So, Just What's AntiVirus For Handhelds Like?

[Brad Adrian]

Yesterday, <a href="http://www.pocketpcthoughts.com/forums/viewtopic.php?t=17093">Ed posted </a> on Symantec's announcement about their new AntiVirus For Handhelds. Now that it's officially been launched, I found some of the feature details:<br /><br /><img src="http://www.pocketpcthoughts.com/images/adrian/antiviruspda.gif" /><br /><br />• Runs natively on Palm OS® and Pocket PC devices. <br />• Renewable annual service keeps you up to date with the latest virus protection updates, features, and OS compatibility upgrades. <br />• Auto-Protect provides real-time protection against malicious code—unobtrusively, in the background. <br />• Automatic scans can check for viruses after expansion card insertion or desktop synchronization. <br />• On-demand scans allow you to examine applications and files for viruses at any time you want. <br />• New virus protection updates are automatically transferred from your desktop computer the next time you synchronize your PDA. <br />• Wireless LiveUpdate™ downloads new virus protection updates directly to your handheld when you have a direct wireless connection to the Internet. <br />• Logging capability provides vital information you need to take action against virus threats. <br />• Symantec™ Security Response works 24 hours a day to discover and develop antidotes for new viruses.<br /><br />The one-year service goes for $39.95 and can be bought <a href="http://www.symantecstore.com/dr/sat2/ec_MAIN.Entry17c?CID=39910&SID=27674&SP=10007&PN=5&PID=584410&DSP=&CUR=840&PGRP=0&CACHE_ID=39910">directly from the Symantec site</a>. Plus, there's a $20USD (or $30CDN) mail-in rebate for any "previous owners of a stand alone, retail (boxed or downloaded) version of any Norton,™ Symantec,™ or McAfee® software product."<br /><br />I'm not really sure yet how badly I need this kind of a product, for some of the reasons discussed in <a href="http://www.pocketpcthoughts.com/forums/viewtopic.php?t=17093">Ed's thread</a>. But, I'm also thinking that for a final price of $19.95, it's pretty inexpensive insurance.

[madbart]

In 7 years of using both Palm & Pocket PC's i have never heard of, seen or recieved a virus on my mobile device. Has anyone seen one????? :|

This one just might be worth a poll!

Seems like the virus histeria is just going to be a cash cow for these vendors across all platforms now including the PPC

[Brad Adrian]

In 7 years of using both Palm & Pocket PC's i have never heard of, seen or recieved a virus on my mobile device.
You're right, and my ignorance about viruses makes me a prime target for the antivirus marketers. I guess I'm just afraid that what I don't know will hurt me.

[snowlion]

I wouldn't be a bit surprised if some "consultants" of these virus companies are releasing a few themselves.

Because of all this virus scare...i buckled and bought an anti-virus product from symantec. but it let thru all the sobig virus emails. so what does this product do??????????

[Duncan]

I wouldn't be a bit surprised if some "consultants" of these virus companies are releasing a few themselves.

Because of all this virus scare...i buckled and bought an anti-virus product from symantec. but it let thru all the sobig virus emails. so what does this product do??????????

OK - that first idea is just plain absurd. AV companies have no need to create viruses - there are plenty of morons to do that for them.

As for the second - no way on earth would Norton AV have let through the sobig virus if you have set it to update its virus definitions immediately on installation and then at regular intervals (they have won every AV test I've seen for years and almost always with a 100% detection rate). Since that piece of AV software explains all this very clearly during set-up then the sobig viruses getting through is someone's fault but it ain't Symantec's.

Oh - and if I sound particularly irritated - it is because it is those with no, or poorly configured, AV products who end up being responsible for the flood of virus ridden e-mails (set out from their computers) that my AV software has to waste so much time dealing with these days.

[JvanEkris]

IMHO, PocketPC's aren't that popular by virusmakers. I guess virusmakers focus on large platforms having many novice users that contact eachother very frequent, allowing virusses to spread easlily, making big headlines.

Removing one of these key elements will stop a virus from spreading very fast. This is also why Unix virusses are so rare.

PocketPC's don't talk to each other a lot in a direct way, so spreading the virus is a bit of a challenge. Things like network-connections are very infrequent, so they can't be dependend upon to spread the virus. PocketPC's mainly communicate with a host (laptop/desktop) using another operating system and another processor architecture. Besides this, PocketPC's are extremely hard to execute malicious code (Outlook does not even understand VB and Java). A virus that would spread on PocketPC would be extremely complex to adapt to these situations.

So making a virus that hurts PocketPC's won't spread like wildfire and probably will never make the headlines on international news. Making a virus for normal PC's is a lot easier and make much better headlines. So i guess as long as that's the case, were safe :)

One thing to worry about IMHO is Trojans. They spread easily, and could cause some severy damage (hard-resets can be triggered from within applications :eek: ). But that can be countered by only downloading software from trusted sources.

Jaap

[rpommier]

I run AVG Antivirus from www.grisoft.com and it's kept me covered. It's free and checks email too. This is for the desktop.

[petvas]

I have never had problems with Viruses. Of course I use an Antivirus but this isn't enough. It is about the best practises in using computers. I never:
Download stuff from suspect sites
Open suspect Email Messages
Surf Suspect Sites
Accept to install applications that I do not trust
I never download plugins for IE

I also believe that Pocket PCs do not need an Antivirus solution at the moment. Of course that may change...
I would hate to have an Antivirus that would slow down my Pocket PC.

[surur]

The ast thing I need on my slow 400mhz system is some constantly running software examining every file operation and running process, slowing everything down, especially when there are no proven virusses, and the routes for contaminatin (e-mail and file transfers) are so much less relevant.

at those prices, its just a scam. Maybe in a few years time...

Anyways, it should be MS's responibility to make their very new, legacy free os as bullet proof as possible.

Surur

[wocket]

Fear is a great marketing tool.

nuff said

[Bill Gunn]

DuncanOh - and if I sound particularly irritated - it is because it is those with no, or poorly configured, AV products who end up being responsible for the flood of virus ridden e-mails (set out from their computers) that my AV software has to waste so much time dealing with these days.

Yeah!! And people without bullet proof vests are responsible for murders and people without a bodyguard are responsible for muggings. :lol:

Seriously, a virus has to pass through ISP routers to get to an individual's PC. We need AV in the routers not on a billion PC's and mobile devices.

[Ekkie Tepsupornchai]

There's a trade-off to all decisions. AV for a windows desktop can make sense because of the risk. The trade-off, as someone mentioned, is the added overhead and overall degradation of performance. Plus on a desktop, I'm always left to wonder if the AV may have caused a program to crash or my OS to crash or prevent something from running correctly. Still could be worth the hassle given the risk.

On a PPC, as long as I have my PIM information backed up on Outlook and I have backup images, I feel that my risk is mitigated. I also just couldn't justify the constant overhead & performance degradation introduced by this AV program when there hasn't yet been any known virus cases for the PPC.

[dannyoneill]

Working in an IT department I often get people asking for information why there home PC is running slow or downloading stuff from teh net. I then ask them if they have a virus and they say "no, of course I dont", I ask them what antivirus they use and they say "I dont use any cos I dont have any viru's". They run a web scanner or a free tool and find they do have somthing.

I run PC Cilling Wireless on my IPAQ. Its a free on demand scanner, so far nothing, but you never know. There getting popular and its only a matter of time before one gets into the wild. There are PocketPC and Palm Virus's, its just that they dont distribute as easily as the PC ones.

Its worth being carful.

[bjornkeizers]

I've used antivirus software in the past, but not these days. I rely on common sense. And I know that, even if I keep my AV software updated, I'll still be vulnerable to any number of new viruses. It's the ones you cant see that hurt you. I occasionally scan for a virus if I "might" have an infected file or two, and I do the odd ad-aware scan, but that's it. No antiviral software on any of our home PC's. We had Norton on a couple, but it updated badly, it slowed down performance of the systems, and worse yet, it let a virus through one day, while we updated it a couple days before that!

Common sense is the best defence.

[burtman007]

My biggest problem is the cost. $19.95 AFTER rebates? :?: For a piece of software that has yet to prove that it does anything??? Peace of mind is one thing, but seriously now...

[Janak Parekh]

Seriously, a virus has to pass through ISP routers to get to an individual's PC. We need AV in the routers not on a billion PC's and mobile devices.
8O No way. A router is dealing with low-level IP headers (e.g. Layer 3), and looks at as little of the packet before passing it on. There is no way that core routers or even ISP-level routers could handle the added load of filtering the content of packets. Trust me, I've written router-level code, and Layer 7 inspection is very expensive for static checks, let alone a dynamic database that grows by tens or hundreds of entries every week. Add the fact that a virus is typically much larger than one IP packet, so you'd have to assemble a sequence in memory. It's not happening.

What we really need is better security policies on individuals' PCs that makes it more difficult to write to HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run -- that is, not running as Administrator. That, and more server-side filtering in corporate installations.

--janak

[bkerrins]

I just don't see the value in it. Worst thing that happens is I get some bug and it shuts down my Ipaq. So I do a hard reset and start over. Select one of the older version backups and install that and I'm all set to just start over. Any critical information is kept on my hard drive with AV software and backups.

[dean_shan]

Does this acually scan for virus or just play an animation to make people feel good.

[Jereboam]

You may not see the value now...but imagine this - in ten years time, let's conjecture, when wireless, converged, always on devices rule supreme, and everyone has one from early teens upwards - and we have voice, video and text messages flying around in vast numbers, much as email today...now imagine a virus tailored to take out the mobile OS of choice in the future....suddenly no one can communicate, pay their bills, navigate to their destinations, complete their homework, listen to music, watch the news...and so on.

It's not a problem now but as devices get more refined, cheaper and vastly more numerous, this WILL be a problem. Only a matter of time.

J

[Janak Parekh]

It's not a problem now but as devices get more refined, cheaper and vastly more numerous, this WILL be a problem. Only a matter of time.
Agreed -- but then we'll have computation power to spare for antivirus. By that point, we'll all have 3D VR-enabled handhelds that are the size of a cookie. ;)

--janak

[Jereboam]

It's not a problem now but as devices get more refined, cheaper and vastly more numerous, this WILL be a problem. Only a matter of time.
Agreed -- but then we'll have computation power to spare for antivirus. By that point, we'll all have 3D VR-enabled handhelds that are the size of a cookie. ;)

--janak

Don't - you'll start of a geekfest of predictions for devices of the future... :lol:

J

[sponge]

What kind of cookie? The local bakery has a cookie the size of small children's head's atleast in circumference.

[Jonathan1]

Great. Another TSR app eating at my memory and system performance. :|

[David C]

I still don't see the value in this software. Let's say in 10 years, wireless PPC becomes very popular, and virus starts coming out. At $39.95 a year x 10 = $400. Hmm.. I could probably have already bought my self 2 more wireless PPC already, since they will get cheaper as time comes.

[Jacob]

If I'm not mistaken, doesn't anti-virus software work by scanning files and finding patterns of virii in them?

If no virus has yet been found for the PPC, what is it scanning for?

Is it just for PC virii that could be moved to the PC? If not, then it seems like it would be just a little fancy security blanket.

[dean_shan]

Great. Another TSR app eating at my memory and system performance. :|

What is a TSR app?

[jmulder]

Great. Another TSR app eating at my memory and system performance. :|

What is a TSR app?

Is it true Paul McCartney was in a group before Wings? :D

Just teasing...TSR stands for Terminate and Stay Resident. Basically, in the old MS-DOS days, an app could run from the command line and install itself in RAM, then the UI would exit, leaving the program running in RAM. Today's analog would be the difference between what you see on the Applications tab of XP's Task Manager, and what you see on the Processes tab.

[Brad Adrian]

Worst thing that happens is I get some bug and it shuts down my Ipaq.
No, worst thing that happens is you get infected and then spread the virus to my Pocket PC when you beam me your biz card or spread a form of it to your company's network when you synchronize, or...

[Bill Gunn]

8O No way. A router is dealing with low-level IP headers (e.g. Layer 3), and looks at as little of the packet before passing it on. There is no way that core routers or even ISP-level routers could handle the added load of filtering the content of packets. Trust me, I've written router-level code, and Layer 7 inspection is very expensive for static checks, let alone a dynamic database that grows by tens or hundreds of entries every week. Add the fact that a virus is typically much larger than one IP packet, so you'd have to assemble a sequence in memory. It's not happening.
--janak

Maybe not today. Many things that where impossible a few years ago are common today. Like 400mhz computers that fit in your pocket and run off tiny batteries. :wink: Imagine suggesting such a thing 10 years ago.

[ombu]

Great!!! My PPC will be virus-free. (from known viruses at least)

I'll buy it as soon as the first PPC virus comes to stage. :mrgreen:

Regards.

[Duncan]

DuncanOh - and if I sound particularly irritated - it is because it is those with no, or poorly configured, AV products who end up being responsible for the flood of virus ridden e-mails (set out from their computers) that my AV software has to waste so much time dealing with these days.

Yeah!! And people without bullet proof vests are responsible for murders and people without a bodyguard are responsible for muggings. :lol:

Seriously, a virus has to pass through ISP routers to get to an individual's PC. We need AV in the routers not on a billion PC's and mobile devices.

Bill - your analogy fails on one simple count. The virus writers are better compared to the gun sellers. No gun manufacturer has ever harmed anyone by selling a weapon to a private citizen - but plenty of proivate citizens have killed or hurt people by ignorance with guns and not taking the correct precautions. Name ONE virus released in the past two years that did not already have a Windows patch and/or pre-existing AV protection for it. There hasn't been. So damn right I blame users for the deluge of virus e-mails that get sent my way everytime opne of these viruses gets into the wild...! :evil:

[Janak Parekh]

8O No way. A router is dealing with low-level IP headers (e.g. Layer 3), and looks at as little of the packet before passing it on. There is no way that core routers or even ISP-level routers could handle the added load of filtering the content of packets. ::snip::
Maybe not today. Many things that where impossible a few years ago are common today. Like 400mhz computers that fit in your pocket and run off tiny batteries. :wink: Imagine suggesting such a thing 10 years ago.
Actually, I strongly doubt it'll happen in the foreseeable future. As router performance increases, so does bandwidth and other low-level requirements. As it is, we haven't succeeded in deploying QoS (Quality of Service) across the Internet, even though we've been talking about it for 5+ years. Content filtering is very, very low on the totem pole. You may see more widespread installation of virus scanners on ISPs mail servers, but not in their routers.

--janak

[qmrq]

I know of only one virus for the Pocket PC platform.. I don't see any reason to use this software.

I never download plugins for IE

Better yet, don't use IE.

[iPaqDude]

I have been using the free Trend PC-Cillin for Wireless for some time - it is the same that I use on my corporate laptop. Never found anything, hopefully won't. I do a complete scan once or twice a day - prior to connecting to my laptop or home desktop for sync.

In the readme.txt file that accompanies the download is the statement "PC-cillin for Pocket PC version 2.0 can only detect Excel-type and Word VB script-type viruses."

Seems like that is all I need - for now. They have a $$ version that does more of the real-time scanning of files, predominately for wireless, beaming or internet connectivity. I'll wait, although this may bubble up as a company standard and I will have to switch to it in order to still sync with my company laptop.

[dannyoneill]

there are virus for PPC. Install Trend PCCillin on your PPC and check the list of virus. nothing in the wild though.

[beq]

http://news.com.com/2009-1009_3-5069674.html (MSBlast creator arrest)

Or we can rely on our Homeland/FBI to arrest virus creators and terrify potential virus creators into submission :)

P.S. Ironically we weren't really bothered by MSBlast (nor Sobig.F except for one isolated infection), but MSBlast's counter virus Welchia/Nachi somehow got through and proliferated our network, and brought down our Cisco router's WAN line repeatedly that day until we cleaned up :roll:

[dean_shan]

http://news.com.com/2009-1009_3-5069674.html (MSBlast creator arrest)


It would have been better if you posted this as a new topic. This really has nothing to do with handhelds.

[bazza]

The question is whether to be proactive or reactive - and if proactive at what cost? Given the chance of getting a virus on your PPC is very unlikely (at the moment) it seems an expensive task to obtain protection for something that really isn't necessary.

Having said that I have downloaded Symantec Antivirus onto my PPC. It runs in the background and has no visible effect on speed - (I haven't benchmarked). Live update is via the desktop connection.

Overkill? Maybe - it gives me peace of mind!

Necessary - probably not for the short-term future.

[norad]

well, I've installed norton anti-virus on my paq 4150 and there is only one type of virus under its definitions and it's a test virus. So, it seems like there is nothing it can scan for and it just slows my ipaq down.

[spikedrabbit]

Why not just use McAfee? the latest version scans on connection to the host pc, but like most of you, I don't see the point in this.