Spysweeper and Online Armor

[Mongol]

I currently run Spysweeper and am trialing Online Armor. The way Online Armor hardens my computer settings is it even necessary to have Spysweeper running?. Should I just use Spysweeper for scans and disable the guard?. Any feedback will be much appreciated..;D

[hollywoodpc]

Hi there Mongol .
You will be fine by disabling the guards and only use SS as on demand .
Hope that helps and GREAT choice in OA . Excellent program

[Mongol]

-{ Quote: "Hi there Mongol .
You will be fine by disabling the guards and only use SS as on demand .
Hope that helps and GREAT choice in OA . Excellent program" }-

I have to agree. I am real impressed with Online Armor and have it running along side NOD32 on my work laptop. They seem very impenetrable as a tandem. They may just have a new customer. Another plus is that Online Armor is noticably lighter on RAM...cheers...8)

[Peter2150]

I would concur. I have in fact uninstalled spysweeper.

Pete

[Mongol]

I may keep Spysweeper on board just for scanning since I have about 6 months left on the license. Or maybe just go for Lavasoft Adaware, if nothing else its good for cleaning up MRU's eh?.

[siliconman01]

"I may keep Spysweeper on board just for scanning since I have about 6 months left on the license. Or maybe just go for Lavasoft Adaware, if nothing else its good for cleaning up MRU's eh?."

If one can believe the "unbiased analysis" reports, Spy Sweeper catches 90+% of spyware and AdAware is down around 60%. I feel that SS is a much stronger program for keeping...even though it has an annual support fee.

I agree that with OA, the shields in SS are unnecessary.

[tuatara]

At the moment i am testing Online Armor meself,
but i am very curious to know if you find still find malware
with Spy Sweeper , if you are running both.

And if you found malware, what kind ?

[Mongol]

-{ Quote: "At the moment i am testing Online Armor meself,
but i am very curious to know if you find still find malware
with Spy Sweeper , if you are running both.

And if you found malware, what kind ?" }-
As I understand Online Armor it hardens your system and all active X scripts so that it is virtually impossible for anything to install. The new Version 2 expected out in 2-3 months is also going to provide a high level of registry protection. I have seen Mike Nash of Online Armor posting in here and maybe he will explain further. Since I primarily use Firefox the active X thing is not such a big deal. I will keep Spysweeper around but may disable the active guard and use it as a scanner if I take the leap and buy a license. It is looking likely that I will...8)

[Mongol]

-{ Quote: " If one can believe the "unbiased analysis" reports, Spy Sweeper catches 90+% of spyware and AdAware is down around 60%. I feel that SS is a much stronger program for keeping...even though it has an annual support fee.

I agree that with OA, the shields in SS are unnecessary." }-

Just curious, do you think I should keep Spysweepers guard active and disable the shields?...??? :)

[Tassie_Devils]

Keeping/using/uninstalling something is ultimately up to you.

If you have a new program and am trialling it, then *most* certainly I would keep others until you grow in confidence to use it singularly.

OA for example, when I first trialled it, I absolutely did not turn anything else off.

2 reasons: 1] I still wanted to make sure of my protection; 2] I wanted to make sure they were compatible, because if not, then there could be trouble down the road.

But personally as to having OA as a frontline defender now, absolutely, it's the first to warn me on virtually everything, followed by Kerio FW, etc.

I have had spysweeper for quite a while, but I never enabled 'any' of the active shields on it, I had reserved that job for AdWatch from AdAware PRO and SpywareGuard.

I only kept SS as a 'checking scanner' and only in rare instances does it find something else [which is always a very tiny item as in a cookie] apart from AAW or Spybot.

SpywareGuard is no longer running now in my SysTray, just FW/AV/AdWatch and Online Armour.

Cheers, TAS :)

[MikeNash]

-{ Quote: "As I understand Online Armor it hardens your system and all active X scripts so that it is virtually impossible for anything to install. The new Version 2 expected out in 2-3 months is also going to provide a high level of registry protection. I have seen Mike Nash of Online Armor posting in here and maybe he will explain further. Since I primarily use Firefox the active X thing is not such a big deal. I will keep Spysweeper around but may disable the active guard and use it as a scanner if I take the leap and buy a license. It is looking likely that I will...8)" }-

Basically, Online Armor combines execution protection, along with an HTTP, POP3 and IMAP proxy. The proxies filter content coming on to your system before they get to your browser/mail client. For example, OA will warn if a page contains references to ActiveX objects.

The execution protection is a second line of defence. If something gets past OA (which is certainly possible) or you allow in error (also possible) then you would get a warning of an exe trying to run.

Assuming you block it, that's it - nailed forever. If you allow it, you can also delete files created by it. There are other features in there - for example, control over brower helper objects.

So, typically in the event of a drive-by infection you could get :

1. A warning that page contains dangerous object, (ActiveX)
2. A warning that the program is trying to run
3. Autostart warning
4. Notification of an attempt to install a Browser extension

That should be sufficient in the most parts to alert you that something strange is happening (assuming, you press allow each time)

-{ Quote: "At the moment i am testing Online Armor meself,
but i am very curious to know if you find still find malware
with Spy Sweeper , if you are running both.

And if you found malware, what kind ?" }-

I'd be very curious about that too :)

[tuatara]

-{ Quote: "If you have a new program and am trialling it, then *most* certainly I would keep others until you grow in confidence to use it singularly." }-

Thanks Taz!
But ..
Don't worry, the setup of the testpc is so, that i don't mind if it gets infected.

Recovery takes from a infected pc, takes 2 seconds here!

[Mongol]

1. Thanks Mike Nash for popping in and for the explanation about Online Armor.

2. Thanks Tazzie for the suggestion about keeping all the goodies on hand while trialing Online Armor. I was looking for suggested feedback on what I could or should do if I bought Online Armor. All my other security software is running here for the test drive. So far the drive has been quite smooth...:o ;D

[MikeNash]

-{ Quote: "1. Thanks Mike Nash for popping in and for the explanation about Online Armor. " }-

No problem :)

I don't notice all of the OA threads over here, but when I do I'm happy to step in where I can help.

[tuatara]

Thanks MikeNash !

[b00sfuk]

Just my experience. I trialled OA and bought it recently. It has replaced SpySweeper which I just keep as an on-demand scanner. I have also stopped using SpywareGuard. Until recently I also ran BOClean but even that I now use as an optional guard if I have a concern. I just run OA alongside my Filseclab firewall and Avast! antivirus.

[tuatara]

hi b00sfuk,

Is that because you have run them together for a while,
and found out that you did not found malware more since
you where using O.A. ?

or is it because you just have a lot of trust O.A.

For the record, this is a honest question, i have no experience
and thus opinion regarding O.A. YET.

[b00sfuk]

-{ Quote: "Is that because you have run them together for a while,
and found out that you did not found malware more since
you where using O.A. ?
or is it because you just have a lot of trust O.A." }-

Both, mainly I had growing confidence in OA, once you use it for a while and understand what it is doing you appreciate its overall benefit. My on-line habits mean I'm not generally exposed to much malware anyway. If I frequented file-sharing sites etc. I might want to go for a more multilayered approach and would also run apps like BOClean etc. at startup. There is no harm in running multiple apps as they don't generally interfere (though multiple prompts might get annoying), I was happy to drop BOClean though as its CPU spikes were annoying.

[Bubba]

@ Mongol,

I have split off your post and other related posts concerning Process Guard and Online-Armor into a thread of it's own to keep things someone separated from the discussion on Spysweeper and Online-Armor.

This thread--->Process Guard and Online-Armor (http://www.wilderssecurity.com/showthread.php?t=111045)

[Mongol]

-{ Quote: "@ Mongol,

I have split off your post and other related posts concerning Process Guard and Online-Armor into a thread of it's own to keep things someone separated from the discussion on Spysweeper and Online-Armor.

This thread--->Process Guard and Online-Armor (http://www.wilderssecurity.com/showthread.php?t=111045)" }-

OOPS...sorry about that, I kinda wandered off topic a bit...::) :o :)

[Bubba]

-{ Quote: "OOPS...sorry about that, I kinda wandered off topic a bit...::) :o :)" }-It's all good :o :D

[Defenestration]

I was one of the original beta testers of OA, and found that it noticeably slowed my system down (eg. starting apps etc). I have installed it several times since but still found it slowed my system down too much for my liking, although I haven't ried one of the more recent builds. That said, I do believe Mike's support is top notch and is up there with the best. I will no doubt try it again in the future to see if it runs any better on my system.

Regarding SpySweeper...... Don't like it and haven't for a long time. It's bloated and has a horrible, though distinct user interface. It's also very badly programmed, being resource hungry and using Madshi's libraries (ie. WebRoot don't write or understand the hooking/injection technology involved in their product, surprising though it may be).

Since you still have 6 months left on SpySweeper licence, I would keep it for on-demand scanning only, and disable the real-time protection.

For real-time spyware, I currently run Ad-Watch alongside my AV/FW/HIPS.

[MikeNash]

Please, try a more recent build :D

Seriously, if you have low ram and your system pages then OA will not perform as nicely as it could. There were also a couple of issues in there relating to incorrectly checking hashes on some files - these should be fixed.

IF you still have slowdown problems, I'll swap you a nice shiny licence key for help in figuring out why OA slows down on your system.


Cheers


Mike

[Here4aday]

-{ Quote: "Please, try a more recent build :D

Seriously, if you have low ram and your system pages then OA will not perform as nicely as it could. There were also a couple of issues in there relating to incorrectly checking hashes on some files - these should be fixed.

IF you still have slowdown problems, I'll swap you a nice shiny licence key for help in figuring out why OA slows down on your system.

Cheers

Mike" }-

This is the kind of customer support that amazes me. Thats why I bought a license.

[Tassie_Devils]

-{ Quote: "This is the kind of customer support that amazes me. Thats why I bought a license." }-

Cannot get any more fairer than that. Gotta luv it! Very 8)

TAS

[Defenestration]

I have 512MB RAM which, while not massive, is plenty to run XP and the various apps I choose to run, so I don't think a lack of RAM is the problem.

I will install the latest version of OA and let you know if my system still feels sluggish. If it does, I will take you up on your offer.

Like I said, your support is second to none!

BTW, would I be correct in thinking that the whole of OA is coded in C# and so uses the .NET library ?

... or are speed critical parts coded in ASM/C/C++ ?

[MikeNash]

-{ Quote: "I have 512MB RAM which, while not massive, is plenty to run XP and the various apps I choose to run, so I don't think a lack of RAM is the problem." }-

512MB is plenty for XP, unless you're doing intensive graphics work in Photoshop or doing software development in which case your sanity will be directly proportional to the amount of RAM in the machine.

-{ Quote: "
I will install the latest version of OA and let you know if my system still feels sluggish. If it does, I will take you up on your offer.

Like I said, your support is second to none!" }-

Thanks :) But really, it's common sense. You like OA, but it slows your system. I don't have that problem, and I would like it fixed. Seems like a fair exchange to me.

-{ Quote: "
BTW, would I be correct in thinking that the whole of OA is coded in C# and so uses the .NET library ?

... or are speed critical parts coded in ASM/C/C++ ?" }-

No, it's written in Delphi which compiles almost as fast as C++, but is a lot "nicer" to work with, easier to debug. Our new kernel mode stuff is written in C (or C++ can't recall, I've not looked at it yet) as is the upcoming OA toolbar simply because of the smaller file size that it's possible to obtain (and in the case of the driver - because that's the way the Driver Development kit likes it).

I've written code in C# before and actually quite like it. I just don't like the .NET framework which needs to be downloaded. Funnily enough, I don't have the same prejudice against Java...

[Mongol]

After a smooth eight or nine day run I went and treated myself to an Online Armor license. My gift to me for the holidays...;D

[MikeNash]

-{ Quote: " My gift to me for the holidays...;D" }-

Impeccable taste. ;)

[SG1]

Came across mention of OA here yesterday, and d'l trial ver. of it (as I'm getting rapidly fed up with Webroot's SS).

Seems to me that, offhand, OA is a bit like ProcessGuard - is that more or less correct? Was going to maybe buy PG as DrWeb AV was fixed, I guess, so that it doesn't clash with PG any longer; but, I also wondered about OA - as I seem to read quite the high praise of it here. If one has OA, would you even need PG? {That's not an "us vs them" query, as I most certainly have numerous apps that are similar in their approach to security, so I'm not adverse to having more than one app that is "like" something else}.

Your thoughts on the matter appreciated, as always,
SG1 (pat)

[MikeNash]

-{ Quote: "Came across mention of OA here yesterday, and d'l trial ver. of it (as I'm getting rapidly fed up with Webroot's SS).

Seems to me that, offhand, OA is a bit like ProcessGuard - is that more or less correct? Was going to maybe buy PG as DrWeb AV was fixed, I guess, so that it doesn't clash with PG any longer; but, I also wondered about OA - as I seem to read quite the high praise of it here. If one has OA, would you even need PG? {That's not an "us vs them" query, as I most certainly have numerous apps that are similar in their approach to security, so I'm not adverse to having more than one app that is "like" something else}.

Your thoughts on the matter appreciated, as always,
SG1 (pat)" }-

Hi SG1,

OA has a bit more to it than Process Guard.

Aside from Execution protection, it has mail and web protection, phishing filters, dns checking, HOSTS protection, anti-keylogger, startup and embedded IE objects filtering.

The idea is that if you're surfing, for example, you can get a warning about embedded objects in webpages. Allow them anyway? Well, you'll get a warning if they try to run, set themself as startup, install as a browser extension, etc.

And, if you accidentally allow something to run - it can be rolled back by OA (created files and registry entries).

Hope that helps.


Mike

[MikeNash]

-{ Quote: "I will install the latest version of OA and let you know if my system still feels sluggish. If it does, I will take you up on your offer." }-

Hi Defenestration,

How did you go ?

Mike

[Defenestration]

Hi Mike,

Been a bit busy the last few days. I will install it right now and get back to you.

[Defenestration]

Mike,

Just installed it using the trial licence key given on the download page (ie. "f43a09e707c8a36160eca62ff6cbbb89"), but OA came back with Service registration error. Activation key is expired.

[MikeNash]

-{ Quote: "Mike,

Just installed it using the trial licence key given on the download page (ie. "f43a09e707c8a36160eca62ff6cbbb89"), but OA came back with Service registration error. Activation key is expired." }-

I'll PM/Mail you a new key?

Mike

[Defenestration]

Thanks Mike. Got it.

[SG1]

Mike;

Nice of you to drop by, and reply to my query - thanks.

Opinions-queries thus far of trial with OA; and these are just thoughts in passing. I may have missed something, or didn't understand all involved at the time - as I'm most certainly not a programmer, and never could be.
==============================
a) Seems app, at install completion, wanted to "check" something online immed., re lic. or key if I recall. Well, we're always warned to have everything off, as far as possible, when installing an app. - so of course, one's not online at the time of installing. I have seen apps that let you "register" offline, by just popping in the key or lic. # into a dialog box, even when just for a trial of said app.

b) After installing the app, I rebooted, got online and went through the process needed, and one gets to "clicking Finish" time and then boom, a restart occurs - while I had many security apps on, and was online at the time, of course.

Well, unless I missed something there, how about a question of IF one wants to shut down apps and get off line first, before the Finish button zooms one off to immed. reboot. Not sure, but I think a "rude" immed. restart like that with apps open, and modem fired up, can lead to bit of a mess, can't it?

c) Seems that OA didn't "know" many of the major name brand security apps - and I think I gave OA permission to allow them, incl. a help file(?) of JavaCool's Spywareguard - but it asked again at startup, if I wished to allow or not allow something therein - and I hoped I picked the right choice, as I do want his apps running too, while online.

d) With HOSTS file, it showed entries that had permission to run. As almost all those entries come from Spybot (or perhaps one of Javacool's apps), I do want to leave the Yes - permissions set to Yes for those - to be allowed?

==========================

Now, having said that or asked about "how-to," with OA, I must say your program seems to be a real winner and a keeper (and I will likely buy it shortly). Keep up the great work. ;-) I'm rapidly coming over to your camp, I think, & would be happy to drop that wretched kludge, SpySweeper.

*** BTW - are OA and DCS' PG similar, in that they may clash if both running at same time on a PC - you know? *** Just wondering, as I'm one to run many similar apps.

Best, SG1 (Pat)

[Mongol]

Straying off topic briefly, I have Process Guard and Online Armor both running here. There is no clash at all. I can do a tiny bit more fine tuning with Process Guard but I am really wondering myself if its worth having them both. Especially with Online Armor version 2 coming in the next few months. I've heard rumors that it will make tools like Process Guard unnecessary...:o :D

[MikeNash]

-{ Quote: "Mike;

Nice of you to drop by, and reply to my query - thanks.

Opinions-queries thus far of trial with OA; and these are just thoughts in passing. I may have missed something, or didn't understand all involved at the time - as I'm most certainly not a programmer, and never could be.
==============================
a) Seems app, at install completion, wanted to "check" something online immed., re lic. or key if I recall. Well, we're always warned to have everything off, as far as possible, when installing an app. - so of course, one's not online at the time of installing. I have seen apps that let you "register" offline, by just popping in the key or lic. # into a dialog box, even when just for a trial of said app." }-

Yeah, people hate the online activation inside Online armor. So much so that we've decided to get rid of it (or, at least, significantly de-fang it) in the 2.0 version.

-{ Quote: "
b) After installing the app, I rebooted, got online and went through the process needed, and one gets to "clicking Finish" time and then boom, a restart occurs - while I had many security apps on, and was online at the time, of course.

Well, unless I missed something there, how about a question of IF one wants to shut down apps and get off line first, before the Finish button zooms one off to immed. reboot. Not sure, but I think a "rude" immed. restart like that with apps open, and modem fired up, can lead to bit of a mess, can't it?
" }-

Yikes! There's a checkbox there that gives you the option :( Maybe I need to make it bigger, or change button positions...

In my experience, the worst that a restart can do is cause you to lose unsaved data in programs if windows tries to terminate them and you have something like a save dialog on the screen.

-{ Quote: "
c) Seems that OA didn't "know" many of the major name brand security apps - and I think I gave OA permission to allow them, incl. a help file(?) of JavaCool's Spywareguard - but it asked again at startup, if I wished to allow or not allow something therein - and I hoped I picked the right choice, as I do want his apps running too, while online.
" }-

OK, Now is probably as good a time as any to let this out of the bag :))

In Online Armor, there's a trusted app list - and you're right, it doesn't recognise certain programs. The reason for this is that I have not really updated this list in about 2 months or so (the list is not critical, so protection is not impacted). The reason why this list has not been updated in so long will become clear in a few days... watch and wait :)

-{ Quote: "
d) With HOSTS file, it showed entries that had permission to run. As almost all those entries come from Spybot (or perhaps one of Javacool's apps), I do want to leave the Yes - permissions set to Yes for those - to be allowed?
" }-
Yes, thats right. HOSTS in OA is horrid. Everyone else has said it, and so I guess I can too. If you have a look over at our forums, or around here you'll see how it was designed to work - and how it's actually turned out in the wild. It's getting a revamp in version 2

==========================
-{ Quote: "
Now, having said that or asked about "how-to," with OA, I must say your program seems to be a real winner and a keeper (and I will likely buy it shortly). Keep up the great work. ;-) I'm rapidly coming over to your camp, I think, & would be happy to drop that wretched kludge, SpySweeper.
" }-

;D Great. Just wait till you see what's coming in the (Free upgrade) to version 2 !

-{ Quote: "
*** BTW - are OA and DCS' PG similar, in that they may clash if both running at same time on a PC - you know? *** Just wondering, as I'm one to run many similar apps.

Best, SG1 (Pat)" }-

Similar, but don't clash. Some users run OA alongside many different security apps. We try and play nice.

[MikeNash]

-{ Quote: "I've heard rumors that it will make tools like Process Guard unnecessary...:o :D" }-

I think I have said before that my Goal with Online Armor is to make it the only security application that needs to be run.

Now, before all of the defense in depth and redundancy guys get upset with me here, and run to get the guys who hate "Security Suites" let me explain.

Yes, with Online Armor 2.x you will have a firewall. No, you will not need other protection apps, such as Processguard. But, you will still be able to run them, and you will still be able to disable the parts of OA that you don't like.

Think PG's execution protection is better than OA's ? Disable it in OA and install PG instead. Prefer Tiny Firewall to OA's firewall? Well, turn off your computer and seek medical help. Really. Online Armor is the least of your problems.

My objective is simple. If you plan to buy just *one* security program (instead of 6 or 7) then it should give wide-ranging coverage, be easy to use and affordable. I want that program to be Online Armor.

We'll be aiming for best-of-class in each feature that we implement.


Mike