Testing Out AVG Suite Also

[huntnyc]

Like others, i am trying AVG 7.5 suite for a while to see how it is. So far so good.

However, I only adjusted two settings so far. First, I scheduled a detailed complete test to run every week and then I adjusted Residential Shield to scan all files. Is there anything else I should be on the lookout for as far as adjusting settings? Anyone else who is using it, your feedback greatly appreciated and thanks. i guess what I am looking for is settings that might tighten the security of the program compared to the default settings. Thanks again.

Gary

[C.S.J]

yeah sure, edit the complete test to scan all files (This can be done in advanced layout)

antipsam - high performance / more agressive
firewall - block ICMP
resident shield - scan all files / tick all apart from scan PUP's
shell extension (Settings) - scan all files / untick scan active processes
action to take - set to prompt user for virus and continue scanning for warnin

hope that helps a bit.

[huntnyc]

Thanks a lot and it helps a lot. but, what do you mean by tick all apart from scan PUP's?

And, where is the Firewall setting you mentioned?

Sorry for the followups but just not clear on these and thanks again.

Gary

[C.S.J]

resisdent shield, tick all but do not tick PUP (Potentially Unwanted Programs)

in the firewall settings, you will see a TICK (green) nexto to ICMP network diagnostics, block it to X (red)

[huntnyc]

Yes, I found that and edited that rule to block it. And, thanks for clarification of all. So far this suite is running very light as you have previously indicated.

Gary

[C.S.J]

yep extremly fast... check your boot time? :) big difference, and apparently avg has vastly improved, cant wait to see the next on demand result, the next one from av comparatives is only the retrospecitive one :-\

glad your enjoying it at the moment,

[huntnyc]

Do you know if this suite also protects against Rootkit threats? I don't know much about those anyway but just curious.

Gary

[C.S.J]

yes it protects from rootkits, as does:

Rootkit revealer – www.sysinternals.com/Utilities/RootkitRevealer.html

UnHackMe – www.greatis.com

F-Secure www.f-secure.co.uk

Kaspersky – www.kaspersky.co.uk

McAfee – www.mcafee.com

Norton - www.symantic.co.uk

Trend - www.trendmicro-consumer.com

Panda - www.pandasoftware.co.uk

im sure there are more, but at least it answered your question. ;D

[huntnyc]

Thanks and I will keep using it for a while and see how it goes.

Gary

[huntnyc]

@C.S.J

Regarding settings for Updates, did you do anything with that? Is there a way to adjust the frequency of updates? I am looking at the Scheduler but don't know which options to choose regarding the type of update task to set up. I am leaning toward recommended update schedule but just wondering if you made any adjustments to this and thanks again.

This suite is running so light compared to anything else I have used so far.

Gary

[C.S.J]

-{ Quote: "@C.S.J

Regarding settings for Updates, did you do anything with that? Is there a way to adjust the frequency of updates? I am looking at the Scheduler but don't know which options to choose regarding the type of update task to set up. I am leaning toward recommended update schedule but just wondering if you made any adjustments to this and thanks again.

This suite is running so light compared to anything else I have used so far.

Gary" }-

just leave it on what its on.

if you like though, you can add another schedule for priority updates which is usually the signatures, to perform every hour if you like, simple to create this if you want to.

[huntnyc]

Thanks. I think I will do just that for good measure.

Gary

[huntnyc]

Just one negative I have found now with AVG suite is the cluky way it handles infected files sometimes. it will give you a choice to heal or move to vault and then you have to go to vault and manually delete them. I guess this is what you were driving at with the cookies thing. I really don't like this at all. Would like to have smoother deletion of viruses.

Gary

[C.S.J]

i like this move to vault thing, as its safe in there and can be deleted anytime you like.

the vault can also be accessed from microsoft outlook, which is a nice option.

[huntnyc]

I guess since I am using TheBat! plugin from AVG, this is why I found it to be a little clunky but I see your point. Just would have to get used to it I guess. Still a fantanstic suite though.

Gary

[C.S.J]

-{ Quote: "I guess since I am using TheBat! plugin from AVG, this is why I found it to be a little clunky but I see your point. Just would have to get used to it I guess. Still a fantanstic suite though.

Gary" }-

im 'hoping' they will fix the tracking cookie issue though, then i wont have any problems with it.

when it finds a tracking cookie, as im sure you now know huntnyc, it will pop up with the option to move to vault, then pop up again ... and again ... and again, shouldnt do this for just tracking cookies, they should be treated automatically as ewido anti-spyware did.

[huntnyc]

Agree with you on that. Will keep an eye on this. Might be tempted to at least test NIS 2007 but although improved, I really don't like Symantec as a company that much. And, still hanging out for either NOD32 3 or maybe KIS 6 but I am not thrilled about the firewall interface at all. Other than AVG right now, what else do you think is top notch to you? Thanks.

Gary

[C.S.J]

you wont be dissappointed with norton IS 2007 either,

to be honest, when choosing what to buy, i was going through a crazy should i pick norton 2007 / avg or f-secure, i like all 3, i really do .. and all are great, but all do have faults at certain things as expected.

[huntnyc]

I guess it comes down to finding the one that runs well on your system, is well balanced in all areas and has the least number of "fualts" that you will be able to tolerate during the license period without taking too much away from enoying using the product.

Never tried F-Secure and might try Norton but AVG still looks good for now. Will continue to try it out and thanks.

Gary

Gary

[C.S.J]

was testing out the plugin for avg suite for email scanning in microsoft outlook.

turned off the suite completly, and tried to send the eicar virus to myself, the plugin popped up (not the program) saying it had a virus and had to block it.

nice to know the ms outlook plugin still operates when the program is not on.

[huntnyc]

Sounds very good. Don't use Outlook but I suppose it would work with TheBat! as well hopefully.

On F-Secure and Norton 2007, wht did you find to be their biggest negatives?

Gary

[C.S.J]

f-secure was boot time and scan speed but super security.

norton 2007, was a little basic... all options are configured after install, basically just install it and thats it, if i had to pick a negative, it would be the super long time it takes to install it.

[huntnyc]

Sounds like if I want to run something on both of my computers with no extra cost, Norton might be the one although i have not used it since 2003 version when i went to NOD32. Like NOD32 a lot but still looking for suite I can run on both machines. Have heard there is a limit on how many times you can install Norton and I am not fond of that at all. Thanks.

Gary

[C.S.J]

avg is cheaper than norton, as nortons 3 pc licence is i think £79.99 GBP

but, yes there is a limit to how many times you can install it, if you went with norton 2007, id recommend:

partition your c: into (c: and e:)

install norton 2007
create image using acronis
and whenever you want a fresh start, restore from that image.

id recommend doing a fresh format, then install your programs and then norton, defrag and then create the image, so its a perfect fresh start whenever you want.

[huntnyc]

I hate to be concerned about those things with Norton but will think about it. Thanks.

KIS is very expensive and I think you can install on only one PC. My wife is seldom on the internet with her computer so I may just run free stuff on that machine anyway. AVG, Norton, F-Secure, KIS or NOD32. AVG still running very light here so far.

Gary

[huntnyc]

Going to have to leave AVG because I just found the way it repeated found various temp files as infected annoying because no matter if you send them to vault they just keep pooping up in warning box. Maybe my system is mixed up but with Nod32, Ewido 4, Comodo FW and Spyware Terminator RTM do not have these problems. May look at KIS next but not sure. Enjoyed this suite except for this annoyance which I could not get around in a way that would be acceptable to me. Thanks again for good feedback.

Gary

[C.S.J]

is it tracking cookies?

or just viruses in your temp.. if it is viruses, i think you should be happy avg is finding them and moving them to vault.

[huntnyc]

It says something about Worm something. I might give it another try but I just did not like it. If I copy and paste the text when it comes up maybe you can help me with it. I really do like just about everything else about the suite. Will take a while to reinstall but I will give it a go and let do its thing a few more days. When I used Bullguard 7 nothing like this was found or with any other antivirus program I have used of late so would like to know. Maybe this is some kind of trojan or perceived trojan. Will see the message again later I am sure and will get back and thanks.

Gary

[C.S.J]

OMG, if its a worm ... let the software move it to the vault, thats nasty if its a worm.

maybe a screenshot?

and if it keeps coming back in your temp internet files, i really suggest changing the websites you use, as a certain website keeps giving you the worm, if this is the case.

[huntnyc]

I have not reinstalled AVG Suite yet but will do so later today to give another go. It is truly amazing no other security programs give me that warning but AVG suite. Either it is better than the rest in that respect or something is not right with the detection on this one. Would like to know for sure. Will let you know when it pops up again and it may be tomorrow evening on this but I will find out about this. Will try to post a screen shot if I can. Thanks again.

Gary

[C.S.J]

yeah post a screen and maybe send the file to www.virustotal.com and check what the other vendors say about the file.

avg doesnt usually give many fp's, just 3 in the last av-comparatives.

[huntnyc]

Will take just a little time but I will let you know and thanks again.

Gary

[huntnyc]

How do you see AVG's coverage of HIPS related protection. Do they have anything that is like KIS's Proactive defense or someof the similar defenses? I don't think I saw anything like this but I could be missing something. Would I need to run any program to supplement it and thanks.

Gary

[duke1959]

I was just wondering what leak tests the AVG firewall passes like Tool Leaky, PC Audit ect... I understand this isn't always that important, but I'm just curious.

[ellison64]

The AVG suite doesnt have anything as in depth as kis proactive defence,and the firewall is pretty basic.It is meant for the user that just wants to get on about thier buisness and not be bothered with technical jargon or popups that that they have no idea about what to action or disable anyway.Its the sort of suite that i could happily install on my mothers pc and know that she wouldnt get into difficulties running it.If you are worried about hips and leak tests ...then AVG suite is not for you.If you want a no-nonsense suite that you dont have to worry about ,then itsdefinitly worth considering.
ellison

[duke1959]

I do believe that a no nonsense suite with no worries is exactly what I would want ellison64. So thank you for your reply.

[huntnyc]

For just a bit decided to take a break from the suites and run my regular setup with a little twist as in NOD32 Beta 2.7, - along with Comod FW, Spyware Terminator RTM/HIPs and Ewido 4 on-damand. Probably will stay with the idea of putting BullGuard 7 on my wife's machine and that is another set it and forget it suite you might think about also. Still like a lot about AVG but just a little too many steps for me to fool with some "detected" files but will not rule it out yet. When and if I get back to it, will let you know and appreciate all the feedback and this and all subjects here.

Gary

[C.S.J]

i have to say though, on this thread that that latest updates from avg have seen a big improvment on the software, the cookies problem has been fixed, the auto healing works properly now, never had a failure on anything.

also, i set my outlook express to move messages that are tagged as [SPAM] by avg to an avg spam folder automatically, and its very easy to set up and works perfectly, its so far... caught 100% of spam in the last 2 days and moved it correctly to "AVG spam folder"

http://www.imagehosting.us/index.php?action=show&ident=1741046

if nobody knows how to do this, it takes 10 seconds and will gladly help anyone who wants to do this, i do recommend it.

also, i think the ram usage has lowered by a good 20 mb or so, i will keep my eye on it to see if it fluctuates, but all looks good,
current ram usage is 44.9mb, but as stated before.. runs a whole lot quicker than ANY other suite, with a super super boot-up time.

http://www.imagehosting.us/index.php?action=show&ident=1741059

good work AVG,
lets continue with the updates :)

[huntnyc]

Trialing this suite again and you are right. I have not had the problems since they have provided these updates to properly deal with cookies. They seem to be very responsive to improving thier product and it does run lighter than any of my setups so far. Will keep trialing and look forward to more input from others. Thanks again.

Gary

[duke1959]

Does anyone get anything in their logs like I do? I get logs that I think are about AVG blocking my Wireless IP adress from contacting the Router, but I'm not sure. I was also getting logs that I now believe was because I had netbios enabled, but after disabling it I know longer see the log message I use to. Sorry I'm not writing what these logs are, as I emptied them earlier I just haven't received any yet. The one I still get occasionally though, that I mentioned in the beginning, is something like Filter Device blocked with the destination IP address being 255.255.255.255.67. I googled it, and as far as I can figure this has something to do with my Wirelss PC trying to go out to the Router or Service Provider. Any help?

[huntnyc]

Just curious when i do detailed complete scan with AVG suite, it says it scanned just over 113,000 obejects but with NOD#@ 2.7 RC! and Antivir suite, they scan well over 300,000 files, almost 400,000 files scanning the same drives. Why the difference I wonder since I have AVG set in the test to scan all files? Thanks.

Gary

[Don Pelotas]

-{ Quote: "Just curious when i do detailed complete scan with AVG suite, it says it scanned just over 113,000 obejects but with NOD#@ 2.7 RC! and Antivir suite, they scan well over 300,000 files, almost 400,000 files scanning the same drives. Why the difference I wonder since I have AVG set in the test to scan all files? Thanks.

Gary" }-
There is no point in looking at the number of files scanned...every AV counts them in a different way, so you could in fact have two scanners that scanned the exact same number of files, but said 117000 & 217000.

It's the same with the number of signatures, the one with the low amount could potentially detect more than an AV with a "impressive number like 510000 instead of 170000.:)

[huntnyc]

Thanks Don. I am glad to hear that.

Gary

[DVD+R]

I tested it, and I'm glad I did before purchasing it. I dont like it at all,:thumbd: its just AVG AntiVirus with plugins for Firewall/AntiSpyware Its nothing like the Standalone Programs of AVG AntiVirus Professional 7.5 and AVG Anti-Spyware 7.5

[C.S.J]

plugins for firewall?

the only plugins are for email, which work a treat.

the firewall is there, built into the suite.

and avg antispyware runs when you do a full scan,

yes it looks like avg antivirus as IT IS AVG, they have kept the UI which im glad they did, as the basic interface is a good one in my opinion.

but, thats what trials are there for, to try it :)

[duke1959]

Hey C.S.J. Am I right in assuming that the AVG Antispyware Component not only scans, but is also for RealTime protection as well?

[huntnyc]

AVG Suite scan speed just over an hour. Antivir Suite about 35 minutes NOD#@ 2.7 RC was 28 minutes. All scanning all drives. No program found anything threatening thankfullly.

Gary

[C.S.J]

-{ Quote: "Hey C.S.J. Am I right in assuming that the AVG Antispyware Component not only scans, but is also for RealTime protection as well?" }-

yeah spyware, gets trapped whenever it finds it while surfing.

[ellison64]

-{ Quote: "I tested it, and I'm glad I did before purchasing it. I dont like it at all,:thumbd: its just AVG AntiVirus with plugins for Firewall/AntiSpyware Its nothing like the Standalone Programs of AVG AntiVirus Professional 7.5 and AVG Anti-Spyware 7.5" }-

It is the pro version with integrated firewall.While i would like more options for the anti spyware plugin ,i am also thankful that it still supports 98 (for the diehards)whereas the standalone anti spyware doesnt.I guess if you are a poweruser it may not appeal to you as it just sits there doing its job without any problems....quite disconcerting....even for me sometimes;)
ellison

[Firecat]

-{ Quote: "Hey C.S.J. Am I right in assuming that the AVG Antispyware Component not only scans, but is also for RealTime protection as well?" }-
Real-time spyware protection is only for Windows NT/2000/XP/Vista. Windows 98/ME users do not get this.

[duke1959]

Thanks C.S.J and Firecat. Two more questions if I may. I'm showing these Firewall Logs. Application > Filter Device, Direction > Out, Protocol > UDP, Local address > 192.168.1.101.68 with Remote address > 255.255.255.255.67. And. Application > Windows\System32\svchost.exe, Direction > In, User > NETWORK SERVICE, Protocol > TCP, Local address > localhost135, with Remote address 0.0.0.0.1024. I believe the first one is my PC asking for a new IP address from the DHCP service on my router or something of that nature, and even though I'm not sure what the second one is I don't think it's spyware. So my two questions are. How do I set up a rule (or find out where to) that allows them access? And should I?

[Firecat]

-{ Quote: "Thanks C.S.J and Firecat. Two more questions if I may. I'm showing these Firewall Logs. Application > Filter Device, Direction > Out, Protocol > UDP, Local address > 192.168.1.101.68 with Remote address > 255.255.255.255.67. And. Application > Windows\System32\svchost.exe, Direction > In, User > NETWORK SERVICE, Protocol > TCP, Local address > localhost135, with Remote address 0.0.0.0.1024. I believe the first one is my PC asking for a new IP address from the DHCP service on my router or something of that nature, and even though I'm not sure what the second one is I don't think it's spyware. So my two questions are. How do I set up a rule (or find out where to) that allows them access? And should I?" }-
I'm sorry, I am not using the AVG firewall so I'm not sure. :-\

I have noticed some very strange behaviour with the AVG Anti-Malware suite which could also apply for the AVG Internet Security suite.

I noticed that on certain infected samples, AVG reports the samples as being "suspicious" even when they are actually detected by signatures by either the AVG or Ewido engine.

I had a few samples which were detected by signatures with Ewido engine and heuristically by AVG Antivirus engine. However, AVG Anti-Malware reports the files as being suspicious (the AVG engine detection) instead of actually being infected (as Ewido engine detects it). Not such a big deal but it is not such a good thing because it can lead to people unnecessarily sending samples for analysis simply because AVG reported it wrongly...

[C.S.J]

-{ Quote: "Thanks C.S.J and Firecat. Two more questions if I may. I'm showing these Firewall Logs. Application > Filter Device, Direction > Out, Protocol > UDP, Local address > 192.168.1.101.68 with Remote address > 255.255.255.255.67. And. Application > Windows\System32\svchost.exe, Direction > In, User > NETWORK SERVICE, Protocol > TCP, Local address > localhost135, with Remote address 0.0.0.0.1024. I believe the first one is my PC asking for a new IP address from the DHCP service on my router or something of that nature, and even though I'm not sure what the second one is I don't think it's spyware. So my two questions are. How do I set up a rule (or find out where to) that allows them access? And should I?" }-

the firewall will block thins like svchost.exe and filter device all the time, i wouldnt worry about this at all, it wont block any new application, unless you select it to block, as for dhcp services, just make sure you have it ticked in the firewall settings, and this will allow it forever.

[ellison64]

-{ Quote: "Thanks C.S.J and Firecat. Two more questions if I may. I'm showing these Firewall Logs. Application > Filter Device, Direction > Out, Protocol > UDP, Local address > 192.168.1.101.68 with Remote address > 255.255.255.255.67. And. Application > Windows\System32\svchost.exe, Direction > In, User > NETWORK SERVICE, Protocol > TCP, Local address > localhost135, with Remote address 0.0.0.0.1024. I believe the first one is my PC asking for a new IP address from the DHCP service on my router or something of that nature, and even though I'm not sure what the second one is I don't think it's spyware. So my two questions are. How do I set up a rule (or find out where to) that allows them access? And should I?" }-
I think youll probably get rid of the first set of logs by enabling internet connection sharing under system tab (its disabled by default).Not sure about the svhost ones though (i use 98 )
ellison

[C.S.J]

i have ICS turned on,

i get scvhost and filter device logs, but id rather the firewall be logging stuff than not doing.

if it aint causing any problems etc etc, why bother worrying about it?

[duke1959]

I wasn't worried C.S.J, just alittle curious is all. I also appreciate your and everyones input in this forum, and want to thank them and you. I like the AVG Suite, and am contented enough with it to finally stop trying other protection software. Just how good though, do you or others believe the new 7.5 is now as Antivirus with it's latest improvements? AVG has been very close to Avast in the AV Comparitives before the improvements, and I can't imagine it won't surpass it now. Also the Antispyware Componnt should be one of the top AS Protection Programs around, and since Grisoft bought Ewido,and I would image both are better than before. Take care.

[C.S.J]

-{ Quote: "I wasn't worried C.S.J, just alittle curious is all. I also appreciate your and everyones input in this forum, and want to thank them and you. I like the AVG Suite, and am contented enough with it to finally stop trying other protection software. Just how good though, do you or others believe the new 7.5 is now as Antivirus with it's latest improvements? AVG has been very close to Avast in the AV Comparitives before the improvements, and I can't imagine it won't surpass it now. Also the Antispyware Componnt should be one of the top AS Protection Programs around, and since Grisoft bought Ewido,and I would image both are better than before. Take care." }-

i have also stopped testing others and sticking with avg suite, its sooo fast, especially boot-up times.

when we complained a few times on here about a few things, and sent a few emails... they soon fixed all that with updates, so updates can come quick and fast whenever they are needed.

as for detection, i really think avg suite will give a detection of the highest quality with ewido signatures added, and avg has improved too ... mainly with heuristics / detection and removal, which is what you want really.

i really do think avg will surpass avast and maybe some of the big boys, but IBK aint saying. ;D

my only worry would be, with ewido joining... yes their detection for malware was great and will improve avg's but it did have FP's, but only time will tell.

[duke1959]

Glad to hear this C.S.J. The only small gripe I have with the AVG Suite, and maybe it's the way others are, is that it doesn't offer more information or features in it's Antispyware Components, or really even in the Firewall one like it does with the Antivirus Component. I guess this to keep it simple which is fine, but I miss the way the User Interface was in the stand alone AVG Ant-Spyware program, and would like a little more information in the Firewall Component. (logs programs ect...) not complaining, just wishing. LOL. What's your opinion on Leak Tests? Is it really that important how many a Firewall passes? Talk to you soon.

[C.S.J]

well avg antispyware is just ewido 4.0 with the name altered.

avg suite is ewido signatures built into the scan and realtime.

[Firecat]

-{ Quote: "i have also stopped testing others and sticking with avg suite, its sooo fast, especially boot-up times.

when we complained a few times on here about a few things, and sent a few emails... they soon fixed all that with updates, so updates can come quick and fast whenever they are needed.

as for detection, i really think avg suite will give a detection of the highest quality with ewido signatures added, and avg has improved too ... mainly with heuristics / detection and removal, which is what you want really.

i really do think avg will surpass avast and maybe some of the big boys, but IBK aint saying. ;D

my only worry would be, with ewido joining... yes their detection for malware was great and will improve avg's but it did have FP's, but only time will tell." }-
Unfortunately, I've already had instances of AVG's anti-malware finding FPs through the ewido engine, but they fixed it (even though they took 15 days to do it).