Avast and Drivesentry function comparison?

I would like to run just one security app - I know I'm unusual.

I'm looking at Avast using network, standard and web shields OR Drivesentry.

Avast is a pure av play and runs well. Drivesentry is a HIPS with av.

Avast is well-known and has a better pedigree than Drivesentry. Avast has a better forum (probably the most civil you can come across).

Things going through my mind:
Is the Drivesentry av as good as Avast's?
Does DS offer greater all-round protection than the Avast shields from a functional perspective?

I'm not looking for I think Avast is better than DS or vice-versa.

Keen to hear FABs (function, advantage, benefit).

Thanks,
Ian

 

I would pick Drive Sentry because of the HIPS feature.

 

I agree with the Avast forum being very helpful. And it doesn't seem to conflict with much at all, or anything I've tried.

You can also use it as an on-demand scanner, if need be, and its web scanning is quick.

I've yet to try drive sentry, but with the new version of Avast coming, it is rumored to have some sort of 'behavior blocker' and possibly a 'firewall', I think you'll see many good things to come from Avast! in the up-coming months.

 

I wouldn't say a webguard is for everyone, but I like knowing when a page is trying something I'm unaware of.

Avast's webguard also operates while using sandboxie. So your browser is sandboxed, nothing can bust out, but Avast would alert you the page is 'malicious' or trying to download a trojan etc.

Then at least you have an idea not to go back to that page, say, when using another's system which is less secure.

 

Drive Sentry
+ bargain deal (life time lisence)
+ nice way of looking at protection (file and regsitry access)
+ for a HIPS it throws releatively few pop-ups
+ trickle update is a smart way of pushing latest protection to customers (in stead of time based check for updates, it provides a signature as soon as it is developed, so it nearly provides the actuality of in the cload architecture without the possible weakness of needing a working internet connection)

- Current registry protection does not include all startup items (the stupid limitation of adding personal regsitry protection only withinh HKLM/HKU software hive. makes that you can not compensate for this, while the mechanisme is allready in place )
- Current granularity is to wide, even potential dangerous programs like Internet Explorer get write access to files and registry, like the above downside this can also be overcome within existing program when they should differenttiate between the standard and advanced rules (so yes IE gets by default access to write to registry, but no not all startup rengistry entries, same applies for file/folder protection)
- Some parts of program are still not well developed, for instance logging is on all events, you do not want that you want exception logging (easier to find out what went wrong, it i slike looking for a needle in a hay stack now), also you can include folders, but can not exclude folders at the moment for protection, this makes fine tuning your folder/file protection difficult without sacrifying system performance.
- Relatively young AV company, so their experience in writing generic blacklist fingerprints is questionable (their large fingerprint data base indicates on this), so a new variant of a known family of malware might be missed by DS.

The first three remarks can be dealt with very easy, because DS allready has the infrastructure to provide this (some how the development team is behind their release calendar and this causes tunnel vision, by not implementing those quick wins).

Regards Kees

 

To keep the discussion in one place, I have merged a number of posts from this thread into the ongoing DriveSentry free no more? thread.

Bubba

 

And Kaspersky already has every single one of them in its latest beta . Problem is they seem like addon instead of full-fledged features.

 

... and still it's not my cup of tea - how unfortunate. I don't remember why, but it doesn't behave in a way which is my liking... I could think of going with Avira FREE, though, if they would just add that automatic operation possibility finally...