Vista and Avast compatible firewall, spyware

[Liz]

Hi all,

In big need of help here.  I have a new Dell desktop with Vista and broadband internet for the first time, and Avast seems to work great, thought I was 'safe' until I read I need a firewall and spyware program(s).  (I had an old Win 98 system on dial-up internet for 9 years, never updated the OS, used Avast and Ad-aware only, no firewall, never had problems!).

I have spent a lot of time trying to find the following, but now I'm going in circles and my brain has shut down.

Can you guys recommend both a firewall and spyware programs that meet theses criteria? (I assume the Windows Vista firewall is not too good and needs to be replaced?) I am using Defender for spyware, but have read it's not all that effective.  I did searches on Google and here on the forum but can't seem to find both good programs and ones that really do work with Vista and Avast.

1.  prefer free programs
2. with good support forums (like here at Avast!)
3. compatible with Vista (not just claims to be, but have people actually used them?)
4. compatible with Avast
5. any other info I need to know

thanks
Liz

[19monty64]

Firewall... http://www.pctools.com/firewall/ AntiSpyware... http://www.superantispyware.com/index.html... I have them myself, on XP, but they are Vista compatable and free. Free SAS doesn't have realtime protection, but is great at removal of anything Avast may miss.

[smokethapimp]

If you use RR Cable for broadband then you can download their free CA Internet Security Suite. Install everything EXCEPT for the CA Antivirus program. Then install Avast Free Home. You will have a Great Antivirus in Avast, an excellent Two-way Firewall, and also Anti-Spam for your email and an Anti-Spyware with Real-Time protection. These all integrate well and work very well with Vista OS. It is my combo of choice for Vista. I went thru heck finding this combo, but of course it is only a help if you have RR for your broadband connection.

[DavidR]

You could also use the Vista firewall and enable outbound checking/protection, there is a program to make the configuration of the Vista firewall easier. Vista Firewall Control, check out this topic for some user friendly help for the Vista Firewall, Outbound protection, http://forum.avast.com/index.php?topic=30234.0

[Spiritsongs]

   Hi Liz :

     To provide proper assistance, you need to tell us the SPECIFIC version
      and/or the amount of "bits" ( either 32 or 64 ) of your Vista Operating
     System !? As far as I know, the "Vista Firewall Control" program ONLY
     works with those having a 32-bit Vista OS ; I doubt it will work for those
     having a 64 -bit OS, which I believe is called Vista "Ultimate" !?
     The Vista OS Windows Firewall seems to be better than the Win XP
     Windows Firewall; however, I have read it is a "Rules-based" firewall,
      geared to "Advanced Users" . Those who prefer working with an
     "Application-based" firewall and have a 32 bit Vista OS, should try using
      the PC Tools Firewall Plus, that was mentioned earlier in this Thread .

[Lisandro]

Those who prefer working with an "Application-based" firewall and have a 32 bit Vista OS, should try using the PC Tools Firewall Plus, that was mentioned earlier in this Thread .

Fully agree

[Liz]

Hi guys,

Thanks ever so much!  I am now the proud user of PC Tool firewall and Superantispyware just downloaded and installed, proud as long as nothing goes wrong anyway . 

Everything was so easy I'm thinking there must be something I didn't do that I should have!  I just chose normal/regular (whatever the word was) user for the firewall and it seems to have done everything else, I just have to allow programs as they come up, like Avast.  Actually I did enable 'protection against code injection,' 'stealth mode' and 'stateful packet injection'.  Have only the very faintest idea what those are, but they sound good!    Feel free to let me know if I those are not a good idea!

I bookmarked the support forums for both programs for if/when I run into trouble.  Really like having those!

I ran a Vista Defender check last night which came up with nothing, it has come up with nothing since I've had the computer in July.  I just ran SAS full scan and got 125 tracking cookies which I will delete.  I assume as long as they are labelled 'tracking' cookies they don't delete all cookies (like the few you want for auto logins, etc.)

Since the free SAS doesn't do automatic checks for updates or automatic scans, do you guys have a recommendation how often to do these?

Also, does SAS take care of Rootkits along with spyware. Or is it better to get a separate program?  I happened to notice on their forum that it did find a certain one, but I didn't see whether it's advertized to get find them in general or not.

Another quick question if anyone happens to know this...I read something about computers being more secure behind a router.  I have two computers hardwired into a Belkin router to use the same broadband internet connection.  I have a wireless card in my new computer, but it is not set up or secured for wireless at the present time.  The router pretty much set itself up when I installed it and I don't remember if it took any security measures (or if it didn't need to since I am not going wireless yet, I don't understand router securing).  But just wondering if I still have that extra protection that was mentioned.

Liz 

PS: I have Vista Home Premium 32 bit, and don't have RR broadband.  Also I checked into using the Vista Firewall in the Vista for dummies book, and he sounded like it would drive you crazy on the outbound and recommended getting a better firewall, more user friendly.  this computer kindergartener took his advice.

Thanks all of you again! 

[DavidR]

Well code injection is very helpful as it is a common practice by some malware to try and inject malicious code into a legit function. You ideally want to prevent that however, you may find that there are other programs that use this legitimately so you may well get a pop-up asking for a decision with the possibility you don't know the answer is it legit use or not.

Stealth mode is I would have thought is the corner stone of a firewall and I'm surprised this isn't a default option. The idea being if your system is stealthed then if someone tries to attack it, first they have to detect its presence and they usually do this by port scanning. If they can't see any open ports it would be a random IP address port scan and the idea is they are hoping for a response to confirm something is at that IP. In stealth mode I would assume comodo wouldn't reply to the port scan revealing its presence.

I'm not to sure if adding Stateful Packet Inspection provides much more protection it is something often found in a Router's firewall and this may have a performance impact. http://en.wikipedia.org/wiki/Stateful_firewall

I generally do on-demand scans (security applications) once a week as part of my system maintenance for those that are signature based first you should update the signatures before doing the scan. I don't believe SAS has a specific anti-rootkit function, though it is some time since I checked it or its features.

I don't routinely do anti-rootkit scans as this I feel is something you do if you suspect the presence of a rootkit and if so you should always get the latest version of the anti-rootkit tools anyway.

Also see, anti-rootkit, detection, removal & protection http://www.antirootkit.com/software/index.htm. These are some of the more efficient and user friendly anti-rootkit tools.
- BlackLight - http://www.f-secure.com/blacklight/
- Panda Rootkit Cleaner - http://research.pandasoftware.com/blogs/images/AntiRootkit.zip.
- AVG Anti-Rootkit http://free.grisoft.com/doc/avg-anti-rootkit-free/lng/us/tpl/v5.

[Lisandro]

Since the free SAS doesn't do automatic checks for updates or automatic scans, do you guys have a recommendation how often to do these?

Update before you scan. It helps nothing having it updated and you do not run it.
How often to run it? Maybe monthly will be good.

Also, does SAS take care of Rootkits along with spyware. Or is it better to get a separate program?

I don't think SAS covers rootkits.
Better the applications David suggested you.

I read something about computers being more secure behind a router.

Only if the router has a firewall or internal filter, which is generally truth.
Some (most?) of them won't give you outbound protection.

[Liz]

Thank you guys for the recommendations about how often to scan, and also DavidR for the rootkit links!  Also David I think you're right about the injection code--things got a lot more complicated after I enabled that.

Remember when I said it seemed too easy?! I wound up somehow not being able to connect my bluetooth mouse and keyboard not long after I installed the firewall.  Too complicated for me to remember what all happened, but at one point it was saying the devices were trying to connect but I had to click on an icon, which I couldn't because the devices weren't connected!

Wound up half the night by myself, and 2 1/2 hours with a Dell technician this afternoon fixing that one, and firewall was uninstalled in the process!  I left a post at the PC Tools forum, hopefully they can help me out on that one.

 (anyone know if a computer will recognize a regular mouse and keyboard at the same times as the bluetooth, really need to get one if so!)

sheesh, I'm exhausted, and still don't have a firewall.

Oh, was thrilled to find out that my Belkin router has a firewall enabled by default, but don't have a clue what the settings are, and also read that some businesses who don't know what they're doing (because it's all so complicated) basically just set to 'allow everything' and so get almost no protection.  I'm thinking my firewall probably has this setting, too...


Going to sleep now...
Liz 

[DavidR]

Well I have a PS2 mouse connected at the same time as my microsoft USB wireless optical mouse and I can use either. My main reason is I have a program that runs pre windows boot (not unlike the avast boot-time scan does) and even though my USB wireless mouse is recognised that program doesn't want to play nice, so I need to use a PS2 mouse.

Your Belkin router's firewall almost certainly only provides inbound protection, so you will have very limited settings, that is why a third party firewall is required for outbound protection.

The Default settings in Comodo had such a compromise between protection and death by pop-up until you tweaked it that is It is often advisable to leave it on the default settings so it only questions major things. Unfortunately I don't use Comodo firewall so can be of no practical help with settings, etc.

[Lisandro]

(because it's all so complicated) basically just set to 'allow everything' and so get almost no protection.  I'm thinking my firewall probably has this setting, too...

This is the most common problem with firewalls and other security programs that ask for allowance of the users: we get tired and finish removing the software.
For simplicity, stay with Windows Vista firewall. For 99% of the cases, you'll be glad to have only inbound protection (i.e., against hackers and intrusion in your computer).

[DavidR]

There was little wrong using the default settings of comodo until Liz went tweaking. I personally believe it is a backward step not to have outbound protection.

With default settings many firewalls aren't a problem as they too are looking for a compromise between protection and ease of use, it is possible to dial down the sensitivity to Low in comodo is it not.

[rhuds13]

On SAS site it states: Detect and Remove Spyware, Adware, Malware, Trojans, Dialers, Worms, KeyLoggers, HiJackers, Parasites, Rootkits and many other types of threats.
 
Also if you inable the Enable protection against code injection things like the control panel for Creative sound cards will not launch, so may also stop other control panels.  Just uncheck that and you are good to go.  Hope this helps.

[Spiritsongs]

   Hi Liz :

      SUPERAntiSpyware will detect SOME Rootkits ; for "general" rootkit
      detection, I use the FREE "RootkitRevealer", available from
      www.microsoft.com/technet/sysinternals/Security/RootkitRevealer.mspx .
      This program uses unique technology to detect possible rootkits, but does
      not "remove" them . Microsoft bought the SysInternals company, the
      Makers of some very good FREE programs . There are 2 "RootkitRevealer"
      Forums at http://forum.sysinternals.com/  . IF RootkitRevealer "detects"
      something that the Volunteer Experts on the Support Forums can NOT
      resolve, then the use of Other Rootkit detection programs should be
      tried, such as the Ones recommended by DavidR .