small footprint antivirus

[annihilator_god]

Last week I received a Dell Inspiron 3500 laptop. Specs are: 266mhz PII, 64mb 66mhz ram, 4.2gb hdd. I've installed windows 2000 pro. The network is provided by a netgear USB adapter, which plugs into my linksys router. As it stands, I have about 26mb of free ram (lots of services shut down). Plenty for surfing the internet (firefox) and DOS gaming. Spyware is no problem because I have adaware and spybot.

What I do wonder is about a good small footprint anti-virus program. I've really only used norton and mcaffe (in the past) on my desktops, so small footprint and low system overhead is unknown to me. I've done some searching and came up with 3 contenders...

1. ETrust EZ antivirus - website says 100k system footprint - $19.95
2. F-Prot - "without draining your system’s resources" from their website - $29.00
3. NOD32 - won awards for scanning in the past (website) - $39.00

So, without breaking out into a huge "which is better" war... I would like to know your experiences with these (or other) small footprint anti-virus programs.

Also, please don't say "install Linux" because I'm already in the process of getting a distro ready so it will be dual-boot. And a firewall program won't be necessary because of my (relatively) secure home network and fully-patched OS.

Any ideas?

[Spyder32]

Well financially (obviously) EZ Trust EZ A/V is the way to go. Personally, this is the only one out of the group I've dealt with and it's the cheapest of those three so I'd go with that one (out of the three). However, there are plent other's out there that are free (Avast, AVG, etc etc) and work just as well.

EDIT:

And a firewall program won't be necessary because of my (relatively) secure home network and fully-patched OS.

Wrong. IMO a firewall is typically a must for a home network. You are just as targeted as a company network and a firewall will help you moniter traffic and the program's that connect outside/inside your computer or network.

[Soda_Popinsky]

Well, if your network is firewalled, then the systems technically shouldnt need one either. Try Clamwin from sourceforge, its pretty slow, but it's open source, so its most likely stripped down well.

[annihilator_god]

Wrong. IMO a firewall is typically a must for a home network. You are just as targeted as a company network and a firewall will help you moniter traffic and the program's that connect outside/inside your computer or network.

ok, let me rephrase that...

I'm not going to install a firewall program... my desktop and other laptop both have firewall programs so i can restrict in/out on those machines. Also, I have a router with SPI, dhcp, and completely stealth (according to shields up!). The laptop won't be online very often, probably just to get other games from the archive.

[The Grunt]

Well if I were you, I would just go without an AV. Just check process every few days and make sure there is nothing odd in there which shouldn't be too hard if all you use it for is what you stated, there shouldn't be much new too often. And if there is then google and see what it is. If you need it for scanning your DOS games you d/l you could just send them over to your desktop and scan them there.

[allenb1963]

AVG uses 1904k....not bad for a freebie. As for the advice above from The Grunt concerning not even running an AV....hopefully you're smarter than that.

[The Grunt]

Originally posted here by allenb1963
AVG uses 1904k....not bad for a freebie. As for the advice above from The Grunt concerning not even running an AV....hopefully you're smarter than that.

Why exactly is it such a bad idea not to run an AV? What red signs does an AV throw up that checking your various proccess will not do for you? I really would like to know why your opinion on this matter is the way it is, because I have yet to have anyone convince me of a good reason to run an AV on my own machine. I KNOW what is supposed to be running, I KNOW what is not supposed to. I keep windows updated so I don't need to worry about worms, and AV's don't even do anything against worms.

If someone really knows their system intimitly, what is the need for an AV? I can understand the need for the average joe, but I do not believe that annihilator_god falls into that category, as he has shown an above average amount of intelligence in his posts on this site. I believe he could handle checking his proccess everytime he uses it, it would be no different than updating his AV defs, but it would require less resources.

[Soda_Popinsky]

Check this out:
http://www.eeye.com/html/research/upcoming/index.html
You are vulnerable as we speak. One MS patch is 228 days overdue, and viruses do not need a constant process to function. Your AV is there to detect when they are run. Task manager, process explorer, are like a "ghetto antivirus".

Lets say you visit a infected web server. Your firewall wont do jack, because its port 80, your antivirus wont do anything because you decided its a resource hog, and "A vulnerability in default installations of the affected software that allows malicious code to be executed, contingent upon certain user interaction," has become your problem.

So what happens if it places a HKCR\EXEfile\shell\open\command key in your registry? Heres an example:
For every .exe that is run, another executable will launch that will keylog / sniff for 10 seconds, then upload to home base. Unless you "happen" to see that process there, because your AV sure as heck didn't.

This doc says it can hide processes.
http://www.blackhat.com/presentation...04-erdelyi.pdf
Here is the tool that does it.
http://hxdef.czweb.org/

One, two, three, quatro reasons why your AV just saved your box.

[darkes]

I too would strongly suggest you run a personal firewall & AV scanner.
Given that you are using it on a 'secure' home network, free products should be fine.

You have loads of free ones to choose from, most of which are pretty effective, and are pretty efficient as well. On the PC you described, I would say it doesn't matter in the slightest what you choose if you are just using it to surf the net or use email, as you have just enough spare capacity for the free products out there. You won't really notice the difference, and better safe than sorry, as extra layers of security are always a good idea.

In terms of footprint, the HD usage won't be an issue as you are talking of a few Mb at most.
CPU/memory usage can be an issue, but you have just enough to spare for normal net usage.

When it comes to using it for stand alone games (DOS based or anything else), terminate your firewall & AV software.
You will then get virtually all your resources (CPU, memory) back.
If you want to use the net again, just re-enable them.

EDIT: The point in running a personal firewall is to prevent this PC screwing the other PCs on your internal network.
From some setups that have been suggested (i.e. nothing!), it is quite possible this PC will get a virus/worm, which could then be passed to the two other PCs on your network.

[allenb1963]

Originally posted here by The Grunt
Why exactly is it such a bad idea not to run an AV? What red signs does an AV throw up that checking your various proccess will not do for you? I really would like to know why your opinion on this matter is the way it is, because I have yet to have anyone convince me of a good reason to run an AV on my own machine. I KNOW what is supposed to be running, I KNOW what is not supposed to. I keep windows updated so I don't need to worry about worms, and AV's don't even do anything against worms.

If someone really knows their system intimitly, what is the need for an AV? I can understand the need for the average joe, but I do not believe that annihilator_god falls into that category, as he has shown an above average amount of intelligence in his posts on this site. I believe he could handle checking his proccess everytime he uses it, it would be no different than updating his AV defs, but it would require less resources.

Thats great if thats what fits for you. Personally, I ENJOY being free of the hassle of jumping through the hoops (manual removal) that some pissy-assed script kiddie has slapped together just to jerk my chain so I run AVG on my system. I LIKE being able to scan any file that comes into my box for unwanted critters. Based on his REQUEST for information, I would guess that a_g feels the same way.

Also, please accept my apology for the wording of my first post. I by no means meant to imply any lack of knowledge on your part. It just seems to me that manual removal is poor time management if you have an automated task available that (mostly) eliminates the need for it. Ahhh, but to each his own...