Which security software?

mr_fishbulb

hippyadam wrote: »

But apparently, according to some folk on here windows firewall is fine....

Windows firewall is good from the perspective of you being attacked by a machine on the same network (i.e. when you are connected to a free wifi hotspot). It will stop other machines connecting to you.

But it does not stop any software on your machine from creating a connection out to the internet. The default option is to allow any programs to connect to the internet. You can block all, and create rules one by one to allow connections but that is time consuming. Better personal firewalls will give you a pop-up box when one program is trying to access the Internet and ask you if you want to allow or not.

If you have any spyware on your machine it will try and phone home at some point. A personal firewall which flashes up when a new program is trying to access the internet is good way of identifying an infection (if it has got past your AV in the first place).

[Deleted User]

mr_fishbulb wrote: »

But it does not stop any software on your machine from creating a connection out to the internet. The default option is to allow any programs to connect to the internet. You can block all, and create rules one by one to allow connections but that is time consuming. Better personal firewalls will give you a pop-up box when one program is trying to access the Internet and ask you if you want to allow or not.

If you have any spyware on your machine it will try and phone home at some point. A personal firewall which flashes up when a new program is trying to access the internet is good way of identifying an infection (if it has got past your AV in the first place).

I posted something very similar about this only a few days ago, so I'll just copy it here:

The term "shutting the barn door after the horse has bolted" comes to mind.

Outbound filtering is ineffective. Software based firewalls operate in the wrong layer of the stack to be effective at what they set out to do. Even mediocre malware will be able to circumnavigate your filters by waiting for you to execute a program that you have already given permission to connect and simply hijack those processes. Funnily enough, Port 80 is always available. Put simply, if you don’t trust an application to be active on your network, don’t use it.

Windows Firewall works with Vista & 7's ways of protecting services by restricting access to resources, and importantly, not allowing them to merge so that a compromised service cannot hijack the permissions of another. A much more effective way to control network traffic. While Outbound Rules are not enabled by default, the protection around services is. It's misleading to report otherwise, but I understand that the vast majority of these review sites don't actually much of a concept or understanding of the Windows Security model and how different parts integrate therefore it's easy to say that no outbound filtering is bad.

[Deleted User]

anewhope wrote: »

I posted something very similar about this only a few days ago, so I'll just copy it here:

When will people learn :rolleyes:

mr_fishbulb

anewhope wrote: »

Windows Firewall works with Vista & 7's ways of protecting services by restricting access to resources, and importantly, not allowing them to merge so that a compromised service cannot hijack the permissions of another. A much more effective way to control network traffic. While Outbound Rules are not enabled by default, the protection around services is. It's misleading to report otherwise, but I understand that the vast majority of these review sites don't actually much of a concept or understanding of the Windows Security model and how different parts integrate therefore it's easy to say that no outbound filtering is bad.

But in that scenario you would stop Bad Malware 2009 program from hijacking the legitimate traffic from Good App 2008, but not have any control over Bad Malware 2009 making a direct connection itself?

aliEnRIK

Make sure you use the MCAFEE REMOVAL TOOL before installing your new av

[Deleted User]

mr_fishbulb wrote: »

But in that scenario you would stop Bad Malware 2009 program from hijacking the legitimate traffic from Good App 2008, but not have any control over Bad Malware 2009 making a direct connection itself?

Software firewalls can quite easily be manipulated and bypassed entirely without you as the user even being aware.

Once a machine becomes infected you can no longer trust any notification you receive, the only sensible option is to isolate the machine from the network and then start the process of removal.

hethmar

I have Kasperskys internet suite - covers av, firewall, spam, maleware. If you bank with barclays you can get it free. If not, trial pay will get it free. Failing that, quidco gives cash back and you can still buy 3 licences for £15 on some sites.

I gave up on AVG a couple of years back it seemed to go downhill. Zonealarm (paid for) was a pain, really slowed my puter. Kaspersky has been very good.

mr_fishbulb

anewhope wrote: »

Software firewalls can quite easily be manipulated and bypassed entirely without you as the user even being aware.

Once a machine becomes infected you can no longer trust any notification you receive, the only sensible option is to isolate the machine from the network and then start the process of removal.

Of course. Some have rootkit technology which gets so deep, you can only really be sure of a clean machine by doing a low-level format and reinstalling from scratch.

But then there are the less complicated malware which can't do this. That's where defence in depth comes in - personal firewalls may not do anything to stop sophisticated malware, but they can help against more basic ones.

IThelp

Hopefully my last beg for some assistance.

Am using windows firewall and MSE on new pc.
Was wondering whether to try the comodo FW instead/as well as the windows firewall. What do people think?

[Deleted User]

IThelp wrote: »

Was wondering whether to try the comodo FW instead/as well as the windows firewall. What do people think?

Windows Firewall is more than sufficient. However, running two firewalls in tandem will cause you problems.