Realtime protection: SAS Pro or Windows Defender?

Windows Defender came free with my new PC and Vista. But I also use SAS Pro. I don't believe that I shoudl use both for real time protection.

If you were selecting between these 2 (not others), which would you choose and why?

 

SAS Pro without a second thought.

Windows Defender is a M$ security program/not very good.

 

I've deactivated Windows Defender in favor of SAS Pro.
I liked Giant, but not this one.

 

Hi,

SAS pro no doubt. Also take a look ot TheatFire (with customm rules)

 

Id choose SAS Pro as well.

 

Just like the other posters, SAS Pro without a doubt.

 

I'm always the odd man out...

If I ran as an Admin account only, I'd run Defender real-time with SAS as the manual scanner. Defender's manual scanner is pretty much worthless but based on what I've seen, it's real-time scanner appears to monitor more than SAS's does (one example is the HOSTS file.) The reason I would use this only under an Admin account is because Defender uses Windows Update to update, so updates will only function under an Admin user. (If Defender is going to be used, check this thread for some additional advice from RejZoR.)

However, under a Limited User, I'd use only SAS. Defender runs under a Limited account but it won't update under a Limited User and unless MS has recently fixed it, it doesn't prevent intrusions under a Limited account either...

 

SAS Pro vote here also.

 

I believe this is the thread hes talking about: Make your Windows Defender more effective!

 

Yes, that's the one! Sorry!

 

Part I: I see many votes for SAS Real time protection. Would the people that voted please expand on their vote?

SAS Pro strength appears to be in the detection/ removal. Windows Defender strength seems to be in it's active Shields. Using each according to it's strength appears to be the best of both worlds. Does SAS Pro have better active protectilon, better detection.removal, or both?

Part II: Can you still use SAS First chance prevention with Windwos Defender Active protections enabled?

 

It's just a preference, never liked MSAS and certainly not Windows Defender. I also think SAS is better, since it's updated pretty often and their support is really good.

Don't know about detection, since there aren't a lot of tests done with it.
Besides they all do miss some and give false positives.

I've used so many anti-spyware programs, but till now SAS doesn't need a lot of resources and offers good protection together with my other security tools.

Yes, I even had Windows Defender active together with AVG AS, as well as SAS.
Tried it with CounterSpy, Spy Sweeper and it ran quite well.

 

I doubt that you are seeing many votes for SAS realtime protection; just about all the votes you are seeing are based on the fact SAS has a reputation for removing certain difficult malware, but that is NOT the same as prevention which is what you are interested in.

Yes, but detection and removal are more a function of demand scanning than realtime protection. It would depend on your requirements but WD will be monitoring more bases. SAS would probably offer better protection on the things it recognises, but the interesting question to ask is what happens if something new comes along?

Yes, but not necessarily the best of all possible worlds; I know you don't want to hear this but there are better solutions for realtime protection, if SAS cannot recognise something as bad it is limited in its protection - CounterSpy on the other hand has execution protection which prevents any unknown file from running, and hence making adverse changes, unless you approve it. This is the best possible protection against drive-by downloads since the malware cannot run unless you foolishly allow it. If SAS does recognise the malware file then the chances are your AV will as well - so unknown malware is the biggest danger.

 

If I leave UAC (user account control) on in windows vista, this pretty much accomplishes the same thing as counterspy's execution prevention, correct?

 

There really would be no point in paying for SAS Pro if you're not going to use the realtime protection, just get the free version and use Windows Defender for realtime protection like you said. Adding Spyware Blaster wouldn't hurt either if you haven't already.

Defender certainly isn't all that for detection, but I did once have it find something that Kaspersky and my other AV scanners didn't, so it's not completely worthless.

 

I wouldn't say so. A user account has limited permissions which restricts what damage malware can do; however some malware exploits do work in user accounts (I believe the .wmf exploit was one example). However execution protection could prevent the malware running at all.

Another thing, CS can prevent adverse system changes unless you specifically allow them. Thus even if you allow a malware file to run (by clicking yes to the execution protection pop-up) it cannot make changes to those areas of the registry covered by CS unless you give permission via another pop-up. That is different from WD which merely informs you of changes after the event (by which time it may be too late). This, incidently, is why SAS fails all the AS tests like Spycar - because it cannot prevent adverse changes unless it recognises the presence of malware. CS on the other hand can prevent such changes from ever occuring even though it may be confronted by a threat it doesn't recognise.

CS also covers areas like the Hosts file etc, perhaps it covers less areas than WD but more than SAS (I've not checked width of coverage though!). I think SAS does not protect against commercial Keyloggers either (perhaps someone could confirm?) which is another reason some reviewers have been luke warm.

 

Spyware Terminator has a great real time shield as well.