Maybe I should just stop using antivirus software?

[mechBgon]

I will, but you'll want to disable "Show pictures" in your browser since the in-the-wild source of these is mostly pr0n sites. Don't want you going blind... 😱

 

[Robor]

Originally posted by: microAmp

Originally posted by: mechBgon

Originally posted by: beggerking

Originally posted by: mechBgon

Originally posted by: fireandicefuel
avg free works very well, its not bloated, runs fast and does the job

Check how well it does the job: http://www.av-comparatives.org > click the Comparatives link > click 11. On-demand comparative > Online Results. I don't know about anyone else, but I'm not settling for 42% detection rate of script malware or 85% detection of Windows viruses when AntiVir and Kaspersky both "do the job" significantly better.

That may be true according to tests.. but in reality, I have been using AVGfree for the last 5 yrs and I have never had a single virus passed thru it.

How do you know that you've never had a single virus get past AVG? Do you expect all infections to show clear user-visible signs?

Incidentally, if you want to put AVG through some live-fire testing, I can supply you with some URLs that will illustrate why I think Kaspersky (free or pay) is way better than AVG or Avast. :evil:

Care to forward those links to me in a PM, mechbgon? I would like to try out AOL Kaspersky AV program I now use. Curious as to how it holds up.

I'd like to try them out as well. Of course, I'll do it in from a VMWare XP VM in Ubuntu. 🙂

 

[mechBgon]

Originally posted by: Robor

Originally posted by: microAmp

Originally posted by: mechBgon

Originally posted by: beggerking

Originally posted by: mechBgon

Originally posted by: fireandicefuel
avg free works very well, its not bloated, runs fast and does the job

Check how well it does the job: http://www.av-comparatives.org > click the Comparatives link > click 11. On-demand comparative > Online Results. I don't know about anyone else, but I'm not settling for 42% detection rate of script malware or 85% detection of Windows viruses when AntiVir and Kaspersky both "do the job" significantly better.

That may be true according to tests.. but in reality, I have been using AVGfree for the last 5 yrs and I have never had a single virus passed thru it.

How do you know that you've never had a single virus get past AVG? Do you expect all infections to show clear user-visible signs?

Incidentally, if you want to put AVG through some live-fire testing, I can supply you with some URLs that will illustrate why I think Kaspersky (free or pay) is way better than AVG or Avast. :evil:

Care to forward those links to me in a PM, mechbgon? I would like to try out AOL Kaspersky AV program I now use. Curious as to how it holds up.

I'd like to try them out as well. Of course, I'll do it in from a VMWare XP VM in Ubuntu. 🙂

For detection-rate purposes, that would work. For actually testing the malware in question, it won't work, because the malware is VM-aware and won't do some of its dirty deeds when it's being run from a VM. But I'll send you a PM in a minute here.

 

[Lemon law]

Getting a little far off topic in MHO---as I recall--the posted question is should one have an AV--or not---and while a few experts may get away with it by having many other defenses and alot of knowledge the ordinary user does not have---be it resolved---almost 100%---you are a fool not to run an AV.

Th question of which anti-virus is the best should be the subject of another thread.---but somewhat the answer is no given one will catch all past, present, and future threats. So one is always best hedging your bet and using free on line scans from competing products.

But before I bemoan all this off topic tangents---this thread has brought up and stressed the need for a multi-layered defense---and also pointed out the fact that many popular products are now security risks---so kudos to mech bgan's referral to the secunia on line scan---and after taking that scan--I just replaced old programs with newer more secure versions. But this thread has had excellent value in raising security awareness---and that computer security cannot be thought of in just one single layer.---be it AV--firewall--or whatever single layers. But I contend, even if you don't use the top rated paid product in a given layer, its the cumulative sum of layers that constitute the thickness of your total armor against malware in most real world situations.---and even if your armor is a mile thick in one area--it does not mean there are not other areas where you have no armor at all.---which in many ways is the value of John's guide---a step by step formula for closing holes.

And I did decide to replace my old AV --avast--with the probably better aol--kaspersky---but for whatever reason--perhaps too much security---AOL-Kaspersky refused to install on my computer because it failed at the activation step. So I am back to using Avast.--wrote AOL support--no response to date.

 

[beggerking]

Originally posted by: mechBgon
How do you know that you've never had a single virus get past AVG? Do you expect all infections to show clear user-visible signs?

because I have always had at least 3 antivirus softwares installed in my systems, 2 actively on all the time. (Avast, avg, antivir, norton, mcaffy, aol 🙂) all active scanner trigger at same time, no exception in 5 yrs.

w/o a router, on the other hand, does make a difference...worm gets in as soon as i connect to the internet. There may be warnings from some of these antivirus softwares, but the worm still gets in through all of them regardless.

 

[mechBgon]

Originally posted by: beggerking

Originally posted by: mechBgon
How do you know that you've never had a single virus get past AVG? Do you expect all infections to show clear user-visible signs?

because I have always had at least 3 antivirus softwares installed in my systems, 2 actively on all the time. (Avast, avg, antivir, norton, mcaffy, aol 🙂) all active scanner trigger at same time, no exception in 5 yrs.

w/o a router, on the other hand, does make a difference...worm gets in as soon as i connect to the internet. There may be warnings from some of these antivirus softwares, but the worm still gets in through all of them regardless.

No offense, but if you don't know how to stop worm intrusion without a router... :roll: Also, if you're using multiple active antivirus softwares at the same time (which is not a good idea), how do you know AVG got the first crack at detection, rather than the other antivirus software?

I have seen McAfee VirusScan Enterprise 7.0 singlehandedly defend an unfirewalled system from non-stop worm attacks on a broadband connection, so it may depend on what you're using. But firewalls are the proper defense against worm attacks, not antivirus software, whether that's a software firewall such as the Windows Firewall, Kerio, ZoneAlarm, etc, and/or the firewall capabilities of a router.

If you hit http://www.kaspersky.com/viruswatchlite and filter for Warezov, Hupigon or Zlob, you'll see that many variants can appear in rapid succession. This is a reason I think antivirus vendors should all be updating as frequently as practical. Kaspersky = hourly updates. AVG...?

 

[Lemon law]

To beggerking,

Who writes---because I have always had at least 3 antivirus softwares installed in my systems, 2 actively on all the time. (Avast, avg, antivir, norton, mcaffy, aol ) all active scanner trigger at same time, no exception in 5 yrs.

What you say flies in the face of conventional wisdom--that one can have perhaps an infinite number of passive AV scanners---but only one active at a time or else conflicts among them inevitably result.

But when you list the AOL one in that list---I really begin to doubt you---because that was plan one when I tried to install AOL Kaspersly---said plan being to disable Avast by stopping it from starting up---which I did--and AOL Kaspersky still sensed Avast and refused to install---I had to uninstall Avast before AOL Kaspersky would even install. And then when AOL kaspersky failed to activate--I had almost nothing--leaving me no time to play around and exhaustively troubleshoot. Yet you claim to have installed AOL when other AV's were running?
I for one would like to know how you pulled off that hat trick.

 

[beggerking]

Originally posted by: mechBgon
No offense, but if you don't know how to stop worm intrusion without a router... :roll: Also, if you're using multiple active antivirus softwares at the same time (which is not a good idea), how do you know AVG got the first crack at detection, rather than the other antivirus software?

disable incoming software ports would stop worm intrusion, but why do it manually when you have a router w. active firewall that would do it automatically for you?

multiple antivirus does work.. I do it in combinations and when a virus runs, they usually trigger sequentially at nearly the same time. Its hard to say which triggers first because each software trigger machinism is different, some pops the screen sooner, some later, but all of them do trigger and disable the activating application.

to Lemon:
I tried aol a long time ago, I think I had it installed along with avg or norton. In general, If your antivirus is having problem installing , try remove other antivirus softwares and install aol first, disable active scan, then reinstall others.

 

[Lemon law]

to Beggerking,

If you say you tried AOL a long time ago---then its probably not the recent AOL_Kaspersky now drawing rave reviews.---but I have already done on line scans at The main Kaspersky
web site---and got a clean bill of health---but I still have to agree that Kaspersky is arguably the best---and I will stick to only one active AV at a time.

 

[beggerking]

to Lemon law,

?? ok ..?? and I never said its not good either..?? please go back and read what I wrote next time you decide to make a quick judgment on another person.

All I said was, avg is not bad.

 

[mechBgon]

disable incoming software ports would stop worm intrusion, but why do it manually when you have a router w. active firewall that would do it automatically for you?

Because someone can plug a second, worm-infested computer into your router, or connect to it wirelessly if you have wireless and haven't secured it. Now your router's firewall is not protecting you, the threat is inside the perimeter. Also, your router may not provide utterly foolproof defense by itself.

multiple antivirus does work.. I do it in combinations and when a virus runs, they usually trigger sequentially at nearly the same time. Its hard to say which triggers first because each software trigger machinism is different, some pops the screen sooner, some later, but all of them do trigger and disable the activating application.

You won't find many other people recommending multiple active antivirus software programs around here, I don't think. I'm not sure what you see in AVG, but its detection rate has never been its strong point and I don't think its response time is too hot either. To each his own....

but I have already done on line scans at The main Kaspersky
web site---and got a clean bill of health

The online scanner doesn't check system memory, for the record. Try getting another activation code by going through the download page again. If it's not resolved, LMK and I'll get them to send me another code and PM it to you.

 

[beggerking]

Originally posted by: mechBgon

disable incoming software ports would stop worm intrusion, but why do it manually when you have a router w. active firewall that would do it automatically for you?

Because someone can plug a second, worm-infested computer into your router, or connect to it wirelessly if you have wireless and haven't secured it. Now your router's firewall is not protecting you, the threat is inside the perimeter. Also, your router may not provide utterly foolproof defense by itself.

Someone? who else would have access to my router other than myself?

wirelessly? its not possible because I have mac filter on EVEN IF I DON"T SECURE IT!
besides, default mode for most wireless router seperate wireless vs wired clients.

unless a router HARDWARE firewall has a bug in it that somehow it missed to close an incoming port (rarely), it is foolproof for worm attacks.

multiple antivirus does work.. I do it in combinations and when a virus runs, they usually trigger sequentially at nearly the same time. Its hard to say which triggers first because each software trigger machinism is different, some pops the screen sooner, some later, but all of them do trigger and disable the activating application.

You won't find many other people recommending multiple active antivirus software programs around here, I don't think. I'm not sure what you see in AVG, but its detection rate has never been its strong point and I don't think its response time is too hot either. To each his own....

look around, lots people are using avg or avast. I don't argue AOL is good ( or perhaps the best), but to my own experience, avg or avast is "good enough".

 

[John]

Originally posted by: beggerking
Someone? who else would have access to my router other than myself?

wirelessly? its not possible because I have mac filter on EVEN IF I DON"T SECURE IT!
besides, default mode for most wireless router seperate wireless vs wired clients.

unless a router HARDWARE firewall has a bug in it that somehow it missed to close an incoming port (rarely), it is foolproof for worm attacks.

[*]If you think turning off SSID broadcast makes your access point undetectable - you are sadly mistaken.

[*]MAC filtering will NOT keep your wireless network secure, its ridiculously easy for a hacker to get around.

[*]WEP encryption can easily be broken - don't think you're safe just because your network uses WEP.

In a nutshell use WPA w/ AES if possible, and stop using multiple anti-viruses. I can only imagine how many running processes you have, not to mention lousy system performance. 😛

 

[mechBgon]

Someone? who else would have access to my router other than myself?

Anyone within wireless range, evidently :evil:

wirelessly? its not possible because I have mac filter on EVEN IF I DON"T SECURE IT!
besides, default mode for most wireless router seperate wireless vs wired clients.

LOL

unless a router HARDWARE firewall has a bug in it that somehow it missed to close an incoming port (rarely), it is foolproof for worm attacks.

In point of fact, router hardware firewalls have been known to have bugs. Try enabling your Windows Firewall, set it to No Exceptions, enable logging, and have it log dropped packets. Check that log every so often as the days go by.

look around, lots people are using avg or avast.

I know (said the guy with 25000 posts). And when I upload bad stuff to VirusTotal, and AVG and Avast strike out, or when people ask for help removing the viruses that AVG didn't catch, it makes me want to recommend something better, especially for people who don't have a lot of layers in their defense.

Personally, I could intentionally download a Trojan Horse, double-click it, and nothing will happen (other than a Software Restriction Policy prompt telling me THAT IS NOT PERMITTED, FOOL), because the antivirus software isn't all I've got for protection. But for the majority of home Windows users, the antivirus might be their only chance. So I think they should get the best that they can. At the rate that new malware comes out nowdays, and will continue to do so in the future, I'm not comfortable saying "this worked in the past, therefore it's good enough for the future," or else we'd still be getting new virus signatures only once a week like in the olden days. Fast response time + strong detection rate is where it's at for prevention, IMHO.

Just my 2¢ worth. If you want more protection than a single antivirus product can provide, then my advice would be to set up a Limited account and a disallowed-by-default Software Restriction Policy next, rather than a second antivirus product. And keep your nose clean.

 

[beggerking]

Originally posted by: John

[*]If you think turning off SSID broadcast makes your access point undetectable - you are sadly mistaken.

[*]MAC filtering will NOT keep your wireless network secure, its ridiculously easy for a hacker to get around.

[*]WEP encryption can easily be broken - don't think you're safe just because your network uses WEP.

In a nutshell use WPA w/ AES if possible, and stop using multiple anti-viruses. I can only imagine how many running processes you have, not to mention lousy system performance. 😛

[*] ?? WTF are you referring to?
[*] MAC = uniquehardware signature, how do you get around that? you have absolutely no reasoning behind your threadcrapping. Your router checks for your MAC signature before it lets any data in.
[*]no one use WEP for serious security anymore. Once again, WTF are you referring to?

 

[beggerking]

Originally posted by: mechBgon
In point of fact, router hardware firewalls have been known to have bugs.

that is what you may have heard.. "firewalls have bugs"
fact: NOT IN THE WAY YOU ARE REFERRING TO.

The fact is, firewall "bug" actually refers to how hackers can sometimes "crush" firewall program by sending enough excessive requests. Once again, its very different than your bs reasoning.

 

[John]

Originally posted by: beggerking

Originally posted by: John

[*]If you think turning off SSID broadcast makes your access point undetectable - you are sadly mistaken.

[*]MAC filtering will NOT keep your wireless network secure, its ridiculously easy for a hacker to get around.

[*]WEP encryption can easily be broken - don't think you're safe just because your network uses WEP.

In a nutshell use WPA w/ AES if possible, and stop using multiple anti-viruses. I can only imagine how many running processes you have, not to mention lousy system performance. 😛

[*] ?? WTF are you referring to?
[*] MAC = uniquehardware signature, how do you get around that? you have absolutely no reasoning behind your threadcrapping. Your router checks for your MAC signature before it lets any data in.
[*]no one use WEP for serious security anymore. Once again, WTF are you referring to?

Thread crapping? :roll: Judging by your replies it was quite evident that you're lacking basic fundamentals when it comes to security and wireless routing capabilities. Your last post seemed to imply that you had a wireless router and you were putting a lot of faith in mac address filtering. My reply was merely a heads up on basic wireless myths. Anyone sniffing your packets can find the valid mac address and spoof it. I could go into more detail but it will not do any good until you choose to listen and learn. Unfortunately a quick search for your prior posts shows you to be a hostile individual, and it's obvious that trying to reason with you is going to be a futile attempt.

 

[mechBgon]

Originally posted by: beggerking

Originally posted by: mechBgon
In point of fact, router hardware firewalls have been known to have bugs.

that is what you may have heard.. "firewalls have bugs"
fact: NOT IN THE WAY YOU ARE REFERRING TO.

The Cisco PIX-series flaw comes to mind.

the CISCO 500 Series PIX firewalls may have a flaw. The potential flaw is with the SIP protocol. By sending a certain packet to the PIX, hackers would be able to gain free reins to the UDP protocol to send any messages to the Internal network using UDP.

...although I doubt you'd have one of those yourself. There's also the Linksys/DHCP one, the D-Link one... anyway, ask yourself why the router makers release new firmware, if there's no issues to fix.

MAC = uniquehardware signature, how do you get around that? you have absolutely no reasoning behind your threadcrapping. Your router checks for your MAC signature before it lets any data in.

Ummm, I can make my computer's NIC spoof any MAC address. Sniff some traffic, pull out the "approved" MAC address, go to Control Panel > Device Manager, enter it in a box, done. Therefore I recommend John's advice: use WPA encryption. And turn on your Windows Firewall if you don't have anything else in place.

 

[KingofFah]

Originally posted by: joshsquall

Originally posted by: MrChad
Running Windows without an up-to-date anti-virus application is stupid and irresponsible. You not only put yourself at risk, but others as well.

It's very easy to avoid getting a virus. Don't open files from questionable sources. Ever.

Well I had to reply to this. I have never been one to use anti-virus programs and pretty much have never had a problem. The one problem I remember was about 4 years ago when I was doing a fresh install on another hard drive. It was my mistake to open up outlook, which I had already copied my old inbox and account settings, and of course it did the auto download messages for one of my email address that receives a lot of spam. That's about the last virus I remember that I had. I do online every year or so and find nothing except maybe a cookie reported as possible spyware.

Smart browsing, blocked ports, blocked ips, blocked urls, etc works well. The majority of PC users really don't know what's going on on their computers.

One such occasion that comes to mind was when I was removing a lot of spyware, trojans, worms, etc from a computer with norton on it. One of the first things that happened when I sat down to start working on it, was a pop up saying had to do this or blah blah will happen. The guy I was fixing it for said, in all sincerity, "Oh you better click that."

 

[beggerking]

Originally posted by: John

Thread crapping? :roll: Judging by your replies it was quite evident that you're lacking basic fundamentals when it comes to security and wireless routing capabilities. Your last post seemed to imply that you had a wireless router and you were putting a lot of faith in mac address filtering. My reply was merely a heads up on basic wireless myths. Anyone sniffing your packets can find the valid mac address and spoof it. I could go into more detail but it will not do any good until you choose to listen and learn. Unfortunately a quick search for your prior posts shows you to be a hostile individual, and it's obvious that trying to reason with you is going to be a futile attempt.

as I have stated earlier, your router seperates wireless client vs wired clients even if you are able to sniff and spoof and somehow get into the network. with wpa-psk its nearly impossible and I seriously doubt you can do even the first part.

moreover, its utterly gay that you search people's prior post..

 

[beggerking]

Originally posted by: mechBgon
although I doubt you'd have one of those yourself. There's also the Linksys/DHCP one, the D-Link one... anyway, ask yourself why the router makers release new firmware, if there's no issues to fix.

the bug in your example are temporary, difficult to exploit, and usually easily fixable. aka disabling ports or protocoles.

A true "bug" is the one that you cannot fix: as I have stated in my previous message, network traffic overloading, unless you disable your network, you cannot prevent it.

 

[mechBgon]

as I have stated earlier, your router seperates wireless client vs wired clients even if you are able to sniff and spoof and somehow get into the network.

Sure about that? 😀

I'm on a system at work right now that's protected by a typical home-caliber router. A quick glance at the Windows Firewall logs is enough to satisfy me that the additional layer of firewall protection is merited.

At home, I have two routers in series. It was interesting to see the "inboard" router detecting improper packets that the "outside" router had allowed to pass through (Stateful Packet Inspection caught them).


I think we just have a difference in philosophies here... as a former network admin, I'm interested in a layered defense that proactively puts as many obstacles as practical in the path of the bad guys, even if it's just the computer nerd who lives within wireless range. Routers are wonderful, I wouldn't go without one, but I'm still going to run a firewall on the host too.