Using 2 anti-trojan programs with both guards enabled ?

I am presently on my 3rd week of the trial version of Trojan Hunter and was going to purchase the software. However, I was provided with a 1 year licence to A2 Personal recently & I really like the program. I am presently running both A2 & Trojan Hunter with the guards enabled & have not noticed any issues as yet. Is this recommended ? I would still like to keep Trojan Hunter after the trial period.

 

Hi,

Slightly off-topic:
While posting this I have BOClean and TDS-3 (with exec protection enabled), and NOD32, resident on my old W98SE box: no problem
Frequently I scan my whole system with TDS-3; in that case I disable BOClean and any other scanner to give TDS-3 all the room it needs.

I too have TH, which I use for on-demand scanning.
I don't have A2 (I had Ants some years ago).
I have to leave the specific question about those two both resident to others.

 

Hi,

Sometimes I have BOClean and Ewido running in real-time and I have never had a problem. However, I have never had a situation where either has caught anything in real-time (KAV seems to catch everything), so I do not know what would happen if both alerted on the same trojan at the same time in real-time. Has anyone ever had this happen.

I do know that it once happened to me with two registry tools and it was a mess since both were trying to "undo" the registry at the same time. Totally fried my registry (this was before I installed RegDefend which catches the program before anything is entered into the registry instead of undoing it).

It would be interesting to hear of a real-life situation.

Rich

 

Hi Rich,

Previous to having the licenced personal version of A2, I was running the free A2 scanner & the full trial version of Trojan Hunter (manual updates). At that time no detections took place.

Once the A2 Personal version was installed & licenced, the A2 Guard immediately alerted me to a malware .exe file within my Program Files\Common Files\AOL File. This malware was posing as part of my ISP (AOL) Program & nothing (not even Norton AV) had detected it previously.

CounterSpy had detected a file called server.lock related to this malware in the same folder but was unable to delete it.

It was only after speaking to a tech at AOL that I felt confident to delete this aoltpspd.exe file, as he assured me that it was NOT part of the AOL program. After this .exe file was deleted I was able to delete the above mentioned server.lock file as well.

Needless to say I am VERY impressed with A2 !!!

 

Hi Hard Rocker,

Sounds good. I will give A2 a try, but the last time I tried it out it didn't find anything. KAV is such a darn good program and coupled with ProcessGuard and RegDefend, nothing seems to get through any more. Today BitDefender's online scanner did detect two minor pieces of malware which are borderline spyware. But it was nice to see that BitDefender was tracking down stuff that KAV may have missed. Possibly they are a bit more aggressive than some of the other ATs. But I will give A2 a try again and see if it discovers anything.

Thanks for the tip,
Rich

 

Rich,

I also have the BitDefender free scanner & like yourself with A2, it has not detected anything as yet. However, RegDefend sounds very interesting. Can you provide a reputable link ? I'm not familiar with this program. Is it a program that can mess up your registry if you aren't careful ? I do NOT have much experience in the registry department !!

 

Straight from the developer at http://www.ghostsecurity.com/index.php?page=regdefend

It's worth becoming a member (it's free) because you get a discount (15% I think).

RegDefend does not mess up your registry at all, it protects it. It's completely configurable and allows you to block read or modification attempts on registry keys or values. It's a very powerful program and you can read more at the link above.

 

Thanks a million for the great link Defenestration & also the heads up on RegDefend !!

HR

 

Getting back to the original question...

I used to think that running two A/T's (or two A/V's, for that matter) resident at the same time was a bad idea, but not anymore.

Something is going to get to a piece of malware first, IMO, because the odds against any two programs being hooked into your system at exactly the same level are pretty high.

Here (most of the time) I witness NOD32 picking off stuff before anything else has a chance to get ahold of it - which is fine - but only if it's something NOD has a def for, or can pick up heuristically.

If it doesn't/can't, I would expect the next thing down the line that's running resident and that does have a def or is able to pick up the malware heuristically to nab it.

IOW, if it's okay for anyone to run both an A/T and an A/V resident at one time (and apparently it must be if all the A/T software manufacturer's provide real-time "guards" for you to run resident), then it must be okay to run two of anything simultaneously (richrf's experience with his registry monitors being the obvious exception).

About the only realistic chance for "conflicts" that I can see is if you're trying to auto-start a bunch of similar resident monitors at start-up - but if you start your back-up A/V's - A/T's manually after your primaries are up and running, that shouldn't be an issue, either - because your primaries are going to get first shot at something.

So - why run more than one? Well, there's always the chance that your primary (whatever) might miss whatever piece of malware you've just happened to trip over - having a back-up (whatever) resident monitor running might just pick that up and save you from a nasty infection.

Of course, if you haven't the resources for this kind of stuff (mainly as much RAM as your computer will take and a modern OS), you're very likely to cause yourself either slow-down - or even freeze-up - problems.

Have to say I agree with richrf, though - one A/V, one A/T, PG and RD makes for awfully good protection.

I run more than that, but mostly because I like to see lots of pretty icons in SYSTRAY - and because I can. Pete

 

Hi Hard Rocker,

And, of course, they have their own excellent forum right here on Wilders'

https://www.wilderssecurity.com/forumdisplay.php?f=72

Rich

 

I just had a smile on my face when I saw your systray Pete
Anyway I am using nod32, Ewido and Boclean "on access" and all the rest on demand (tds-3, trojanhunter, giant, adaware+spybot)

 

I don't subscribe to the two of anything is O.K. school of thought - at least not where AVs are concerned. Have a look at this thread:- http://castlecops.com/t102982-Manual_remove.html

But ATs don't hook into the system so deeply as AVs (which is howcome they can co-exist with an AV) so you have a better chance of running two ATs successfully.

 

Thanks for all the very interesting replies and links guys !! Especially Spy1 for the informative post pertaining to my original question ......... LOL

I have learned so much in the short time that have been a member here at Wilders. However, compared to a lot of the experts here I certainly have a long way to go !!!

Regards,
HR