To Use, Or not to Use? AV and Firewall

N

n64man120

2[H]4U
Joined
Jan 11, 2004
Messages
3,498
I'm reformatting my rig and giving it a much better setup with drive partitions and so on. I was wondering what AV and Firewall everyone uses and if its even worth it. This is my "clean" computer and no garbage gets DL onto it. My only concern would be malicious emails. Now i have ZA and Norton installed... seems to be giving a big performance hit. I'm also running a router blocking incomming calls. Are these things needed to keep my system safe and if so what should I use?
 
The only way not to be guaranteed not to have a virus or an attack on your system, is if you don't use the internet or have some sort of secure Operating System.

ZA records the number of attacks that go against my computer, and I've got 5 this month.
 
adri1456 said:
The only way not to be guaranteed not to have a virus or an attack on your system, is if you don't use the internet or have some sort of secure Operating System.

ZA records the number of attacks that go against my computer, and I've got 5 this month.
Click to expand...

lmao, i just looked and i got 50 in 2 hours... why does the internet hate me? :( then again this computer was in DMZ and i just took it off
 
Firewall?

If you have a NAT router, maybe you can live without one...if you configured it to a point where you got zero ZA alerts over a period of time. I'm there, but the software firewall stays. Call me paranoid. (ZA or Kerio)

An aside: Hopefully, I'll have a Smoothwall Linux router built shortly. This is an effective, but cheap solution.


AV?

Norton's does eat resources...lots and lots of them.
Take a look at NOD32.

While you are looking around, take a look at PocoMail. It is an extremely secure mail client.
 
Kerio or Zone Alarm would be your two best choices for a firewall. Sygate is another thats fairly popular. I use Kerio myself.

The new SP2 firewall seems to work alot better then the original. I dont know how it stacks up against a REAL software firewall though.

AVG would be my first choice for a free firewall. NOD32 and Kaspersky are both really good but you'd have to pay for those two.
 
Here's my home security setup:

Inexpensive D-Link router/firewall. (It's amazing how far a little NAT goes)
Windows firewall.
Symantec AV that I don't even allow to run in the background, and is just used to manually scan downloaded files and email attachments from sources not 100% trusted.

While I don't recommend being this lax to the average user, I can say that I''ve never, ever, had a single infection of any kind. (Unless you count spyware, and that was before I learned the joys of Firefox.)
 
Norton AV is a resource whore.

I like Kerio 2.5 (their best version) and a low resource using AV running, like AVG or Avast. If you can afford it, NOD32 is one of the best AV software out there.
 
n64man120 said:
and if its even worth it. This is my "clean" computer and no garbage gets DL onto it.
Click to expand...

its so refreshing to see someone actually decompile ever bit of code they put on thier computer :p


http://hardforum.com/showthread.php?t=768776
http://www.microsoft.com/technet/security/guidance/avdind_0.mspx

firewalls and AV arent necessary
they can be completely avoided with three simple steps
1. disconnect the computer from the internet
2. encase in cement
3. stand a 19 year old with a rifle over it :p
 
BillLeeLee said:
Norton AV is a resource whore.

I like Kerio 2.5 (their best version) and a low resource using AV running, like AVG or Avast. If you can afford it, NOD32 is one of the best AV software out there.
Click to expand...
A little money spent on this kind of software will go a long, long way. I've spent a few hundred on software over the last few years, in addition to the OS. Still, I spent less than a really good video card costs. When I upgrade rigs, I move the software, too. That saves money, if you don't mind using software as it ages. I still use Word97, for example. My point is that money spent for NOD32 and other security oriented software is money well spent. You can't get freeware for everything. Well, you can, but it may not be the best thing to do everytime.
 
Personally I use Sygate Pro, as I like its wealth of features and relatively small footprint. If you don't neccessarily need all the detail of sygate but good an free protection, Kerio is the way to go.

As far as an AntiVirus goes, I suggest either MKS_Vir (a new product with killer heuristics, but is still in its first release) or AVK Pro (www.boomerangsoftware.com). AVK Pro utilizes 2 anti virus heuristics and definition sets at the same time for greater protection, and its only like $30.

Stay away from Norton at all costs! Zone alarm is in my opinion flawed in many ways but still better than nothing. With a nice little NAT/SPI router, a software firewall, and good antivirus you have a decent measure of protection.
 
AVG Antivirus

Zone Alarm

Computer into Linksys Wireless router into Linksys Cable/DSL router into profit
 
norton system works 2003 (hey, hey, found it in a dumpster)

tiny personal firewall 2.0 (best yet that i've found)

nat

between those 3 and the top 2 are the VERY FIRST things that i install, even before any drivers (well, mouse drivers, so i can use it...)
 
Falls Included said:
norton system works 2003 (hey, hey, found it in a dumpster)
Click to expand...

you ever wonder why it was there?

that pos has caused way more problems than it has ever prevented or fixed
 
how about Thunderbird (set for IMAP), FireFox, Kerio and AVG?

I have separate restricted accounts for email and internet on my sys. The internet account is not set up for any email at all so that if something gets in that way there is no way for it to read the email address book. my email account is not used for surfing, just for emails. obviously it needs an internet connection but IE and FF are never started if at all possible. It is started only for resume submission at sites that are in the newspaper, for example, or for hitting a link in a read email. It is a POP3 while the internet account uses IMAP email reading. obviously all 'net purchases use a non-ISP account.

If you have an ISP never give out your real email address but rather give them a sub account which you have created. Then use mailwasher...
 
If you don't look at shoddy porn sites, download music, and open e-mail attachments, then you're probably not going to need an av prog. And unless you're running a server/website off your pc or broadcasting yourself all over the net, a firewall won't be necessary.
 
poopy said:
If you don't look at shoddy porn sites, download music, and open e-mail attachments, then you're probably not going to need an av prog. And unless you're running a server/website off your pc or broadcasting yourself all over the net, a firewall won't be necessary.
Click to expand...

welcome to 2004 :p
this is called a search engine
search queries may or maynot take you where you think they should
where they may or maynot exploit one of a various number of flaws
and since most people from time to time, want to get something for free
there is this type of software, that is quite popular, its called freeware
(we wont discuss the other kind you pointed out :p)
it may or maynot contain malicious code as well, bringing us to
email and IM which alas no longer require user assistance in many cases
or, are in fact fairly clever with social engineering,
not to mention direct attacks through flaws in the OS or applications
leaving brute force attacks


while your advise is certainly a cornerstone of a security policy
you forgot the rest of the house :p

a few links
3 real security guides

http://www.nsa.gov/snac/
http://www.microsoft.com/technet/security/guidance/avdind_0.mspx
http://www.uksecurityonline.com/husdg/wxpp2.php

and a basic checklist
http://hardforum.com/showthread.php?t=768776
and an out of date linkfarm
http://radified.com/Articles/internet_security.htm
and a security freeware repository
http://www.wilders.org/free_tools.htm

and never, ever, leave your IP Stack hanging in the wind

A conversation with Lance Spitzner, Sun Microsystems senior security architect
and a founder of the Honeynet Project
a Honeynet (or pot) is a system that is bait for intrusion so it can be detected, monitored, mined for data and techniques
and eventually deflected, causing no harm from it, not an easy thing to do, considering the intruder has "root"

Excerpted Transcript
Used with permission from both Lance Spitzner and Dana Greenlee Producer and co-host of the WebTalkGuys
but she is a Lady, and very nice one for letting me do this ;)
and of course Lance for taking time out to give me permission and answer a few questions.

We join the discussion of Honeynets in the middle here

WebTalkGuys: Well Lance lets talk about bait, I mean why would...
does a hacker come to one of these sites just because...
or one of these computers, just because he can or
is there something on there that he'd want,
Do you care about that?

Lance: Thats actually one of the most amazing things,
if you just put a computer out there that has no percieved value
it will probably get scanned 10 to 20 time a day
this is any system Im not talking about corporations, small businesses
If any of your listeners have a connection at home
a home connection dsl cable isdn
and they have a dedicated connection
they are most likely getting scanned ten to twenty times a day, also
just as our systems are
the bad guys are being very active,
because it very simple to hack
you just download a tool and run the tool

WebTalkGuys: Why are they doing this though? dont these people have jobs?
Dont they have lives themselves or do they just sit around?

Lance: Well its very interesting and its one of the things weve learned
beacuse of these honeynets we see what these guys do afterwords, so we can monitor the motives
there is a misconception that people think that alot of these attackers are
misguided youths out exploring the internet
the reality is that the vast majority of these individuals
are criminal intent, in other words to make money
we see alot of time peolple hacking systems and
scanning for stolen credit cards
or thier launching attacks against other organizations
and potentially getting paid for it
or they are dealing in stolen music,
videos, licensed software such things called warez
people scanning or scouring the internet for email addresses
to build databases of stolen email addresses to sell to spammers
stolen paypal accounts
stolen ebay accounts
there is just a tremendous amount of criminal activity going on

WebTalk Guys: Ok so its really a malicious type of environment

Lance: Extremely hostile

----------discontiuity-----------------

a large percentage of the bad guys really dont care what systems they break into
they simply download an automated tool that
will literally scan 16 million computers in a night
and any one of those 16 million computers is vulnerable
the program will break into them

----------discontiuity-----------------

WebTalk: What are some of the most hacked operating systems out there?
Everybody has heard about Windows, but is Windows really the most hacked operating system on the internet?

Lance: No everybody is a potential victim, Windows tends to be very popular just because if the bad guys are going to develop an exploit he gets the biggest bang for the buck, for Windows.

we also tend to see alot of focus on Linux just because Linux is a free operating system
so more economically depressed countries its easier for the bad guys to get access to this OS, understand this OS and attack the OS
For example countries like Romania, Eastern Europe very economically depressed,
so we tend to see
alot of hacking activity coming out of those countries

WebTalk Guys: OK cause certainly as far as the numbers of computers that are connected to the Internet most of them are Unix and Linux arent they as far as the overall number?

No I would actually disagree I would say the growing majority is more in the
Windows side as more and more home users are connecting via broadband

WebTalk Guys: Well thats true and thats a fairly recent phenomenon

Lance: Exactly
and the very scary thing is thats why its becoming easier for hackers because people have this misconception that bad guys only target buisnesses or companies, but they dont realize
anybody, any system with an IP stack is a target
so you have these millions of home users coming online
that have no conception of security, who dont beleive theyre a target,
this becomes a very target rich environment for the bad guys.


----------discontiuity-----------------

More >
Click to expand...
 
poopy said:
If you don't look at shoddy porn sites, download music, and open e-mail attachments, then you're probably not going to need an av prog. And unless you're running a server/website off your pc or broadcasting yourself all over the net, a firewall won't be necessary.
Click to expand...

Lollerberries...

I don't look at shoddy or quality porn sites, download music or open untrusted email attachments. Yet I still sit here behind my router, daily updated AV and software firewall and pay attention to what's going on.

Your kind of attitude is why my router activity light has reached the point where it just doesn't go off at all anymore, it's solid on. Nothing much going on on my side of the router, it's mostly crap from infected peoples computers bouncing off the router.

There's no excuse to not have some kind of firewall and av.
 
i run my dlink 624 as a firewall and the windows firewall on all my windows machines. and i run norton corporate 9 on all my windows machines also. you can probobly get away with no firewall but antivirus is a must imo
 
Even with AV and a firewall I am paranoid. I try to stick to known sites, if it's freeware I try to get it from a known site, and sometimes from two places to compare byte sizes. I don't use instant messengers, I don't use and idle on irc. I don't use P2P. And also because of that paranoia I don't mention what brands of router/av software/firewall I use.
 
You must log in or register to reply here.
Back
Top