Combining AV's not done, but very effective!

Hi All,

Trustport obtained the highest ratung in the last AV comparatives test. (AV=Anti Virus, AS = AntiSpyware)

Trustport Combines the AVG free, Ewido (now AVG AS), Norman and Dr Webb, so in effect it is AVG paid (AV+AS), Norman and DrWebb.

Most Wilders Members always argue that out of the free AV's Antivir is best. Only the free Antivir is the AV engine only, without the AS. In other tests this reduced the effectivitu of AVG and ANtivir with 75 t 90 percent (depends off course on the test samples used).

For a friend with an average dual core with 2 GIG mem running Vista with UAC in quiet mode and Vista FW, I have set up this combo:

1. Antivir free (only has AV engine)
a) set to check at write only
b) set with heuristics high (Avira has one of the best heuristics)

2. Avast free (has AV and AS engine)
a) set with standard shield OFF (dus no execution, read and write control). This to prevent overlap with Antivir.
b) set with the other (except Outlook) shields ON, being P2P, Web, Internet Mail, Messenger, Network

I told him this combo would be as good as Kapersky (I know it is a bold statement). He is really a security Noob. He also told me that everyone is warning him not to combine AV's. I only showed him Trustport and said that it is true when they conflict, but Avira and Avast do not conflict with this set up. It is a Best of Both worlds setup,

Any comments/ideas/discussion?

 

Re: Combining AV's not done, but effective?

Forgot to tell that I gunned down Notify.exe with Vista security properties (not allowed to execute).

 

AV's don't conflict eachother if you properly exclude their folders.
They only compliment eachother unless devs use some crappy way of hoking stuff that hogs down everything. Stay away from such antiviruses anyway even if you use them alone. They are no good if they do such things...

 

just u wait till the day that one starts getting FPs from the other's update packages orcrashes from new updates and patching..if you like that anyway you should consider a multiengine product Gdata is great

 

Chris,

Friend did not report any of such problems. I think this 'wait until' are one of the myths of combining an AV.

Regards

 

I know for a fact that KAV and NOD32 v3 don't play well together. There may be others.

 

KAV, doesn't go with any its got to be on its own. Just don't put 2 realtime scanners or firewalls on one go.

 

Yep,

Some AV do not match and should not be matched. But the combo Avira and Avast work wondefully well together.

 

If it works, its good!

 

Kees! let me ask what you are going to get by adding Avast to Antivir?
It will add a minimal of extra protection only( if ever). U can,t totally protect a PC from viruses even if u install Virus Total( supposing it to be possible). One good scanner is more than enough. If I am in ur place I would have added ThreatFire or some thing similar( Prevx ABC, PRSC, N Antibot etc) in addition to Antivir( with medium heuristics).

 

Can't imagine cobining Avast and Avira is more safe than just Avira. Avira is safe enough. I will only slow things down, isn't it?

 

well both scanners are tops in performance but still,if files are opened three times thats gonna have an impact.altough if you only use your pc for surfing and non intensive stuff and u like it,why not

 

so have they dropped bitdefender?

or is it now?

1. AVG AM
2. NORMAN
3. BITDEFENDER
4. DRWEB

 

Of course, 2 AVs often do not get on well with each other and cause major problems/crashes, whereby usually, simply uninstalling them both and then installing one usually fixes it.

There is a large slowdown with 2 AVs and little additional protection attained by using 2 AVs (because of often a large signature/detection overlap)

Add each AV to the other's exclusions to minimize the possibility of conflict.

2 AVs can be done. Just keep an eye out for problems. Any sign of instability and you know what to do

 

try to limit web browsing to 1 (or maybe 2 max) engines.

use the 4/5 or whatever for purely on demand scans.

 

Aigle,

Why Avast?

Avast free is the AV + AS. Antivir freee is only AV. I have seen some test reports where the free version sof AVG and Antivir scored 75 to 85/90 percent of the paid version (AV plus AS versus only AV).

So reason one is: Avast free = AV PLUS ANTI SPYWARE

Reason two is that Avast has modules whch check data before it is executed (the Web shield for instance). In terms of protection you want this malware to be killed before it is executed (f.i. in a webpage). Because Antivir takes care of the file writes to disk, Avast takes of all the incoming data streams. This means that Avast discovers earlier than Antivir. Earlier is better is a golden rule. Third reason Avast has got a Network module which acts as a simple NDIS (mostly against worms), so all and all it is safer.

Secondly Trustport proves that combining different engines increases the protection level (see AV comparatives).

It turns out that execution and read checking of AV's account for the highest CPU delay. With this setup Avast incoming streams and Antivir writes the combo is amazingly fast.

The higher AV protection level combined with the LUA of Vista gives a lot of protection.

Why not TF?
I tried TF with him, let him download a few test files. ThreatFire tells often to only proceed when you trust the program. The Noob trust the program so he choses YES! So even TF was to difficult.

Regards Kees

Regards Kees

 

I do not know exactly, I will take your word for it.

 

Nope Avira = write, Avast = incoming data streams (try it) you will see

 

No overlap
- Avira is AV only and checks only at writes (no data reads)
- Avast is AV + AS and standard shield is OFF, so only incoming data streams like P2P, Internat Mail (PoP3), Network shield (sort of light NDIS) and Web Shield (HTTP scanner).

All these services of Avast free are not in Antivir free

 

I've used this combo (avira with webshield from avast) for a long time. No conflict. I exclude the tempory folder avast uses. The combo slows down the boot-up for about 2-3 seconds in my machine (sempron 2500+, 1gb, winxp sp2). Other than that, everything goes well.

 

slightly, but both are top notch products with low mems and webshield is included...

 

From my personal tests, combining certain av's didn't cause me any trouble. I had 4 of them running side by side at one point with no problems apart from the expected performance drag. I definitely found it a more effective setup when i was purposefully trying to get infected but for the average user its probably overkill.

 

Shek,

Do you have Avira checking on reads and writes or writes only?

Regards K

 

both read and write.

 

Shek,

Try write only and feel the speed improvement.