Protecting the computer from viruses

[irn_bru]

Hi Everyone

This is my first post here. I want to know more about which are the best packages to protect my computer from viruses. I'm willing to pay for a really good service.

Which ones do you all suggest?

[oldbeefer]

Don't pay! Avast! or AVG are highly rated, and FREE. If on XP, use Defender as well

[VH-GRUMPY]

Declaring an interest as the 'webmeister' of the IIA Internet Security Portal - go and check out all of the resources and advice available for free from:
http://www.security.iia.net.au
:ok:
And is you want to use the "Ask and Expert' facility I will arrange for an answer.
:p

[DBTL]

I'm afraid you'll have to pay for a constantly updated antivirus service. That's the unfortunate situation we're facing. Yesterday's papers are cheap, but only good for fish-wrapping -- the news are already printed elsewhere.

[frostbite]

I'm afraid you'll have to pay for a constantly updated antivirus service.


Not so!

Avast updates itself pretty much every day, and hasn't cost me a penny.

[DBTL]

You'll have to take into account the speed of response, and the width of the coverage as well. Taking the "ransomware" trojan that was mentioned recently on this forum (called Trojan.Archiveus, Trojan.Win32.MayArchive.b, Archiveus, depending on the antivir maker) as an example, I was unable to find a mention of it in the Avast database updates today.
Since slave labour is illegal in Western societies, you'll be paying for a comprehensive coverage in one way or the other. Ad-based financing may not be the best choice for a privacy-oriented product such as an antivirus package. I feel security is one the factors you just need to take into account in the total cost of computer ownership today.

[ZH875]

Use anything.....EXCEPT :mad: Norton. Unless you really want to slow your PC down.

[irn_bru]

Hi everyone.

Thanks for your replies.

VH-GRUMPY, I've submitted my question for the expert's answer.

So far, it looks like Avast / AVG / Defender

What do you all think of McAfee?

[frostbite]

" What do you all think of McAfee?"

About as desirable as Norton! Wouldn't touch it.

[Buster Cherry]

What do you all think of McAfee?

Excellent product. Used it for 4 years now & to compare it to Norton is laughable. That would be like comparing Pipex with AOL.

[future captain]

I use AVG for my antivirus on my desktop, its fairly old and AVG isnt to resource hungry, on my laptop i use NOD32, for someone with a decent spec pc i recomend NOD32. Tried Norton, Mcafee, Avast, Panda, and Zonealarm range in the past and found the two i use at the moment to be the good ones for me.

Firewall i have used nothing apart from Zonealarm though if you want a proper firewall you would want a hardware on on a router etc.

Spyware/Adware - Spybot, Ad adware, Microsofts Antispyware.

Thats about all i use to keep my systems clean, but i do like to have a 'clear out' and do a format here and there. :ok:

[Tartan Giant]

Hi Irn_Bru,
I've tried all the free AV software, but like everything, you pay for what you get!
I have been so pleased with NOD32 I purchased a three-year licence when it came up for renewal.
They say it all here:D
NOD32 Receives 36th Virus Bulletin 100% Award
It is almost 8 years now since the NOD32 Anti-Virus System from ESET Software was first tested by the prestigious Virus Bulletin. It still remains the only product never to have missed an “in the wild” virus in their tests since first introduced in May 1998. This is further reinforced by the latest Virus Bulletin test results in February where NOD32 achieved its record 36th VB 100% Award.
Not only did NOD32 have 100% detection across all test sets (In the Wild, Macro, Polymorphic & Standard viruses) in both On Demand and On Access testing, it also had the fastest overall hard disk scanning speeds. With a much smaller system footprint and lower use of system resources, NOD32 scanned substantially faster than all other products and more than twice as fast as certain brand names (Symantec Norton, Kaspersky, BitDefender).
ESET Software’s dedicated and highly skilled development team have made these remarkable results possible through their consistent efforts, whilst constantly adding a wealth of new features and functionality to the product over the years.
I'm been virus free since NOD32:ok:
Cheers
Tartan Giant

[oldbeefer]

Yeah, TG, but I've been using Avast! for years with no problem (and no cost!).

[future captain]

I'm been virus free since NOD32:ok:
Tartan Giant

That makes two of us :ok:

[crewmeal]

Here we go again!!! I am using ad-aware to clean my laptop, continually protect it with anti virus personal clean and check nearly every day and sites still hang!!! messengers slow down with the appropiate warnings, web cams freeze!! I even tried spy doctor and it found 82 new infections - guess what they want $30 to subscribe. Why does one programme find spyware and others don't??
Oh I use talktalk as my server, with all the publicity about free broadband then I guess the whole of the Uk has signed up and slowed it right down - oh yes 20p per min to tell you that!!! come back dial up all is forgiven - never had any problems then!!!

[oldbeefer]

Generally programmes that find that much spyware will con you in to paying to get rid of the (non-existant) infections! you might find this http://www.spywarewarrior.com/rogue_anti-spyware.htm interesting.

[DBTL]

Hi Irn_Bru,
I've tried all the free AV software, but like everything, you pay for what you get!
I have been so pleased with NOD32 I purchased a three-year licence when it came up for renewal.
They say it all here

I'm been virus free since NOD32
Cheers
Tartan Giant

The products that got the VB 100% mark in June 2006 were: Avira, CA eTrust, Authentium, Doctor Web, Eset NOD 32, Fortinet FortiClient, F-Secure AntiVirus, GDATA AntiVirusKit, Grisoft AVG, Kaspersky AntiVirus, McAfee VirusScan, Microsoft OneCare, MicroWorld eScanWin, Norman Virus Control, NWI Virus Chaser, Softwin BitDefender, Sophos Antivirus, Symantec Antivirus.

One of the failed ones was Alwil avast! (their exclamation mark)

You may also want to read:
http://www.av-comparatives.org/seiten/ergebnisse/report09.pdf

[VH-GRUMPY]

I received a message from Irn as he said he would - and I am sure he wouldn't mind me publishing my response. I am an humanoid! (I have made two small edits to tidy up the language).

"Hi Irn

I see that you said in the PPRUNE site that you had emailed me.
As I am sure you will understand I cannot recommend an individual program.
However, I purposely have two email address on the IIA security portal designed to suck up all of the scam and viruses. They are unprotected.

What I then do is use Nortons Antivirus 2006 - despite what others say about slowing down the system - this can be a problem if you use Norton Systemsworks and don't switch some live monitoring items off. NAV2006 includes an anti-spyware program . But I also use Microsoft Defender to block spyware and also use a free version of Adaware.

I get hit every day by lots of spam, emails with viruses and other malware but have not had one yet get into my system and destroy it.

I know that McAfee, Trend Micro and the MessageLabs systems also work well. As will may of the the freeware and shareware programs about.

Best to try what suits you and your budget - just keep it up to date.
Cheers"

[OpsSix]

NOD32 and Kaspersky are the ones to look at.

A mate of mine used AVG until I scanned his HDD using my antivirus software and it found 156 viruses..... says it all for AVG.


The problem with anti virus software is those that babble on about how good Avast/AVG/Norton/Mcafee are, don't know when a virus slips through. Remember, it only tells you when it catches one, and not when it misses it. Get some proper anti virus software.... for the sake of £30 a year, it's not much.

I use NOD32 by the way.

[Gertrude the Wombat]

Hi Everyone

This is my first post here. I want to know more about which are the best packages to protect my computer from viruses. I'm willing to pay for a really good service.

Which ones do you all suggest?


I suggest:

(1) don't download viruses
(2) don't install viruses
(3) don't run viruses.

Er, that's it really. The advantages you get from this approach are:

(a) you don't get viruses
(b) your computer doesn't run like a fast-asleep snail because of the CPU cycles stolen by your anti-virus "solution"
(c) your computer doesn't keep crashing because of your anti-virus "solution"
(d) when you install new applications they actually work because they don't have "conflicts" with your anti-virus "solution".

(OK, so maybe you don't want to connect an out-of-date unpatched machine directly to the internet, but that's why you put a stealth mode router between your PC and the broadband connection.)

[Mac the Knife]

Helpful as ever...

main(i,c) int*c; { for(c=fopen(c[1],"r"); i=~getchar(); putchar(getc(c)^~i)); }

[Gertrude the Wombat]

Helpful as ever...
main(i,c) int*c; { for(c=fopen(c[1],"r"); i=~getchar(); putchar(getc(c)^~i)); }

It works though. I know plenty of people who find that a stealth mode router plus some common sense is all that is required. It's even not really difficult to train children not to download and install and run spyware.

[Saab Dastard]

Don't run as administrator or equivalent!!!!!!!!!!!

[Gertrude the Wombat]

Don't run as administrator or equivalent!!!!!!!!!!!
Well, I did try that, on my new box on which I've installed Windows 2003 Server, but so much stuff didn't work that I had to give up.

But the basic hygiene rules still work.

[DBTL]

A good read on Admin and other rights esp. related to Web browsing:
http://www.securityfocus.com/infocus/1848

[Gertrude the Wombat]

A good read on Admin and other rights esp. related to Web browsing:
http://www.securityfocus.com/infocus/1848

Er, yes. I note that the testing procedure includes:

- Obtain a list of unfriendly websites.
- Open each of these sites on the virtual machine using Internet Explorer

If you simply choose not to do that sort of thing there isn't a problem in the first place and nothing that needs fixing.

[Mac the Knife]

If you simply choose not to do that sort of thing there isn't a problem in the first place and nothing that needs fixing.

(1) don't download viruses
(2) don't install viruses
(3) don't run viruses.

I know plenty of people who find that a stealth mode router plus some common sense is all that is required. It's even not really difficult to train children not to download and install and run spyware.

You're theoretically right Gertrude, but that doesn't help the average user who doesn't have much commonsense and has no idea of the problems. This sort of advice really isn't very helpful - you could just as well say that if you drive really responsibly and carefully you don't need car insurance.

The average punter just doesn't have a clue, they just use the apps. They've never seen the command line and don't know anything about how an OS works. They have zero insight and little inclination or interest in learning stuff that isn't directly relevant to their computing experience. That's just how things are. Pontificating that they ought to learn that stuff is the mistake that us Linux mavens are often guilty of (and why Linux is not more widespread) - folks just refuse to learn things that even smell complicated that they see no immediate benefit in (even though they'll write complex spreadsheet macros).

I've taught Tom to be very circumspect about what he downloads and installs and he's a responsible lad, but it wouldn't be that dificult to catch him out. HE doesn't know what is spyware and what isn't, even though your clever (and well disciplined) children do. But he does check with me (usually). "Training" children (and adults) in computer caution is not that easy or foolproof.

Running as non-admin is theoretically good, but in practice it's such a pain and so many things don't work (esp. games) that I don't. If you're prepared for a LOT of tinkering with MakeMeAdmin etc., you can get a reasonably smooth non-admin experience, but it's a PITA.

AV is by no means infallible (any of them), but it's a good second line of defence - having said that, it (Norton and AVG) have only picked up a couple of virii in all the years I've been using them (and I download a lot). Admittedly I don't frequent warez sites.

I'd guess 1 in 100 users or less have a properly configured ("stealth" as you put it) external firewall, which is the best defence, although there are lots of inexpensive ways to implement this). MS firewall (in SP2) isn't wonderful, but it isn't bad.

So irn_bru, if you:
Use MS built-in firewall (ON by default)
Set autoupdates to ON (ON by default)
Install & use MS Antispyware, aka Windows Defender
Use a reputable AV product - properly set up and set to autoupdate
Avoid Internet Explorer and Outlook (use Firefox/Thunderbird or Opera)
You should be reasonably safe.

DO find an ISP who does virus/spam filtering (important!) and don't give your email addy to all and sundry (don't use the unsubscribe function!)

Oh and just don't ;) install any viruses.....:ok:

[Saab Dastard]

Running as non-admin is theoretically good, but in practice it's such a pain and so many things don't work (esp. games) that I don't. If you're prepared for a LOT of tinkering with MakeMeAdmin etc., you can get a reasonably smooth non-admin experience, but it's a PITA.

Mac, I usually agree with 99% of your posts, but in this case it's the 1%!

I find it a non-issue to simply "run as" administrator (win XP), either to install or to run apps (games included). OK, I have to type the admin password, but I can type this so fast it really isn't a problem!

Compare this to the hassle when my wife downloaded a "screensaver" trojan before I instigated the no-admin policy!

It also means that the boys have to ASK to run some games that require an admin password - a handy bit of extra parental control!

SD

[HelenD]

I have come up against a problem with updating defender: My PC is rarely run in Admin mode, Defender asks if you want to update it to which I reply yes. I believe it downloads the update then promptly complains that it cannot install as the PC does not have administrator privileges. I have not found any way of doing the download seperatly then using the Run As method to do the install keeping only that install running with Admin privileges. Considering that MS are now preaching secured by design, secured by default and secured in deployment it is pretty poor show that they dont provide a means of having the PC running as Non Admin and allowing their defender program to be installed using Run As. If anyone has any ideas on how to install defender while having the PC mainly as non Admin I would like to know currently I am :ugh:

[Mac the Knife]

Yo Saab! I too can type the administrator password (though it's not called Administrator on my machines).

RunAs is fine if it's a solo machine, but many games store user info and game score in the currently logged on profile - not all of them create an internal database of players. If you have several kids doing games then all the preferences and scores get all mixed up.

And running anything "as" Administrator means that everything gets written into the Administrators document folder rather than yours.

Using Michael Howard's DropMyRights for Internet facing apps. is an approach that appeals to me more and I started using it a while ago. That way you can have two shortcuts for an app. - one with admin privileges and one restricted.

Vista :yuk: if it ever ships will supposedly correct these problems but I'm not planning on going there. SuSe 10.1 keeps me pretty happy.

But perhaps I should reconsider RunAs as a strategy on the Windows machines - I'll try demoting Tom and see how many of his games crash out, I forsee some tears ahead!

:ok:

[Saab Dastard]

MAC,

Thanks for the info on DMR, I'd not come across it before - it might have useful applications in my corporate world too. ;)

For others interested, here's a link to the MSDN DropMyRights article (http://msdn.microsoft.com/security/securecode/columns/default.aspx?pull=/library/en-us/dncode/html/secure11152004.asp)

RunAs is fine if it's a solo machine, but many games store user info and game score in the currently logged on profile - not all of them create an internal database of players. If you have several kids doing games then all the preferences and scores get all mixed up.


- Not a problem for me, as both boys log on to the same account. :)

And running anything "as" Administrator means that everything gets written into the Administrators document folder rather than yours.


This may be true - I haven't noticed it myself - but the boys aren't complaining (yet).

I find that the way that works best is NEVER to use the autorun install, but to run the game SETUP.EXE as admin (while logged in as normal user), then create a shortcut with "run as" for the game once installed.

Copes with everything the 7 and 10 year old have wanted to run - so far!

I also recommend VirtualCD or similar, especially for younger kids - why bother with the hassles of physical CDs if you don't have to? I find that about 30% of games will install if simply copied to the hard disk, and a further 50-60% will work with V-CD. That just leaves 10-20% where you have to physically put a CD in the drive.

And yes, I know you call it root, or SU :p

[Mac the Knife]

And yes, I know you call it root, or SU :p

Actually no. One of the first things I do on a Windows machine is to change the name of the "root" account from Administrator to something else.

Note for anyone who doesn't know, the "root" account in Windows is given the default name of Administrator, but you can change this to anything you like - this is a good security practice, since if you know the name of an account and can always count on there being one called Administrator then you're halfway to getting in. And many Administrator accounts have a blank password or something trivial like "admin". Theoretically Windows disallows network logons to the Administrator account if the password is blank but in practice it doesn't always seem to!

This of course leads to a cruel honey-trap!

1) Change to name of the root account from Administrator to something else.
2) Create a new, VERY limited account with the name of Administrator (since there is no longer an account called Administrator you are allowed to do this).
3) Either leave the PW blank on this new account or set it to something silly like "admin" that is easily guessed.
4) Monitor login attempts for this account with a tripwire since they'll all be hack attempts.

This is hilarious, as hackers login as Administrator, laugh at you and congratulate themselves, but then find out that they can't do anything :confused:

[To change the name of Administrator, run the Group Policy editor and go to Local Computer Policy/Computer Configuration/Windows Settings/Security Settings/Local Policies/Security Options and there it is: Rename administrator account]

[DBTL]

This of course leads to a cruel honey-trap!


Seems the present XP password encryption scheme is nowhere near too secure:
http://www.securiteam.com/tools/6T00D0A35S.html

I could imagine a root-kit type of trojan getting an access to this same database as the software featured in the above link, then decrypting all the passwords, and having a go at it at will.

[Saab Dastard]

Mac,

I see what you mean - I thought you were referring to the Unix / Linux systems that you champion.

Yes, I too have renamed the administrator account.

For the purposes of the discussion I was using the term "administrator" to mean "the administrator account", not necessarily the name, as referring to it as "Joe Bloggs" (no that's not it, really) might not have been understood! ;)

SD

[Mac the Knife]

Sorry Saab! I know you know all this stuff (and more). Understandable that you should have thought I was talking about UNIX/Linux/BSD

I actually run Windows (9x and XP), FreeBSD and a couple of Linux flavours, but I'm only an amateur and it's just a pastime, not a crusade.

For all it's faults and foibles (and awful default security model) 2000/XP is not such a bad OS (despite MS unpleasant and rapacious corporate culture) and it's certainly fun to tinker with.