Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Since 6 or 8 years ago I have stopped using antivirus on my main computers. Whenever I download a suspicious file, I would upload it to VirusTotal or use other online scanners to check whether the file is safe. However, my upload speed is not exactly spectacular, so uploading big files to VirusTotal takes a long time. They support checking by file hash, which is a great feature, but sometimes I have files that they have no record. On the other hand, online scanners take time to load and I'd prefer one that loads instantly.

Is there any good non-resident anti-virus software that I can occasionally use to scan suspicious files? Preferably one that makes no changes to the system files and add no hooks to the system calls. (Am I too demanding? :-)

share|improve this question
    
It helps to know that the "non-resident" virus scanners are known as "on demand", as opposed to "on access" scanner. –  MSalters Jul 21 '11 at 12:44
    
Just FYI, viruses have the ability to modify file checksums, so that is not a reliable method. Unless you're running a computer from the late 80's, you should be able to handle any modern antivirus program without a noticeable performance hit. If you're on Windows, try Microsoft Security Essentials, since it's free, and they kind of made the operating system... If not for anything, that should at least give it credibility as being the best performing antivirus software on Windows (they wrote it, they know the low-level OS/API hooks). –  Breakthrough Jul 21 '11 at 19:15

6 Answers 6

If you're very funny about having the software installed on your computer then you could always create a Virtual Machine on your computer. (VirtualBox is a great free Virtual Machine Software) You can install an antivirus program in the VM and do all of your downloading there. You can then use it's built in networking features to transfer the file over to your host. You can also create a backup of the VM in case you do download a nasty file and need to format the VM. You can just delete the Virtual HDD and restore from your backup.

share|improve this answer
    
Creative idea. I like it. A sandboxed AV system. –  music2myear Jul 26 '11 at 21:57

Try Malwarebytes Anti Malware. Free for personal use and has the ability to right-click and scan a file, as well as it doesn't load a resident program unles you pay for it.

share|improve this answer
1  
yes, but it's not technically an anti-virus –  Sathya Jul 21 '11 at 4:59
1  
Still catches more than most AV's I've seen in my shop –  Canadian Luke Jul 21 '11 at 17:06
    
My favorite anti-virus. I don't like resident scanners either. –  ultrasawblade Jul 21 '11 at 20:37

You can use ClamWin - free and open source.

share|improve this answer

Most packages can be configured to operate in this mode. I personally like Kaspersky, but any of the major ones should be able to do it.

share|improve this answer
    
My impression is that most of the major ones make a lot of changes to the system (potentially causing problems or slowing down the system even when real-time monitoring is turned off). Not true? –  netvope Jul 21 '11 at 4:01
    
Norton's corporate edition is pretty lightweight if you can get a copy of that. I dislike regular consumer norton and macaffee. –  Paul McMillan Jul 21 '11 at 4:26

Microsoft Security Essential. Free, great reviews, lightweight, gets updates through Windows Update and not Yet Another Update Program. Plus it isn't vulnerable to kernel hooks, unlike other antivirus software. . .

edit:

http://www.matousec.com/info/articles/khobe-8.0-earthquake-for-windows-desktop-security-software.php

http://arstechnica.com/security/news/2010/05/multicore-cpus-move-attack-from-theoretical-to-practical.ars

These are the kernel hooks I'm talking about. The reason they are becoming more prominent is due to the prominence of multicore processors. They try to sneak in between thread syncs and basically overwrite data. It's a tough technique to write but never the less still exists. Probably the most bitter part of the articles though is Microsoft has known about this vulnerability since XP64. When Microsoft decided to block this "vulnerability", security companies balked and threatened to sue. Aparently, these same kernel hooks are vital to the functionality of many anti-virus engines. Cause everyone like to sue Microsoft, they decided to back off. And thus the inevitable. . .

share|improve this answer
    
It's not vulnerable to kernel hooks? Can you define that more? –  Canadian Luke Jul 21 '11 at 17:05
    
I edited my answer. –  surfasb Jul 21 '11 at 19:12

I'm also running without resident anti-virus "protection" (if you can call it that)

I use these 3 periodically:

enter image description here

enter image description here

enter image description here

Well that's my 2 cents

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.