Difference between firewall and real-time antispyware software

happyflea

Am pretty much newbie to PC security. On microsoft website "Windows Defender" says it does real-time protection and removal of spyware. What category of prog is this? Anti-spyware software?

But what's the difference between that and a firewall? Isn't the firewall also to stop spyware or does it do other security too?

Have used ZoneAlarm free for years but doesn't seem to work. I get "trojans" occasionally and ZoneAlarm doesn't detect them but Norton Antivirus does. I know NAV is a virus prog but I think am right in saying it detects spyware.

isofa

Put simply:

A firewall monitors and restricts connections coming into and leaving your PC.

Anti-spyware scans and/or protects you computer against spyware and malware, often in a similar way to anti-virus software (but not always). It can also prevent browsers visiting suspect sites and lock down settings within browsers.

Anti-virus software, monitors and scans your system for traditional virus attacks, some anti-virus packages have anti-spyware built in, but most are just virus scanners.

For complete protection you need:

A good firewall
Strong anti-virus software (just one installed)
Various anti-spyware programs to protect you.

happyflea

Thanks isofa for explaining. What does the firewall stop? Is it, if spyware got into my computer and tried to send info over my internet connection, the firewall would realise and give an alert?

Have scanned with free versions of Adaware and Spybot but they don't do real-time protection. Is it necesaary to have real-time? Does it slow computer?

Thanks

Donnie

SpyBot does have real time protection in it's Tea Timer function. It also has a useful Immunize function.

happyflea

The Trojan I got recently was Infostealer.Bzup

http://www.symantec.com/security_response/writeup.jsp?docid=2006-080315-1729-99&tabid=2

ZoneAlarm didn't do anything about it. First I knew was a pop-up box from NAV and I put it in NAV "quarantine" and deleted it. I don't think it actually ran on my computer because none of the changes it's supposed to make in registry (from above link) had occurred.

Did ZA not do anything because the trojan had not tried to use the internet connection? Would even the best firewall have done nothing in this situation, because NAV had stopped it running?

Sorry if silly questions, am newbie.

isofa

happyflea wrote: »

Thanks isofa for explaining. What does the firewall stop? Is it, if spyware got into my computer and tried to send info over my internet connection, the firewall would realise and give an alert?

Possibly it depends how it's set-up and the type of firewall.

For instance, I have ZoneAlarm on this PC here, and if a new program tries to connect out, it will bring up a warning. But it's not always that simple, because spyware can masquerade as other applications, take over your browser etc, so it's not always an application trying to connect out showing itself to the firewall.

happyflea wrote: »

Have scanned with free versions of Adaware and Spybot but they don't do real-time protection. Is it necesaary to have real-time? Does it slow computer? Thanks

Yes it will slow your computer a little, as all real time scanners do. It depends on the level of security you want, how technically savvy you are, and what sort of websites you visit.

Personally I don't have any real time anti-spyware, but I never visit dodgy sites, I never click links on e-mail and I'm very technically savvy. I run anti-spyware scanners every few weeks just as a check. But I do have anti-spyware which "inoculates" against some problems, including SpywareBlaster and SpyBot S+D as you mentioned.

I also only browse with Firefox much better and more secure than IE (in my opinion) and have all manner of security add-ons installed, including the excellent NoScript.

Also I run CCleaner regularly to strip out cookies and other bits and bobs.

aliEnRIK

happyflea wrote: »

Thanks isofa for explaining. What does the firewall stop? Is it, if spyware got into my computer and tried to send info over my internet connection, the firewall would realise and give an alert?

Have scanned with free versions of Adaware and Spybot but they don't do real-time protection. Is it necesaary to have real-time? Does it slow computer?

Thanks

A decent firewall will stop to ask you for ANY NEW connections. In OR out.
So if a dodgy program tried to access your computer it would ASK you first. You can then either say YES or NO and wether you want it to REMEMBER YOUR ANSWER (These can be changed from within the firewall program)
If theres a nasty ON your harddrive, (Usually 'spyware') it will try to connect FROM YOUR COMPUTER (outwards as opposed to inbound) and again the firewall will ask you. If your never sure of the program just select NO and write down what the program was and either ask someone or google it. If it was legit, you can always allow it later.

esuhl

To use an analogy, a firewall is like a bouncer who looks at everything entering (and leaving) your private network, making sure anything coming in is whitelisted or has "an invitation".

Anti-spyware software is like a security guard inside the club, with a list of "wanted" programs and heuristic patterns (i.e. men wearing baseball caps with more than one tattoo and a shifty expression should be ejected... er... or something).

If you want to minimise your chances of downloading spyware, isofa's excellent suggestions of using Spybot, SpywareBlaster and NoScript will help.... in conjuction with a good firewall and antivirus, of course.

happyflea

Thanks for all the replies - really helpful - have now got much clearer idea of what this is about.