It's just shifted slightly. Better stateful packet filtering and correct rights limiting for user accounts is all that's needed.

Its down to OS developers to get these things right. It always has been.

[quote]LinkScanner sits on a user's computer and monitors the outside world for exploits. When it detects one, it drops the connection, which prevents the attack from succeeding. It then reports the incident back to a central database so it can warn users who try to visit the same destination.[/quote]

I'm curious though how the connection can be dropped while still being able to report to a database? Don't you mean that the access to that specific site is blocked? Without a connection it's kind of impossible to report to an external anything.

PS: el Reg can't handle accents in usernames .. tsk tsk

"We're moving away from just protecting your laptop after you've been infected."

Well, maybe Grisoft's product tries to protect their users' laptops *after* they have been infected, but most other AV companies strive to do it *before* this happens. That's what on-access scanners are for.

And adding a scanning of Web pages for known exploits is no different from the usual AV model based on blacklisting.

I've always thought that fixing an infection after the event is poor doctoring, especially when a new virus/trojan is released. Horse - door - bolted springs to mind. The AV companies have been making a very nice living, thank you very much.

This sounds like a Good Idea, perhaps others with more knowledge of these products have other ideas.

I take back what i said. Apparently the accents being messed up just shows in the preview section of the comments. In the 'final' page it is displayed correctly.

I've no idea how LinkScanner does it, but I think there should be a big bat handle toggle switch on the front of the computer. Up - red light - network connected. Down - green light - ethernet clock pulse only; no external connection.

One switch for every NIC in the box. (Remember the reset switch? And how invaluable it was for software debugging? Sometimes the mobo circuitry is there but the box builder omitted the switch/wires/connector to cut costs.)

Anyway, LinkScanner could use multiple NICs paired with multiple web connections and multiple browser instances (even dial-up) to accomplish scanning in a honeypot. One issue is malware targeting specific countries that wouldn't be triggered if you were coming from the wrong country code, and I'm sure there are additional issues because several people think the current trend of these "safe site" apps are rather worthless.

"most other AV companies strive to do it *before* this happens."

HAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHA

*ahem* Doctor, don't make me laugh like that, it hurts!

Grisoft's just diversifying their portfolio, that's all. At least they're prepared to admit up front what the rest of the AV industry knew since 1999, since Melissa:

Popular anti-virus software failed to do its job.

It's called Melissa's Ultimate Lesson. Google that some time.