Multiple Virus/Firewall/Crapware running...

  • Thread starter Thread starter Guest
  • Start date Start date
G

Guest

Is there a good "cross-reference" FAQ page that would break down the do's &
don't of running many different products at the same time?? My McAfee
freebie (Dell) v/s & f/w plus is set to expire in 3 weeks, so I wanted to
make the rounds with the different products. Any suggestions/comments are
welcomed. Thanks.
 
MrGib said:
Is there a good "cross-reference" FAQ page that would break down the do's &
don't of running many different products at the same time?? My McAfee
freebie (Dell) v/s & f/w plus is set to expire in 3 weeks, so I wanted to
make the rounds with the different products. Any suggestions/comments are
welcomed. Thanks.


You'll get nearly as many differing opinions as you will responses.

I used, and recommended, Norton Antivirus and then Norton Internet
Security, for many years, on Win98, WinNT, Win2K, and WinXP, all
without any significant problems. I had used McAfee prior to that.
But it's been several years since I've been tempted to try McAfee
products. Their quality seemed to take a steep nose-dive after they
were acquired by Network Associates.

However, when my subscription to Symantec's updates for Norton
Internet Security 2002 came up for renewal (at a cost substantially
higher than the preceding year's subscription), I decided to try less
expensive solutions. I downloaded and installed the free version of
GriSoft's AVG (http://www.grisoft.com/us/us_dwnl_free.php ) and the
free version of Sygate's Personal Firewall
(http://smb.sygate.com/free/default.php ). Both have proven to be
easily installed, easy to use, and quite effective. Additionally, I
was pleasantly surprised to see a small but very noticeable
improvement in my PC's performance, once I'd replaced the Symantec
product.

Firewalls and anti-virus applications, which should always be used
and should always be running, are important components of "safe hex,"
but they cannot, and should not be expected to, protect the computer
user from him/herself. Ultimately, it is incumbent upon each and
every computer user to learn how to secure his/her own computer.

To learn more about practicing "safe hex," start with these links:

Protect Your PC
http://www.microsoft.com/security/protect/default.asp

Home Computer Security
http://www.cert.org/homeusers/HomeComputerSecurity/

List of Antivirus Software Vendors
http://support.microsoft.com/default.aspx?scid=kb;en-us;49500

Home PC Firewall Guide
http://www.firewallguide.com/

Scumware.com
http://www.scumware.com/


--

Bruce Chambers

Help us help you:



You can have peace. Or you can have freedom. Don't ever count on having
both at once. - RAH
 
Bruce....thanks much for the quick response! I too ran AVG free a while back
and it and XP got along just great. Never a conflict. Now....The Dell
loaded McAfee that's running now has blocked / caught all hacks, viruses,
etc......but it's causing so many conflicts, errors and events that I'm just
busy doing damage control after the fact. Please take a look at the below
warning and give me your expert opinion on this. Is this a ext./file that is
not being scanned?? As it occurs constantly, I'm beginning to think
something "ain't" right. Also, I've had to de-reinstall a few times and now
my registry is all crapped... about a 2.5 minute start and shut down delay
now.....esp. shut down....what's up with this??

Again, Thanks Bruce...awaiting your comments...

Happy Easter!


Event Type: Warning
Event Source: McLogEvent
Event Category: None
Event ID: 5028
Date: 3/26/2005
Time: 2:10:04 AM
User: NT AUTHORITY\SYSTEM
Computer: D1KGKL61
Description:
VirusScan McShield service received an invalid filename from the NaiFiltr
device driver.
Received name = \GLOBAL??\TFSWIFS
Process = IEXPLORE.EXE
 
MrGib said:
Bruce....thanks much for the quick response! I too ran AVG free a while back
and it and XP got along just great. Never a conflict. Now....The Dell
loaded McAfee that's running now has blocked / caught all hacks, viruses,
etc......but it's causing so many conflicts, errors and events that I'm just
busy doing damage control after the fact. Please take a look at the below
warning and give me your expert opinion on this. Is this a ext./file that is
not being scanned?? As it occurs constantly, I'm beginning to think
something "ain't" right. Also, I've had to de-reinstall a few times and now
my registry is all crapped... about a 2.5 minute start and shut down delay
now.....esp. shut down....what's up with this??

Again, Thanks Bruce...awaiting your comments...

Happy Easter!


Event Type: Warning
Event Source: McLogEvent
Event Category: None
Event ID: 5028
Date: 3/26/2005
Time: 2:10:04 AM
User: NT AUTHORITY\SYSTEM
Computer: D1KGKL61
Description:
VirusScan McShield service received an invalid filename from the NaiFiltr
device driver.
Received name = \GLOBAL??\TFSWIFS
Process = IEXPLORE.EXE

I really can't say what that particular error means, other than that
your McAfee Virus Scan is having a problem with some file that may be
trying to open Internet Explorer (the IEXPLORE.EXE). I'd be inclined to
suspect a Trojan of some sort. Have you performed a search on your hard
drive for any folders/files with that name?

Because many of the newer viruses and worms can disable antivirus
applications whose definitions aren't kept up-to-date, try using one or
more of the free on-line scanners to double-check your system.

Trend Micro - Free online virus Scan
http://housecall.trendmicro.com/

Symantec Security Check
http://security.symantec.com/ssc/home.asp

Panda ActiveScan - Free online scanner
http://www.pandasoftware.com/activescan/com/activescan_principal.htm

Computer Associates:
http://www3.ca.com/securityadvisor/virusinfo/scan.aspx

DialogueScience:
http://www.antivir.ru/english/www_av/

F-Secure:
http://support.f-secure.com/enu/home/ols.shtml

BitDefender
http://www.bitdefender.com/scan/license.php

Freedom Online scanner
http://www.freedom.net/viruscenter/index.html


--

Bruce Chambers

Help us help you:



You can have peace. Or you can have freedom. Don't ever count on having
both at once. - RAH
 
MrGib wrote:

I like free AVG 7.0 too, with one exception that may apply if you use
dial-up networking; the email integration is more troublesome than 6.0

Specifically, it causes this familiar problem pattern...
- av integrates into mail axis
- so av gets mail from outside, acts as POP3 server to email app
- and av acts as SMTP server to email app, then sends mail outside
- email app is set to disconnect after finishes with mail
- email app sends mail - to the av app
- having done that, email app markes as "sent", drops the line
- but the av is still checking the outgoing mail
- when done, av finds it can't send the mail out (line's dropped)
- av sends message to email app saying message(s) weren't sent
- user sees email app's "sent" the mail
- recipient never gets the mail
- user asks tech what all these messages from AVG mean

Affects OE and Eudora on dial-up. OK as long as sending is completed
by the time that getting mail is completed.

Disabling the mail plugin doesn't seem to work properly; I've taken to
uninstalling AVG 7.0 and reinstalling it without the email plugin
selected for install. But that means large first updates!

That's ugly, and would prompt me to look at hardware, motherboard caps
etc. as well as do a formal av scan.
Because many of the newer viruses and worms can disable antivirus
applications whose definitions aren't kept up-to-date, try using one or
more of the free on-line scanners to double-check your system.

Um. Because active malware can spoof URLs to alternate IP addresses,
I don't think I'd like to chase them via a site reached through
possibly tainted DNS. You may end up at a lookalike site that indeed
scans through all your files, but for info to "send home" instead!
Trend Micro - Free online virus Scan
http://housecall.trendmicro.com/

I'd rather go tio the above site from a clean machine, and download
SysClean and latest signature files from there. This is a
non-installed scanner for a wide range of traditional malware
(viruses, worms, trojans) that can be run formally from a Barts PE CDR
boot, or semi-formally from Safe Mode Command Only. Copy to HD before
use, from a write-protected USB stick or CDR, then FC it with the
protected original to detect possible malware changes.

They also have free killers for specific malware, but you have to
detect them first!

I don't know if they have any formal post-infection intervention tools

I don't know if they have any formal post-infection intervention tools

I don't know if they have any formal post-infection intervention tools

They have free killers for specific bugs, a la Symantec and NOD32, as
well as a good DOS-based av that can work if you're FATxx, not NTFS

They used to offer a bootable Linux CDR with av built in, but it never
finished a scan without crashing when I tested it. It relies on the
now-discontinued Capture NTFS driver project, so not hoping for much.

Dunno that one.

Other free tools you can use from Bart's PE CDR boot, or Safe Mode
Command Only, include a killer from Avast (faster than SysClean,
updated less often, likely fewer malware covered), a killer from AVG,
and Stinger from McAfee. Stinger's the best-known non-installed
post-infection cleanup tool, but it is VERY limited; covers about 50
common malware, out of several thousand possible infectors.

Once you've done that, turn your attention to commercial malware that
are generally ignored by traditional av. Good free ones include
AdAware SE, Spybot, and what used to be Giant; this is now being
further developed by MS, and while it is still in beta (i.e.
pre-release test phase) it's pretty good.


---------- ----- ---- --- -- - - - -
Gone to bloggery: http://cquirke.blogspot.com
 
Back
Top