? What happens if I let this service off/on? These questions are asked by most of the users after they find out the answer to What IS a Windows service? I know I spent about 3-4 days searching the net for service descriptions, and I don't yet know if I stopped all the ones I don't need.

******-block, blocked referrals/redirections: this offers a degree of protection, yes (but not every web-malware can be filtered like this). But also this causes huge experience degradation of the web. Everytime you visit a new page, you have to think: is this page safe? Can I accept scripts from it? Yes, tech-minded users may choose this solution (yes, I also have NoScript installed on my Firefox), but the average user just can't stay and think at all this stuff (like my mother, who always wants everything to be simpler, maybe the computer to read her mind and do it all on it's own... if I'd ask my mom to learn to use a ******-blocker, she'll just sell the computer :wacko: . And like her there are many many users). And the exact same thing happens with referrals/redirections.

HOSTS file: valid solution, but for an extremely short period. Web-based exploits change their domains/IPs very fast. A small example you can see on the Sample Submission section. There is a topic about a sql exploit. Since it was posted, till it was checked by an analyst, there were 3-4 days. In this interval, all links from that topic were dead. The malware just moved away. This happens because (1) to prevent filtering by basic methods (like HOSTS file) (2) because those domains are not always dedicated for that exploit (They are infected servers, which get cleaned in a few days since the infection is found).

security software intercepting and blocking system processes: Oh, yeah this is the best part. You don't use an AV, but use a HIPS system. While this solution is very good (most of the times, it is more effective than an AV), this kind of software is used only by security freaks, because they offer just too much protection. They ask you about every single thing that happens in your PC: an application starts, and application closes another, an application loads a driver, etc... UAC (User Account Control) in Vista is a little baby besides a HIPS solution.

As I said before, in my experience, the risk is hugely exaggerated. Email is scanned by senders and ISPs these days -- and there is always on-demand scanning, often run by mailer plugins when needed. Drive-by attacks may be common according to the media and the industry, but somehow I've been missing them for two decades despite my efforts And, no, I don't believe in luck.

Well, I can really see why you don't believe in luck. With all the method posted above, yes, you can get even more security than an AV can provide you. But, really, it very much work to configure them so they actually work, you need to have a very big knowledge about many things, and most of all, you need a lot of patience to configure all of them.

And still, an AV solution combines a part of all the above, and provides almost the same amount of security without much configuration and knowledge.

I say "almost" only because of the HIPS solution, which, by the way, it is included in some AV/Firewall solution also... in which case, those AVs provide even more security than your methods, with much less spent time configuring them. Also, other methods are also included in an AV solution, like ******/cookie control, registry control, identity theft prevention (anti-phishing), etc...

As a conclusion: AV products are made to make your life easier. Why become the slave of your computer, and spend time looking after it, when you can just enjoy your time?

Yes, you also need to keep your eyes open, but that's about it.

The way I see it, there are 2 ways to go:

- install AV/Firewall, be careful what you click on, and enjoy the internet

- be careful what you click on, configure a HOSTS file, study the services and stop the ones you don't need, disable some stuff (and loose some functionality), and other configurations that don't resist more than a few days, after which you'll have to start over.

Cris.

glocal

@Cris,

I never said the average user is able to use the methods I mentioned. On friends' systems I install one of the many free on-access AV apps just to be on the safe side -- because I don't trust them All I am saying is that with a little knowledge and effort you can have greater security and a more responsive system. I don't think it's as demanding as you suggest. Many of these things are even done semi-automatically by various apps, including Spybot. As for HIPS, it is annoying in the beginning but with training, it more or less works like a firewall, with the added advantage that you know exactly what app does what. The reason I installed HIPS recently was for that advantage, not as an antivirus measure. I've been working without HIPS for many-many years without a single infection.

You identify the weaknesses of each of the methods, but the strength is in their combination. Nothing is 100% secure, not even on-access AV checking. In fact, those who believe their on-access AV is enough are less secure. Even HIPS is not 100% secure because users tend to OK things they don't understand. As for Windows services, there are all sorts of guides out there on how to configure them. The advantage is not just greater security. The main advantage is a far more responsive system and fewer conflicts. If you get something wrong, that's OK. You will realise something doesn't work and re-enable the relevant service. I would recommend it highly. On my systems there are only a handful of services running, very few things start with windows and there are even fewer icons on the tray -- all this with no impact on usability, except perhaps that things like QuickTime have to start when I ask them to. Even my Windows Update happens according to my schedule -- no service running in the background. As I said before, my main system is one of the oldest, yet most responsive systems I know (and I know quite a few) with full functionality and hundreds of installed apps.

Like you, I have been working on large networks with USB keys carrying executables etc. As a lecturer, I've been using the facilities of nearly ten universities for many years. I have never been affected by what you describe. After all, your traffic can be affected by conditions beyond your control that network admin should be dealing with.

To sum up, what I am counter-suggesting is not for newbies, but with networked PCs comes responsibility. If you want a more responsive and more secure system, you need to know a few things about your system and avoid resources-consuming on-access AV scanning -- after all, I believe the risk is massively exaggerated anyway. If you don't or can't, then that's fine but people shouldn't complain then about their system becoming progressively slower or more unstable, or about botnets and the amount of spam they receive, or identity theft etc. I don't think the 'fit and forget' on-access scanning approach is the best solution. It shouldn't be this way, but I am afraid it is. BTW, I see this as being the master, not the slave of the PC.

BTW, the 'it depends' responses to the poll essentially are votes for 'Yes' if you think about it. That's exactly what I am saying.