What security setup do you have?

[DJG]

yeah for some reason I haven't seen any good comment about them too,but as far as i care the moar the merrier gonna try it out to see if it works on seven
btw did you try the tests from comodo?

I ran the Comodo leak tests - I scored 270 out of the 340. How did you do?

 

[KazeNoKoe23]

Can't believe so many people disable UAC. There's no reason for it.

Anyway, my setup is pretty basic. NOD32 v4.0 x64 + UAC enabled + Windows Defender enabled + Windows Firewall.

 

[pparks1]

Can't believe so many people disable UAC. There's no reason for it.

Well, keep in mind that UAC is generally designed for the less savvy computer user who might be unaware of what they are doing. For many enthusiasts here, they are well aware of what they are doing and they do want to do it and not be bothered by it. Personally, I just leave it enabled as I really don't see it too much...but I could see others not wanting the disruption.

The sad part is, for those who really do "need it", they don't take the time to read or even question why something is just happening and go ahead and blindly click on ok.

 

[MadMax]

Aah! That's who they're from? I'll check them. Although do I trust tests from a provider of firewalls to be impartial :sarc: ???

oh yea:sarc: but neither of us are using comodo at the moment so if it leaks it leaks

I ran the Comodo leak tests - I scored 270 out of the 340. How did you do?

got 280/340,although the result is a bit faulty

4. RootkitInstallation: ChangeDrvPath Vulnerable

that result is wrong cuz kaspersky gave me popup,but then again who knows:huh:

23. Impersonation: ExplorerAsParent Vulnerable

gets right pass outpost,even while it says that it blocked it in the log,how about you?

24. Impersonation: DDE Protected

another wrong result,cuz it gets pass outpost too.

lol all in all an inconclusive result,but yeah we're leaking
btw are you using the x64 version of win 7?

 

[A320]

Well, keep in mind that UAC is generally designed for the less savvy computer user who might be unaware of what they are doing. For many enthusiasts here, they are well aware of what they are doing and they do want to do it and not be bothered by it. Personally, I just leave it enabled as I really don't see it too much...but I could see others not wanting the disruption.

The sad part is, for those who really do "need it", they don't take the time to read or even question why something is just happening and go ahead and blindly click on ok.

Having said all that, due to what I stated earlier I have Defender now off, is there any real reason for me to turn it back on, considering my computer knowledge level?

 

[DJG]

oh yea:sarc: but neither of us are using comodo at the moment so if it leaks it leaks
...
got 280/340,although the result is a bit faulty
...
lol all in all an inconclusive result,but yeah we're leaking
btw are you using the x64 version of win 7?

I'm running x64 RTM.

Quote:
4. RootkitInstallation: ChangeDrvPath Vulnerable
Got that ...

Quote:
23. Impersonation: ExplorerAsParent Vulnerable
Got that ...

Quote:
24. Impersonation: DDE Protected
Got that ...

Also got as vulnerable:

8. Filedrop
11. SetWindowHook
12. SetThreadContext
16. DupHandles

Hey, a guy's gotta take a leak every now & then :sarc:.

 

[tw33k]

A320

You know we all think it is more complex than it truely is sometimes. Just a matter of finding out. You solved it. I like the saying if you hear hoofbeats think horses not zebra's.

Glad you are working and I think you will like eset

Ken

Occam's razor: "when you have two competing theories that make exactly the same predictions, the simpler one is the better."

applied to pc errors this theory rings true 99.999% of the time

 

[AlexT2889]

I got 200/340, meh, just wait till Windows 7 recieves security updates after the first month of availability and RTM of MSE 1.0 then things will improve. Comodo website labels my OS as "Vista SP0 7600".

 

[MadMax]

I'm running x64 RTM.

Quote:
4. RootkitInstallation: ChangeDrvPath Vulnerable
Got that ...

Quote:
23. Impersonation: ExplorerAsParent Vulnerable
Got that ...

Quote:
24. Impersonation: DDE Protected
Got that ...

Also got as vulnerable:

8. Filedrop
11. SetWindowHook
12. SetThreadContext
16. DupHandles

my complete list would be
4. RootkitInstallation: ChangeDrvPath Vulnerable
5. Invasion: Runner Vulnerable
8. Invasion: FileDrop Vulnerable
10. Injection: SetWinEventHook Vulnerable
11. Injection: SetWindowsHookEx Vulnerable
15. Injection: KnownDlls Vulnerable
23. Impersonation: ExplorerAsParent Vulnerable

I got a KAV popup for number 4 and most probably a popup from OP for the rest(too many popups to keep up with lol) except for 23,damn thing is oblivious to a attack of that kind :S
btw could you pls run firehole and post the results,it kinda uses the same tactic as number 23 and get right pass OP

Hey, a guy's gotta take a leak every now & then :sarc:.

lol word :roflmao:

 

[wallyinnc]

The sad part is, for those who really do "need it", they don't take the time to read or even question why something is just happening and go ahead and blindly click on ok.

Agree and I wonder whether I am becoming one of those...
I have an additional issue and question: I set up separate users for my kids as Standard users. Now every time they log in there are at least 3 programs (all ASUS) that require my Administrator passoword to run. Why UAC doesn't learn what programs we have once (or many times) authorized to run and then we dont' have to do that anymore (I read about viruses disguising as the actual programs. I think in that case we will just blindly click anyway).
Is there a way to avoid the issue with the startup programs?

 

[pparks1]

Perhaps considering scheduling tasks for these applications at startup per the advice of this guide.
Guide: Bypass UAC for startup programs

 

[Mercurial]

I ran the Comodo leak tests - I scored 270 out of the 340. How did you do?

LMFAO...eset says the comodo leak test is a trojan... how the hell did you even able to download it? (unless you're not using eset =D) oh god you're in big trouble with your current protection LMFAO.

basically comodo leak test is a virus simulator that test if the OS can be infected with the different methods a virus uses...

but eset doesnt even allow it to land on my hard drive =D so I guess I get 340/340? LOL

so yea eset FTW...

 

[MadMax]

LMFAO...eset says the comodo leak test is a trojan... how the hell did you even able to download it? (unless you're not using eset =D) oh god you're in big trouble with your current protection LMFAO.

basically comodo leak test is a virus simulator that test if the OS can be infected with the different methods a virus uses...

but eset doesnt even allow it to land on my hard drive =D so I guess I get 340/340? LOL

so yea eset FTW...

well we all know that it isn't a trojan now don't we,and just cuz eset has a signature for that perticular test(maybe a cheap way to avoid failing:sarc doesn't mean that eset would protect you from a similar attack method.
no it doesn't mean that you got 340/340
and if you're using the 32 bit version of eset or whatever you're using,don't even bother comparing it with a 64 bit security product(yet) its a fact that almost all the 64 bit security solutions we currently have are weaker

 

[Kari]

Been using MSE now about a month and a half. Nothing to complain, it was working well. Today I got this dialog telling a new version is out, do you want to upgrade. Yes, clicked I and that's when problems started.

Installation runs until almost to the end. Then comes this:



Contacting M$ tech forums and telling about error code, I got a nice and typical answer: "Uninstall any other virus or malware software. If you do not have any other virus or malware software and this error occurs, please file a bug report. Have a nice day."

I decided to wait the final product. A little nepotism on my mind, I thought I'll try a Quality Product from Finland. Went to F-Secure's website and found "F-Secure Technology Preview 2009". Downloaded this F-Secure internet Security 2009 Beta, and I have to say I think I found my security suite.

Stunningly easy and clear user interface:



Easy to use and configure, works well with Win7. The beta program allows me to use this until February 2010, so there's enough time to test and build an opinion before I have to decide if I want to buy the final product.

For those interested, here's the download link.

Kari

 

[pw2buz]

My security setup

I have a Thinkpad T41, 2GB RAM, two HD (Seagate 100GB & 80GB). Win7 is on second, 80GB, HD; XP (plus Puppy Linux) is on the 100GB HD.

For Win7 I use Windows Defender, Windows firewall, and AVG 8.5 free, which I installed yesterday. AVG replaces Kaspersky's anti-virus beta for Win7, which was posting more than 50% CPU usage (as reported by Resource Monitor).

pw2buz

 

[geeve420]

Using Antivir free edition, Spybot, UAC on, windows firewall.

 

[Dinesh]

I have a very strong protection:
NOD32 4 AV.
Windows Firewall.


Yes, i mean it. That's a solid protecion.

 

[Mercurial]

well we all know that it isn't a trojan now don't we,and just cuz eset has a signature for that perticular test(maybe a cheap way to avoid failing:sarc doesn't mean that eset would protect you from a similar attack method.
no it doesn't mean that you got 340/340
and if you're using the 32 bit version of eset or whatever you're using,don't even bother comparing it with a 64 bit security product(yet) its a fact that almost all the 64 bit security solutions we currently have are weaker

lol why so serious? the fact that it caught a program that contained malicious code alone means its a really good protection, it also means that if any program that has the same code init will be caught too so meh =D... and cheap? i don't think that app is in esets virus database yet LMFAO...

and what? weaker? LOL? 64bit doesn't mean the program to be entirely different... 64bit apps just takes advantage of the CPU powahhrrr... scans faster and whatnot so meh...

wrong info my friend =)

 

[MadMax]

lol why so serious? the fact that it caught a program that contained malicious code alone means its a really good protection, it also means that if any program that has the same code init will be caught too so meh =D... and cheap? i don't think that app is in esets virus database yet LMFAO...

and what? weaker? LOL? 64bit doesn't mean the program to be entirely different... 64bit apps just takes advantage of the CPU powahhrrr... scans faster and whatnot so meh...

wrong info my friend =)

okay well as long as you're LYFAO it shouldn't matter
yup weaker,due to patchguard it makes a world of difference to anything which heavily depended on kernel patching.
read up instead of rofling:sarc:

 

[darkassain]

okay well as long as you're LYFAO it shouldn't matter
yup weaker,due to patchguard it makes a world of difference to anything which heavily depended on kernel patching.
read up instead of rofling:sarc:

well acording to what i know there are api's which make it able to secure the kernel without such patching (and as you with every bug there is a possibility of exploit)...
it might be weaker protection but it is better than nothing...
to me kernel patching is bad thing (coming at this from the a security and stability standpoint) because your are messing with the core of windows itself and any bug in their kernel drivers can cause massive consequences...
sophos was even quoted saying

However, Sophos argues that its approach to HIPS technology has met with no problems on both the low-spec and high-spec versions of Windows Vista. In addition, Sophos claims that Microsoft has so far provided all the interfaces that Sophos needs for providing this form of protection.

"Symantec and McAfee may be struggling with HIPS because they haven't coded their solutions with high-spec Vista in mind," said Richard Jacobs, CTO of Sophos.
"We've taken a different approach, by focusing on catching bad behaviour before it has a chance to occur. Additionally, we are building our technology by making use of supported Microsoft interfaces rather than by trying to subvert them. That's why we're ready for 64-bit Vista, and others aren't."

Symantec and McAfee 'should have prepared better' for Vista - V3.co.uk - formerly vnunet.com

and the corporate edition of symantec's antivirus has not been using KPP for some time now (which i used to use for some time now, when i was in HS and for a while in college)...