RE: The Confiker Virus hype and measures

Actually, I can't remember the last cable/DSL ISP that I had seen solicit offers for service that didn't offer some level of free bundled AV.

Most conventional AV software is oriented towards checking files for "badness" before the access is allowed, which doesn't really apply to the ms08-067 infection vector so much - at least, not in my experience with what most AV software does. That is more the domain of signature-based IPS's.

But I think the real morale of the story is that end users want to see their computer like an every-day person sees a car: as a tool that works to get from A to B, and not what a mechanic would see a car as. Users don't want to have to deal with the nitty-gritty details of maintenance. Hence, why automatic updates are a good thing (*if implemented properly) in some cases (i.e. where there's no sysadmin to manage things). The AV folk have done that for a long time and it's been reasonably well accepted.

- S