I've been using computers since the 80's. I haven't used anti-virus software since the 90's. And yes, I have been using Windows until somewhere in the 00's, including Windows 95, which is about as vulnerable as it gets.
When I was using antivirus software, it never set off any alarms once. I still occasionally install and run antivirus software, it doesn't find anything, so I remove it again. I've sat in the middle of major virus outbreaks inside companies and not be affected.
I have no idea how people manage to get infected. Every time I read about some malware scare, I look at how it spreads and think to myself "but... why would you do that?".
In the 80s we had boot sector viruses that would bite you as soon as you inserted a disk, and disks where the only way of exchanging data. You couldn't protect against those without antivirus.
But today most malware seems self-inflicted, and only spreads through naivety, ignorance and laziness.
Sure, I could still get infected tomorrow. After 25 years of computing it's bound to happen to me at some point. But it will most likely be because I did something I shouldn't have, not because I don't have adequate anti-malware protection.
But today most malware seems self-inflicted, and only spreads through naivety, ignorance and laziness.
I assert that stereotypical "stupid users" were indeed the cause of most virus spreading in the 1980's and 1990's. There is still a fair amount of "stupid user" stuff happening these days, such as clicking on a link in an email to log into your bank account. (1)
However, these days, I'm also worried about exploits against browsers. If you have your system infected by just by visting a webpage, I don't consider that the user's fault.
Every year that goes by, the browser gets more complex (like recent support for 3-D rendering), and the attack surface increases. I'm glad that most browsers are fairly secure, but they're not perfect now, nor are they likely to be in the near future.
(1) It continues to annoy me that two of my banks will send out legitimate emails (new bill, etc.) that have clickable links in them. If the banks would stop putting links in their emails, and try to educate their users to not click on links in emails, that would reduce the problem.
However, these days, I'm also worried about exploits against browsers. If you have your system infected by just by visting a webpage, I don't consider that the user's fault.
I'm starting to consider a lot of these exploits and security problems to be the developer's fault. Too many attack vectors are well-known, and should be accounted for in the design of software.
For example, overflow exploits: Why, in this day and age, do we still default to writing software that works with untrusted data in languages that don't enforce bounds checking? C++ has many virtues in many situations, but it's not a language for writing web browsers. For performance-critical modules that are small enough to make serious code auditing feasible, sure. But as the primary implementation language it's just one big vector for attack that pervades the entire codebase.
used to think more-or-less the same thing: antiviruses are unneeded resource hogs...
until I connected my laptop to the network at school.
I didn't notice anything strange until a month later when I reinstalled WinXP (was doing it regularly for speed).
My mistake was that I installed Winamp and other software from kits on a shared folder (full access for everybody) on my laptop, before installing the AV.
That's when all hell broke loose: the kits were injected by some virus and got activated only when were run
tl;dr: Thing is even "power-users" can get it wrong. Is it really worth it risk so much, for so little?
PS: referring here strictly to platforms that need AVs
When I was using antivirus software, it never set off any alarms once. I still occasionally install and run antivirus software, it doesn't find anything, so I remove it again. I've sat in the middle of major virus outbreaks inside companies and not be affected.
I have no idea how people manage to get infected. Every time I read about some malware scare, I look at how it spreads and think to myself "but... why would you do that?".
In the 80s we had boot sector viruses that would bite you as soon as you inserted a disk, and disks where the only way of exchanging data. You couldn't protect against those without antivirus.
But today most malware seems self-inflicted, and only spreads through naivety, ignorance and laziness.
Sure, I could still get infected tomorrow. After 25 years of computing it's bound to happen to me at some point. But it will most likely be because I did something I shouldn't have, not because I don't have adequate anti-malware protection.