Spyware Warrior

r2baruch · Posted: Sun Mar 19, 2006 12:27 am Post subject: Spyware/adware protection

I am already running Spyware Guard, Spyware Blaster, SpybotSD/Teatime, and the Microsoft AS program. Should I also be loading IE-SPYADS? Does it add anything or just duplicate what I am already running (such as Spyware Blaster)?
Thanks.

Moore · Posted: Sun Mar 19, 2006 1:51 am Post subject:

Hi r2baruch , welcome to the forum.

Honestly , you would benefit from another layer of protection if you did load up IE-Spyads.. It's not going to drain any of your pc resources if you do use it.

fcukdat · Posted: Sun Mar 19, 2006 2:39 am Post subject:

....and realtime AV protection Question

Hi R2baruch and welcome to the SWW forums Smile

FWIW if you have M$ and teatimer timer running in realtime then IMO there is unnecessary overlap in place.I would demote SS&D to ondemand role and not realtime.

I'll probaly get slaughtered for the next view but i would uninstall SG as M$ covers the bases there in realtime.

There is such a thing as too much security hence the previous suggestions and as long as you have a firewall/realtime AV/fully patched up OS combined with a healthy process of researching any alerts your security softwares generate then your well on your way to a good level of security.

With reguards IESpyAds its a must have item IMO for people that use IE as their default browser.

HTH Smile

_________________
Malware hunter....Got Bot ?

MIRT Handler >>>
http://www.castlecops.com/c55-MIRT.html

Nick · Posted: Sun Mar 19, 2006 4:24 am Post subject:

I won't slaughter you fcukdat about SpywareGuard. If one is running another realtime protection like MS Antispy's or Tea timer, then there is no benefit to running SG. In fact, it can cause problems by having too many monitors running at the same time, as has already been said.
_________________
Nick's Security Ticker

r2baruch · Posted: Sun Mar 19, 2006 4:42 am Post subject: Antispyware duplication

I thank everyone for their responses.
To sum up, I should
(1)install IE-SPYADS,
(2)uninstall Spyware Guard,
(3)make Spybot on-demand only and
(4)rely on Windows Defender for real time protection.
Please let me know if I have understood correctly.

And I did forget to include in my original post that I am running Kaspersky AV and Zone Alarm Free in addition to all the others.

fcukdat · Posted: Sun Mar 19, 2006 5:06 am Post subject: Re: Antispyware duplication

r2baruch · Posted: Sun Mar 19, 2006 12:04 pm Post subject: winpatrol

I guess I also forgot to mention that I run winpatrol, so it seems that I am in pretty good shape. However the proof of the pudding is in the eating, and as I have not seen any signs of spyware since I started with these various programs I have the ultimate proof.

Could you please explain what you mean by disabling "polling" in WinDef. I didn't see that term anywhere in the WD settings.

fcukdat · Posted: Sun Mar 19, 2006 1:33 pm Post subject:

Scotty rocks Laughing

Polling is monitoring of parts of your system in realtime.

Ie The start up locations,IE addons,services,toolbars etc

You will notice that certain software fire off alerts should you install new software that attempts to add itself to the start up registry for example.

These could be good/bad programmes but the polling software is giving you a chance to take action if necessary by alerting you to the change.

A lot of anti whatever programmes have some form of polling attached ie teatimer for spybot,M$ realtime agents etc but for me when i'm not testing malware/softwares Scotty has pride of place Smile

If the proof is in the pudding about your security arrangements what have SpyBot,M$,SG alerted you too(Discounting cookies)that KAV(on extended databases in realtime) &Winpatrol have missed ?
I'm curious Wink

_________________
Malware hunter....Got Bot ?

MIRT Handler >>>
http://www.castlecops.com/c55-MIRT.html

wyrmrider · Posted: Sun Mar 19, 2006 2:16 pm Post subject:

are you running IE? fully patched did you say what os?
I think everyone is assuming you do
if running firefox then advice changes slightly
Think about a HOSTS file
works similar to IE-Spyads but works for both Ie and firefox
may be used in addition to IE-spyads

Scotty says arf here
not exactly realitme
Scotty goes "on patrol" on a regular basis and "Polls"-looks at things
on guard

read the stickies about locking ie down and make sure Os , Ie and office are fully patched

just say no works
if others use your machine think process guard or similar

r2baruch · Posted: Sun Mar 19, 2006 11:32 pm Post subject:

fcukdat · Posted: Mon Mar 20, 2006 10:44 am Post subject:

There you go then but FWIW the hosts file& SpywareBlaster won't give you alerts whilst their saving your bacon but SG should Confused

With reguards KAV extended database protection

settings tab >>>Threats&Exclusions>>>select extended database where by default "standard" is selected Wink

IMO the scope of the KAV extended database blows away the need for antispyware appointments(You only need the cleaners if you get hosed Wink

).Purely your call as what makes you feel comfortable and safe but i only advise based my experience's& slant being protection=prevention is better than cure.

FWIW i would be very surprised if M$&SpyBot have things in their sightsthat KAV dose'nt Wink

_________________
Malware hunter....Got Bot ?

MIRT Handler >>>
http://www.castlecops.com/c55-MIRT.html

r2baruch · Posted: Mon Mar 20, 2006 12:44 pm Post subject:

fcukdat · Posted: Mon Mar 20, 2006 1:12 pm Post subject:

So sorry

What i ment was if(Past ) SG had stopped malware installing it would have alerted you at the time of capture.

Spywareblaster/IESpyAd our set and forget until update time to keep their databases up with current threats.They will not alert you to anything they have prevented.Thats not how they work.

Still uninstall SG,Spybot,WinDef in my opinion.
_________________
Malware hunter....Got Bot ?

MIRT Handler >>>
http://www.castlecops.com/c55-MIRT.html

r2baruch · Posted: Mon Mar 20, 2006 11:10 pm Post subject:

Great. I think everything is clear now. To sum up, I have KAV, ZA, hosts file, Spyware Blaster and IE-Spyads which taken together should provide adequate protection in your opinion.

Real time scanning of Spybot and SG is now disabled, and available as backup should the need arise.

I guess I will leave WinDef active for now unless I see that it creates a conlict with other programs.

It has been really nice talking to you and I appreciate your advice.
All the best.

r2baruch · Posted: Tue Mar 21, 2006 12:00 am Post subject:

And of course WinPatrol - Scotty on guard! Exclamation

PattyB · Posted: Sat Sep 02, 2006 12:51 pm Post subject: fcukdat re: Kaspersky settings

Hi

I've just installed Kaspersky Suite 6.0

Where can I find the extended settings you are referring to?

(remember I am a newbie) Wink

wyrmrider · Posted: Sat Sep 02, 2006 1:37 pm Post subject:

PattB
just scroll up to fckdats "BLUE" post above

Kaspersky- good choice

There are detailed discussions on Spybot vs Spyware guard vsxxx elsewhere
You can't tell from the current discussion if they are talking about tea-timer or what in spybot
I, personally, use spybots real time protection which is on the immunize page and I immunize- I am not using tea-timer
I use spywareblaster- it takes NO resources
I use ie-spyads for the times ie opens all by itself- also takes no resources
i use a hosts file takes little/ no resources
I use Win Patrol

and I have either Pest patrol free or Webroot spysweeper Or Counterspy loading at boot
along with my AV and software Firewall

looking at SSM for the next step

layered protection

I have Spybot, Ad-aware, pest patrol, counterspy, A-squared, etc as needed scanners available
asell as Bit-defender on line scan if needed

PattyB · Posted: Sat Sep 02, 2006 1:41 pm Post subject:

Hi

Thanks. Yes I see that but my Kaspersky looks different than the posted pics.

After I get home from the store I will look around and see if I can find something that says threats and exclusions.

r2baruch · Posted: Sat Sep 02, 2006 9:13 pm Post subject:

fcukdat · Posted: Sun Sep 03, 2006 3:59 am Post subject:

Hi Patty B Smile

IRC that was KASP AV 5,i had downloaded the free trial for test purposes so i would imagine KIS6 has got a different GUI.Maybe someone with KIS6 installed can have a mooch around and see if they can assist you.

Sincere advice,i've seen some of your recent posts and feel(in security terms)you need to learn to walk before you start running.No offence ment but SSM is a very effective but very complex tool to setup and use to its abilities.Take some time to learn about the basic's before dabbling in the serious g33k sec tools IMO

No amount of softwares will protect your PC if you donot understand to some degree what they are doing.The best security softwares can sometimes be rendered useless in the click of a mouse so get to grips with what you've got installed before moving onto more complex tools IMO

On a subnote although WinPatrol is a different type of HIBS tool than SSM/ProcessGuard etc it really is a good stepping stone from basic tools to the more advanced(processfirewall)tools.If you feel your up to it then give Scotty a go Smile

HTH

_________________
Malware hunter....Got Bot ?

MIRT Handler >>>
http://www.castlecops.com/c55-MIRT.html

fcukdat · Posted: Sun Sep 03, 2006 4:17 am Post subject:

Hi Patty B Smile

forgot to add this to my last post.

KASP have a product support forums>>>
http://forum.kaspersky.com/

You should be able to get a lot of answers over there Wink

_________________
Malware hunter....Got Bot ?

MIRT Handler >>>
http://www.castlecops.com/c55-MIRT.html

wyrmrider · Posted: Sun Sep 03, 2006 7:26 am Post subject:

SSM is one of the HIPS programs
check out th HIPS threads
Herbalist is our resident SSM expert
Herbalist???
I'm runing win 98 on this machine so most of not all of the other HIPS programs will not work
I would eventually turn off real time portion of pest patrol, counterspy, spysweeper etc and just use them for on demand scans- or I might keep one of them active TBD
I woul most likely keep ie spyads and hosts file
Scotty is cute- he'd stay
spyware blaster would stay for active x protection
remember I have several of these programs installed in case I need to burn a cd and go clean another machine
I think webroot made a mistake removing the cleaning ability in their free trial
several of my clients bought it after it cleaned their systems
same with pest-patrol
I ususally run spybot- very well written program- and ad- aware first - usually in safe mode

wyrmrider

herbalist · Posted: Sun Sep 03, 2006 1:04 pm Post subject:

I've been involved with SSMs development for some time, but I'm no expert on HIPS or SSM.
There'd be little gained by running SSM and WinPatrol. They overlap greatly in coverage. You'll also find a lot of overlap in the coverage between HIPS software and many resident anti-spyware apps. Those overlaps not only gain you nothing, they load down your system and can cause conflicts. If you decide to go with HIPS software, you can eventually disable most antispyware resident apps as you get an app like SSM configured. SSM can protect your IE6 start and search pages as well as preventing unwanted BHOs from being installed. It can also defend your registry and startup folder if you want it to. While HIPS can go a long way to really securing a system, it's not a do-it-all solution and is not a substitute for secure habits and tight browser settings.
As for using SSM on Win98/ME, IMO it's the best thing that ever came along for those systems and does what M$ wouldn't do, give the control back to the user. I consider SSM and a good firewall to be the core of my security package, along with good content filtering such as is provided by Proxomitron. The rest of the security-ware is add-on coverage.
Rick