Are web AV scanners worth a hit on browsing speed?

Yes or no? Do it without comparing A to B. Just say I have a web AV that affects browsing speed. Is the extra security worth it?

 

I can't use Sandboxie on Vista 64-bit. Do you have the same opinion?

 

Hello,

Based on what you say that Anti-Viruses with HTTP traffic scanners built in are not worth even if they slow your browsing speeds down a bit?

I believe it's worth the sacrifice to keep your computer secure.

Do you know how many web pages out there are infected with malicious SCRIPTS and your computer might get infected in a blinking of an eye by a drive-by download?

HTTP A/V scanners will filter the contents of the page much before its contents are downloaded to your web browser (i.e.: Internet Explorer, etc.)

Just my 2¢

Regards,

Carlos

 

"Extra security" compared to what? Firewall only? Something else? Or nothing?

 

I have the AV and a firewall + HIPS.

 

Same here.

But as with all security solutions, it all comes down to personal taste and perception of the danger.

 

Only crappy HTTP scanners affect performance. avast! probably has the best performing HTTP scanner that doesn't affect performance and also provides great protection.
So far i've only seen few isolated problems on avast! forums where there was most probably something rong with system itself.
NOD32 for example works much better now but still locks up most of the time when file is downloaded and NOD32 checks it. This almost never happens with avast!. BitDefender HTTP scanner was quite slow all the time in BD v10.
Same goes for Kaspersky 2009...

 

For me avast! or NOD32 HTTP Scanner always worked very well without impact on browsing...

For me this feature is a must have...

 

Just want to be sure you are referring in your question to the web (as in web shield) component of the AV, as ably demonstrated by Avast, or referring to having an AV installed generally.

If the former, I believe it is an added and very useful layer of defence. Reason: Every so often there is a case, with a lot of AV's, where the malware, or a variant of it, is identified, but the application cannot completely remove it. Either because the application isn't strong in the removal routine required for the particular beast, or the beast is a variant with different file names/fingerprints/ default disk install paths etc.

I don't expect an AV - any AV - using blacklist technology, can stay ahead of a malware that is morphing, or has several new variants frequently released. So if you are relying on blacklist technology - at least in part (as I do)- having a module that blocks it before it even gets to the disk is mighty fine.

If the latter, well, unless the HIPS you use is very capable, set up correctly, and you know how to use it and what any prompts may portend, I would say "hang on to your AV."

I'm fairly certain your question pertained to webshield- like modules of an AV, rather than AV generally, but just wanted to be sure.

 

In my opinion, yes, I allways keep my Web-AV running - I personally do not see a slowdown or any negative effects with having my web-AV active and can only see benefits now-and-then (blocking of scripts and malware while its being downloaded).
Guess it depends on how much the webAV slows you down at the end of the day - I dont see any slowdown with mine, so there's nothing to loose for me at all.

 

Web AV tends to affect very high speed connections (over 10MB or so) more adversely than the slower, older ADSL connections.... if it is having a negative effect on your browsing then turn it off...as long as your file protection/other security measures are running then you should be fine.

 

I reaffirm the fact that Web Protection provided for some A/V scanners is worth.

For example, I don't know if you guys recall when the SuperBowl web page went bad and infected thousands of visitors a while ago. I visited that page also and I thank God I had an A/V with HTTP scanning installed on my computer. The HTTP scanner part of the A/V detected the threat on that page and neutralized it even before it reached my web browser.
Thus, it's accurate to say that the Web Scanner part of my A/V saved my day, right?

Therefore, I strongly agree that HTTP traffic scanneing feature of SOME Anti-Viruses (Avast!, Avira, Kaspersky, ESET NOD32, BitDefender) is worth every penny even when it MIGHT slow down your browsing speed lightly.

Best regards,

Carlos

 

I use Avast! Web Shield also on two machines, and the slowdown is pretty much invisible, especially with all of the other delays on the internet. And that is where virtually all of the malware I see is discovered and deleted. Using gmail pop3/imap pretty much kills email viruses, which were the wave of the past.

 

Yes, my question pertains to the webshield. I have no problems with a couple of the webshields out there, but of the AVs I want to use the most, they slow me down. Thus, my question.

I do have a high-speed connection, so perhaps that is why I get a performance hit.

 

i think its worth it to have Web AV scanner even you have sandboxie.
KIS2009 detected trojan script (see pics) while i'm browsing the internet using Sandboxie.

If KIS2009 never detected it or clean it, then Sandboxie is my last line of defense.

 

You can also state for which Av the slowdown is (either here or in the AV's forum) and someone may be able to give you advice on speeding it up.

 

I am pretty touchy about anything that slows down perceived browsing speed and performance. But I am willing to use them when their impact is very minimal. 2 that I can think of don't bother me, Avast's and Avira's. There is a very slight delay before you see the page dump on the screen, but as long as that is very slight, I don't mind putting up with it. But I'd say if you're sensitive to this delay, then don't use them. It's pretty much a matter of what you can personally tolerate I guess...

 

We are not just spending money to speedup things , CPUs, RAMs, Video cards, Connections ,etc.. we are spending money to slow the things down , sometimes ...

 

With the crazy increase in "hacked/infected" websites with the rogue antivirus software....(XPAntivirus/Winfixer/XPAntiSpyware/etc)...yet having added protection for your web traffic is desired. Especially for businesses, as the time it takes to clean these infections can get quite high as you scan/remove with a 1/2 dozen good cleaners.

I've been swapping out clients traditional NAT routers/firewalls with UTM appliances running Untangle. It does scanning of web traffic with antivirus, and a slew of anti spyware tools. I've seen marketed decreases in rogue antivirus infections at clients I've installed these UTM appliances at. And as an added note...if a brand new variant does slip past the UTM appliance....it seems it doesn't get fully installed on the workstation..that the UTM appliance seems to block a good part of the installation so it's easy to clean/remove.

Verdict? Web AV scanners are hands down worth it IMO. Sidenote? Have your router/firewall do the scanning...because workstations behind it don't get bogged down by having to run bloated software to do it.

Endian is another UTM distro, a little lighter than Untangle, but not as many features.

Both distros have a "free" community distro, all you need is an older small PC with 2x NICs to run them on.

 

IMO web guard is worth keeping on

 

Yes. Absolutely

["Yes" is too short an answer, wilders doesn't allow it.

 

I have Avira Premium with the Web Guard uninstalled, as I think the main Guard is enough. I also think all browsers nowadays (including IE are safe against drive-by downloads. To be honest I also surf the internet always virtualized.

 

If you don't want webguard, then do run as LUA and full system wide DEP enabled via boot.ini hack. I feel for novices, webguard is a extra layer of security, its like the drawbridge in a fort, it prevents the malware from reaching inside your system and then being detected, rather it stops them right at the gate.

 

Thanks, all. If I want, I can always go to a web guard like NOD32's, that doesn't slow me down. Problem is, I just bought my recent AV thinking they might make changes to the web guard - and they did not. I can't buy one right now.