Avast WEBforum
Other => General Topics => Topic started by: xerostar on September 24, 2009, 11:50:43 PM
-
Sorry if this has been covered already.
I couldn't find any answers on the Avast web site.
Do I need to buy an anti-spyware program in addition to using the Avast Anti-virus software?
Avast does a great job on detecting viruses but does it detect spyware by default?
If I do need to buy anti-spyware what program would you recommend?
Thanks
-
I would use with Avast! the current anti spyware and malware.
1. Windows Defender (Should be in your Windows)
2. Malwarebytes 1.41 Free (On-Demand)
And if possible with a 2 Ways Firewall like the Vista one or Outpost,PC Tools,Online Armor...
That what i use and its never failed me.
Mr.Agent
-
Hi xerostar,
avast! does have an antispyware module integrated into it's detection engine.
http://www.avast.com/eng/avast-free-home-antivirus-antispyware.html#1
I would also suggest to have a second opinion, on-demand scanner like has been said above.
The ones generally recommended here are:
Malwarebytes AntiMalware: www.malwarebytes.org
and/or
SUPER AntiSpyware: www.superantispyware.com
BOTH are free in non-resident (On-Demand) forms :)
-Scott-
-
A multi-application approach to security is better than a single application, whilst there some AVs like avast that has a detection rate in the high 90%, but none that give 100% protection.
The only thing is not to have more than one resident AV, but compatible anti-spyware applications like SuperAntiSpyware (SAS) and or MalwareBytes AntiMalware (MBAM) would compliment avast. These applications have free versions that provide on-demand protection only, they have paid options, but you should only have one resident anti-spyware (as mentioned for AVs).
-
Windows Defender is resident too. Even if people say its bad but its can help a bit when Malwarebytes can do the rest with Avast!
-
I find Threatfire as a good program that can run with Avast as that has spyware and malware protection. also.
-
I find some people say Threatfire is really hard and annoying. But i dont got proof for it so its may be true or false. For sure i like my kit because when i play or surf web its really light and dont make me angry when surfing lol. ;)
-
Threatfire is a good choice.It does not pop up all the time like HIPS and it can detect alot of zero day malware with its behavior analysis.
-
Well your true but i still like more my kit lol. Really simple and fast. Its like SPG Scott. lol ;D
-
take my advice this MBAM and super anti spyware have a lot of FP maybe you will say no but i use avast professional on my laptop and i install MBAM on it it detect 9 Trojans but i analyse every one of them and they were FPS.
avast global product you can rely on it and you just want to update windows defender and have a tool to manage your web browser BHOs and this related things or get Google chrome and forget the last idea.
avast+avira without the Guard modules+comodo internet security without antivirus+chrome will be a good mixture of software and that dont takes a lot of system resourses
-
Malwarebytes has only detected 1 false positive for me. Most time is a file no a registry.
But Comodo got a really bad reputation with his Ask Bar... Very bad reputation !!!! I wouldnt touch Comodo as it isnt really recommanded and very annoying. For gaming and surfing.
Disable Avira Guard isnt enought and can result in conflict.
Disable is not enought.
Also Avira has really full false positive. If you think its not i did see some file my self and AV-Comparative his self said its got 21 FPs...
No for offense but i will stay with my kit.
Thank for suggest but i dont need your kit.
Mr.Agent
-
Well,you can report these false positive to the mbam team.They usually resolves this in about 3-4 hours.
Although sometime mbam can have alot of false positive,you still have to admit that it is a great program.Sames goes for superantispyware.
-
Well Malwarebytes i just send them a email and i think 30 mins or less they respond me. So they can confirm or say push ignore button if you trust this file.
Its really a great support and dont think its bad because of his FPs.
Mr.Agent
-
Hi xerostar,
Whatever non-resident anti spyware program/hips you use alongside the resident avast av-solution - be it MBAM or SAS or SpywareBlaster, TrendMicroRUBotted, ImmunetProtect, ThreatFire, etc. (or a non-resident av solution like DrWebCureIt for a second op) you should always and under all instances check malcode finds against FP's or riskware (if you know what it is and have installed it yourself for a purpose) at for instance virustotal.com (upload the suspicious file or eventual FP there) or whenever in doubt report here in the forums.
There is a sticky on this issue here: http://forum.avast.com/index.php?topic=14433.0
polonus
-
no i dont mean disable avira guard i mean dont install it when thy ask you to install complete or custom just install scanner,anti-rootkit,and context menu scanner. ;)
-
@superhacker
Your advice seems a bit overzelous as to having Avara as well as avast! will clash and this fact is well documented on this forum.
I would not use anything from Comodo myself:
http://hphosts.blogspot.com/2009/07/comodo-replace-malware-with-err-malware.html
http://hphosts.blogspot.com/2009/07/comodo-and-ongoing-trust-saga.html
-
+1 for Yokenny. ;)
-
Thank you everyone!
Your advice has been very helpful.
-
Your welcome.
-
I installed MBAM and ran a detailed scan.
These are the results:
Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
Files Infected:
C:\Program Files\HTMLConvert\HTMLConvert.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{78D99F90-86DF-4B3C-85F2-336148289E01}\RP157\A0080141.dll (Trojan.Agent) -> Quarantined and deleted successfully.
K:\Papa\AppData\Local\Temp\MMBPlayer\dssEditBox.dll (Malware.Packer) -> Quarantined and deleted successfully.
K:\Papa\AppData\Local\Temp\MMBPlayer\Plugin.dll (Malware.Packer) -> Quarantined and deleted successfully.
So I'm very happy with MBAM and your advice. My paranoia was justified!
Can anything of significance be seen in the type of malware found?
-
AntiVirusDisableNotify means that the anti virus was disabled or not up to date
FirewallDisableNotify means that the Windows firewall was turned off
UpdatesDisableNotify means that Automatic updates was turned off
You need to post the complete MBAM log as the top part is important as well.
The rest are malware removal indications.
-
AntiVirusDisableNotify means that the anti virus was disabled or not up to date
FirewallDisableNotify means that the Windows firewall was turned off
<snip>
What they actually mean is that the Windows Security Centre's (WSC) function to 'notify' you that your AV or firewall has been disabled, etc. It doesn't actually mean that they have been disabled, this is usually a pre-emptive strike before attempting to disable them. Whilst it is a possibility they have been disabled this actual registry key is for the WSC notifications.
-
Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
they are system policies and may be done by avirus but may be done by disable alarm am control panel by a user.
Files Infected:
C:\Program Files\HTMLConvert\HTMLConvert.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{78D99F90-86DF-4B3C-85F2-336148289E01}\RP157\A0080141.dll (Trojan.Agent) -> Quarantined and deleted successfully.
K:\Papa\AppData\Local\Temp\MMBPlayer\dssEditBox.dll (Malware.Packer) -> Quarantined and deleted successfully.
K:\Papa\AppData\Local\Temp\MMBPlayer\Plugin.dll (Malware.Packer) -> Quarantined and deleted successfully.
i am sure that the last two files completely virus free(the same thing came with me but i analyze the files and discover that FPs in MBAM)
and the other files maybe virus free but how i am sure?
you can send the files to kaspersky lab virus lab :virus@kaspersky.com
after zip those files and protect them with a password (dont forget to write the password in the message) ;D
after two days or less they will tell you about them or send them to me and iw ill report you after two days at most(make a zipped file with password)
or send them to any virus lab and see. ;)
-
I'm seeing much more false positives of MBAM nowadays. Take care.