Avg.

Yes I know that probes and pings are not attacks!

"Don't I know it" because everyone sure calls when they do get a Firewall and become paranoid to see the things that have been going on all along and they didn't know it.

I have seen these more than once some that even got thru the router and firewall but was caught by the firewall trying to get back out!

I have seen these from all the avenues you mentioned, because these things do get on the computers and not just from the WWW but from floppys/cd's/removables and other network nodes on a LAN

You can not assume that people will not get viri trojans and and even OS updates that have an exploit that will not open a port.

Yes BB is an expert user and will take both our views into consideration. But don't forget the non experts that read this and decide not to get a firewall when they do need one.

Mike

 

I seem to see ( unless wrong ) that all our posts so far seem to invlove a Router.

Now to those of you out there that DO NOT have a Router. Or are using a HUB instead of a Router.

Get grip and get a Firewall. You folks DO NEED one.

And UNBIND File & Printer Sharing from TCP/IP. If not there is ( or may be I think ) several ports left open for intrusion. And I believe that might be true even with a Router.

If I am wrong here either Mike or Tony will correct me.

In other words. A Router and/or a Firewall will not do it all.

Windows XP says it has a Firewall built in. But I believe that only controls INCOMING.

So If you have a system with TONS of Phone Home software you have no control over it at all. And once it get out I believe it can get back in Firewall or no Firewall.

How bout it guys ?

BillyBob

 

I vote ipmerative with no router!

Very important to have a 2 way even so!

mike

 

Hi

I have just arrived back now - long way to fly from here I haven't received tht e-mail link yet - glad I looked in ....

I was actually just going to turn off the computer & found this ongoing thread. It is FULL of information which I am coming back to read when my mind is clear in the morning !

I really appreciate all the info. the ' experts ' on the matter have posted.
Routers are all new to me - I know I need one if I want to allow my laptop to use the connection in another room ( haven't taken this step yet )

I note the wee bit about the hub - would I have a little more protection ( given my software Firewall ) if I connected the modem via my hub instead or is this a differnet type of hub

Thanks for the links MFlynn - I have not seen these before ( again tomorrow )

We are just about to have a thunder & lightening storm & Guess what I turn of the PC for safety I do have a surge bar BUT .....

I just checked out a site earlier - incredible just what info. can be picked up from the browser & I thought I had it secured

I really will be back to read all sides of this debate. I may not understand it all but I will learn something ~ Thanks to all.

Yes - I will start to enjoy my computer - just want to be safe

 

Hello MiniB

No a hub will not work, it is for a different purpose. A router is what you would need but if you run a firewall, not nessesary for 1 computer.

If you do put another computer up that will need intenet access then you will need a hub and router. Actually a switch which is better than a hub. But you can get a switch/router combo to do your job with one piece of equipment.

What email link??

Mike

 

to "minib "

With the expert assistance of members of this forum (Mike and billybob) I recently went through the transition form Norton Antivirus to AVG (and ALSO the "Avast" AntiVirus - more on that later...), also dumping Norton Internet Security in the process (replacing it with Agnitums Outpost.

FYI, bottom line, much better! And no annual renewal fees and no more having to put up with problems that Symantec's technical(?) support cannot resolve.

Now for the kicker, which you may want to consider, and elicit input from others on. I mentioned that I also installed Avast antivirus, in addition to AVG. I originally did this as a result of the other post that was referred to earlier in this thread on having multiple AVs for the purpose of more thorough scanning. BUT! Avast actually came in a close second to AVG (might even have been a tie) in my initial research as the primary AV to replace NAV. Now, I just recently did this and actually at this point in time have both AV's executing concurrently resident (with no apparent conflicts, that I am aware of anyway...). This kind of happened by accident, as rather than uninstalling AVG to checkout Avast, I just took AVG out of the startup, and the found out that BOTH AVG and Avast will still start up their "engine" even being disabled in the startup, such that they are both actually running resident. It appears (?) that I would have to uninstall them to prevent them from executing concurrently, if that actuallyis a bad thing...

Anyway, here is the heart of the matter that you likely will not find anywhere else (I didn't in my research). Monitoring the two AV's reveals that, roughly, AVG only takes up from 1 meg to 3 megs of RAM and does NOT establish it's resident TWO processes with task priority, whereas Avast kicks off THREE processes, one WITH priority running at the top of the food chain, at about 20 megs of RAM with the other two adding about 8 megs of RAM consumed, for a total of around 28 meg, about 10 times that of AVG... That's kind of the proverbial tip of the iceberg, but it should set the stage for my "conclusion" to follow...

SO! Take that for what you will. My quandary, and maybe yours also, is that I look at the monitoring info and wonder, does the high priority and increased RAM consumption mean that Avast is maybe doing a better job of detecting, intercepting, and disabling potential nefarious activity. Or, does it just mean that it is bloated code that must have priority to be effective? Maybe AVGs code is extremely efficient and is adept at catching evil doers without priority? Hmmm...wish I knew. I'm thinkin that maybe I might go with Avast as resident, it does appear to be a little better "put together" than AVG, maybe indicating something tangible, maybe not. Any opinions from anyone out there?

 

Keywester

I would not run 2 resident virus scanners. I would unload one completely from autostart then run only the scanner part to scan on alternate scans a week or so apart or if one finds something then run the other also.

No real problem having 2 but not resident at the same time.

Knowing how these things work, they are not just running at the same time they are on the same track, I see a possibility of a collision. Imagine 2 basketball players headed for the ball one player makes a right angle turn the other makes a left, they collide and the ball goes free. Smile!

I usually reccomend 2 of the online scanners Trend and Panda to keep whatever you have installed on the HD honest!

Now if you ever set up a dual boot then for sure use a different scanner on each.

Mike

 

Mike/all:

Yeh, and it is my intent to get back to just one AV, I am just not sure which of the two might be the best bet, but I am leaning toward Avast, altho I could well be mistaken in my impression that more code with higher priority might indicate that it might provide better protection.

But, for some reason, I am thinking that AVG is supposed to have more frequent updates than Avast, which may or may not be a big deal since both AV's also incorporate hueristics...(?)

So many intangibles to ponder. Any advice on selecting AVG or Avast as primary resident AV?

Also -- on my earlier indication that taking either AVG or Avast out of the startup does not prevent the "engines" (actually I think all of the normal processes) from starting up -- do you not have that problem? Note that the removal from the startup does eliminate the sys tray icons from appearing, so it LOOKS LIKE they are not running, but if I recall correctly, all the processes show up in a monitor as executing resident...

 

I know nothing about AVAST but I do know that being big and bloated does not a better program make.

Even if it lays a tu*d on top of the processer for cycles, and more little baby t*rds all over the place. As a matter of fact as a general rule I have found the smaller tighter programs to be faster and more stable and powerful.

Probably because they use more pure assembly languge librarys and routines. Which are as rockets compared to Piper Cubs airplanes when they execute, and like Ants compared to humans when you compare to how much body weight they can carry!

I say AVG because you are going to use Online scans additionally, right?

But you can run either without all the resident modules by using Startup Control Panel or Startup Cop to take these out, and then run the scan engine directly. But if you start the resident loader just to do a scan then it will load all modules back untill a reboot. The scan engine can be run without the resident modules in memory for almost all virus scanners.

Mike

 

Hi, BB, Mike & Mini, et al !

Boy, I am I sorry I missed out on all of this great thread! Shame on some of you for not notifying me (you know who you are!).

I have a ton to add, but it would be too long and probably too late. I will shorthand some w/ a tongue-in-cheek

@brett ~ Excellent link on AVG - sad to hear it. I don't know who I can trust if the free version falls by the wayside.

@Mike ~ 'smell the URLs' - you slay me! Agree on the 2 resident AV scanners.

@BB ~ You're on it! I just had a fellow who required some assistance since many of his apps weren't working. I asked him when the last time he updated his AV. He stared at me with a blank look and said "Uhhh, I installed McAfee 95 in 1998 ". That was it. Result? I installed AVG and it vaulted 219 virii before it crashed!

@keywester ~ AVG. Taking out of startup? Depends how you accomplish this. AVG runs 3 files: the avg service (avgserv.exe) and the process (avgcc32.exe) and this is started by avgw.exe. Check your HKLM/HKCU Run/RunOnce. Avast? No. Well, 'no' unless AVG free goes defunct.

@mini ~ AVG is what is seems, it is just disenchanting to hear about something on which you rely possible vaporize.

@Tony ~ XP native defragger is Diskeeper LiteLiteLite and does not defrag MFT as does Perfect Disk. XP firewall = inbound only. FW hardware=more secure/efficient than FW software.

 

Yet MORE

Hi EVERYONE ..................

miniB's reading all the opinions - what a thread for gathering information.

AVG - I thought you had to purchase this but realise it was free. I do not have any problem with purchasing software like this but is this the only reason users are disppointed ? ( it doesn't mean that it is not going to be available at all ???? )

Talking of this type of software - new worm out yesterday supposedly from support@microsoft.com - has an attachment which someone thought genuine & opened - Oh Dear ....... Just keep a look out for this your side of the world !

I just wonder what Symantec would think if they arrived at this post ? I was browsing yesterday & noticed a question ' What is wrong with Norton Products ? ' they were then referred to 36 PAGES on the the topic ........................

Thanks for the info. on the hub/ router. I do have two computers but do not have them networked etc

I feel a bit happier about having a software firewall as yesterday I was beginning to think it was not safe at all ......... I know anyone really having the know how could disable etc but at least I have something and do keep things well updated. McAfee must have the same effect on the users as there seems to be a lot of people do not think they have to update !!!!!

I think I will be here most of the day - reading all the info. It is really great to have the topic debated as it is here. What one adds the other gleans. I am gleaning just now as I have yet to sort out my mind ......

Mflynn - the little fixes - just read about them. I used SpyBot to fix the first one with IE. All the others I would like to run as extra security - just one question first - XP is not mentioned as one of the systems. Is it OK to use them with XP ?

At least I am trying and will fit all the advice into my mini~mind !

Cetainly thorough research from all the contributers More reading now. Thanks again.

 

Bruce Krymow / et al

Thanks for your input, in reply....

Based on some "fixes" that I applied late yesterday, on the expert advice of Mike Flynn, before powering down last night, using "Startup Manager" I disabled AVG (rather than Avast AV cause I was CERTAIN that I had observed that Avast would start up regardless, but was not so sure about AVG) from the start up, theoretically stopping it from executing on next reboot. Result -- powered up this am and altho there are no indications on the surface that AVG is running, "avgserv.exe" shows up (in "Faber Toys" monitor and task manager) as executing. Point, I have previously NOT observed that AVG fires up 3 processes, but have noted 2 processes when it is in the startup, and I doubt that I was in error on that...altho one of the problems that Mike was assisting me to fix was that I was encountering abnormal terminations "behind the scenes ", this surfacing only in the WinD'OHs "event logs" but with no other indications, so just maybe the few times that I checked, that may have been happening, since I was shaking down both AV's executing concurrently....

Anyway. I am still learning from you wise and knowledgable folks on this forum and your comment "Check your HKLM/HKCU Run/RunOnce" does not compute for me. I will try to research that, but right now it is "Greek/geek to me "...

Lastly, on your comment "Avast? No ". I am still evaluating the two AV's, and would appreciate it if you would venture a bottom line premise for that advice. I did do some preliminary research on the two (and more) AV's, and I did not manage to detect anything terribly negative about Avast or sufficiently more positive about AVG. And I will reiterate my earlier (possibly misleading) impression about Avast -- which is that on the surface (realizing this could mean absolutely nothing), Avast does look "better put together ", slicker, more bells and whistles, and kind of like the designers/developers of Avast were quite a bit more on the ball than the AVG outfit... ...which tends to make me wonder if consequently this might tend to indicate that the "internals" of Avast are maybe "better put together" in some ways also. And I still gotta wonder, with all that Avast code executing at high priority, is that maybe indicative of more "firepower" ( "or bloated code "...)? Who knows?

Hope I don't come off as argumentative, just trying to determine the best AV to choose as "memory resident "...

 

I think it is very hard to determine which one is actaully best. It may well depend on who you talk to. The BETTER one for me might not be for someone else.

I think that all we can do is at least have SOMETHING installed as a Resident and than run an online scan to keep it honest.

Which one is better may well depend on other programs installed and how well them and the AV software play together.

Too many times I have heard users B**** about software not behaving. Many times the users did not think about the other kids on the playground may not be playing nice.

I have had Friends that complained about a hangup while running an AV check. I ask " Did you shut things like screensavers off before checking ? " Answer was NO. Susggestion. Try the scan with SS off. ALL went very well.

This is the MAIN reason I use Startup Cop and keep the Startup items to an ABSOLUTE minimum.

I have also found ( thru MUCH trial and error testing ) that the use of Cntrl-Alt-Del does not always work. It may shut the program down but * MAY NOT * remove it from RAM. Not loading the progam in the first place work bettter. Also Cntrl-Alt-Del does not stop the program lrom reloading at startup. This can come into play when updating things like AV.

And DO NOT stop the AV from loading at startup. ( unless testing or updating things ) because I know users that would shut the AV down when not online and then FORGET to turn it back on.

On Dial-up you may be able to get away with that but on cable it is ( I believe ) a NO-NO.

There are many players in this game of computing. And it is a MUST that they all play nice together. If they don't it is time to find the bad palyer and replace him ( her~ ) with one that ( hopefully ) will play nice.

And they whole darn thing boils down to a time consumming, bad language creating PITA.

My lunch is ready. Catch Y'all later.

BillyBob

 

MiniB:

QUOTE -- "I was browsing yesterday & noticed a question ' What is wrong with Norton Products ? ' they were then referred to 36 PAGES on the the topic ".

Only 36 pages? Must be a fairly new thread...

Well, I googled on the text in the above quote but did not find the forum -- if you recall what it was, would appreciate a pointer to it. I REEAALLLY want to go put in my $40 worth about my experience with Symantec's incapable, obnoxiously ignorant (not as in stupid, as in ignoring facts....) UNtechnical offshore support (via "Software Spectrum ").

Good luck on your quest for the wholey AV...

 

Hi

I have tried to re-trace my steps to fin the link abou NAV but still haven't got there yet.

One I did find on the way was about NSW - I know this topic is not about this but I have posted the link in case you would like to read a few things about this one.

NSW

I will post back if I manage to find the NAV one ~ Sorry but I was browsing ..................

 

Extremely interesting reading folks.

First, about Avast. After about a week of testing, I've dumped it. AVG still does a better job, and uses far less mem, and less processes. On XP I do not have it's engine starting up, and only scan when I want. It's a matter of editing the registry key that starts it. You can't just turn it off in msconfig.
HKLM/software/microsoft/windows/currentversion/run
I know it's the same key in 98.
I think there's a key in HKCU possibly, don't remember now.

About routers/default password.
It has nothing to do with external security. Changing a routers setup password is only for internal/hands on security, and having a router (even if the internal firewall is turned off) still gives better security than a software firewall. Sure, your IP becomes "visible ", but it's inaccessible. Port 80 is open for browsing. Do you think that someone is going to try and access port 80 by any other means? Anyone with the technical know-how doesn't care about your little petty personal box. They're after corporate lan's. Go ahead, scan me. Do what you will. You're not going to get anywhere. At the worst, you can cause (or initiate) a DDoS attack, which will slow down my surfing, until I change my IP.

About Norton/NIS/NAV/System works, et al.
They ****. Nothing can convince me to do any further testing on any Norton products. The ONLY one I still keep around is Ghost, and that's because it's used in DOS and cannot @^%%#^*$%^ up my Widows!

Need a software firewall? Get Kerio or Sygate. Zonealarm shot themselves in the foot, Norton (see above), and the rest just cost money for something that Kerio and Sygate do for free.
Blackice is NOT a firewall, and is a waste of time and resources.
If you're truly worried, get a router, and forget all about software firewalls.
Test your incoming vulnerabilities at www.grc.com

Keywester
Open Regedit (start > run > type in: regedit)
Navigate down to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
We use HKLM and other acronyms to save typing. Note that HKLM is equivalent to HKEY_LOCAL_MACHINE

miniB Spybot, Adaware, and most registry cleaners are all safe to run on XP.
My personal choice is RegScrubXP from Lexan. It's a "run it and forget it" type of program. No extraneous thinking involved, and I have never had a problem with it removing everything it finds. EasyCleaner from Toniarts is also very good, although not as thorough. The one from JV16 can get users in trouble, removing too much stuff, and doesn't specify what is safe, and what is not. On XP you can actually let it remove needed services without knowing it, and then XP can get truly hooped.

Lastly, about AVG. It's simple, it works. It has updates, it's free.
As of this post, there is NO better/easier alternative. Period.
I iknow there are a TON of antivirus programs around, and most of the better ones are not easy to find, nor are they free. I have yet to see any proof that one is that much better than any other.
I hate to see it go "pay only ", but so be it. They have provided the internet community with an excellent product for a very long time, at no cost, and they deserve some recompense. I will probably buy it.

 

I dis-agree with that. The Router only blocks incoming. I believe this is a mistake that some users may be making with XP. XP firewall only blocks incoming.

After I removed NAV ( shared files are ( or can be ) a problem ( being polite )) for some reason I had to remove and redo the NIS Firewall.

That is one reason I like AVG better. No shared files.

I was absolutely amazed at what was trying to get out of this machine.

Plus the Router will not block others on a LAN from getting in.

Apparently due to my not checking ( or whatever ) I found a 10 year old was getting into my machine. ( via the LAN ) He ain't now.

So it looks like we are back to the ancient game of Pros and Cons. And how our systems are setup and what we do with same.

BillyBob

 

Reboot ~

You are my new hero! Good gospel- short, sweet, and dammit, right!

 

For BillyBob and others, I will rephrase:
"If you're truly worried, get a router WITH SPI, and forget all about software firewalls. "
SPI being Stateful Packet Inspection.
If you don't know what it is, go look it up.
A router will not block others on the lan from getting in, because it's not designed to do that. Why would you expect it to do that? If you are sharing anything on the computer, the rest of it is prone to attack, especially by tweenage snoops. Get XP (or 2K) and set up some security. Don't expect 98 to secure anything. It can't, and don't get me started on WinME.
Don't get on my case about outgoing stuff.
Just what is it that you're so worried is outgoing? Do you think it's your credit card numbers? Personal email to your mistress?
The truly paranoid simply should not be online. Period.
If you have an updated anti-virus program, and you have taken an ounce of prevention with adaware and spybot, then you don't NEED to worry about outgoing.
Of course, if you insist on using Outhouse Express, then I truly wish you luck.
XP with the right services disabled (or the much-touted "XPAntiSpy" program for those that WANT to run more software to disable other software (oxmoron, no?)) will have no problems.
99% of all outgoing stuff is legit, or is part of some "automatic update ", such as AVG, et al.