Firewall etc

On Wed, 16 Jul 2008 11:48:17 -0700, jo5030
<jo5030 RemoveThis @discussions.microsoft.com> wrote:

> Guys
>
> Thank you all very much for your help. As a result of it, I have
> reconfigured my protection as follows:
>
> 1. I am using my broadband hub as a firewall (for those of you that may
> know it, a BT Home Hub set to Standard security level)


Good.


> 2. I have turned on my Windows Firewall as well with automatic updating,


Good.


> but malware protection turned off


When you say "malware protection," do you mean anti-spyware
protection? Spyware and viruses are both different kinds of malware.

If so, I assume that that means you turned off Defender. That's a
mistake. Defender may not be the single best anti-spyware app
available, but it's much better than nothing, and works well in
combination with other such products. It sounds like you presently
have no protection against spyware, and that leaves you very
vulnerable.


> (and removed Norton).


Good.


> 3. I have installed Avast! On-Access scanner as virus protection


Good.


> 4. I am considering using SuperAntispyware or Spybot as well.


Good, but do more than consider. I would install them both, if I were
you. Just don't scan simultaneously with both.


> To you experts - does this seem enough, and would you advise me to use on or
> both of the products mentioned in 4 above.
>
> Thank you all again for helping me.


You're welcome. Glad to help.




> "Ken Blake, MVP" wrote:
>
> > On Wed, 16 Jul 2008 03:10:01 -0700, jo5030
> > <jo5030 RemoveThis @discussions.microsoft.com> wrote:
> >
> > > Can anyone comment on the effectiveness of the MS supplied Firewall and
> > > Defender offering when compared to other commercial products (such as McAfee
> > > and Norton)? I use Norton at the moment, and it seems to me that if one is
> > > offered through Vista for nothing, I may as well use it rather than pay for
> > > another?
> >
> >
> > There are three kinds of software products you need for adequate
> > protection:
> >
> > 1. Firewall. I used to prefer the ZA firewall (or other third-party
> > firewalls) because it also provided outbound protection. I've become
> > convinced, however, that outbound protection is meaningless. Once one
> > of the nasties gets into your computer, it can essentially do whatever
> > it wants, including circumventing the firewall. So the extra
> > protection that a firewall that monitors outbound traffic provides is
> > more apparent than real, and I think the Windows firewall is fine.
> >
> > 2. An anti-virus program. Windows provides *nothing* in this regard,
> > and you should run a third-party product. I recommend NOD32, if you
> > want to pay for a product, or the freeware Avast! if you don't.
> >
> > 3. Anti-spyware programs. No single anti-spyware is adequate to
> > protect you against everything. Windows defender comes with Windows
> > Vista, but it alone isn't sufficient. I recommend adding at least one
> > or more of the following: Spybot Search and Destroy, Spyware Blaster,
> > Adaware, and Super AntiSpyware.
> >
> > You mention McAfee and Norton. In my view (and that of many other
> > regulars here), Norton is the worst product on the market, and McAfgee
> > is only slightly better. Although they are the best-known and the
> > biggest sellers, I strongly recommend against both.
> >
> >
> > --
> > Ken Blake, Microsoft MVP - Windows Desktop Experience
> > Please Reply to the Newsgroup
> >

--
Ken Blake, Microsoft MVP - Windows Desktop Experience
Please Reply to the Newsgroup

On Wed, 16 Jul 2008 05:42:05 -0500, Chappy <guest.TakeThisOut@unknown-email.com>
wrote:

>Matousec ran a very comprehensive test of the available products for
>Windows..
>'Matousec Firewall Challenge'
>(http://www.matousec.com/projects/firewall-challenge/)
>
>Windows firewall in it's default state scored a rather dismal 5% but
>does better with some advanced configuration, still not as good as
>others tho.

This is getting boring.... Testing the windows FW for outbound
capabilities is like testing your car for the ability to fly....

>Comodo scored the best for Free firewalls at 95%

Yes. Because they specifically targeted leak tests in order to gain
popularity. You do know that Comodo FW was developed for company
promotional purposes, don't you?

>and is the choice of
>many of the security pros here in the Forums.

Pros? What's a pro?

>Some in the Newsgroups here get rather "testy" when anyone mentions
>(God forbid) using a 3rd party firewall...call them "Snake Oil"

Well, that's what they are. But heck, do go install them if it makes
you feel good. Just realize that there is a difference between real
security and the subjective feeling of security. Indeed, the latter
has value - just not in a technical sense.

>and the like, but Matousec's test suite is very comprehensive and runs
>the toughest firewall attacks and go-rounds available

They test for some publicly known and also some self-made ones. The
problem is there is no end to ways of leaking. Dealing with outbound
control is nothing but gap stopping.

>so I'll take their word over the ...ahem "other" guy here who may come in and start
>bashing this post for Blasphemy.

I don't care, but you are aware that the malware industry offer
services like testing your malware's ability to by-pass firewalls and
anti-malware products, right?

On Wed, 16 Jul 2008 11:48:17 -0700, jo5030
<jo5030 DeleteThis @discussions.microsoft.com> wrote:

>2. I have turned on my Windows Firewall as well with automatic updating,
>but malware protection turned off (and removed Norton).

Turn malware protection (Defender) back on. Use one or two others to
supplement it.

If you're not totally fatigued by UAC's constant prompts, I would
suggest you install Spybot Search and Destroy. It's free, and it has a
feature named "teatimer" that keeps a lookout for any changes to your
registry and prompts you before letting them be made.

That is basically the setup I have. The Windows firewall could be
eliminated, but I don't feel it hurts to have it enabled just in case
I end up not behind my router. This can happen with wireless
networking. )

Do make sure your HUB's firewall is *yours* - that is you should
change the default password to something more secure than 'admin'
or 'user'.

"jo5030" <jo5030 DeleteThis @discussions.microsoft.com> wrote in message
news:48D04914-D303-454B-BA9F-7375CFF5C58C@microsoft.com...
> Guys
>
> Thank you all very much for your help. As a result of it, I have
> reconfigured my protection as follows:
>
> 1. I am using my broadband hub as a firewall (for those of you that may
> know it, a BT Home Hub set to Standard security level)
>
> 2. I have turned on my Windows Firewall as well with automatic updating,
> but malware protection turned off (and removed Norton).
>
> 3. I have installed Avast! On-Access scanner as virus protection
>
> 4. I am considering using SuperAntispyware or Spybot as well.
>
> To you experts - does this seem enough, and would you advise me to use on
> or
> both of the products mentioned in 4 above.
>
> Thank you all again for helping me.
>
> John
>
> "Ken Blake, MVP" wrote:
>
>> On Wed, 16 Jul 2008 03:10:01 -0700, jo5030
>> <jo5030 DeleteThis @discussions.microsoft.com> wrote:
>>
>> > Can anyone comment on the effectiveness of the MS supplied Firewall and
>> > Defender offering when compared to other commercial products (such as
>> > McAfee
>> > and Norton)? I use Norton at the moment, and it seems to me that if
>> > one is
>> > offered through Vista for nothing, I may as well use it rather than pay
>> > for
>> > another?
>>
>>
>> There are three kinds of software products you need for adequate
>> protection:
>>
>> 1. Firewall. I used to prefer the ZA firewall (or other third-party
>> firewalls) because it also provided outbound protection. I've become
>> convinced, however, that outbound protection is meaningless. Once one
>> of the nasties gets into your computer, it can essentially do whatever
>> it wants, including circumventing the firewall. So the extra
>> protection that a firewall that monitors outbound traffic provides is
>> more apparent than real, and I think the Windows firewall is fine.
>>
>> 2. An anti-virus program. Windows provides *nothing* in this regard,
>> and you should run a third-party product. I recommend NOD32, if you
>> want to pay for a product, or the freeware Avast! if you don't.
>>
>> 3. Anti-spyware programs. No single anti-spyware is adequate to
>> protect you against everything. Windows defender comes with Windows
>> Vista, but it alone isn't sufficient. I recommend adding at least one
>> or more of the following: Spybot Search and Destroy, Spyware Blaster,
>> Adaware, and Super AntiSpyware.
>>
>> You mention McAfee and Norton. In my view (and that of many other
>> regulars here), Norton is the worst product on the market, and McAfgee
>> is only slightly better. Although they are the best-known and the
>> biggest sellers, I strongly recommend against both.
>>
>>
>> --
>> Ken Blake, Microsoft MVP - Windows Desktop Experience
>> Please Reply to the Newsgroup
>>

"FromTheRafters" <Erratic.TakeThisOut@ne.rr.com> wrote in message
news:uk%23QNs35IHA.3512@TK2MSFTNGP02.phx.gbl...
> That is basically the setup I have. The Windows firewall could be
> eliminated, but I don't feel it hurts to have it enabled just in case
> I end up not behind my router. This can happen with wireless
> networking. )
>
> Do make sure your HUB's firewall is *yours* - that is you should
> change the default password to something more secure than 'admin'
> or 'user'.


And turn off uPnP on the router. There are two steps to securing a router.
Make sure a strong password is in place for the router setup. Turn off uPnP.
UPnP can be used to program a router bypassing the need for authentication.

--
Kerry Brown
MS-MVP - Windows Desktop Experience: Systems Administration
http://www.vistahelp.ca/phpBB2/
http://vistahelpca.blogspot.com/

On Wed, 16 Jul 2008 03:10:01 -0700, jo5030 wrote:

> Can anyone comment on the effectiveness of the MS supplied Firewall and
> Defender

Both are good-quality applications, especially the firewall. (Steer away
from 3rd party software (so-called) firewall applications!!).
Educational reading:
Managing the Windows Vista Firewall
http://technet.microsoft.com/en-us/magazine/cc510323.aspx

Interesting reading:
http://www.pcworld.com/article/id,136195/article.html
"...Windows Defender did excel in behavior-based protection, which detects
changes to key areas of the system without having to know anything about
the actual threat."

A-S applications - for non-viral malware.
The effectiveness of an individual A-S scanners can be wide-ranging and
oftentimes a collection of scanners is best. There isn't one software that
cleans and immunizes you against everything. That's why you need multiple
products to do the job i.e. overlap their coverage - one may catch what
another may miss, (grab'em all).

SuperAntispyware - Free
http://www.superantispyware.com/superantispywarefreevspro.html
and
Ad-Aware 2007 - Free
http://www.lavasoftusa.com/products/ad_aware_free.php
http://www.download.com/3000-2144-10045910.html
and
Spybot Search & Destroy - Free
http://www.safer-networking.org/en/download/index.html

> offering when compared to other commercial products (such as McAfee
> and Norton)?

A number of experts agree that the retail AV version of McAfee, Norton and
Trend Micro has become cumbersome and bloated for the average user.

The major Norton criticisms are related to stability and footprint, the
most common problem being slow-downs because of the massive system
resources Norton hogs. There are products on the market with equal or
better test results than Symantec's products, consuming less resources at a
lower price (*even free ones*).

> I use Norton at the moment, and it seems to me that if one is
> offered through Vista for nothing, I may as well use it rather than pay for
> another?

Download and run the Norton Removal Tool:
http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2005033108162039
The Norton Removal Tool uninstalls all Norton 2008/2007/2006/2005/2004/2003
products and Norton 360 from your computer.

Real-time AV applications - for viral malware.
Do not utilize more than one (1) real-time anti-virus scanning engine!
Disable the e-mail scanning function during installation (Custom
Installation on some AV apps.) as it provides no additional protection.

Why You Don't Need Your Anti-Virus Program to Scan Your E-Mail
http://thundercloud.net/infoave/tutorials/email-scanning/index.htm
Viral Irony: The Most Common Cause of Corruption.
http://www.microsoft.com/windows/IE/community/columns/filecorruption.mspx

Avira AntiVir® Personal - FREE Antivirus
http://www.free-av.com/
You may wish to consider removing the 'AntiVir Nagscreen'
http://www.elitekiller.com/files/disable_antivir_nag.htm
or
Free antivirus - avast! 4 Home Edition
It includes ANTI-SPYWARE protection, certified by the West Coast Labs
Checkmark process, and ANTI-ROOTKIT DETECTION based on the best-in class
GMER technology.
http://www.avast.com/eng/avast_4_home.html
(Choose Custom Installation and under Resident
Protection, uncheck: Internet Mail and Outlook/Exchange.)
or
AVG Anti-Virus Free Edition
http://free.grisoft.com/
(Choose custom install and untick the email scanner plugin.)
or
ESET NOD32 Antivirus - Not Free
http://www.eset.com/
or
Kaspersky® Anti-Virus 7.0 - Not Free
http://www.kaspersky.com/homeuser

and (optional but highly recommendable)

On-demand AV applications.
(add them to your arsenal and use them as a "second opinion" av scanner).
David H. Lipman's MULTI_AV Tool
http://www.pctipp.ch/ds/28400/28470/Multi_AV.exe
http://www.pctipp.ch/downloads/dl/35905.asp
English:
http://www.raymond.cc/blog/archives/2008/01/09/scan-your-computer-with...ltiple-
Additional Instructions:
http://pcdid.com/Multi_AV.htm
and/or
Kaspersky's AVPTool
http://downloads5.kaspersky-labs.com/devbuilds/AVPTool/
There's no updating involved since the scanning engine is updated
several times a day and you simply download the updated scanner whenever
you want to do a scan.

Dr.Web CureIt!® Utility - FREE
http://www.freedrweb.com/cureit/

Malwarebytes© Corporation - Anti-Malware
http://www.malwarebytes.org/mbam/program/mbam-setup.exe
Note: It is Free for private use. Just download (do NOT buy) and install.

A clarification on the terminology: the word "malware" is short for
"malicious software." Most Anti-Virus applications detect many types of
malware such as viruses, worms, trojans, etc.
What AV applications usually don't detect is "non-viral" malware, and the
term "non-viral malware" is normally used to refer to things like spyware
and adware.

Good luck