A non-obtrusive Antivirus for a saavy user

[lal]

For security sake a software firewall on an interweb connected box is about the most important thing and should be first on any list. It matters not if you get infected with something, if it cant phone home and get or give info. I also dont update anything unless there is a good reason M$ updates included I dont see the point of new software if it cant do anything more than the old stuff.

Jesus, you don't know what you're talking about...

[ch_123]

I agree with lal here, there are plenty of viruses that can do a ****load of damage without being able to phone home.

I never get people who use Windows 2000, with all the effort you put it to keeping it up and running, you'd be better off learning how to use Linux. Besides, MS isn't going to support it for ever, what do you do then?

[o2dazone]

Since I've made this thread I've formatted twice, for fun (I've got a twisted idea of fun). I've been using VirusTotal for all my scans, but when something big comes across, I'm still undecided. I found a way to turn off AVG for good. And I use a bat script to turn the service back on, and then "run" AVG when I need to scan something big. Hit another shortcut, it brute forces AVG off, and disables the service. It's working how I need it to, but I need the reliability that if I scan something, it's not covered in viruses.

But I do this maybe...once every month, when I'm running something I don't currently own (and has already been scanned). The AV lays dormant on my machine, when I need it, it comes to life. When I don't need it, it goes back to sleep. Firefox, NoScript and Adblock keep me protected from all the "baddies" on the internet. Common sense is playing the role of the anti-virus here.

If you're like me, that likes to demo a lot of software, you can't exactly open an exe and look through it trying to find malicious bits of code. This is what the AV is for. I don't need it for everyday use (a lot of contributors to this thread that only seemed to have read the last five posts...which is why I'm reiterating this), I just use it for big files.

[ch_123]

If you're like me, that likes to demo a lot of software, you can't exactly open an exe and look through it trying to find malicious bits of code. This is what the AV is for.

No, that's what Virtual Box or VMware Server is for.

[Rajagra]

I am another that has used Acronis True Image for ages and have a stack of backups on DVD+RW.

I used to do regular Ghost images to CD/DVD until Disk sizes just got too big. I tried Acronis True Image last night and was pleased to find that:

• You can boot straight from the CD and have USB support;
• Then do a full image of the internal drives, and save it onto an external USB drive.

As far as I'm concerned, this is the only way to do a proper full backup of a system - take a full image while the system is inactive, and save it straight to an external media.

And given how cheap 1TB external drives are now...


Acronis did the job well. I'd read tales of it failing to restore, and thought I'd encountered the problem, but it turns out it was analyzing the backup data in the background (no "Please wait" message unfortunately!) After waiting patiently for a minute, it went ahead as intended. It allowed me to move and expand partitions from a 80GB failing drive to a replacement 500GB drive with no fuss. *

I bet the latest version of Ghost can do the same, but I stopped buying that ages ago when they kept bringing out updates that did less than the older versions.

(*) Done via an image on an external USB drive.

[o2dazone]

No, that's what Virtual Box or VMware Server is for.

Good call. I mostly just use vm's for multiple versions of IE ;p

[ch_123]

Obviously it's more work, but I don't really trust anti-viruses to pick up everything, and once you get a virus on a Windows installation, you really need to reformat to guarantee that your PC is safe from it.

[o2dazone]

I agree about having to reformat. There's just no clean way to get everything. But the time you've dug out all the roots a virus has sunk into the dirt (your os), many things come up broken, or dll's come up corrupted and irreparable.

I have yet to give sandboxie a look, but I was under the impression it did a bit of what a vm would do (correct me if I'm wrong though)

[Lenny_Nero]

Jesus, you don't know what you're talking about...

Well I will let you believe that as I have no need to prove anything, but this thing I also said might go some way ..."If you do get hit by a real virus the best thing to do is format and start again". The reason why a software firewall keeps you safe (i.e. the reason I was trying to put across) is that its trivial to format and re-install, its what, like a 10 minute job, the big deal is when your info is got by a third party, or your box gets 0wned and made to do things you would not want. All your anti Virus can stop that cant they ? ...but then I have not a clue what I am talking about do I.

With a 'hard' Win2k box well locked down there is not much that can get into it that is why I do have 6+ year old installs that can run for 2/300 plus days without a problem, but then there has to be a reason why M$ has promised 'us' (see link below) support thru 2016 before they review and renew the lifeline again ...but then I dont have a clue what I am talking about.

As for running win2000 only, I dont seem to remember saying that ? It was more like..."then I only run win 2000 for my M$ installs". I have too much stuff I have to work with that is still run in an M$ enviro, and as I have been a M$ Select plus customer for almost too long to remember I see no reason to stop.
Then again only running 2k could be called a lie, as I did build a dual quad core box to show someone just how bad XP (NT5.1) is with multi chip/cores and has to be patched to thread anything but the first core it can see, and its still round here somewhere. Where as 2k can use 32 chips/cores right out of the box, and with a few reg hacks is happy with 64 and 64 GB.

As for Linux I dont have a box that has 'not' got a slackware boot or solaris on my ultrasparc T1's, but then I also remember when Linus first offered us the use of his new minix like kernel code and asked if we could help out with some source to try to get it up to something more like a real OS quite some years back in c.o.m ...but then its not like I have a clue what I am talking about.

Thinking about it only yesterday I followed a link from here to overclockers forum to a thread about mech kbrds and wondered why it was full of kids telling other kids that they did not have clue about anything and 'they' were the real deal.
Its a shame that in 26~27 years of being 'on-line' talking to others computer users things have really seemed to have gone down hill ...but then.....

[BucklingSpring]

Yep - ESET/NOD32 all the way. Less intrusive of all, very small footprint, excellent detection rate. (Con: Below average at cleaning)

As a side note BufferZone from Trustware is pretty good at sandboxing.
It's basically the poor man's virtualization. I've played with a lot of azardous material in the "Virtual Zone" and it was able to contain most of the mess.

Click here to see how BufferZone works

But not exactly non-intrusive.

[ironcoder]

Well, I'm kind of big on not letting sh!t running all the time. In fact, I even turn off my printer spooler (the service that collects available printers) if I'm not using it. While it's a small amount of memory, I just don't like it being there...

Antiviruses have caused me grief in the passed, and while it shows that it takes a small footprint, it still is scanning everything being moved in and out of the machine, and that's what bothers me the most. Last I need is something to be bottlenecking because the AV software can't keep up.

But in all, if I can circumvent having an application running all the time, by just being a better user, then so be it.

I'm little late to this thread. I agree with your points, well said.

I've been online since there was an "online" and I'll bet I log as many hours with my machines on and online as anybody. In all that time ( up until 5 years ago I ditched Windows completely except for one copy I run in a VM for work) I never ran any AV on Windows.

I turn off 50-60% of Windows services and I use a router or a hardware firewall AND a good software firewall. I turn off auto update on the GUI *and* in the services list, just because I don't trust anybody in that part of Washington state.

In Winworld, most of the threat is the OS, it's not from outside. If you set up a nice software firewall like ZoneAlarm or Kerio (find an older version, the newer ones suck) and set the default to not let anything go outside your box you will be amazed how much crap including stuff like Word is trying to phone home. I have never had any virus on any of my Windows machines so I have to say either our view is correct and practical, or today
today
today
I am the luckiest est est est
man
on the face of the earth erth erth erth....

The best AV is limiting use of services you don't need, paying attention, and just not doing stupid things.

For the people who don't agree with our philsophy, then ask yourself why you are running an OS that spawned a multi BILLION dollar AV industry.

[ironcoder]

I use Common Sense Antivirus (CSAV), where I simply don't go to find free credit reports, don't claim prizes for being the 10000th visitor, and don't find that trick for white teeth. CSAV works great and I have never gotten a virus in the many years I have been using it.

LOL, classic post. Somebody sticky this!

[ironcoder]

As for Linux I dont have a box that has 'not' got a slackware boot or solaris on my ultrasparc T1's, but then I also remember when Linus first offered us the use of his new minix like kernel code and asked if we could help out with some source to try to get it up to something more like a real OS quite some years back in c.o.m ...but then its not like I have a clue what I am talking about.

Thinking about it only yesterday I followed a link from here to overclockers forum to a thread about mech kbrds and wondered why it was full of kids telling other kids that they did not have clue about anything and 'they' were the real deal.
Its a shame that in 26~27 years of being 'on-line' talking to others computer users things have really seemed to have gone down hill ...but then.....

Welcome to the forums Lenny, from another greybeard.

[ch_123]

but then there has to be a reason why M$ has promised 'us' (see link below) support thru 2016 before they review and renew the lifeline again ...but then I dont have a clue what I am talking about.

Oh, I was under the impression that they were killing it next year. My bad!

Where as 2k can use 32 chips/cores right out of the box, and with a few reg hacks is happy with 64 and 64 GB.

I had heard about the large RAM support that they mysteriously killed in the desktop versions of XP and later, but not the multicore support. Again, news to me.

[lal]

[...I'm pissed...]

Well, I'm feeling a bit sorry that you're pissed, Lenny.  So I will try to give you a short explanation why I think that you don't know what you were talking about.  You said:

For security sake a software firewall on an interweb connected box is about the most important thing and should be first on any list.

Which is BS because anyone claiming to have a clue about security should know that PFs are completely and utterly useless.  Reason: malware can just reconfigure or disable it without you noticing.  As I said earlier, once malware gets to run it has complete control over the system.  Anti-virus is there to prevent first time execution.

Even when we hypothesize you're being *really* security sensitive and log in as a non-admin user only, so the malware runs with just user privileges, AND we assume the PF is well behaved and cannot be modified from the user context, you will still have at least one application whitelisted that is allowed to communicate with the network (otherwise you could just pull the network plug and don't need a PF).  The malware can piggyback on this app and communicate with the world just fine.  You loose.

If you have a local privilege escalation hole it's much easier for the malware obviously since it can just gain admin rights and do what it wants to, which in your case is very likely because:

I also dont update anything unless there is a good reason M$ updates included

Which is a violation of the *true* first security principle.  If you don't understand why immediate patching of widely known security flaws is important, I just can't help you, sorry.

One word to everyone thinking a PF can stop your applications "phoning home": apart from the fact that it does not (see above), I just don't get why you're running proprietary software in the first place if you don't trust it?  And then you install another proprietary program to try to shut it up?  That's insane.  There is OSS if you want something you can trust.

[Rajagra]

PFs are completely and utterly useless.

By PF do you mean personal firewall - i.e. software application running on the computer you are using?

Saying they are utterly useless is too strong. They can do a lot of good. Your point that they are not bulletproof is valid though. You need a separate, well configured 'black box' firewall sitting between you and the Internet to reach that level of confidence.

[lal]

By PF do you mean personal firewall - i.e. software application running on the computer you are using?

Saying they are utterly useless is too strong. They can do a lot of good. Your point that they are not bulletproof is valid though. You need a separate, well configured 'black box' firewall sitting between you and the Internet to reach that level of confidence.

Yes, i meant "personal firewall", sorry.  And if you mean the warm feeling of power and control that you get when the PF tells you that it successfully defended another break-in attempt from a dangerous hax0r (in reality a script kiddie ping-scanning the whole internet or something), then yes, a PF can do something good

Full ACK to your last sentence.

[ch_123]

Lal, do you use a firewall with your Linux boxes? If so, which one?

[lal]

Lal, do you use a firewall with your Linux boxes? If so, which one?

Only on the one exposed host that serves http, ssh etc. to the internet.  It's basically a script that sets up the iptables filter rules.

If I would do it "professionally" correct that box would only run services accessible from the internet and hence would need no filter rules whatsoever.  But I'm cheap and have it running LAN-only services too and while they're bound to the LAN interface only I play it safe and additionally block them with iptables.

[lal]

Oh, and the LAN is "protected" by your typical broadband router that does the network address translation so the hosts behind it cannot be "seen" from the internet (except that one exposed host of course).

[ch_123]

I stopped putting ZoneAlarm on my Windows PCs when I got my first wireless router - before the router I'd get thousands of suspicious traffic blocked over some period of time (I used to check every once in a while, cant remember how regularly though) but when I got the router, it dropped to 2-3 over the space of a week or two, with no changes in my internet usage. Figured it wasn't really worth my time maintaining the router and unblocking apps when it wasn't doing much. Now that I use Linux on an almost primary basis, it seems even less relevant.

[ironcoder]

Yeah ZA can be weird at times. I switched over to Kerio years ago for the same reason, but some people like the ZA interface more. Plus ZA has that cool geolocator addon which is sweet.

[CX23882]

Has anybody tried Microsoft Security Essentials? I've installed it on several PCs and the results are very good. Even the slowest of the lot, an Athlon XP 2100+ with 1GB RAM and Windows XP SP3 is still responsive. The biggest benefits of it (other than being lightweight) are that it's very simple and unobtrusive, and that integrates well into Windows and Windows Update. It feels like it's part of Windows (and probably would be, if not for anti-competitive issues).

[ironcoder]

Is that a firewall or AV?

[itlnstln]

Has anybody tried Microsoft Security Essentials? I've installed it on several PCs and the results are very good. Even the slowest of the lot, an Athlon XP 2100+ with 1GB RAM and Windows XP SP3 is still responsive. The biggest benefits of it (other than being lightweight) are that it's very simple and unobtrusive, and that integrates well into Windows and Windows Update. It feels like it's part of Windows (and probably would be, if not for anti-competitive issues).

I use it on both my Windows 7 installs, and I love it.  No performance impact to speak of and very unobtrusive.

[CX23882]

I don't have any additional firewall software over the standard Windows Firewall and the hardware firewall in my router. Every time I've tried 3rd party firewalls they've been problematic, although admittedly a lot of those bad experiences were on Windows 98SE and Windows Me.

[itlnstln]

Is that a firewall or AV?

AV

[ironcoder]

The first thing that goes on a clean bloze install (if that isn't a oxymoron) is Kerio. The bloze firewall does fine as a mini fw but the threats in winbloze-land are from the OS and the apps. A good software firewall set to deny everything shows you just how much winbloze spills its guts to the world outside.

[microsoft windows]

Are you bashing Windows?

To tell you the truth, I use Windows 2000 every day. It's got no anti-virus software. No firewall. No Windows Defender. And no viruses!

[AndrewZorn]

common sense 2010 deluxe combined with regular updates,
cant imagine when it has served me wrong.

ive played with kaspersky, seems nice, but still.

[zwmalone]

MS Security Essentials.  Currently sitting at 243k memory usage.  Best AV I've used yet, even better than my beloved nod32.

[DreymaR]

The only thing that makes me sceptical of MS Security Essentials is that that's where the front line fighting will be most intense! Every virus maker worth his weight in piss will be trying his best to get past it, while other programs like Avast etc won't attract the same kind of attention. That's my guess.

[itlnstln]

MS Security Essentials. Currently sitting at 243k memory usage. Best AV I've used yet, even better than my beloved nod32.

Exactly.  SAV Corporate used anywhere from 60MB to 125MB. MSSECES.exe is using 1.7MB.  Nice.

[Rajagra]

MS Security Essentials.  Currently sitting at 243k memory usage.  Best AV I've used yet, even better than my beloved nod32.

Bah! Why are there always catches? (Going by the installation video on their website.)

Runs a Genuine Validation during installation. I'm 100% legit, but there's always a chance it will mess up my system. Besides, it's like having a police car follow you while you're driving, you feel guilty even if you've done nothing wrong.

There's something about a privacy statement. Why? What personal info can they justify taking?

You are advised to uninstall all other anti-virus and anti-spyware software.

Trust MS to sour its own milk.

[ch_123]

You are advised to uninstall all other anti-virus and anti-spyware software.

That's good advice. Using two antiviruses is like wearing two condoms - it's not as good an idea as you might think.

[Rajagra]

That's good advice. Using two antiviruses is like wearing two condoms - it's not as good an idea as you might think.

Yes, but all anti-spyware too? And full uninstall, not just deactivate? Totally unnecessary for on-demand scanners.

[Rajagra]

http://lifehacker.com/5399564/five-best-antivirus-applications

[CX23882]

http://lifehacker.com/5399564/five-best-antivirus-applications

I'm sure Avast works well, but wow that UI, it's like going back to 1999.

[ch_123]

Yes, but all anti-spyware too? And full uninstall, not just deactivate? Totally unnecessary for on-demand scanners.

MSE also automatically detects stuff... And I'm pretty sure it's meant to catch out spyware and the like as well, although I can't entirely confirm that.

Does it actually refuse to be installed unless you get rid of the other stuff?

[Rajagra]

MSE also automatically detects stuff... And I'm pretty sure it's meant to catch out spyware and the like as well, although I can't entirely confirm that.

Does it actually refuse to be installed unless you get rid of the other stuff?

[strike]I doubt it refuses, but I haven't tried.[/strike] I'm keeping Kapersky on my XP machine for now, it seems fine, and I just installed MSE on my Vista box (previously had nothing of that nature on it, I'm trying to keep it as clean as possible for gaming.)
EDIT> Correction - I had Ad-Aware loaded on my Vista PC before installing MSE. It didn't cause any problems.


The thing about spyware scanners is most people say to use several. None of them detect everything, and they don't conflict with each other. So MS asking you to uninstall them seems odd - or at least unnecessarily cautious.

MSE did install easily and the first scan was extremely quick. I laughed when it said it could take "several minutes", but it really was that quick. (But as I said, that machine doesn't have any junk installed.)

[tamasrepus]

I used to swear by Symantec Antivirus Corporate.

But, it's now an EOL'ed (end of life) product, replaced by Symantec Endpoint Security which seems like the slow bloatware you usually get from Norton. It still updates, however, but I'm not sure whether it's compatible with Windows 7.

[PRISONER 24601]

I prefer Kasperasky and Avast! AVG comes in third because it's very free and not bad at all.

Good, thorough programs- few false positives and very lightweight.

Right now I'm using McAfee (I know I know) because it comes free with my ISP. Not bad at all.

[ch_123]

Right now I'm using McAfee (I know I know) because it comes free with my ISP. Not bad at all.

Do you install every piece of free software you get onto your PC? You might end up in a bad way if you stick with that...

[PRISONER 24601]

Do you install every piece of free software you get onto your PC? You might end up in a bad way if you stick with that...

It uses very little resources compared to older Mcafee versions

Seriously. i wouldn't use it if there were a better free option.

[itlnstln]

It uses very little resources compared to older Mcafee versions
 
Seriously. i wouldn't use it if there were a better free option.

MS Security Essentials.  Get it today.

[roaduck]

I use the free version of Avast and it's miles better than AVG, Kaspersky, Norton, Avira and Bitdefender  because it doesn't give many false positives and updates 2-3 times a day sometimes.The GUI and user interface of Avast is crap but I can live with that shortcoming for the full spectrum safety aspect.The pro version of Avast is a little better in that regard.All the big four AV software let nasties in and missed most of the stuff that Avast caught.

I don't use AD-Aware, spybot or spyware blocker anymore because they are too big and intrusive and windows defender is big and ineffective.I use malwarebytes free and SpywareBlaster and the best site for anti-virus and anti-malware/spyware free and paid programs and great advice is run by a guy called Eric Howes formerly at the University of Illinois at Urbana-Champaign.It is a very comprehensive site that I have been using for ten years.

http://www.spywarewarrior.com/uiuc/main.htm

[Rajagra]

Hmmm. I ran a full scan while away from my PC, and MS Security Essentials found a ton of viruses in my email attachment folder (not a problem, as I get a lot of spam and assume all attachments are viruses.)

BUT ... MSE didn't bother telling me about them! I had to go into History to find out!

Excuse me, Microsoft, but don't you think users need to be alerted that they had an infection?

What's the point of cleaning the system if you allow the user to remain ignorant and keep doing the things that cause infection?

Bloody MS have to dumb down everything.

[AndrewZorn]

installed MS security essentials (downloading updates now) to see/prove how well common sense 2010 has been working lately

[roaduck]

Hmmm. I ran a full scan while away from my PC, and MS Security Essentials found a ton of viruses in my email attachment folder (not a problem, as I get a lot of spam and assume all attachments are viruses.)

BUT ... MSE didn't bother telling me about them! I had to go into History to find out!

Excuse me, Microsoft, but don't you think users need to be alerted that they had an infection?

What's the point of cleaning the system if you allow the user to remain ignorant and keep doing the things that cause infection?

Bloody MS have to dumb down everything.

That's why I don't use MS Security Essentials or Windows defender or whatever crap it was called when it first came out.

I've tried them all from freeware to state of the art corporate security software at thousands of pounds and now I know what works and what doesn't through a lot of trial and error over ten years.

[ch_123]

Hmmm. I ran a full scan while away from my PC, and MS Security Essentials found a ton of viruses in my email attachment folder (not a problem, as I get a lot of spam and assume all attachments are viruses.)

BUT ... MSE didn't bother telling me about them! I had to go into History to find out!

Excuse me, Microsoft, but don't you think users need to be alerted that they had an infection?

What's the point of cleaning the system if you allow the user to remain ignorant and keep doing the things that cause infection?

Bloody MS have to dumb down everything.

I was using it to clean a friend's PC and it notified me everytime it found something. It also picked up stuff AVG and Avira never found.