Could a kernel level keylogger bypass all of this? (x64)

[SpongeGuard]

I'm aware that patchguard has been bypassed now, but I'm curious if pre-patchguard keyloggers could not be hidden by rootkits or by just being kernel level?

I'm by nature a very paranoid person when it comes to web security (suffer from several types of OCD), so I am always worrying about the latest threads (longtime lurker).
So far my security setup consists of Sandboxie (x64 so I don't rely on it completely), Avira Antivir (with webguard/guard turned off as I find it to be more of a hassle than it's worth), Winpatrol, Comodo firewall (defense+ turned off as it prevents many games from running on my system), SUPERantispyware, Malwarebytes, Spybot Search & Destroy, spywareblaster, hitman pro, and lastly microsoft security essentials. I am also planning on purchasing a 1 year prevx license at the end of the month.

Anyways, so I'm wondering - if none of the apps I've said detect ANYTHING, are there any steps I could go about to be 100% sure that there is nothing on my system?

[aigle]

My God!! you need to do some house cleaning. Get rid of Microsoft security essentials, SB, SpyBot, SAS, MBAM, Prevx etc.

Antivir + SBIE + Comodo( I assume u have switched off it,s AV) might be enough IMO. Some scans with HitmanPro.

[Kernelwars]

Hmmmmm.. I would suggest you try keyscrambler free.. (I thought about this setup..feel free to reject and smirk)
Avira free + OA free + keyscrambler free ..:thumb: :thumb: :thumb: :thumb: :thumb: :thumb:

[lordraiden]

Comodo firewall + Sandbox + D+ with any other AV, (keyscrambler) and Prevx Free. You dont need more programs on real time.

Try the latest version of comodo v5 and your problem with the games will disapear. Also due to the whitelist in the cloud the popups has been reduced drastically (1 or 2 afer reboot, and 2 or 3 a week if you install new and unknown software)

[SpongeGuard]

Thanks for the recommendation of updating to v5. The product seems to have VASTLY improved, and I'm loving the lack of interference by defense+. I'm just hoping security hasn't been reduced, but I set security to maximum on firewall and D+ just to be sure.

Also, I don't run any of those programs in realtime. Everything with spybot, SAS, malwarebytes, MSE, etc, is all disabled at all times. I only ever load them to scan, otherwise I use winpatrol and avira guard for defense.

[lordraiden]

If you set D+ in paranoid mode you will get all those popups that Comodo had at the begining. Not recomended.
If you set the configuration to "Proactive security" in the presets you will get the better protection almost without popups due to the cloud and local whitelist. D+ in "safe mode"

All the excutables that are not trusted (they are not in the whitelist) are run inside the sandbox, if you trust in the app and you dont want to run it in the sandbox again you can check "dont isolate this app again" and you will make the app trusted. If you want an app to be added to the whitelist cloud you can always request it in the forum, usually in 2 or 3 days if is a trusted app they will add it.

The firewall should be in "safe mode" in "custom policy" you can't create new rules so any new app trying to access to internet will be automatically blocked.

[SpongeGuard]

Sorry, when I said maximum security I meant I clicked the "max security" box on installation, instead of clicking "optimum security"
Not sure what the difference between those two is, but either way!

I like the whole running unknown apps in sandbox. Unfortunately, however, video drivers + sandbox = not a good idea.

[Meriadoc]

-{ Quote: "I'm aware that patchguard has been bypassed now," }-
For along while now. Anything at kernel mode is game over.

[shadek]

Considering the recent tests, even if infected in this scenario, Prevx provides the best protection by far with its Safe Online feature.

[SpongeGuard]

Well, Comodo defense+ is still giving me a ton of issues. Even without a dozen notifications per day, it's still minimizing my games randomly. I think I'll give onlinearmor a test.

[lordraiden]

-{ Quote: "Well, Comodo defense+ is still giving me a ton of issues. Even without a dozen notifications per day, it's still minimizing my games randomly. I think I'll give onlinearmor a test." }-

I have never had this kind of issues with the games.
If any popups appears, just accept popup if the game is sandboxed check "dont isolate this app again" close the game and open it again.
Another way is add to the trusted files the executable of the game and you will never have any problem with Comodo.

[jmonge]

i believe comodo has a game mode too;)

[lordraiden]

-{ Quote: "i believe comodo has a game mode too;)" }-

Yes, I forgot the "game mode" (right click in the icon) ;D it's new in CIS 5

[jmonge]

yes;D

[lordraiden]

-{ Quote: "Well, Comodo defense+ is still giving me a ton of issues. Even without a dozen notifications per day, it's still minimizing my games randomly. I think I'll give onlinearmor a test." }-

here it is, you can use the "game mode"
http://help.comodo.com/topic-72-1-155-1147-Starting-Comodo-Internet-Security.html
-{ Quote: "Comodo Internet Security

Game Mode – Switches CIS 2011 to Game Mode to enable you to play your games without any interruptions from various alerts in your computer. The operations that can interfere with users’ gaming experience are either suppressed or postponed.

In game mode:
- Defense+/Firewall alerts are suppressed as if they are in training mode;
- AV database updates and scheduled scans are postponed until the gaming is over;
- Automatic isolation of unknown applications and real-time virus detection are still functional.
- Deactivate Game Mode to resume alerts and scheduled scans. " }-

[jmonge]

yes i tested the game mode when my sons play game and not a single pop up;)

[markusg]

are you also installing all windows updates, is your instaled software fully patched?
you can use for exsample file hippo to check
http://www.filehippo.com/updatechecker/
normaly its not needed to install so many programms... but to be fully updated is and good start to be secure.

[jmonge]

ofcourse the patches:)

[markusg]

for most users its not normal.
you can see it in most statistiks, most people are not updating windows and other software
i see it every day. no updates and a lot of malware.
some are thinking its only needed to install as much tools as posible and "i'm" protected. but this is not needed and not the most important.

[jmonge]

yes agree;D even if i didnt get any updates from the the day i format my pc i turn off my updates alerts;D bad me:thumbd: ;D

[SpongeGuard]

-{ Quote: "are you also installing all windows updates, is your instaled software fully patched?
you can use for exsample file hippo to check
http://www.filehippo.com/updatechecker/
normaly its not needed to install so many programms... but to be fully updated is and good start to be secure." }-


Of course :)
First mistake a person can make is to browse on an unpatched system!

[markusg]

yer but not only windows updates, also flash, adobe etc must be all patched. you can also use an limmited user account, dep for all processes, sandboxie, maximum uac i use under win7.
and someother windows configurations, i personaly had no malware since 10 years and use since 6 months no av anymore, its useless for me
when you are using firefox, you can also use noscript + adblock+
more secure is opera. think its one of the most secure browsers

[Boyfriend]

-{ Quote: "....since 6 months no av anymore, its useless for me" }-

Be careful and Good Luck :thumb: :thumb:

[markusg]

I'm :d
and if somethings goes wron, after 5 minutes my backup makes all fine :p but like i said, no malware since 10 years, only on my test pc...

[jmonge]

good man;)