What AntiVirus and/or Firewall?

[wickedestman]

Well i decided to start another thread elsewhere to find out about the above.

I kinda want a quick answer to the following if there is one...

1) In your opinion what is the best antivirus or protection suite out there?
Im currently using AVG Free and i think thats not good enough. i dont want something that is going to suck RAM as i only have a lil bit of RAM.


2) i guess i should be using a firewall. i have a 2mbit connection and i download a lot and i used zone alarm pro before... is this good enough? should i use the entire zone alarm suite (firewall+antivirus+etc)?

Please guys shed your light on this topic thanks!

[PrntRhd]

Best AV?
Paid: NOD32, Kaspersky, Avast, Antivir
Free: Avast Home Edition, AVG

Best firewall:
Get a router, the firewall in the router takes the memory hit off the PC.
Software firewall is then only for monitoring and backs up the router:
Kerio
Comodo

"Suites" tend to use more memory than separate applications.

[wickedestman]

Between NOD32, Kaspersky, Avast.... which one is the best lol? i like AVG the most.. i used all t*rrented lol..

ohhh didnt know that suites used more.. thanks...

well a router is expensive and wont the firewall block my uTorrent and Limewire etc? i guess ill jus have to be scanning endlessly lol!

[pop pop]

Between the two "pay" AVs...

NOD32's interface is a bit geeky and not the most intuitive. It is however very good at what it does. It's rated "Advanced+" and "Fast" by AV-Comparitives. The current version of Kaspersky has a simple interface and is basically a set it and forget it app. It updates 8 time a day. It's rated "Advanced+" and "Slow" by AV-Comparatives. I've never used Avast, so I can't speak directly to that product. One of the mods here, ClassicSoftware, loves it. AV-Comparatives rate it "Advanced" (slightly lower) and "Average" for speed. You can't go wrong with any of the three.

Below is the link to AV-Comparatives. Their policy requires only links to their home page, not to charts or articles...sorry. Dig around there and you'll find a bunch of good info.

http://www.av-comparatives.org/

[Budfred]

If you do not run a firewall, you will almost certainly get infected, especially if you are using uTorrent and Limewire... As someone who helps clean up infected computers, I do not appreciate people who don't use firewalls... You can configure any firewall or router to allow specific sites access... However, you will still be at risk if you do file sharing... There isn't an antivirus available that will protect you if you do not run a firewall...

[wickedestman]

wow so nod32 it is! lol i will be sure to run that on my next pc. right now AVG is holding up and i installed a firewall. thanks so much pop pop for the advice i will check out av-comparatives.

@Budfred
haha i totally agree with you now. thats how i lost my last pc. well partially. i had no anti virus but a firewall and then i started playing around with some AV's and deleted my firewall and well i had none at a time then a virus spread and killed: media player, Nero, my bandwidth manager and totally lagged the system. then i sent it to fix and the guy crashed it!
So budfred what firewall do you recommend? i use zonealarm pro right now is thats good enough right?

BTW i use Spybot-S&D and sometimes Adaware SE Personal. is this good? thanks so much.

I see that hijack this is a cool log app. so if i suspect i have a virus i can create the log and post it up in here?

[Budfred]

I won't use ZoneAlarm or recommend it, but it is adequate... They recently started including a dubious "AskJeeves" toolbar in some installs and that is unacceptable for a security company in my mind... They also see to use more resources and their customer support is pathetic...

I use Kerio which is available in a free version and Comodo or Outpost are generally well recommended and available in free versions...

I no longer recommend Ad-Aware because of problems in the latest version that relate to problems in the company... They have had a difficult history with their employees and that seems to be continuing...

And yes, if you have a problem you can post a HJT log here so that one of us can help you... However, the best option is to prevent the infection as you have apparently learned... Here is the prevention speech that I generally post with more ideas for security:

Please consider using these ideas to help secure your computer. While there is no way to guarantee safety when you use a computer, these steps will make it much less likely that you will need to endure another infection. While we really like to help people, we would rather help you protect yourself so that you won't need that help in the future. :thumbup:

Please navigate to http://windowsupdate.microsoft.com and download all the "Critical Updates" for Windows. These will patch many of the security holes through which attackers can gain access to your computer. Your current versions appear to be outdated.

Please either enable Automatic Updates under Start -> Control Panel -> Automatic Updates or get into the habit of checking Windows Update regularly. They usually have security updates every month. You can set Windows to notify you of Updates so that you can choose, but only do this if you believe you are able to understand which ones are needed. This is a crucial security measure.

As a minimum, you need at least an antivirus, firewall and some type of anti-spyware program.

Please consider installing and running some of the following programs; they are either free or have free versions of commercial programs:

Spybot-Search & Destroy (http://www.safer-networking.org/en/download)
A tutorial on using Spybot to remove spyware from your computer may be found here (http://www.bleepingcomputer.com/tutorials/tutorial43.html). Please also remember to enable Spybot's "Immunize" and "TeaTimer" features if you don't have the resident part of another anti-spyware program running.

SpywareBlaster (http://www.javacoolsoftware.com/spywareblaster.html)
A tutorial on using SpywareBlaster to prevent malware from ever installing on your computer may be found here (http://www.bleepingcomputer.com/tutorials/tutorial49.html).

SpywareGuard (http://www.javacoolsoftware.com/spywareguard.html)
A tutorial on using SpywareGuard for real-time protection against spyware and hijackers may be found here (http://www.bleepingcomputer.com/tutorials/tutorial50.html).

If you use Internet Explorer, it is a good idea to use IE-Spyad (http://www.spywarewarrior.com/uiuc/resource.htm) which provides protections against malicious websites.

Please keep these programs up-to-date and run them whenever you suspect a problem to prevent malware problems. A number of programs have resident protection and it is a good idea to run the resident protection of one of each type of program to maintain protection. However, it is important to run only one resident program of each type since they can conflict and become less effective. That means only one antivirus, firewall and scanning anti-spyware program at a time. Passive protectors, like SpywareBlaster and IE-Spyad can be run with any of them.

Note that there are a lot of rogue programs out there that want to scare you into giving them your money and some malware actually claims to be security programs. If you get a popup for a security program that you did not install yourself, do NOT click on it and ask for help immediately. It is very important to run an antivirus and firewall, but you can't always rely on reviews and ads for information. Ask in a security forum that you trust if you are not sure. If you are unsure are looking for anti-spyware programs, you can find out if it is a rogue here:

http://www.spywarewarrior.com/rogue_anti-spyware.htm

Please consider using an alternate browser. Mozilla's Firefox browser is a very good alternative. In addition to being generally more secure than Internet Explorer, it has a very good built-in popup blocker and add-ons, like NoScripts, can make it even more secure. Opera is another good option.
If you are interested, Firefox may be downloaded from here (http://www.mozilla.org/products/firefox/)
Opera is available here: http://www.opera.com/download/

For much more useful information, please also read Tony Klein's excellent article: How did I get infected in the first place (http://forums.spywareinfo.com/index.php?showtopic=60955)

[Jiggy]

Would it be worth putting this post as a sticky as this question gets asked alot ?

From Budfred,
"I won't use ZoneAlarm or recommend it, but it is adequate... They recently started including a dubious "AskJeeves" toolbar in some installs.

I have just installed the new update for ZoneAlarm and it now includes (box already ticked) a spyware toolbar, im now going to start using Kerio firewall.

[wickedestman]

@Budfred
waw.... im amazed! thanks so much for that quick reply and so detailed! YOU RULE!! i think this should really be a sticky... like make a new topic and do that! well bye bye zone alarm hello kerio!

BTW you said "Your current versions appear to be outdated." how did you know that bro?

ill be getting those programs like spybot and spyware blaster and spyguard... but do i need to run all of those or one? because i already have spybot.

and yes i use firefox since a while now... thanks soooo much

im gonna do some stuff and when im back im gonna get down to updating and installing and uninstalling some stuff!

BTW i also use Tune Up! utilities 2007.. is this program gonna affect me or help me? i use their One-Click Mantainance wizard.

[Budfred]

I am sorry I didn't make this more clear... This is my canned prevention speech... I use it after I have helped someone clean up their computer and modify to fit the situation... I posted it mostly unmodified so that you would see all of the info...

If you are running a resident antivirus, firewall and anti-spyware while using Firefox or Opera, the only other thing I see as really helpful is SpywareBlaster since it provides protection without using resources... You just need to update it occasionally... Of course, that also assumes you are careful about where you go online...

[wickedestman]

hahah ohhh omg i thought u hacked me or something! :D lol thats ok its a great speech! i do think it should be a sticky hehe.

I jus did a full update of windows. only internet explorer 7 stickin so i gonna skip it and download it separately. i dont know why its sticking in the updating process.

so get the spywareblaster and still use spybot right?

also what about Tune Up! utilities 2007.. is this program gonna affect me or help me? i use their One-Click Mantainance wizard.
lol you didnt answer that :P

[Budfred]

I am not really familiar with Tune Up!, but as long as it is something that you run on command for PC maintenance, it is unlikely to interfere with your security programs... I have System Suite tools which I run selectively on occasion... I avoid things like "One-Click Maintenance" since they can get overly aggressive and cripple systems...

[wickedestman]

thank God you are here Budfred. i was thinking that i should make a log with hijack this before i take all of these preventative measures to see if i have any infections before!
But now I jus updated everything in windows and well my browsing has severely slowed down. well i used to use the cable modem through the USB because FLOW (cablenet provider) said there were problems through the network cable. Just now after restarting i noticed the computer did not notice my modem AT ALL! i tried all the usb ports and no connection. so now im using the network port and its working but the net is very slow... i freaking out! What can i do?

sorry if im appearing paranoid and hyper-ventilating!

[wickedestman]

LOL omg... i totally freaked out jus now im sorry. i jus reseted the modem and it worked. but i think i should really create a log and have you take a look and see if i have anything before. im going to get Kerio now and spyware blaster...

[Budfred]

The main thing I suggest is to slow down... When you install and remove all sorts of different programs, there is a pretty good chance that some will leave traces behind and that can interfere with a new program you install to replace it... It is a good idea to look at available info and decide you want before you start installing...

I can look at an HJT log if you want to post one... But please, slow down... :eek:

[wickedestman]

im sorry Budfred i got a lil too excited that happens to me sometimes and i was a bit upset last nite. and my net has been troublesome the past few weeks. im sorry i will try to calm down hehe :D im good now. I will post one soon.

I tried getting a "full" version of kerio but a lot of people say its hard to cr*ck the new one so i dont know.

i think i will get that HJT log for you first ;) thanks again

[wickedestman]

HERE IT IS:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 05:24:25 PM, on 24/12/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\PROGRA~1\MOUSEW~1\SYSTEM\EM_EXEC.EXE
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\MessengerPlus! 3\MsgPlus.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\RunDLL32.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Logitech\iTouch\kbdtray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Sony Ericsson\Mobile\audevicemgr.exe
c:\PROGRA~1\INTUWA~1\Shared\MROUTE~1\MROUTE~2.EXE
C:\PROGRA~1\SONYER~1\Mobile\CONNEC~1\CONNMN~1.EXE
C:\Documents and Settings\Zabar Baksh\Desktop\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\Userinit.exe
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {BDF3E430-B101-42AD-A544-FADC6B084872} - (no file)
O3 - Toolbar: (no name) - {62999427-33FC-4baf-9C9C-BCE6BD127F08} - (no file)
O3 - Toolbar: MSN Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar\01.01.1601.0\en-us\msntb.dll
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Jet Detection] "C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe"
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Gamma Loader.lnk.disabled
O4 - Global Startup: Adobe Reader Speed Launch.lnk.disabled
O4 - Global Startup: Digital Line Detect.lnk.disabled
O4 - Global Startup: Microsoft Office.lnk.disabled
O4 - Global Startup: Phone Connection Monitor.lnk = C:\Program Files\Sony Ericsson\Mobile\audevicemgr.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: RapidShare-Download - res://C:\Documents and Settings\Zabar Baksh\Desktop\more-rapid.exe/RsMenExt.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - [url]http://www.cult3d.com/download/cult.cab[/url]
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - [url]http://download.mcafee.com/molbin/iss-loc/vso/en-us/tools/mcfscan/1,5,0,4306/mcfscan.cab[/url]
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - [url]http://fdl.msn.com/public/chat/msnchat45.cab[/url]
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\SYSTEM32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: InCD Helper (read only) (InCDsrvR) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Intel(R) NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe

--
End of file - 8065 bytes

[wickedestman]

BTW is there a way to get rid of stuff like the ATi and Symantec stuff. That should be able to be disabled in Services in Administrative Tools right?

[Budfred]

im sorry Budfred i got a lil too excited that happens to me sometimes and i was a bit upset last nite. and my net has been troublesome the past few weeks. im sorry i will try to calm down hehe :D im good now. I will post one soon.

I tried getting a "full" version of kerio but a lot of people say its hard to cr*ck the new one so i dont know.

i think i will get that HJT log for you first ;) thanks again

If you are using cracked software, there is no reason for me to help you... First, you will get infected and probably with some of the worst stuff out there... Second, I do not respect people who pirate other people's programs, especially for companies that offer free versions of their programs...

[wickedestman]

ohh i didnt find the free version thats y i resorted to the t*rrented one. can u link me with the free one please? i try not to use cracked stuff cuz i know they mess with the system.

[Budfred]

ohh i didnt find the free version thats y i resorted to the t*rrented one. can u link me with the free one please? i try not to use cracked stuff cuz i know they mess with the system.
I think you are missing the point... In any case, the pay version is only $10 anyway and probably worth that easily... However, if you download the trial, it will simply lose some functionality after the trial period, but the main firewall functions work...

http://www.sunbelt-software.com/Home-Home-Office/Sunbelt-Personal-Firewall/

[wickedestman]

lol i think i understand that cracked programs will not help me in anyway. i dont use crack programs on this pc ever since i lost my last one. Well i dont have access to a credit card.. so i cant purchase it. ohhh i thought it would jus stop working entirely after the trial. sorry.

so any ideas about the HJT log i posted?

[Budfred]

I don't see any problems in your log and it looks like you declined the optional spyware in MessengerPlus3, so you are probably okay...

[wickedestman]

thanks a lot Budfred i would over-recommend this forum for anyone who needs help with anything! i needed help with pc parts and i got the most help ever and now with this Security thing! and jus yesterday with my crashed pc i got help with another topic and i can recover most of my stuff THANKS SO MUCH!!! i so wish i had access to a credit card. i would surely be donating! :D