interesting "new" anti virus program...

[llama]

I have some great screenshots of my accountant's kid's PC.

The first screenie is AVG's scanning results. Number of threats found by AVG: 0. That's Zero.

The second is of NOD32's scanning results. Number of threats found by NOD32: 6.

Both were using definitions updated as of yesterday.

I'll post the screenies onto this post tonight, so anyone can see the identified threats for themselves, but the results are pretty dramatic in terms of PC usability: it was still unusable after AVG's scan, and usable after NOD32's scan. Now I can get in there with the manual tools and start scraping out the hard stuff.

This is typical of AVG's performance these days. This is the third computer this year that AVG has let get owned that I've taken care of - the usual MO is the owner refuses to pay for AV so I set them up with the best that was available last year and cross my fingers.

Nowadays I know this isn't realistic, and I'm going to have to get forceful in getting those AVG hangers-on to switch to something else.

Amazing though -  I get hundred of dollars per visit and they wince at spending $25 a seat per year for something good...

-Llama

[airspro]

I got NOD32 on my PC now , thanks for that info .

I did have AVG and did get the one worm that directed me to a web site to pay to get it off my pc . Was
my last game box that got that , I was getting it ready sell and was downloading the Microsoft updates when
I got bored and started to surf some . Soon very soon I had a big problem . 

Oh ys AVG was on the machine with all there updates , it did tell me I had a problem but couldn't stop it , I
always thought that was mainly because of the Microsoft updates not all being done yet .

Wat a pain it was to get that off .

Anyway nice post , learned quite a bit .
Thanks

[llama]

There is a new kind of a rootkit, mebroot, that can infect your computer just through visiting a website and not even accepting/loading anything from it. The rootkit hides in the first boot sector and is invisible to any antiviruses which load through harddrive. It can only be detected through boot cd or other boot media which doesn't use the infected boot sector.

http://news.yahoo.com/s/pcworld/20080304/tc_pcworld/143105;_ylt=Am5y457TaIWrfeAFofIUrhUjtBAF

The important point about this threat is also listed almost at the bottom of the article:

"Hackers are now creating Web pages that, if visited with certain browsers with security vulnerabilities (Llama's emphasis), will automatically infect a PC with Mebroot-- a technique known as a drive-by download."

Now here's the thing: most of these browser flaws are for pretty old versions: think IE6 pre-SP2 in the vast majority of cases. If you have Windows Update turned on, or are using an alternative browser like Firefox or Opera (which also have autoupdate features), you're pretty much covered.

If you're really concerned, I know Symantec's NAV2008 has drive-by download protection that works well even if you have an unpatched browser (in fact, it really only does anything useful when protecting an older browser, IMHO. I base this on interviewing Symantec engineers at their San Francisco offices last November, inside one of their labs with a few test machines running different things. I covered this earlier too.) McAfee has something similar, but I've not tested it.

And though I haven't said anything about it in this thread yet, Symantec's Norton AV 2008 is also quite good, both from a security standpoint and a lightweight footprint standpoint. Their "Norton Internet Security" is somewhat bloated and "Norton 360" is substantially overbloated, and I don't recommend them for gaming systems at all. I think NOD32 is better for most users, but for a customer who likes a familiar product from a big company (quick, has your Mom heard of Eset or NOD32? I bet she's heard of Norton Antivirus though), NAV2008 is worthy.

I know enough people have been burned by earlier versions of NAV or bloated Norton products that I understand why people would be wary, and might even question my experience by suggesting it. So be it. I was wary until repeating tests two or three times too.

-Llama

[Krusty]

I'm not too impressed with NOD finding 6 things that AVG didn't.

Not unless you tell us WHICH things.


I like spybot as well, but it returns the stupidest things as high urgency threats to security, like the cookies on your hard drive (including ones used on this forum) and like the file use history on applications (like you click the File menu and it has your last 4 files).

There's also some really stupid reports on totally inoccuous items, but I can't recall off the top of my head.


You go by some of those "threat report" webpages and they tell you Nvidia drivers are a major trojan threat.

 

[humble]

Krusty,

A program like NOD will potentially find and/or prevent real threats that AVG or similiar program can miss. Primarily since NOD (and others are integrated suites and a program like AVG isnt {free version or otherwise}). I'm not going to bother getting into this with folks unable or unwilling to address the real core issues here. Within the scope of what AVG does it performs exceptionally well (the test results are there for anyone with a brain to review). It is however limited and is not a complete solution (and neither are any of the best commercial products).

The simple reality is that it is not possible to protect a system 100%....end of story. What we're dealing with here is defining and implementing both a measured level of security and a reasonable recovery plan. The real issue here is incomplete or improper deployment of resources, correctly configured a household PC can be safeguarded by a suite of "lesser" products with equal protection to anything but a few top of the line commercial products.

Not only are McAfee and Norton generally inferior to the top end solutions but many malicious programs are written specifically with them in mind...just like everyone tries to hack the windows OS more then MAC. Its not that MACs are inherently less hackable, just that the threat index is lower.  As Llama said many people buy Symantec because its a "name". Even more sadly many consultants recommend it for the same reason even though its an inferior product. Now in fairness sometimes you can only sell a customer what he wants, but to a suprising degree often the vendor honestly thinks it is the best product.

Regardles of what else is here the realities are really simple. A well configured layered defense is your best bet. A truely topend commercial product like NOD is clearly the best solution. However you can get roughly 99% of the protection from a suite of free products that will in turn clearly exceed the capabilities of an integrated suite from an inferior commercial source. Not having any type of AV is stupid, relying on a single product is risky (any single product). The key is in a quality layered defense of some flavor. Simply buying the best marketing hype isnt going to protect you any better then a well configure free system will. One of the toughest lessons to learn in software procurement is that you can often spend alot more....and get alot less. As mentioned commercial products often have complex and contradictory feature sets that leave the average end user frustrated and confused. Most security failures are the result of improper or changed configurations or improper "workarounds" triggered by an end users need to circumvent a security feature he cant understand/control. If we look at the verified independent testing we'll see variations in qualifying products (those that earn certification {and yes AVG does}) are measured in fractions of a %. Yet losses to major corporations with professional IT staffs are in the billions of dollars...why...

Two simple reasons...

1) most IT staffs are staffed to the lowest common denomonator...
2) most programs are misconfigured or end user altered in the quest for productivity...

So if the biggest corporations with the best staffs are constantly compromised how can you be safe....

KISS

[llama]

So here's the screenshots. AVG is first:



NOD32 is next:


The difference in PC operation is actually a lot greater than the list would suggest. When infected, the box was basically unusable in standard mode, and something was trying to run every 90 seconds. At this point, after NOD32 has done its work yet before I manually clean stuff, the system is actually usable.

-Llama

[Vulcan]

Not only are McAfee and Norton generally inferior to the top end solutions but many malicious programs are written specifically with them in mind...just like everyone tries to hack the windows OS more then MAC. Its not that MACs are inherently less hackable, just that the threat index is lower.  As Llama said many people buy Symantec because its a "name". Even more sadly many consultants recommend it for the same reason even though its an inferior product. Now in fairness sometimes you can only sell a customer what he wants, but to a suprising degree often the vendor honestly thinks it is the best product.

Can you please answer my question, have you ever used or deployed the corporate version of mcafee (specifically 8.5i), or even used products like ePO?

[MrRiplEy[H]]

The real question with AV is not only how well it protects but if it also slows your system down to a crawl while doing it. If the AV is heavy the damage is already done without viruses. The finnish f-secure is infamous for crippling workstations, sometimes to a completely unuseable state.

I had a client with 256mb ram and XP, his computer took an hour to boot and e-mail etc. took 30 minutes to start after f-secure update came. Turned out F-secure had 10 processes and 120mb memory consumption effectively killing the workstation. I switched it to Nod32 with a 12mb or so footprint and the workstation became workable again. Not only that, the workstation worked faster than it ever had done with f-secure in place.

So 'secure' and 'crappy' can fit in the same sentence if you ask me.

[llama]

The real question with AV is not only how well it protects but if it also slows your system down to a crawl while doing it. If the AV is heavy the damage is already done without viruses. The finnish f-secure is infamous for crippling workstations, sometimes to a completely unuseable state.

Agreed 100%. I am regularly surprised that I am basically the only AV reviewer in a major magazine that publishes computer performance data that's unrelated to the effectiveness of the product: i.e.: how fast does it boot and how does it affect running games and other programs. If I had more than 335 words a product, there would be a lot more.

These things can't be reviewed in, or live in, a vacuum.

-Llama

[humble]

Can you please answer my question, have you ever used or deployed the corporate version of mcafee (specifically 8.5i), or even used products like ePO?

ave they actually worked the bugs out on 8.5, last I saw they were on patch 4 and still having "issues". IMO 8.5 isnt the "best" mcafee let alone the best "corporate" AV...

In fact since you want to go here lets look at the realites involved. When the program was intially released it had some serious major flaws which cost early implementors or converts significant time, money and headache. One example of this is the "conflict" between 8.5i and a relatively common business application Lotus notes. Obviously http://www-1.ibm.com/support/docview.wss?rs=475&context=SSKTWP&dc=DB520&uid=swg21252429&loc=en_US&cs=UTF-8&lang=en&rss=ct475lotusIBM diligently worked to solve this solution...by recommending that users either disable Mcafee or roll back to 8.0. Do you even both to read what other people post?

2) most programs are misconfigured or end user altered in the quest for productivity...

What types of issues do you think I was talking about. When your other vendors are instructing you to disable your security tools what type of issues do you think occur?

As I mentioned earlier there are alot of entities that buy crap because someone told them to or because its a "safe" option. Mcclunky falls into that catagory in my opinion.

EPO had similiar significant early issues with major flaws in the initial versions that created very serious issues. Both products are typical of a "1st to market" mentality that constantly see mcafee bringing flawed untested products to the marketplace.


At this point I'm going to bow out of this thread....

All the Best

[Vulcan]

So you haven't used either McAfee 8.5i or ePO and the best you could come up with was some vageuries about epo causing problems (probably googled "epo problems" right?).

As I thought, clueless , probably the best time for you too bow out.