small footprint antivirus

Last week I received a Dell Inspiron 3500 laptop. Specs are: 266mhz PII, 64mb 66mhz ram, 4.2gb hdd. I've installed windows 2000 pro. The network is provided by a netgear USB adapter, which plugs into my linksys router. As it stands, I have about 26mb of free ram (lots of services shut down). Plenty for surfing the internet (firefox) and DOS gaming. Spyware is no problem because I have adaware and spybot.

What I do wonder is about a good small footprint anti-virus program. I've really only used norton and mcaffe (in the past) on my desktops, so small footprint and low system overhead is unknown to me. I've done some searching and came up with 3 contenders...

1. ETrust EZ antivirus - website says 100k system footprint - $19.95
2. F-Prot - "without draining your system’s resources" from their website - $29.00
3. NOD32 - won awards for scanning in the past (website) - $39.00

So, without breaking out into a huge "which is better" war... I would like to know your experiences with these (or other) small footprint anti-virus programs.

Also, please don't say "install Linux" because I'm already in the process of getting a distro ready so it will be dual-boot. And a firewall program won't be necessary because of my (relatively) secure home network and fully-patched OS.

Any ideas?

Well financially (obviously) EZ Trust EZ A/V is the way to go. Personally, this is the only one out of the group I've dealt with and it's the cheapest of those three so I'd go with that one (out of the three). However, there are plent other's out there that are free (Avast, AVG, etc etc) and work just as well.

EDIT:

Quote:

---

And a firewall program won't be necessary because of my (relatively) secure home network and fully-patched OS.

---

Wrong. IMO a firewall is typically a must for a home network. You are just as targeted as a company network and a firewall will help you moniter traffic and the program's that connect outside/inside your computer or network.

Well, if your network is firewalled, then the systems technically shouldnt need one either. Try Clamwin from sourceforge, its pretty slow, but it's open source, so its most likely stripped down well.

Quote:

---

Wrong. IMO a firewall is typically a must for a home network. You are just as targeted as a company network and a firewall will help you moniter traffic and the program's that connect outside/inside your computer or network.

---

ok, let me rephrase that...

I'm not going to install a firewall program... my desktop and other laptop both have firewall programs so i can restrict in/out on those machines. Also, I have a router with SPI, dhcp, and completely stealth (according to shields up!). The laptop won't be online very often, probably just to get other games from the archive.

Well if I were you, I would just go without an AV. Just check process every few days and make sure there is nothing odd in there which shouldn't be too hard if all you use it for is what you stated, there shouldn't be much new too often. And if there is then google and see what it is. If you need it for scanning your DOS games you d/l you could just send them over to your desktop and scan them there.

AVG uses 1904k....not bad for a freebie. As for the advice above from The Grunt concerning not even running an AV....hopefully you're smarter than that.

Quote:

---

Originally posted here by allenb1963
AVG uses 1904k....not bad for a freebie. As for the advice above from The Grunt concerning not even running an AV....hopefully you're smarter than that.

---

Why exactly is it such a bad idea not to run an AV? What red signs does an AV throw up that checking your various proccess will not do for you? I really would like to know why your opinion on this matter is the way it is, because I have yet to have anyone convince me of a good reason to run an AV on my own machine. I KNOW what is supposed to be running, I KNOW what is not supposed to. I keep windows updated so I don't need to worry about worms, and AV's don't even do anything against worms.

If someone really knows their system intimitly, what is the need for an AV? I can understand the need for the average joe, but I do not believe that annihilator_god falls into that category, as he has shown an above average amount of intelligence in his posts on this site. I believe he could handle checking his proccess everytime he uses it, it would be no different than updating his AV defs, but it would require less resources.

Check this out:
http://www.eeye.com/html/research/upcoming/index.html
You are vulnerable as we speak. One MS patch is 228 days overdue, and viruses do not need a constant process to function. Your AV is there to detect when they are run. Task manager, process explorer, are like a "ghetto antivirus".

Lets say you visit a infected web server. Your firewall wont do jack, because its port 80, your antivirus wont do anything because you decided its a resource hog, and "A vulnerability in default installations of the affected software that allows malicious code to be executed, contingent upon certain user interaction," has become your problem.

So what happens if it places a HKCR\EXEfile\shell\open\command key in your registry? Heres an example:
For every .exe that is run, another executable will launch that will keylog / sniff for 10 seconds, then upload to home base. Unless you "happen" to see that process there, because your AV sure as heck didn't.

This doc says it can hide processes.
http://www.blackhat.com/presentation...04-erdelyi.pdf
Here is the tool that does it.
http://hxdef.czweb.org/

One, two, three, quatro reasons why your AV just saved your box.

I too would strongly suggest you run a personal firewall & AV scanner.
Given that you are using it on a 'secure' home network, free products should be fine.

You have loads of free ones to choose from, most of which are pretty effective, and are pretty efficient as well. On the PC you described, I would say it doesn't matter in the slightest what you choose if you are just using it to surf the net or use email, as you have just enough spare capacity for the free products out there. You won't really notice the difference, and better safe than sorry, as extra layers of security are always a good idea.

In terms of footprint, the HD usage won't be an issue as you are talking of a few Mb at most.
CPU/memory usage can be an issue, but you have just enough to spare for normal net usage.

When it comes to using it for stand alone games (DOS based or anything else), terminate your firewall & AV software.
You will then get virtually all your resources (CPU, memory) back.
If you want to use the net again, just re-enable them.

EDIT: The point in running a personal firewall is to prevent this PC screwing the other PCs on your internal network.
From some setups that have been suggested (i.e. nothing!), it is quite possible this PC will get a virus/worm, which could then be passed to the two other PCs on your network.

Quote:

---

Originally posted here by The Grunt
Why exactly is it such a bad idea not to run an AV? What red signs does an AV throw up that checking your various proccess will not do for you? I really would like to know why your opinion on this matter is the way it is, because I have yet to have anyone convince me of a good reason to run an AV on my own machine. I KNOW what is supposed to be running, I KNOW what is not supposed to. I keep windows updated so I don't need to worry about worms, and AV's don't even do anything against worms.

If someone really knows their system intimitly, what is the need for an AV? I can understand the need for the average joe, but I do not believe that annihilator_god falls into that category, as he has shown an above average amount of intelligence in his posts on this site. I believe he could handle checking his proccess everytime he uses it, it would be no different than updating his AV defs, but it would require less resources.

---

Thats great if thats what fits for you. Personally, I ENJOY being free of the hassle of jumping through the hoops (manual removal) that some pissy-assed script kiddie has slapped together just to jerk my chain so I run AVG on my system. I LIKE being able to scan any file that comes into my box for unwanted critters. Based on his REQUEST for information, I would guess that a_g feels the same way.

Also, please accept my apology for the wording of my first post. I by no means meant to imply any lack of knowledge on your part. It just seems to me that manual removal is poor time management if you have an automated task available that (mostly) eliminates the need for it. Ahhh, but to each his own...

Quote:

---

Thats great if thats what fits for you. Personally, I ENJOY being free of the hassle of jumping through the hoops (manual removal) that some pissy-assed script kiddie has slapped together just to jerk my chain so I run AVG on my system.

---

Well, I have that same freedom by:

1. Not going to sites I do not trust and that do not have a user record of use.

2. Not accepting attachments or any sort of file from people I do not trust (notice, not -know- but trust)

3. Not using IE to avoid browser based injected viruses

4. Not downloading pirated/illegal software off of peer to peer networks.

5. Disable services and implimenting a basic firewall to prevent unwanted outside access to ports (blocking worm attempts)

Seriously now, smart browsing will do more for any user than masses of AV will. Seven years, never once had a virus because I thought before I clicked. I -still- don't have an AV installed. Of course this is not for a buisness model, but the parent poster is talking about a personal model, and the one I just described how to follow in the four steps above. If you do all of those steps (and no, they are not difficult and things that should be followed anyways, regardless) then I don't know what could possibly infect you.

Here's another motto that my mentor gave me, that I live by:

"If you don't know exactally what is going in and out of your box, don't you dare assume someone else will do it for you with some 'universal' fix. Learn and help yourself, because you are the first level of protection."

"When the whole World is at peace; a wise man walks with his sword at his side"

Sun Tzu

:D

Sorry, I just could not resist that................Oh...........get some more RAM, it will help.

pooh sun tzu: Those step's would pretty much guarentee little to no viruses on your system, however it's alway's good to be well prepared and to have backup, no?

Quote:

---

1. Not going to sites I do not trust and that do not have a user record of use.
2. Not accepting attachments or any sort of file from people I do not trust (notice, not -know- but trust)
3. Not using IE to avoid browser based injected viruses
4. Not downloading pirated/illegal software off of peer to peer networks.
5. Disable services and implimenting a basic firewall to prevent unwanted outside access to ports (blocking worm attempts)

---

1. Trusted zone sites can be infected themselves unknowingly, and a malicous script can be appended to each document.
2. Make sure scripting is off in your email, and your client is updated and not vulnerable.
3. All good and fine, but javascript and java can screw you over as well.
4. yup
5. Update yer dang software, blackice and norton have showed us that a firewall can be exploited (and yes, hardware too)

I totally agree with pooh when his points are expanded a bit. But I would still use AV because my box can handle it.

Good points guys.

Quote:

---

however it's alway's good to be well prepared and to have backup, no?

---

No, I don't think so. If I have a seven year track record of having learned to avoid and detect what would have infected me, then it's no different than a hunter using a bow and arrow that he's been using for seven years straight, only to have people tell him to take a shotgun with him 'just in case'.

The man's a hunter lol, let him hunt in the way that works best for him.

Soda makes some good points too. I'd like to argue with one or two of them, but it's just -way- too early for that :)

Quote:

---

The man's a hunter lol, let him hunt in the way that works best for him.

---

Pooh, your make an excellent point and your method work's very well. I'd say I don't need A/V software either because I have been smart in my download's, etc etc. However I'd just rather be safe than sorry. I've barely dealt with problems myself and could probably get by w/o A/V software. However it is recommended and I prefer it.

Btw, this is nothing against you pooh ;) I know exactly what you're saying and kinda live by it on my OpenBSD machine :D