Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

If an user does not have admin privileges or privileges to edit the registry, is there any reason to have antivirus software installed?

share|improve this question
2  
Um...the giant, gaping, remotely-exploitable holes in Windows? –  peelman Aug 12 '10 at 14:24

5 Answers 5

up vote 6 down vote accepted

Yes, you need it.

  1. In Windows XP Home, it's very hard to run unprivileged, so for XP the question is relatively moot.
  2. Even if unprivileged, a virus can cause damage. It doesn't take privileges to delete all user files, take sensitive info, make the computer a zombie (infecting other computers on your network). If you're sysadmin, you'd need to clean up.
  3. Privilege escalation: remote exploit + local privilege escalation => remote root/Administrator hole.
share|improve this answer
    
And don't forget Administrator account in Windows XP Home! It's a wide open hole. –  AndrejaKo Aug 12 '10 at 16:11

While the majority of viruses get in through admin/power user accounts, there's still exploits to be had in the locked down accounts.

The general rule of thumb is "safety first", install antivirus/antimalware/anti-everythingbad software anyways.

While restricting user accounts is one way to decrease the risk, it is not a complete replacement for a good security app.

share|improve this answer

I guess you can answer your question with a question: Do you need a lock on your door if no one knows where you live?

I think "reasonable security" (in Windows) can be achieved by using a combination of anti-virus or "internet security" type software, and proper user training.

One major problem with a lot of so-called security software is that if you enable all of its features, you have no CPU cycles left for the user (this in itself, of course, may prevent anything nasty to happen to the machine :-)).

So use something like AVG Internet Security, but don't enable every single bell & whistle, and then tell the user that p0rn.net will not enhance your life ;)

share|improve this answer

There are other ways that a virus and/or spyware can gain access to a PC, and restricting the user's privilages is one deterrent to this but cannot be the ultimate answer unfortunately.

Are you thinking about a maintenance standpoint, or from a cost-per-machine standpoint? If it's a cost thing, I believe that Microsoft's Security Essentials are free to use.

share|improve this answer
    
In the past, we have had issues with Symantec being a resource hog on our terminal server. –  xxl3ww Aug 12 '10 at 15:19
    
I, too, have had problems with Symantec hogging resources. Since moving away from them (and totally uninstalling anything Symantec-related), things have been fine. How about trying the MS version for a bit and see how you get on? –  Brett Rigby Aug 12 '10 at 15:24
    
I'm going to try to disable everything but the anti-virus/spyware protection in the endpoint protection suite and see if that will run correctly (atleast that is what the tech at symantec recommended) –  xxl3ww Aug 12 '10 at 15:55
    
MSE is lightweight, easy, and free. It's the best antivirus on the market. –  Shinrai Aug 12 '10 at 16:00
    
Is it recommended on a terminal server? –  xxl3ww Aug 12 '10 at 17:00

To cut a long story short: Virusses don't care about privileges =)

share|improve this answer
2  
Just because unprivileged users can't install something doesn't mean they can't run something else. –  MBraedley Aug 12 '10 at 14:54
    
A malicious virus could still delete everything you have rights to as that user, which is quite a bit of stuff you might not want deleted. –  Bratch Aug 12 '10 at 17:55

protected by nhinkle Apr 7 '12 at 3:30

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.