Gaps in Coverage with These Tools?

Hi all!

In my seemingly never-ending search for Vista security , I'm looking at AVG and Avast Pro. I'M NOT LOOKING FOR A COMPARISON, OR SIMPLE "X IS GREAT" posts (hopefully that satisifies the mods )

What I'd like to know is what gaps in security remain in each tool on a Vista machine. For example, I don't think Avast Pro includes a firewall. In particular, are there any gaps with rootkits, keyloggers, and similar malware coverage with each tool? Reason I mention this is some tools have functionality that works with XP, but not with Vista.

Thanks in advance for the help, its appreciated!

 

Avast free should be enough, although there is some gaps cause no script detection and firewall, but with comodo firewall alongside and spybot, should be fine! AVG does not have http scanning unlike avast. also, malicious scripts are very rare since it is contained within the browser and rarely get out.

P.S. This thread may get locked.

 

I was worried about that. I'm looking at both tools, and rather than creating two threads I hoped to keep it in one (since its really on the same subject).

 

AVG doesn't have rootkit detection though it does offer a separate tool for that. Unfortunately the Vista version isn't ready yet.

 

A few around here (including me) have noticed a slowdown with Avast on Vista.

 

You layed some valid groundwork for what can be a beneficial discussion and most are grasping what direction We are trying to achieve in these type discussions.

in case it was missed in your initial post....
I'M NOT LOOKING FOR A COMPARISON, OR SIMPLE "X IS GREAT

Carry on,
Bubba

 

AVG and avast are just antiviruses. You would still need a firewall and you may want a HIPS or sandbox for protection from unknown malware.

As for rootkits, keyloggers, etc, I think a separate app may be better. Various antispyware have keylogger detection and theres numerous rootkit detectors to choose from.

 

well, maybe im just old fashioned.

ive certainly never felt the need for anything other than an antivirus.

this is how it used to be, and how it still is.

i would feel extremely comfortable using only an antivirus, probably ANY tested by av-comparatives.

but of course, i do still have a hardware firewall with the router.

 

Well, assuming that you have chosen to maintain UAC active, there's really few gaps there. After all, you'll be explicitly approving installations. That goes a long way to controlling the situation. It's not an be all, but it's a big step, and you have an AV as an active security measure to provide some level of screening of the applications that you purposely choose to install.

In jumping between OS'es, it's important to step back and look at some of the fundamental differences in the two platforms, and this is one. As long as you don't disable the functionality, it provides a positive benefit.

Blue

 

Blue brings up a good point. There are several differences in the security setup of XP and Vista. Vista has these new features in which some were borrowed from Linux:

UAC--akin to the root/user accounts in Linux. For years I have been seeing complaints about MS's OS's not being as secure as Linux. And now that Vista has come out most people turn this most important security feature off complaining about the prompts

ASLR-Address Space Layout Randomization (also borrowed from Linux and BSD)-this is a proactive defense against exploits such as buffer overruns by randomizing the code into different memory locations on each boot. It makes it more difficult for malware to find certain codes in memory.

IE7 Protected Mode--similar to a sandbox, IE7 runs with the lowest privileges. Nothing can be installed without your consent. When I was testing IE7 I visited a 'crack' site that wanted to install something called "Data Control Service" or such. You know this is bad news, lol.

There are more new features such as Network Access Protection and Service Hardening. These are all explained here.

 

I've seen plenty of comments along these lines, and after purchasing my wife a new Vista based laptop, why anyone would even contemplate disabling this is simply beyond me. It's about as innocuous as possible, provides decent protection, and is a native facility.

Blue

 

why?

because its a pain in the butt.

some people dont use a computer to get annoyed by 2/3 pop up and clicks for every program they want to execute.

+ prevx vista beta requires it to be disabled.

 

You do not get prompts for every program, only programs that make changes to your system. If you have something, for example, like a paint program that is requiring a prompt, that is more of the result of bad coding than Vista. For too long software writers have been given free reign over parts of the system they have no business in and UAC is forcing them to be more responsible in their coding.

I can imagine that the reason Prevx is calling for UAC to be turned off is the fact that it hasn't been coded to work in Vista properly yet. I have never seen a finished program that requires you to turn off UAC.

 

I really have to agree bigtime on this. Unless you really tweak Vista in all different way's, it's really a pain in the butt!.
Vista is IMO still in beta stage.


Cheers

 

I agree that UAC can get annoying. Try using TweakUAC and set it to quiet mode (still get the protection but not as many annoying prompts and it's a standalone executable, so no install needed).

 

Absolutely. It's really the same reason behind LUA being something of a problem in XP. Although it has improved over the years, too many programs were unnecessarily coded with the presumption of full (and typically unneeded when you get down to it) administrative privileges. In past years, when most machines did not spend the bulk of their hours on the internet, it wasn't a major issue. Well, that situation has changed.

Blue

 

well, i aint too fussed that it needs to be turned off for prevx beta.

prevx does exactly the same as UAC (and more....) as i have it set on Query at all times.

 

When I was on XP my security setup consisted of a suite, Spybot, SpywareBlaster, Ad-Aware, MRU Blaster, and others I cannot think of at the moment. From the experiences I had the past year with Vista and UAC I feel that all I need is just a basic AV/AS/FW. Some people get by with even less.

Vista reminded me of Linux when I first tried it out. You have to get yourself into a different mindset and throw away old adages from past Windows. To this end I believe those who have dealt with Linux or Macs would be the first ones to appreciate UAC. To me, taking a second to click approve/disapprove is worth the added security. It beats several minutes or hours trying to clear a nasty out of the system later.

InfinityAZ has suggested a compromise with TweakUAC. This might help those trying to make the transition into the LUA world. For me, I rather get myself conditioned right to begin with. The only tweak I performed on UAC was to eliminate the "blackening" effect because it doesn't look good on my computer.

I haven't tried the Prevx beta but if it does what you said it would it would be the first I have seen to require disabling of UAC.

 

they are working on them getting to work together, but it does the same plus more than UAC.

 

Ok, I see now. It is an improvement of UAC which could actually use some more tweaking. I will definitely look into this when it goes final

 

that query screenshot was only a windows update, yet when you have it set to query, it does what UAC does, plus checks for malware/behaviour etc.



i dont think i need more than just an antivirus, never have.... but i just love it (prevx 2.0), so why not use it.