Any reccomendations (Realtime Malware Protection)?

Printable View

December 23rd, 2005, 04:25 PM
corrupted_code

Any reccomendations?

well this is actually my first post :eek: but i've joined quite a while ago and read a lot of anti-online's articles and threads (which was very intresting and helpful :p )

alright, ANYWAYS...

i was wondering if anybody could reccomend me any good antispyware programs that give an effective, good real-time protection. i've already looked at the thread called "top rate N antispyware" or whatever and have found it to be not very helpful. the current stuff i have on my comp for spyware realtime protection is: spybot sd with teatimer and ms antispyware. those don't seem very good because ms antispyware has a nice realtime protection only for whats going on INSIDE your computer but never really protects anything from entering..same for the teatimer in spybot sd. its a hassle to always run scans and remove stuff that could've just been blocked so i hope somebody can help me find a nice real-time protecting antispyware :S
December 23rd, 2005, 04:43 PM
JewishIntent

Go get Ewidow, AdAware, and A-Squared. I have these three as well as Spybot S&D and so far i have had nothing on my pc that one or more of those can't clean.
December 23rd, 2005, 04:50 PM
corrupted_code

well yeah i know those, but they dont have real-time protection (ewido has temporary for free version) , thats what i'm looking for. i already have adaware as well. oh and i forgot to add, i'm looking for one that is FREE :p
December 23rd, 2005, 04:53 PM
HTRegz

Hey Hey,

Microsoft AntiSpyware Beta.... it's free... it has realtime protection and it's quite effective...

http://www.microsoft.com/athome/secu...e/default.mspx

Peace,
HT
December 23rd, 2005, 04:55 PM
corrupted_code

Re: Any reccomendations?

Quote:

Originally posted here by corrupted_code
the current stuff i have on my comp for spyware realtime protection is: spybot sd with teatimer and ms antispyware. those don't seem very good because ms antispyware has a nice realtime protection only for whats going on INSIDE your computer but never really protects anything from entering..same for the teatimer in spybot sd.

already have it :p anyone else have different reccomendations?
December 23rd, 2005, 04:58 PM
HTRegz

Re: Re: Any reccomendations?

Quote:

Originally posted here by corrupted_code
already have it :p

I know but what you're asking for doesn't really exist... What is have is the best you're going to get... Malware software (other than AV) has never really been real-time... it's always been scan and clean.

Perhaps instead of asking for something to keep the malware off... you should figure out what you're doing that causes you these malware infestations and ask for ways to change that.... Switch to firefox, increase browser security, don't use an admin account, Don't use P2P apps like Limewire... Stay away from downloading things you don't recognize.. Turn on some advanced file options like show extensions and show hidden files...

Peace,
HT

[Edit]

I'm also going to rename the thread for you to make it a little more obvious to people browsing the forums.

[/Edit]
December 23rd, 2005, 05:07 PM
corrupted_code

yeah, i was guesin stuff like that doesnt exist. anyway my computer is actually clean of anything right now [i already use firefox, made several saftey precautions etc], i was just asking around for my brother comp since he kept getting the cydoor spyware that ms antispyware could remove but never seem to block from entering. although, i do use limewire (newest version) it apparently stated in it that they dont bundle any spyware or adware anymore in this new version (4.10.0) so i'm hoping nothing strange will happen with limewire >_>
December 23rd, 2005, 05:17 PM
tyger_claw

The reason he has Cydoor is probably because he's using a P2P Program like KaZaA.

Once you remove the spyware cydoor, kazaa stops working, so he reinstalls it, putting cydoor back on
December 23rd, 2005, 06:22 PM
dalek

Quote:

Originally posted here by corrupted_code
yeah, i was guesin stuff like that doesnt exist. anyway my computer is actually clean of anything right now [i already use firefox, made several saftey precautions etc], i was just asking around for my brother comp since he kept getting the cydoor spyware that ms antispyware could remove but never seem to block from entering. although, i do use limewire (newest version) it apparently stated in it that they dont bundle any spyware or adware anymore in this new version (4.10.0) so i'm hoping nothing strange will happen with limewire >_>

Read this if you want to practise safe hex:

How did I get Infected???

And definately get rid of Kazaa, this is a review done by Ben Edelman, on what certain P2P programs will drop onto your PC.

Comparisons P2P

Kazaa is a major one.....

Quote:

Don't use P2P apps like Limewire

actually if you must have a P2P program, then Limewire is the best of the bunch for not slipping in 3rd party apps.It's what the user downloads that determine how infected they become.

Also definately switch to Firefox...http://www.mozilla.com/firefox/ ;)
December 23rd, 2005, 06:24 PM
nihil

My recommendation would be to think rather carefully about this. You are talking about interactive applications here. Each one of them represents a resource overhead, a potential source of conflict/instability, and even a security compromise.

This is why they tend to be stand alone on demand applications. Now, your AV and firewall are interactive, but every week millions of computers get infected, because the bad guys write new stuff all the time. Most of that is just "fooling around", whereas adware/spyware is big business, with vast sums of money involved. Please let me assure you that it is properly financed :(

In a corporate/institutional environment it is possible to mitigate risk with a robust security policy that basically only allows minimum authority to user accounts and groups, and prevents communication between segments/sectors of the network that have no need to interact with one another.

Similarly, you could secure a home setup, but I strongly suspect that the aggravation that this would cause would have your brother logging on as Admin within a very short while.

All I can suggest is that you take a look at http://www.winpatrol.com and check out: http://www.diamondcs.com.au/ RegistryProt is a free product. Stuff that checks for changes to your system at least give you a warning?

I believe that you have SpyBot S&D?......................please take the option to start in "advanced mode" and use the tools to check out BHOs etc from time to time.

"SpywareBlaster" is another tool you might like to get. It runs when it is needed and provides some protection against ActiveX vectors. It integrates with SpyBot.

And use the immunisation feature in SpyBot as well as locking your browser home page. ;)

I am afraid that this is not quite what you were looking for, but it might help?
:)
December 23rd, 2005, 07:37 PM
a1fa

I have been using SpywareBlaster, and when i run SpyBot SD or Ad-Aware SE there is only one critical object that shows up now instead of the 10-15 I would get before. Try it. Hope my 2 cents helps.
December 23rd, 2005, 08:42 PM
corrupted_code

well i heard and investigated a bit on a squared but i'm a bit curious about it. it says its 'a good addition to an antivirus'. so what is it really? an antivirus? an antispyware? or something seperately from the rest? i already have an antivirus so i'm just wondering if there will be any conflicts if i were to install this one. also, is a squared much of a resource hogger?
December 23rd, 2005, 08:52 PM
ric-o

In addition to the apps others here (Winpatrol, Spbot S&D, MS Antispyware, some sort of AV) have identified I run Prevx (http://www.prevx.com). I run the Pro version which costs but the home version is free. It stays active and prompts the user when certain events happen such as installation attempts by software, Registry changes, etc.

I also run IE and Mozilla using the DropMyRights tool created by Microsoft developer - see http://msdn.microsoft.com/library/de...re11152004.asp

For all the tools I have installed see my post http://www.antionline.com/showthread...r=1#post878478
December 23rd, 2005, 09:02 PM
nihil

Quote:

well i heard and investigated a bit on a squared but i'm a bit curious about it. it says its 'a good addition to an antivirus'. so what is it really? an antivirus? an antispyware? or something seperately from the rest? i already have an antivirus so i'm just wondering if there will be any conflicts if i were to install this one. also, is a squared much of a resource hogger?

It is an on demand scanner that specialises in detecting trojans and diallers. Those are not particularly well handled by traditional AV products.

It will find other stuff but you would normally have it for the trojan/dialler detection.

:)

EDIT: Sorry, I did not answer your question fully. As it is on demand, there should not be any conflicts. With all that sort of stuff I update them, reboot into safe mode, then run them. In safe mode you don't tend to get conflicts, they run faster and have a better chance of getting rid of bad stuff.

No, it is not a resource hog, and runs quite quickly
:)
December 26th, 2005, 06:37 PM
corrupted_code

well i seem to have found one which is a relatively new program and currently in beta testing. its not very popular yet, but i've been hearing some pretty good comments about it. has anybody tried this out yet or heard about it? its located here: http://www.everestlabs.com/ and is called SpyDefense. i'm curious about this program so any comments would be nice about it, however i don't know whether i should get it or not because of compatibility issues and memory usage though...but i have to admit it looks quite nice :P
December 26th, 2005, 07:15 PM
brokencrow

Hate to say it: M$ AntiSpyware.

Thet got access to the code, and it offers the best protection against rootkits.
December 27th, 2005, 01:32 AM
nihil

Hmmmm,

I have known Everestlabs for quite a while, it will be an interesting one to test.............I hope to be able to report back shortly :)

I use Microsoft antispyware as well, it seems quite good in theory, but given Microsoft's business practices one does wonder if there aren't "white spies" and "black spies"?..............once again I reveal my age..............anyone remember that comic strip "Spy v Spy"?

Happy New Year y'all

:D
December 27th, 2005, 02:03 AM
dalek

Quote:

anyone remember that comic strip "Spy v Spy"?

You must be "Mad" :D

Microsoft does have white spies:

Quote:

It’s true. Microsoft Antispyware detects Claria’s adware still but the recommended action is set toIgnore . I first learned of this at Calendar of Updates in a post by Donna Buenaventura , another Microsoft Security MVP. I downloaded some Claria software and ran Microsoft Antispyware myself with the same results.

MS downgrades Claria Detections:

Source

Claria has since gone legit (used to be gator)....

http://www.wired.com/wired/archive/13.12/spyware.html I still wouldn't trust Claria...

Happy New Year :phttp://www.angelfire.com/hi/SpyVsSpy/
December 28th, 2005, 03:29 AM
ShagDevil

I agree with JewishIntent about Ewido, it's a nice little program. I've also recently started using Spyware Doctor and it's not too shabby. M$ Antispyware has been quite effective so far on my network, so I have no mal-intentioned remarks towards that product either.
Also, I know it's been mentioned here at AO before, but I think the Microsoft Baseline Security Analyzer is a great tool as well.
Anyways, Good luck.
December 28th, 2005, 03:35 AM
Soda_Popinsky

Winpooch is a sourceforge project that uses Clam signatures for its realtime protection. I'm not a fan of this type of software, but it does what you ask. :p

Quote:

About Winpooch
Winpooch is a Windows watchdog, free and open source. Anti spyware and anti trojan, it gives a full protection against local or external attacks by scanning the activity of programs in real time. Associated with ClamWin antivirus, Winpooch keeps safe your computer against virus.

API Hooking
Winpooch uses the API Hooking method. It spies programs when they are running and gives to the user a powerful control of their activity.For example, you can forbide a program to write in a system directory or in the registry, or else to connect to internet. That makes the difference between others anti spywares using a database of known signatures.

Antivirus
ClamWin is an open source antivirus for Windows that can not scan files in real time, unfortunately. With Winpooch, just associate ClamWin and it will be possible to detect virus in a program before it runs.

Origins
Our first aim was to develop a program that could detect virus infection such as spywares and trojans. At the beginning, Winpooch (before the version 0.5) was only able to alert the user when a program tried something suspicious, but that was not enougth reactive. So we decided to make a new release that could offer to the user a powerful control of the computer system.