IMPORTANT (Just thought I might post this)

[fedor]

A new virus/trojan appeared last friday so I thought I might post this for hotmail/outlook user's http://www.symantec.com/security_res...403-99&tabid=1 My norton has been slowing my computer down to protect me from just this level 3 (Moderate threat ) risk

[Bowser Jr.]

My norton has been slowing my computer down to protect me from just this level 3 (Moderate threat ) risk

What the hell? Yet another reason why Norton sucks. My AV also protects me from this threat, but it hasn't slowed my computer any more than normal, and my normal is probably a lot faster than Norton's normal. An AV shouldn't slow your computer more with each new definition.

Oh, and mine is completely free. And performs better then most of the paid for products (including Norton and McAfee) in both on demand and on access scanning. It's called Antivir, by Avira. AntiVir PersonalEdition Classic - More than Security

[Tekkaman]

Ah, I had AntiVir on my last computer. It's a terrific (and free) anti-virus program. I'd recommed it as well. :mrgreen:

[Kugyince]

I use AVG Anti-Virus. Totally free, self updates, and comes with an extra firewall. Good stuff.

[wanman]

norton security is good stuff, i reccomend it.

[fedor]

Well I found out norton wasnt slowing my computer down <_<
And firewalls are useless (norton has this good firewall that is friendly with programs)
I want to get avast

[Celinta]

I use Avast.

[Bowser Jr.]

I use AVG Anti-Virus. Totally free, self updates, and comes with an extra firewall. Good stuff.

AVG free doesn't come with a firewall. From the website:

What you do not get (Available only with commercial versions)
no Anti-Spyware
no Anti-Spam
no Firewall
no 64-bit and server support
no 24/7 Technical Support
no High-speed updates
no Multiple languages
no Detailed settings
no Consent for commercial use

And if you have the commercial version, it's not totally free. Plus AVG has very substandard detection, even for a free AV. In the latest independent tests: AV-Comparatives , AVG had some of the worst results for on-demand scanning, and failed to even achieve certification for on-access scanning. I wouldn't trust it to protect my computer. It's worth noting that Avira came up more or less top in all tests, beating out many commercial products, and Avast! didn't do badly either. Avast! is the most fully featured of the free products, and the closest to a commercial product, but if you don't mind losing some of the extras, Antivir has the edge on detection rates.

And firewalls are useless (norton has this good firewall that is friendly with programs)

Objection! Yes, that was unnecessarily fancy, but true. A firewall is the most important program to have for any Windows user who uses the internet. Without a firewall, your computer will have:
1) All ports open, ready for anyone who wants to push data into them.
2) No control over which computers send data to your computer.
3) No control over which programs on your computer can connect to the internet (including nasty dialers or downloaders).
4) No control over any of the data which is being sent from your computer (which could include passwords, banking details, spam)

It's not something you should be without. Norton's firewall is adequate (not great, not terrible, definitely better then nothing), but it's a nightmare to configure, and it's quite leaky. Leak tests are a standard method of firewall testing. They are specially crafted programs that use special tricks to try to get around your firewall's program blocking. A firewall needs to be able to detect and stop these tricks, otherwise there's not a lot of point in having the program blocking at all. A list of leak test results can be found here: Leak-tests results

Even the Windows free firewall is better than nothing, although it has no outbound protection, and no program control.

My firewall of choice is a combination of a hardware firewall built into my wireless router (useful, but not essential) and Comodo Firewall Pro, which is very easy to configure, very advanced if you know what you're doing, and scored highest on the leak testing. And it's completely free.

Anyway, that was a really long post, but I'm into security and once I get going I can't stop. I hope it's been of some use.

[fedor]

firewalls my ass... <_<
Firewalls deny to much access and it's really annoying... Having to unblock that! *twitches*

Originally Posted by Browser Jr.

but I'm into security and once I get going I can't stop

Hah! Im into security 2 So on make the programming forum already!!!

[Kugyince]

I like my AVG.

[Hobbes]

Originally Posted by fedor

firewalls my ass... <_<

This from the guy who had a trojan come in and wipe out his computer?
:laughing:

You'll excuse me if I keep my firewall up and running...

[Bowser Jr.]

Originally Posted by fedor

firewalls my ass... <_<
Firewalls deny to much access and it's really annoying... Having to unblock that! *twitches*

That's not a problem with firewalls, it's a problem with your firewall. I just get a pop-up whenever a new program or changed program tries to connect. Allow permanently once, and never get asked again. At any rate though, I'd rather have the attacks blocked than let through.

I stand firm that the only thing a Windows user needs to do to stay safe is get a decent AV and firewall (don't have to pay for either of these), keep up to date with patches and be sensible online (most important). All the other stuff in security suites is just bloat, and not really needed.

[fedor]

I dont have a firewall... and no it was a different trojan hobbes... IF YOU READ!!! <_<
downloader.trojan (it attacks the cache of your browser so a crappy firewall wont help)

[Bowser Jr.]

As a further (perhaps unnecessary) demonstration of how useful a firewall is, here's the last 10 entries in my (hardware) firewall's log. Bear in mind this was from just over five minutes, and this kind of traffic is arriving all the time. This is all genuine traffic lifted straight from the log.

Thursday February 01, 2007 02:57:51 Unrecognized attempt blocked from <Taiwan IP address> to <My IP address> TCP:135 {135= Microsoft DCOM server. Commonly left open by Microsoft, and exploited by certain IRC bots}
Thursday February 01, 2007 02:58:56 Unrecognized attempt blocked from <UK IP address> to <MY IP address> TCP:2967 {2967= ssc-agent. Commonly left open by a vulnerability in Norton products. used by many exploits}
Thursday February 01, 2007 02:58:59 Unrecognized attempt blocked from <UK IP address> to <My IP address> TCP:2967 {As before, same person came back for another try}
Thursday February 01, 2007 03:00:42 Unrecognized attempt blocked from <Taiwan IP address> to <My IP address} TCP:135 {As before}
Thursday February 01, 2007 03:00:45 Unrecognized attempt blocked from <Taiwan IP address> to <My IP address} TCP:135 {And again}
Thursday February 01, 2007 03:01:31 Unrecognized attempt blocked from <Different UK IP address> to <Me> TCP:5800 {5800= vnc access. Commonly used for buffer overflow attacks}
Thursday February 01, 2007 03:01:35 Unrecognized attempt blocked from <Same IP as before, but different port> to <Me> TCP:1433 {1443= Intergrated engineering software. Used for a zero day exploit}
Thursday February 01, 2007 03:01:58 Unrecognized attempt blocked from <Netherlands IP address> to <Me> UDP:1026 {1026=Calender access protocol. Another one opened by Mcrosoft and often exploited}
Thursday February 01, 2007 03:04:19 Unrecognized attempt blocked from <Brazil IP address> to <Me> TCP:22 {22= SSH remote login protocol. Often opened by SSH clients, and exploited}
Thursday February 01, 2007 03:04:23 Unrecognized attempt blocked from <Taiwan IP address> to <Me> TCP:135 {yep, Taiwan's back for more too}

These aren't just random misdirected internet traffic. They're all to potentially vulnerable ports, which leads me to believe they're all created by people running hacker tools, for the sole purpose of trying to access my computer. My computer is no more obvious or useful then any computer on the internet (it's probably better stealthed than many), so if they're trying to hack me, they're probably trying to hack everyone else in the area, all at the same time. My firewall blocked all these attempts, but without it, nothing else on my computer would have blocked them. No one is safe from attacks nowadays. Best you can do is stop them getting in.



And as for saying "a crappy firewall wont help", this program is a downloader. It needs to go on the internet to download more nasty stuff to put on your computer. Any firewall with application control will allow you to block this attempt in one click, thus making the trojan pretty useless.

[fedor]

how can you tell the countries IP address?

[Bowser Jr.]

DNS Stuff: DNS tools, DNS hosting tests, WHOIS, traceroute, ping, and other network and domain name tools.

Stick the IP into the IP information box.