> but it always puzzled me that anybody in IT would think a mega-priviledged piece of software that looks into all files was a good idea.
Because otherwise, a piece of malware that installs itself at a "mega-privileged" level can easily make itself completely invisible to a scanner running as a low-priv user.
Heck, just placing itself in /root and hooking a few system calls would likely be enough to prevent a low-priv process from seeing it.
You're ignoring the parent's question of "why do we have systems where we expect malicous files to just show up in random places?", which I think is a good question. If a system is truly critical, you don't secure it by adding antivirus. You secure it by restricting access to it, and restricting what all software on the machine can do, such that it's difficult to attack in the first place. If your critical machines are immune to commodity malware, now you only have to worry about high-effort targeted attacks.
My point exactly. Antivirus is a cheap on top measure thst makes people feel they have done something, the actual safety of a system comes from preventing people and software from doing things they shouldn't do.
Why would you design a system where a piece of malware can "install itself" at a mega-priviledged position?
My argument was that this is the flaw, and everything else is just trying to put lipstick on a pig.
If you have a nightclub and you have problem controlling which people get in, the first idea would be to not have a thousand unguarded doors and to then recruit people that search the inside of your nightclub for people they think didn't pay.
You probably would think about reducing the numbers of doors and adding effective mechanisms to them that help you with your goals.
I am not saying we don't need software that checks files at the door, I say we need to reduce the number of doors leading directly to the nightclubs cash reserve.
Because otherwise, a piece of malware that installs itself at a "mega-privileged" level can easily make itself completely invisible to a scanner running as a low-priv user.
Heck, just placing itself in /root and hooking a few system calls would likely be enough to prevent a low-priv process from seeing it.