4

Since 6 or 8 years ago I have stopped using antivirus on my main computers. Whenever I download a suspicious file, I would upload it to VirusTotal or use other online scanners to check whether the file is safe. However, my upload speed is not exactly spectacular, so uploading big files to VirusTotal takes a long time. They support checking by file hash, which is a great feature, but sometimes I have files that they have no record. On the other hand, online scanners take time to load and I'd prefer one that loads instantly.

Is there any good non-resident anti-virus software that I can occasionally use to scan suspicious files? Preferably one that makes no changes to the system files and add no hooks to the system calls. (Am I too demanding? :-)

2
  • It helps to know that the "non-resident" virus scanners are known as "on demand", as opposed to "on access" scanner.
    – MSalters
    Jul 21, 2011 at 12:44
  • Just FYI, viruses have the ability to modify file checksums, so that is not a reliable method. Unless you're running a computer from the late 80's, you should be able to handle any modern antivirus program without a noticeable performance hit. If you're on Windows, try Microsoft Security Essentials, since it's free, and they kind of made the operating system... If not for anything, that should at least give it credibility as being the best performing antivirus software on Windows (they wrote it, they know the low-level OS/API hooks). Jul 21, 2011 at 19:15

6 Answers 6

3

You can use ClamWin - free and open source.

2

If you're very funny about having the software installed on your computer then you could always create a Virtual Machine on your computer. (VirtualBox is a great free Virtual Machine Software) You can install an antivirus program in the VM and do all of your downloading there. You can then use it's built in networking features to transfer the file over to your host. You can also create a backup of the VM in case you do download a nasty file and need to format the VM. You can just delete the Virtual HDD and restore from your backup.

1
  • Creative idea. I like it. A sandboxed AV system. Jul 26, 2011 at 21:57
2

Try Malwarebytes Anti Malware. Free for personal use and has the ability to right-click and scan a file, as well as it doesn't load a resident program unles you pay for it.

3
  • 1
    yes, but it's not technically an anti-virus
    – Sathyajith Bhat
    Jul 21, 2011 at 4:59
  • 1
    Still catches more than most AV's I've seen in my shop Jul 21, 2011 at 17:06
  • My favorite anti-virus. I don't like resident scanners either.
    – LawrenceC
    Jul 21, 2011 at 20:37
1

Most packages can be configured to operate in this mode. I personally like Kaspersky, but any of the major ones should be able to do it.

2
  • My impression is that most of the major ones make a lot of changes to the system (potentially causing problems or slowing down the system even when real-time monitoring is turned off). Not true?
    – netvope
    Jul 21, 2011 at 4:01
  • Norton's corporate edition is pretty lightweight if you can get a copy of that. I dislike regular consumer norton and macaffee. Jul 21, 2011 at 4:26
1

Microsoft Security Essential. Free, great reviews, lightweight, gets updates through Windows Update and not Yet Another Update Program. Plus it isn't vulnerable to kernel hooks, unlike other antivirus software. . .

edit:

http://www.matousec.com/info/articles/khobe-8.0-earthquake-for-windows-desktop-security-software.php

http://arstechnica.com/security/news/2010/05/multicore-cpus-move-attack-from-theoretical-to-practical.ars

These are the kernel hooks I'm talking about. The reason they are becoming more prominent is due to the prominence of multicore processors. They try to sneak in between thread syncs and basically overwrite data. It's a tough technique to write but never the less still exists. Probably the most bitter part of the articles though is Microsoft has known about this vulnerability since XP64. When Microsoft decided to block this "vulnerability", security companies balked and threatened to sue. Aparently, these same kernel hooks are vital to the functionality of many anti-virus engines. Cause everyone like to sue Microsoft, they decided to back off. And thus the inevitable. . .

2
  • It's not vulnerable to kernel hooks? Can you define that more? Jul 21, 2011 at 17:05
  • I edited my answer.
    – surfasb
    Jul 21, 2011 at 19:12
0

I'm also running without resident anti-virus "protection" (if you can call it that)

I use these 3 periodically:

enter image description here

enter image description here

enter image description here

Well that's my 2 cents

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .