8

I have been reading here (in superuser) some questions about the necessity of antivirus software in Windows and some doubts arise.

As far as i know (and imagine) virus software can only be harmful if I download any type of infected executable file and then I RUN IT. I mean that if i have the infected executable in my desktop but i leave it there for years without clicking it, I won't be in danger...

My question is: How can i be in danger browsing the so called "malware pages or sites"??.

If i am just browsing an "infected site" how could I be affected by a virus. In any moment the browser is asking me for the permission to download "something", so how could it be?? Although i don't give permission to the browser to download 'something' is data being downloaded to my computer?? Its some kind of cookie?

I will ask in another way... What is the level of riskiness if i get infected in a malware site compared with the level of an executable virus??

2
  • 1
    Antivirus software can also check the http (or other network) stream for viruses before your computer ever tries to execute it.
    – emgee
    Sep 19, 2009 at 2:06
  • In combination with Wil's excellent answer, use IE 8 if you wanna use IE since it has sandboxing which separates whats executed inside the browser from the operating system (This does not apply to actually downloading a .exe/bat/vbs/msi etc and executing it.) You could also used Chrome or Firefox of the latest brand. Moral of the story, always use the latest from the greatest. I wanna take the chance to recommend NoScript for Firefox(and chrome) which blocks all script so you have to accept them beforehand. This helps in the murky waters of the internets.
    – artifex
    Mar 8, 2010 at 19:42

4 Answers 4

10

There are not that many sites that you can get a virus simply by viewing, however there are a few that try to exploit holes in a computer - for example, a while ago there was a nasty one where just viewing a special picture could allow someone to install items on your hard drive (In Windows).

The main reason for the software / services that block visitors to pages is simply to stop the nasty pages that serve no legitimate purpose. For example, there are quite a few "fake antivirus" type websites that the only reason for them to exist is to pretend to be a dialog box and get people to download from them. So, why bother letting people go there at all!

In the above, you are correct that you can only get affected if you actually download and run the software, but why risk it or let it go that far when you can prevent people from visiting all together... For example, I remember some sites that tell people to ignore the warnings, click accept and/or give instructions on how to load addons through the bar in Internet Explorer - it just makes sense to stop people before they are even at the page.

Typically just like email, there is low risk just from viewing, there are a few things that this is not true such as holes in Adobe, Flash and a few other programs, but just don't run .exe or similar files from people or places you do not trust (and even if you trust, take caution!)

3
  • Thanks a lot Wil for your answer...I'am understing a bit more now... I repeat the question i made for baseballboy: Could you be a bit more especific about the exploit/hole issue. Ok, supose that an exploit or security hole is found on my pc, how could somebody or something or whatever it be take advantage of that exploit and affect my computer?
    – flyer88
    Sep 19, 2009 at 1:04
  • 2
    The web site would be designed to take advantage of the exploit whether or not the visitor is susceptible. In theory, if you've got your computer fully patched and up to date, you stay away from shady (pron, pirate, etc.) sites and you never click on a popup or let anything install from your browser, you're not that likely to get infected. That said, I wouldn't try it. There are some nice, free antivirus packages out there.
    – emgee
    Sep 19, 2009 at 2:06
  • 1
    Holes in Adobe Reader and Flash is most likely the biggest risks today - holes in 3rd party applications that are run when you visit a site, that isn't normally patched with your OS installation... just opening a PDF with a slightly out-of-date Adobe Reader could compromise your system just as those "old" image showing holes did. Sep 19, 2009 at 13:34
2

Browsers are computer programs as well, somethimes they have vulnerabilities. Sometimes these vulnerabilities allow bad guys to get their exploits executed without your explicit confirmation (for example, you get that code as JavaScript when visiting a malware site and don't have something like NoScript).

I've always thought that a well-designed operating system can survive without an antivirus. The purpose of an antivirus is to close up some holes in the OS security (holes which a good OS ideally must not have).

Also bear in mind that security is a process. So just running an antivirus (or even more than one, yes, some people do that and feel "safer") and blindly relying on it won't help too much.

I'd say that following some simple rules are more important than running an antivirus:

  • do not work permanently using an Administrator/root account. Use the superuser only when you can't achieve a certain goal as regular user
  • have a sane firewalling policy. This assumes you know the basics of TCP/IP and you know them reasonably well
  • monitor what's happening inside your system, what's changing
1

Well when u browse through malicious websites some of them have something called "drive by downloads" which finds an exploit through ur browser and/or OS. The drive by downloads dont ask for permission, they just simply download.

To answer ur second question, it all depends on the malware being downloaded and running. The level of riskness of visiting malicious websites is a 10 unless u have a decent antivirus.

Hope I answered ur questions correctly.

2
  • Oh! I wasn't noticed about "drive by dowloads" sites. That's is very interesting, thanks for let me know that... Could you be a bit more especific about the exploit. Ok, supose that an exploit or security hole is found on my pc, how could somebody or something or whatever it be take advantage of that exploit and affect my computer? Thanks a lot again.
    – flyer88
    Sep 19, 2009 at 1:03
  • Bugs that can be exploited to run something without user intervention are the holy grail of the malware guys and when a bug is found all the malware guys jump on it. Sep 19, 2009 at 4:36
0

You can't as long as you use Firefox with AdBlock and NoScript. With the correct settings of course. Of course with some common sense.

NoScript is the key though. As most malware (sites) use some sort of script to install themselves on your computer, NoScript, by default, blocks every script possible.

And since NoScript is open-source it is continuously being tweaked and tuned so it can outsmart the newest threats.

It takes some time to fine tune it (allowing specific scripts, so some sites may function properly).

You can take it to the next level and get Comodo Firewall and Avira Antivir coupled with SpyBot (especially its immunize function).

Although no software can beat the common sense, if you are stupid, then you are stupid and no software will protect you.

With the software above I haven't had any malware nor virus, worm, trojan or keylogger infest my computer in a very, very, very long time.

Though I often fell for links containing keyloggers, when I was playing WoW and the WoW forums were running mad with kids posting keylogger-links. Nothing happened to me, ever.

1
  • Would just like to add that noone could ever know that "nothing happened to me" as the more dangerous malware isn't easily detected, at all... Sep 19, 2009 at 13:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .