anti-spy/anti-virus/firewall...

Why can I have a number of anti spyware programs installed, but only one anti virus & firewall? Thanks! I am brand new to computing & have learned so much from all of you.

 

Hello timmins,

Why can I have a number of anti spyware programs installed, but only one anti virus & firewall?
Basically because of conflicts. Firewalls and AV's work in real time, otherwise called "resident" processes. So if they block as in the case of firewalls, which one would get there first? At the very least it would slow your system down, at the worst, it would be paralysis.

Same with AV's. The basic function of an AV is to check a record that is being written to your hard drive with added functions to check when reading a record and if enabled, checking e-mail.

In the case of AV's though, often can have multiple AV's as long as only one is running resident (real time) and the other(s) as on-demand scanner.

There are exceptions to anything, but as a general rule, this is the way these two types should be handled.

BTW, anti-spyware also may have optional resident processes, two off the top of my head - Spybot and MS Anti-spyware. There is a potential for conflict here as well.

Regards - Charles

 

Hi, timmins.

(Experts, feel free to correct me if I make any blant errors in my posts.)
(Charles, I'm posing this anyway cuz I spent way too much time composing it with 3 fingers to just erase what I typed.)

That's a good question! I have been thinking about that lately too and I've been around computers and the Internet for little awhile.
Since you stated you're a "beginner ", I am including some computer "lingo" in quotes or all capital letters (ALL CAPS) that may be confusing. Hopefully, in the context of the message, you will begin to understand those "lingo" terms. Hang in there, and gradually you will become familiar with terms related to computer use.

I think the issue you mentioned deals mainly with whether programs with similar functions run "in the background" (continuously monitoring) or not.

I think you CAN have multiple anti-virus programs INSTALLED as long as you don't have more than one anti-virus program RUNNING in the background at the same time because they can trip each other up and fight each other for control about what to do with viruses, suspiciuos computer behaviors, and other things anti-virus programs control. Many anti-virus programs allow you to disable their continuous "memory resident protection" (background monitoring and control) so you can manually use them only as "scanners ". Then you can have one anti-virus program always running with background monitoring and use the other anti-virus programs for periodic manual scanning.

Likewise, firewalls may fight each other for the same reason about controlling "TCP/UDP port traffic" to/from your computer. (Firewalls are also constantly monitoring.) Lately, some software firewall vendors have started to incorporate anti-virus and anti-spyware capabilities in their programs too and this may be the reason some people recommend against "running" more than one firewall (at the same time). I'm not certain.

I expect the issue of conflicts between firewalls and anti-virus programs will also become more apparent since it appears some software firewalls are starting to incorporate their own anti-virus and anti-spyware functions as well (and, hence, compete with other anti-virus and anti-spyware software for control over how a computer behaves).

I don't know why I haven't seen many similar warnings about anti-spyware since several anti-spyware programs also run "in the background" continuously monitoring the computer. I expect such conflicts do exist. However, I have more than one anti-spyware program running in the background of my computer regularly and they seem to pretty compatible.

According to http://spywarewarrior.com/sww-help.htm, it's a good idea to install both Spyware Blaster and Spyware Guard becuse they protect from spyware in different ways.

Perhaps others here can help us with more information and pointers about where to go for additional info.

BTW (By The Way), I recommend you INSTALL more than one anti-virus (AV) program and keep them updated with the latest "virus definitions ". (Just don't have them running at the same time.) Manually scan your computer regularly (i.e., weekly) with both (or all three, or all four...depending on your level of paranoia) of your installed anti-virus programs. One should scan with more than one AV program regularly because I don't think it is possible for any single AV program to catch all viruses that are out there "in the wild ". Alternatively, you can use various "online scanners" from time to time in addition to your installed anti-virus program(s).

Feel free to post more questions.

 

Hi mailman,

(Charles, I'm posing this anyway cuz I spent way too much time composing it with 3 fingers to just erase what I typed.)
No problem - been there and you're fleshing out what I've written.

Then you can have one anti-virus program always running with background monitoring and use the other anti-virus programs for periodic manual scanning.
Good idea if one is willing to pay for another AV and willing to take the time and trouble to manage two. I dual boot using two different AV's and do reciprocal scans.

Lately, some software firewall vendors have started to incorporate anti-virus and anti-spyware capabilities in their programs too and this may be the reason some people recommend against "running" more than one firewall (at the same time). I'm not certain.
The added anti-spyware components are fairly new - ZoneAlarm is an example and does add a complication. But the basic reason is as I outlined.

I'll 'fess up, I have Windows Firewall enabled along with Sygate on one of my installations, so I engage in heresy that way. Didn't want to get into that in my first post, not the least because James would admonish me and tell me that the MS MVP's would cluck their tongues at such behavior

Regards - Charles

 

Thanks to charlsvar & mailman for the info. I now understand the INSTALLED vs RUNNING concept. I have NAV & will download AVG.

charlsvar, re: anti-spyware. I have Spybot S&D & MS anti-spyware, what is the conflict you mention? (I also have AD-AWARE SE).

mailman, thanks for the heads-up about Spyware Blaster & Spy Guard. Looks like I should download these also. In the short time I have been on the Internet, I find spyware is a huge problem. I run my 3 anti-spyware programs daily.

Many thanks again for your help.
Regards, timmins.

 

Hi timmins,

charlsvar, re: anti-spyware. I have Spybot S&D & MS anti-spyware, what is the conflict you mention? (I also have AD-AWARE SE).
I used those two as an example, nothing specific, if there are conflicts, usually they are system specific, meaning on some systems and not others. If you're only running one "resident" and the rest or all as scanners, then very unlikely to have any conflicts.

If you're not experiencing problems, then continue as you are, but, always keep in mind, not just in the case of security programs, but in general, if you have any problems - such as system slowdowns or the system takes a long time to shut down, etc, the first thing to check into is conflicts between applications. The trouble shooting methodology is to shut apps down one by one. An example of a conflict http://www.windowsbbs.com/showthread.php?t=46879

I have all three of the apps that you mention and use them as scanners only.

Regards - Charles

 

Spyware

Some additional thoughts. I was using Spybot Search & Destroy,Adaware SE,Registry Cleaner,Spyblaster, and I just dropped Microsoft Antispyware.
I was reading in PC World about a 3 new Spybot/Malware Programs tested. The best rated one is called "Counter Spy ", under $20. I downloaded this program, however before I installed it it was recommended to remove Microsoft Anti Spyware BETA 1 from the computer.
I ran this program, and it did a wonderful job finding problems that other programs missed.

For example:

I ran Spybot Search & Destroy 1.4B2 on a computer with XP. It found many problems listed in RED called WILD TA NGENT. It said remove. I did, it came back again and again. Couldn't figure this one out. I had to re-install all HP Print drivers to get it back to where it was.


I ran Counter Spy, it listed the same with over 962 infections. However, it also made it a low rated problem. Said to IGNORE.

It also found other problems that had to be addressed

An eye opener. Anyway, give it a shot. It didn't upset any of my programs yet.

http://www.Sunbelt-Software.com

Good luck

Donabano

 

Thank you for the Counter Spy info,Donabano. Where did you get the SpyBot 1.4? I have 1.3 & have never seen any mention of a newer version on the SpyBot Updates...

 

The big problem is the difference in how they work.
You can actually have several antivirus programs installed , as long as you are very careful to only have one run at a time.

There are a few basic differences to consider; an antivirus program is designed to run continuously and scan all accessed and incomming files and check to see if they match the profile of any known virus. IF they detect a virus signature match, they will stop things there and ask you if you want to delete it; or in some cases they will just delete it and leave you a note .
Now comes the problem. It is a thing called a false positive; where one program detects the detection signature definition files of another as being the virus they are designed to define and detect. If you have multiple antivirus programs ; it is common to have one detect the incomming definitions update for the other as being the viruses they are designed to detect.Often they will just stip out the contents of the update and log it without telling you. Then you update the other and now you have two antivirus programs with damaged detection files. Also when it loads the new definition files, the antivirus turns itself off and lets the updater access its files. At this point the other antivirus could delete them all.


So why do spyware scanners not have this problem? They use different detection techniques, looking for registry entries and certain files , not signatures (chunks of the viral code). Additionally, most antispyware programs add the others entries to their ignore lists.
Yes there have been problems. Initially Spybot detected ad-aware as being an infestation if you did not clear your quarantine files in Ad-aware. And then for a while Microsoft Anti Spyware detected spybot and its immunization as a nasty. But these are not as crucial a problem as an antivirus program. With spyware removal tools, normally you scan for items occaisionally, not constantly. Normally you immunize which adds registry entries to prevent known distributors from having the right to install things without asking.

 

Don't bother trying to get updates for 1.3 (Your question from the other thread) - won't work. Here's where to get 1.4 http://forums.net-integration.net/

Regards - Charles

 

Hi, Charles. Thanks for the link. Should I uninstall the 1.3 version first or can I install the new one over it? Timmins.

 

Hi timmins,

Should I uninstall the 1.3 version first or can I install the new one over it?
Yes uninstall it.

After the install, look in Settings > Ignore Products. Some things are checked - meaning they are excluded from the search. From what I gather, that may have been done for legal reasons. So, it's up to you to uncheck them.

Regards - Charles

 

Counter Spy

If you use Counter Spy, You may not need Spybot Search & Destroy. Check it out 1st

Donabano

 

Whenever I see a product I am not particularly familiar with I check out
http://www.spywarewarrior.com/rogue_anti-spyware.htm#products
first to see if it is listed there.
I also double check at google to see who makes it
http://www.sunbelt-software.com/CounterSpy.cfm
and again search the first link to see if they have any rogue products.

In this case I find that

Giant is now Microsoft Anti Spyware.

So it is basically Microsoft anti spyware database with a different interface.

At that point, I would say , go with Microsoft, they have more resources.ANd they are giving it away for free.

While it got off to a rocky start, Microsoft Antispyware is quickly establishing itself and fixing the problems which existed in the product when Microsoft first bought it.


My only concern with Microsoft Anti Spyware is the rumors that microsoft was trying to buy Claria (producers of gator and gain and other adware) which would be a potential conflict. Since the deal appears to be dead now, I would say good.

 

I have CounterSpy (as does my wife) and we love it. While it is true that CounterSpy had a prior agreement with Giant which is now honored by MS to supply definitions, these are by no means the only definitions it receives. Another point to make is that of support. Twice now I have had to rely upon CounterSpy for support and both times they responded within hours and as a result helped me work out a problem. In addition, CounterSpy puts out a weekly newsletter which really is awesome. I'm serious.. I actually read this newsletter. It's well worth the effort. We were able to get CounterSpy for $19.95 and that is a great deal in my opinion.

Just another perspective.

 

Agreed, in no way did I mean to imply that they were identical ; since as the link points out they have their own code.
And as you point out, paid versions have support which free programs generally lack. Often the price is well worth it , especially when time is money.

 

As for MS Antispyware and Sunbelt CounterSpy...They both originated from the Giant code. That's why they look and operate so much alike...But that's where it all ends.
True CS gets some of their definitions from MS but, in addition they also have their definitions. That is why CS will flag items that MS AS misses.

As a Sunbelt Beta tester, I can tell you that there will be even greater differences between the two when the new CS v1.5 is released. In the meantime CS v1.27 is as good as it gets as far as realtime monitoring and protection is concerned.

CS is not 100% but, it's close. That's why I still run SpyBot S&D v1.4 w/TeaTimer disabled and AdAware SE v1.06 w/AdWatch disabled. I only use the CS Active Protection since, having the other two also enabled only creates a "cat & dog fight ", plus CS's realtime monitoring is better.

If you will install SpyWare Guard, SpywareBlaster, SpyBot S&D, AdAware SE, Sunbelt CS, along with a modified "HOSTS" file, you'll find only a few things to remove...Usually just a cookie or two.

You can find the modified "HOSTS" file w/instructions at
http://www.mvps.org/winhelp2002/hosts.htm
Be sure to use the "HOSTS File Manager" also supplied on the site. It will lock your HOSTS file as "read only" plus, hide it.
If you install the items I've mentioned, your spyware problems will be few.


My Sys:
Dell 8600
Pent "M" 1.6Ghz
XPPro SP2 (all updates)
512 ram, 60Gb HDD
Firefox v1.06 Browser
NAV 2005
ZAPro v6.0.631
Sunbelt CS v1.5 Beta