Print

Please login or register.
1 Hour 1 Day 1 Week 1 Month Forever
Login with username, password and session length

[happy37]

Hello everyone,

Good morning.

There are some of you who have been following my previous thread titled "New PlusNet FTTC install" in the FTTC and FTTH Issues forum here:-

http://forum.kitz.co.uk/index.php/topic,11464.120.html

I have now been advised by a certain "feline" Kitz member to start this thread about PC security in this forum instead.

If you read my last reply - #134 yesterday at 20:31:13 PM in the other forum above, you will see that the issues that I was having with my Fibre internet connection via PlusNet have now been fixed. 

The 2 culprits on both of my PCs were the combination of my anti-virus program, namely Avast Anti-Virus Free and the firewall, namely Emsisoft Online Armor Free.

Avast Free Antivirus:-

http://www.avast.com/en-gb/free-antivirus-download

Emsisoft Online Armor Free:-

http://www.online-armor.com/products-online-armor-free.php

As mentioned previously in the other thread, this software combination was throttling the download speeds on both of my PCs down to 20MB.

Having uninstalled both of these, I am now running MSE (Microsoft Security Essentials) together with Windows Firewall on both the Windows XP Pro and Windows 7 Pro PCs.

I am also using Malwarebytes Pro, Spybot Search and Destroy, Spyware Blaster and McAfee Security Scan Plus on both PCs.

I now have a two-tiered question concerning PC security?

1. Can I make Windows Firewall's defences a bit stronger than they are now? Are there any options that I can tweak/change to do this, please? IMO, Windows Firewall does the job, but it's too basic. I want it to do more?

Is MSE and Windows Firewall the best combination to use?

What about Avira Free Antivirus and Zone Alarm Free instead? Will this combination work or not? Are there any members out there who have experienced the same issues as I have?

http://www.avira.com/en/avira-free-antivirus

http://www.zonealarm.com/security/en-us/zonealarm-pc-security-free-firewall.htm

2. Are there any settings that I can change/configure in Avast Antivirus and/or Online Armor firewall to allow the same full download speeds on both of my PCs?

Does this not usually involve disabling some of the more thorough methods of scanning incoming traffic that some programs employ, and would this be a good thing to do or not?

Grateful for your thoughts/comments/observations, as always. 

Regards

happy37

[HPsauce]

Windows Firewall does the job, but it's too basic. I want it to do more?

Explain. How and what?

[happy37]

Windows Firewall does the job, but it's too basic. I want it to do more?

Explain. How and what?

HPsauce

Good morning.

Thanks for your reply. I have seen various screenshots of how Windows Firewall works on the Internet, but how can I check if the default options that it uses are monitoring both inbound and outbound traffic and protecting both PCs?

Thanks.

Regards

happy37

[HPsauce]

Morning, sorry for the very brief reply above, I was dragged away as I started the reply so had to be brief.

monitoring both inbound and outbound traffic

I've never seen anything claiming it monitors outbound traffic.

protecting both PCs?

I don't understand that, it's a component of Windows that runs on an individual PC and protects that PC.
(or are you using connection-sharing?)

If you want a firewall that protects the network use the one in your router or add a specific hardware-based one that meets your requirements if that is inadequate.

[happy37]

HPsauce,

Thanks for your reply.

Morning, sorry for the very brief reply above, I was dragged away as I started the reply so had to be brief.

No problem at all.

I've now done a bit more reading round how Windows firewall works.

I've never seen anything claiming it monitors outbound traffic.

You're right - it only monitors incoming/inbound traffic, thus meaning that all outbound traffic is allowed by default? Am I correct?

I don't understand that, it's a component of Windows that runs on an individual PC and protects that PC.
(or are you using connection-sharing?)

I have got the Windows Firewall running on both PCs now - the Windows XP Pro one as well as the one on Windows 7 Pro.

If you want a firewall that protects the network use the one in your router or add a specific hardware-based one that meets your requirements if that is inadequate.

I am already using the router's firewall. Is there a specific hardware-based one that you can recommend, please?

The sole reason for all this changing round of firewalls/anti-virus programs was that my particular combination of Avast Antivirus and Online Armor firewall was causing me speed issues with my internet connection.

Hence my trying to find another working combination that can give me better protection than Windows Firewall if it is only going to monitor inbound traffic.

What about Avira Free Antivirus and Zone Alarm Free?

What about MSE and Zone Alarm Free?

Looks like it's a case of "trial and error" then to see which program combination could and would work with my particular setup, and not cause my Internet connection to be throttled when the programs are in use.

Maybe I could faff around with the settings in Avast Antivirus and/or Online Armor firewall to allow the same full download speeds on both of my PCs, but I wouldn't know where to start.

Grateful for your thoughts. 

Regards

happy37

[kitz]

Very quick reply from me

Over the years Ive used various AV..  but I currently use MSE and Windows Firewall is switched on, and also my router.   

Dont forget if youre running a NAT router (you most likely will be), then NAT also adds another layer of protection, aside from windows firewall Ive not used a software firewall for 9+ yrs.

If I get chance later I'll explain why Im not bothered about outbound monitoring.
Adding to much protection actually can cause conflicts and bottlenecks...  but theres another reason, that will take a bit longer to type.

[happy37]

Very quick reply from me

Over the years Ive used various AV..  but I currently use MSE and Windows Firewall is switched on, and also my router.   

Dont forget if youre running a NAT router (you most likely will be), then NAT also adds another layer of protection, aside from windows firewall Ive not used a software firewall for 9+ yrs.

If I get chance later I'll explain why Im not bothered about outbound monitoring.
Adding to much protection actually can cause conflicts and bottlenecks...  but theres another reason, that will take a bit longer to type.

kitz,

Thanks for the useful reply. Do you find this combination enough? (MSE and Windows Firewall)

Is the firewall not a tad too basic, or am I being a bit too harsh?

Is this in Windows XP and/or Windows 7?

AFAIK, the Technicolor TG582n is a NAT router, so yes, I am using NAT in/on my router.

It would be very interesting to know and read about your last point about outbound monitoring. Maybe I am getting unduly worried then?

Thanks again - much appreciated.

Regards

happy37

PS - the speed issue on both of my PCs is now sorted. Unless you haven't had a chance to read the other thread yet, I have explained in there what the issue was, and this is why I have started up this topic about PC security in this forum.

[sheddyian]

I'm with Kitz here - I have MSE and Windows Firewall on my XP machines, and I've turned OFF the firewall because the modem has NAT and what I believe to be reasonable firewall rules that block other inbound attacks.

That said, if anyone can point me to something that explains why my configuration is foolish in the extreme, I'd reconsider!

Ian

[HPsauce]

The only note of caution I'd make there is that your router firewall is fixed at manufacture.
Windows firewall "can" be updated, though I don't know if it is....

As for outbound fiewalls, here's a typical "debate": http://www.davescomputertips.com/2012/05/do-outbound-firewalls-really-offer-any-additional-benefits/

[asbokid]

Nobbled throughput caused by a misconfigured firewall in Windows seems quite common.

Here from the forum of the Beast of Newgate Street, in relation to the Kaspersky firewall:

http://community.bt.com/t5/BT-Infinity/BT-Home-Hub-3-Type-A-problem-with-throughput/td-p/389355

Not clear how a firewall causes "erratic and slow" speedtests.   This is Microsoft though, where the possibilities for failure are limited only by imagination!

cheers, a

[HPsauce]

Nobbled throughput caused by a misconfigured firewall in Windows seems quite common.

Indeed, I saw one just the other day which was down to McAfee and its over-diligent firewall.
User removed that and installed MSE (enabling Windows firewall) and all was well again. 

And it's not that long ago that I saw a very slow system with Kaspersky installed which was solved in the same way. 

[silversurfer44]

This all sounds like M$ bashing the opposition to me.
All a good firewall should do is prevent access to a system by unwanted intruders.
This used to be achieved with firewall rules, that closed the ports that weren't needed for normal operation. To modify a firewall one would create a rule to allow passage of data through to a designated PC.
As for outbound fire-walling one would need rules to prevent certain ports from being used by the OS. To put it in it's simplest form.

If a PC works with M$ firewall and M$ security what ever, but doesn't work with other anti-virus detection software what are M$ doing in the operating system? I would be very inquisitive.

[broadstairs]

I've been watching this thread with interest. My main PC runs Linux with the firewall disabled, my router is NAT'd with all ports closed so only stuff which is going to get through would be because I open an untrusted email or visit a dodgy website. Now because I run Linux there is only a tiny chance of something bad happening so I dont run AntiVirus either. However onl my laptop which still has W7 (my wife likes it) has AV but no firewall. My W2K PC which runs my weather station runs no firewall (its behind the NAT'd router) and no AV as it does not get used for anything and in 6 years it has never been infected.

So to sum up with any M$ system I run AV not because M$ is inherently bad but because 99% of all malware/virii are built to infect M$ and not Linux.

As to any AV products the only one I wont touch is anything to do with Norton, in my view the worst product ever made available. Most of the free AV are perfectly adequate.

Stuart

[kitz]

>> Do you find this combination enough? (MSE and Windows Firewall)

Slight correction.  Do I find MSE, Windows Firewall and my NAT router enough.  Yes.

>> Is this in Windows XP and/or Windows 7?

Both



--------

Ive been on the internet for 16+yrs so Ive been through my fair share of AVs and firewalls during that time.  However for the past 8 yrs or so I havent used a software firewall (other than M$). 

9.5 yrs ago I was very badly hit by SQL Slammer.  I was infected within 20mins of it being released into the wild and I remember it well, because it was the day before I was due to hand in my final BSc yr paper for (WAN) Networking...  and had to reformat  I dont think I slept for about 36hrs.  SQL slammer on a 56k dial-up connection is NOT good, the backup of traffic meant my PC was incapable of doing anything.
I was infected despite having AV and a software firewall (Zone Alarm) because I was using MSDE and although there was a patch for SQL Server, there wasnt for the version that had been supplied as part of my course.. and although NOW there is a patch and removal tool.   Back then there wasnt, nor did my firewall or AV pick it up despite being up to date.  In fact AFAIK it wasnt detectable by any of the AV nor (m)any software firewalls which is why it became one of the worst attacks of all time.

Yet, due to it being an unsolicated packet, NAT would have halted it.

----------

Move on just 2 months, my exchange was activated and I made sure I didnt use one of the ST modems that were being shipped out and I forked out for a NAT router which in those days weren't cheap.
I kept my software firewall on for about another 6 months or so, but I ditched it after I realised it wasnt really doing anything and everything was being caught by my router - the SAR had damn good logging.   I saw absolutely no need to run a software firewall that just bogged down my PC when the router was doing all it should.

Since using a NAT router and decent AV, Ive not been infected by any of the nasties that where constantly trying to get in when just using a modem.

---------

You express concerns about a software firewall and outbound traffic.   My answer to that is - well it depends on you.  What sort of outbound traffic are you wanting to protect against?   If you think about it... then the nasties are incoming and as long as youre not stupid and dont introduce stuff on your own network (say via USB) then you should be fine.   
Outbound monitoring means that the PC (or LAN) is already going to be infected. A decent AV should take care of that already.  Its the AVs job to scan new files and exe's before they hit the machine.

There will always be new exploits and viruses, but since SQLslammer, most of the major Antivirus manufacturers now have added protection in that they dont just look for specific viruses, but they also look for virus patterns, which will pull up new variants before they are even named or identified.

So if you know your network is clean and youre not one of those that will install just about all and sundry on your PC then I dont see the point.   Aside from that tools such as Netmeter easily show any outbound activity.

Im not saying its 100%, because who knows what will be dreamed up in the future and one of the best defences of all is to just be careful what you click on.


-------------
>>> Not clear how a firewall causes "erratic and slow" speedtests.

Not sure either, but McAfee is one of the names that constantly seems to cause problems.  I dont have time to look into it, but I suspect that some cases may be due to relay of traffic/proxies...  if anyone wants to follow that line further and do some research... but that would be my starting point.

[c6em]

Oh,
I have no problem with NIS since 2005 (it was a memory hog though up to 2009 when it was totally re-written)
Never had any problems with virus either, but then I don't click on suspect stuff.  I do recall a couple of pages in the last few years which NIS blocked me from accessing due to nasties on them.
It now works pretty well invisibly on this 2005 vintage computer.
AV comparatives had it in the top group last year with as I recall Kaspersky, Bitdefender, F secure G data.

From what I see on the MSE techie forum of posters and their various AV's yet with endless virus that the users are asking for help in removing, it seems a lot of them don't work.

What no one I've yet seen seems to be considering in the AV sector is virus/worms whatever aimed at the router specifically.
I suppose the next target will be smart phones used for online banking.