Webpage Virus Protection

[Ally]

After creating a test web page then viewing in browser, ActiveX and Java alerts come on screen. I know Norton is guarding my PC, but I only had two images and a block of 3D text. When I view your new and wonderful sites Norton does not alert me to anything. What am I doing wrong?

[Know1]

You're doing nothing wrong.

When viewing a site located on your hard disk it is in a local/trusted zone with fewer restrictions.
Therefore code has access to more parts of your system and can do allot more damage.
MS decided to add a warning instead of just running whatever is in an html file opened in the local or trusted zone to protect people from that.

Once your site is uploaded to an actual web server the warning messages disappear because it's treated in the 'internet zone' that doesn't have access to your computers file system.

So people eventually seeing your site on the internet will not get those messages.

[Ally]

Thank you so much Know1, you certainly know your stuff. I'll carry on now, thanks a mill..........

[Egg Bramhill]

Thank you also Know1, that's the easiest, shortest and simplest explanation of this that I've read. It makes a lot of sense.

[Jimi King]

If you use Firefox instead of Internet Explorer and you won't get those annoying alerts.

[BONES]

Nor should you need to be anywhere near as paranoid about this stuff. I have never used any anti-virus software and I have never had any problems, because I've always used Netscape/Mozilla for my email and web-surfing [and I try not to be an idiot].

[steve.ledger]

I have never used any anti-virus software and I have never had any problems

You'd never know you were infected unless you have an AV prog installed.

I could guarantee that if you have never installed an AV or AntiSpyware program on your PC that you use frequently on the web, I would find infections you didn't know about.


I 100% agree that paranoia is not healthy. I also agree that overdoing it is counter-productive and of course, I 200% agree that trying not to be an idiot can be very rewarding. I cannot however agree that you can make do without any security software installed..

[Egg Bramhill]

I have never used any anti-virus software and I have never had any problems

I agree with Steve's comments but I think it goes further than this. If you have no AV then each time you upload a file here or send an email you could very easily be spreading a virus to us all.

I've always used Netscape/Mozilla for my email and web-surfing

By this are you saying Netscape/Mozilla is immune from viruses?

[BobInce]

To Ally:

You can stop the alerts when you look at files locally in IE by adding the following line to the start of the .html file in a text editor (such as Notepad):

<!-- saved from url=(0014)about:internet -->

(include a new line after the closing > character.)


To the others:

You'd never know you were infected unless you have an AV prog installed.

You might still never know you were infected even with an AV prog installed.

Unfortunately the state of the game today is that, in the face of proliferating and highly-polymorphic malware threats from thousands of parties doing it for a living, signature-based AV is practically dead, and heuristic-based AV is still massively unreliable (whilst generating many false positives).

Wearing another hat, I sometimes research some of the web-infection-based malware coming from the Russian-language adult webmaster market, and submit what I come across to the multi-AV web tests. The results are typically dire: often only a couple of AVs spot anything (and then as a 'generic' detection which also triggers on any packed executables); rarely does it go above 50% detection.

We in the security cabal have always stuck to the "You must have AV!" mantra. It's easy and it sells kit. But now, speaking more honestly, it's looking ever more questionable: today's AV is inadequate for any reliable level of protection, and some of the most system-invasive, attention-seeking, resource-hungry AVs are a poor bargain indeed for the woeful protection they offer.

Unfortunately the more effective approaches require common sense from the user and they don't sell shiny software boxes:

1. not "being an idiot". Don't trust the makers of a program with everything on your machine? Then you don't run it.
2. keeping installed software up to date
3. removing unnecessary net-facing software, especially stuff with browser plugins
4. running everyday work as non-admin

AV can be a useful backstop for when these fail, but *rely* on it at your peril, and don't think you're definitely clean just because Norton hasn't said anything.

[Egg Bramhill]

Thanks for the insight Bob. Very reassuring