Register a SA Forums Account here!
JOINING THE SA FORUMS WILL REMOVE THIS BIG AD, THE ANNOYING UNDERLINED ADS, AND STUPID INTERSTITIAL ADS!!!

You can: log in, read the tech support FAQ, or request your lost password. This dumb message (and those ads) will appear on every screen until you register! Get rid of this crap by registering your own SA Forums Account and joining roughly 150,000 Goons, for the one-time price of $9.95! We charge money because it costs us money per month for bills, and since we don't believe in showing ads to our users, we try to make the money back through forum registrations.
 
  • Locked thread
Chin Strap
Nov 24, 2002

I failed my TFLC Toxx, but I no longer need a double chin strap :buddy:
Pillbug

Khablam posted:

... read the thread?
There's been loads of recommendations as well as links to various sources to get independent comparisons.

See:
http://av-test.org/
http://www.av-comparatives.org/

Sorry, I should have gone 3 pages back. My bad!

Adbot
ADBOT LOVES YOU

Mo_Steel
Mar 7, 2008

Let's Clock Into The Sunset Together

Fun Shoe
According to AV-Comparatives 2013 Summary Report they selected Kaspersky as their Product of the Year, with a number of other AVs being listed as Top Rated (Avast!, AVIRA, Bitdefender, Bullguard, ESET, Fortinet, F-Secure). You could go with any of those to handle active protection and scheduled scanning without much real variation between them so trial any of those AVs you want to try out and see if you like the interface, options, organization, pricing, support, etc. Pick from any one of those and practice safe browsing habits (don't visit potentially malicious sites, run an ad-blocker / NoScript, uninstall Java if you aren't using it right now, don't download strange email attachments, etc.) and you'll probably be in good shape.

Khablam
Mar 29, 2012

Mo_Steel posted:

According to AV-Comparatives 2013 Summary Report they selected Kaspersky as their Product of the Year, with a number of other AVs being listed as Top Rated (Avast!, AVIRA, Bitdefender, Bullguard, ESET, Fortinet, F-Secure). You could go with any of those to handle active protection and scheduled scanning without much real variation between them so trial any of those AVs you want to try out and see if you like the interface, options, organization, pricing, support, etc. Pick from any one of those and practice safe browsing habits (don't visit potentially malicious sites, run an ad-blocker / NoScript, uninstall Java if you aren't using it right now, don't download strange email attachments, etc.) and you'll probably be in good shape.

You don't need to uninstall java if it's something you periodically need, just disable the browser plugins.
In your control panel, go to Java:

uncheck the box and apply.

You can verify it's been removed by opening your browser and looking at the plugins.
In chrome, go to about :plugins and check it is gone. In firefox, to to extensions > plugins.
In internet explorer, re-evaluate your choices in life.

Khablam fucked around with this message at 22:27 on May 20, 2014

gradenko_2000
Oct 5, 2010

HELL SERPENT
Lipstick Apathy
I have something called PUM.DNS that root killer and combo fix can't seem to get rid of, but I'm wondering if that kind of DNS affecting virus only works if my PC is on (granted I haven't checked the other PCs on the network if they're infected) because I'm trying to isolate if my connection keeps dropping every few minutes because of it or because my ISP really sucks.

EDIT: Configuring the router to OpenDNS and running RootKiller from Safe Mode seems to have fixed the problem - my results are coming back clean now, at least on this desktop.

gradenko_2000 fucked around with this message at 07:19 on Jul 21, 2014

Helpimscared
Jun 16, 2014

Does anyone here use Bitdefender Free? Is it a better option than MSE?

Khablam
Mar 29, 2012

Helpimscared posted:

Does anyone here use Bitdefender Free? Is it a better option than MSE?

Bitdefender Free is basically MSE with better definitions. Both are very bare-bones and unobtrusive, but independent tests put BD's detection and removal rates at a much higher level than MSE's. Both have a median of 0 false positives in tests.

I stuck BD free on a netbook, and I actually forgot it was there to the level where I went to re-download it thinking it wasn't running. Unless you look for the icon, it will never do anything unless a threat appears, and doesn't even advertise full versions in any way.

kiwid
Sep 30, 2013

We have a select few people in the company with local admin rights because of terribly written software that isn't UAC aware. We're noticing a lot of new malware is changing the DNS entries on the lan/wlan/vpn interfaces which means auth and all kinds of other stuff takes a poo poo. Anyone else noticing more of this type of malware?

Khablam
Mar 29, 2012

kiwid posted:

We have a select few people in the company with local admin rights because of terribly written software that isn't UAC aware. We're noticing a lot of new malware is changing the DNS entries on the lan/wlan/vpn interfaces which means auth and all kinds of other stuff takes a poo poo. Anyone else noticing more of this type of malware?
All it means when a program isn't 'UAC aware' is that it doesn't ask for admin privileges when denied access by default (i.e. when writing to Program Files) - the best workaround is to have users launch that one program with admin rights under 'Run as...' and select a local admin account. I can't think of a scenario where the logged-on user would need to be an admin, but perhaps one exists.

Whenever a user tells you "I need local admin, because..." you have just found a user who should not be given admin rights. I suppose giving them the admin password to launch the program gives them the ability to make harmful changes, but it handily removes plausible deniability as any change is a proven-deliberate act and you can chastise them accordingly.

To answer your question - yes. Zeroaccess in particular is a rootkit that will mess with your DNS, be sure you're not just removing payloads and there's not active rootkits if it seems persistent.

Ironically, given my above post, zeroaccess will self-escalate and walk around UAC, using a DLL loading exploit to make the user think they are approving a flash/java update. The spoof is wholly convincing, and any user who has the password to hit accept on the prompt needs to know this is a common attack vector / tell them to never accept any updates.

N. Senada
May 17, 2011

My kidneys are busted
Am I right in thinking I need to uninstall MSE before installing Avast! ?

cinci zoo sniper
Mar 15, 2013




N. Senada posted:

Am I right in thinking I need to uninstall MSE before installing Avast! ?
Yes, you are right.

Entropic
Feb 21, 2007

patriarchy sucks
More is not better when it comes to anti-virus programs.

ryanbruce
May 1, 2002

The "Dell Dude"

Entropic posted:

More is not better when it comes to anti-virus programs.

Same principles as condoms. Don't go for the sketchy looking ones, and never double bag.

Scaramouche
Mar 26, 2001

SPACE FACE! SPACE FACE!

ryanbruce posted:

Same principles as condoms. Don't go for the sketchy looking ones, and never double bag.

My antivirus is ribbed for her pleasure.

Nenonen
Oct 22, 2009

Mulla on aina kolkyt donaa taskussa

ryanbruce posted:

Same principles as condoms. Don't go for the sketchy looking ones, and never double bag.

I use trojans all the time! :downs:

Mo_Steel
Mar 7, 2008

Let's Clock Into The Sunset Together

Fun Shoe
In regards to AV chat and the persistent search for a good AV to use for myself / recommend to less PC-savvy family, I've been using the free version of Bitdefender for roughly a month now and I'm liking it more than Avast!. AV-Comparatives ranks the Internet Security version among the top of the pack in Real-World Protection tests lately, and in terms of UI it's as unobtrusive as MSSE is; if the active protection is disabled a Windows flag pops up in the taskbar and under Important Messages. The only downside I see from my point of view is that there aren't a lot of options available to tweak within the application itself, even things like when to run a quick scan.

I think going forward I'll be recommending Bitdefender to family and friends.

Omglosser
Sep 2, 2007

A little confused/concerned.
I downloaded a free C compiler for Windows 8.1 (I'm a total newbie btw) called CodeLite. I'm running the paid version of Avast!, and as I was running the CodeLite install, avast said it caught the virus "Win32:Evo-gen [Susp]". Since Windows also prompted me to not run the .exe file, I figured something bad was up. So I run a full system scan, nothing was found. Ran a boot-time scan, nothing was found but this error message appeared during the scan:

"File C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-1efca74d.exe|>mpavbase.vdm Error 42127 {CAB archive is corrupted.}"

Google turned up nothing for the .exe file but apparently .vdm is a virus database file? I know some viruses seek out anything that might stop it first and damage it. Now, every resource I've used says that CodeLite is legit, and the install file I downloaded safe (avast, malwarebytes, virustotal). Is it possible that even if the install file is okay, once it starts to install a virus can appear that wouldn't have been found otherwise? Or is this a false positive? I've tried installing a few more times with the same result, however, each time the supposedly infected file was a different .tmp file. Or is there something more sinister perhaps, like a virus that waits for something to start being stalled then latches on? :tinfoil:

ryanbruce
May 1, 2002

The "Dell Dude"
I'd suggest clearing out your temp files using CCleaner from the OP. If the install still doesn't work, create a standard thread in SH/SC Haus and someone can help you out.

Khablam
Mar 29, 2012

Omglosser posted:

A little confused/concerned.
I downloaded a free C compiler for Windows 8.1 (I'm a total newbie btw) called CodeLite. I'm running the paid version of Avast!, and as I was running the CodeLite install, avast said it caught the virus "Win32:Evo-gen [Susp]". Since Windows also prompted me to not run the .exe file, I figured something bad was up. So I run a full system scan, nothing was found. Ran a boot-time scan, nothing was found but this error message appeared during the scan:

"File C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-1efca74d.exe|>mpavbase.vdm Error 42127 {CAB archive is corrupted.}"

Google turned up nothing for the .exe file but apparently .vdm is a virus database file? I know some viruses seek out anything that might stop it first and damage it. Now, every resource I've used says that CodeLite is legit, and the install file I downloaded safe (avast, malwarebytes, virustotal). Is it possible that even if the install file is okay, once it starts to install a virus can appear that wouldn't have been found otherwise? Or is this a false positive? I've tried installing a few more times with the same result, however, each time the supposedly infected file was a different .tmp file. Or is there something more sinister perhaps, like a virus that waits for something to start being stalled then latches on? :tinfoil:

A lot of really random data and code can end up flicking enough heuristics flags to get a false positive. It's forever been an issue with SETI, F@Home and similar programs, as their data-files can end up looking like a virus using poly-morphing techniques. This particular CAB might contain something like that.

If you ever get something you can be reasonably sure is not a virus, or you want to check anyway, simply use Virustotal (as mentioned in the thread, there is an uploader which sticks this on a right-click for any file) and scan it against 50+ engines.
A couple of detections with generic names means this is likely a false positive, a good list with specific virus names means it is highly likely to be a virus. Comments / votes help there too.

This is an example of STAY AWAY SPORT - https://www.virustotal.com/en/file/41ce689987cf1341bf6910fb8f39a56c69330a5648ece77090ba998134426f4d/analysis/

This is an example of something that for some reason looks dubious to one or more A/Vs-
https://www.virustotal.com/en/file/f017d5d8a27672e240e89740e17041fad81eb22f13c0504bba38005c49dfe274/analysis/

n.b. look out for AVs flagging optional-toolbars and such as a 'PUP', which is unlikely to be a problem provided the installer makes it optional.

Omglosser
Sep 2, 2007

I mentioned I did virustotal, which said everything was okay. At any rate I ran CCleaner and restarted the computer, and the install went successfully. Thanks guys. Stupid computer security book made me paranoid.

Jamesman
Nov 19, 2004

"First off, let me start by saying curly light blond hair does not suit Hyomin at all. Furthermore,"
Fun Shoe
I've keep having issues where my card information is being stolen and used in fraudulent activity. I believe I've pinpointed it to using my card online at one location, but just to be sure, I was wondering if I should be using any particular programs to scan for something on my system.

I use MSE and keep it up to date with weekly scans, and it never finds anything. I also do regular Windows updates that include security updates to the malicious software removal tool. I run AdBlock, AVG Do Not Track (a holdover from when I used to use AVG instead of MSE), and NoScript with my browser.

Zogo
Jul 29, 2003

Jamesman posted:

...I was wondering if I should be using any particular programs to scan for something on my system.

A good start would be running these in this order:

http://www.bleepingcomputer.com/download/tdsskiller/
http://www.bleepingcomputer.com/download/adwcleaner/
https://www.malwarebytes.org/mwb-download/
http://windows.microsoft.com/en-us/windows/what-is-windows-defender-offline

Jamesman
Nov 19, 2004

"First off, let me start by saying curly light blond hair does not suit Hyomin at all. Furthermore,"
Fun Shoe
TDSSKiller came up completely clean. I have a log from ADW Cleaner that I can't decipher myself. Is there a site I can feed it through to figure these things out, or should I make a thread asking for help going through the logs?

ryanbruce
May 1, 2002

The "Dell Dude"

Jamesman posted:

TDSSKiller came up completely clean. I have a log from ADW Cleaner that I can't decipher myself. Is there a site I can feed it through to figure these things out, or should I make a thread asking for help going through the logs?

The latter, because there's likely to be a lot of back-and-forth as you run various scans.

Jarl
Nov 8, 2007

So what if I'm not for the ever offended?
Just a thank you.

Been looking around for a new malware scanner. Ad-aware stopped being usefull a long time ago, and later Spybot-Search and Destroy went the same way. Really happy I found this thread; Malwarebytes is perfect.

WattsvilleBlues
Jan 25, 2005

Every demon wants his pound of flesh

Jarl posted:

Just a thank you.

Been looking around for a new malware scanner. Ad-aware stopped being usefull a long time ago, and later Spybot-Search and Destroy went the same way. Really happy I found this thread; Malwarebytes is perfect.

There are also spin-offs of Malwarebytes Anti-Malware, such as Malwarebytes Anti-Rootkit and Malwarebytes Chameleon.

Admiral Bosch
Apr 19, 2007
Who is Admiral Aken Bosch, and what is that old scoundrel up to?
edit: deleted

Admiral Bosch fucked around with this message at 09:21 on Sep 6, 2014

Sephiroth_IRA
Mar 31, 2010
I'm sure there's probably a better place to ask this but I couldn't find anything so I hope it's okay if I ask here. I have a co-worker that needs to send someone a large 110mb file but outlook apparently and understandably won't send anything that big. If I was a home this would be a simple issue but since it's work related I want to upload it somewhere somewhat secure where only he and his recipient will be able to open it.

For the time being I'm uploading it to Dropbox (20 minute upload. Our Internet is really slow) but I was wondering if there was a better place I could use in the future?

WattsvilleBlues
Jan 25, 2005

Every demon wants his pound of flesh

Sephiroth_IRA posted:

I'm sure there's probably a better place to ask this but I couldn't find anything so I hope it's okay if I ask here. I have a co-worker that needs to send someone a large 110mb file but outlook apparently and understandably won't send anything that big. If I was a home this would be a simple issue but since it's work related I want to upload it somewhere somewhat secure where only he and his recipient will be able to open it.

For the time being I'm uploading it to Dropbox (20 minute upload. Our Internet is really slow) but I was wondering if there was a better place I could use in the future?

Could you upload it to OneDrive and then share the link?

Mo_Steel
Mar 7, 2008

Let's Clock Into The Sunset Together

Fun Shoe

Sephiroth_IRA posted:

I'm sure there's probably a better place to ask this but I couldn't find anything so I hope it's okay if I ask here. I have a co-worker that needs to send someone a large 110mb file but outlook apparently and understandably won't send anything that big. If I was a home this would be a simple issue but since it's work related I want to upload it somewhere somewhat secure where only he and his recipient will be able to open it.

For the time being I'm uploading it to Dropbox (20 minute upload. Our Internet is really slow) but I was wondering if there was a better place I could use in the future?

Put it in an encrypted zip file and throw it on Google Drive, set it to only allow people with the link to see it, then delete it once he got it would be my attempt.

wearing a lampshade
Mar 6, 2013

avast has been getting Win32:BProtect-J [Trj] everytime i connect to my work's unsecure wifi. plz tell me how to get rid of it fully :(

Khablam
Mar 29, 2012

albany academy posted:

avast has been getting Win32:BProtect-J [Trj] everytime i connect to my work's unsecure wifi. plz tell me how to get rid of it fully :(

Secure the wifi

hooah
Feb 6, 2006
WTF?
On Windows 8.1. When I came home this afternoon, the "Solve PC issues" flag in the system tray had a badge, and when I hovered over, it said "click here to enter your most recent password (important)". When I do, it just takes me to the Metro account settings. I ran Malwarebytes and it didn't find anything, and Avast! hasn't freaked out, either. What the hell is this?

Fruit Smoothies
Mar 28, 2004

The bat with a ZING

hooah posted:

On Windows 8.1. When I came home this afternoon, the "Solve PC issues" flag in the system tray had a badge, and when I hovered over, it said "click here to enter your most recent password (important)". When I do, it just takes me to the Metro account settings. I ran Malwarebytes and it didn't find anything, and Avast! hasn't freaked out, either. What the hell is this?

Probably a Live account password check.

BottledBodhisvata
Jul 26, 2013

by Lowtax
Has anyone else had weird problems with Avast? It used to be well -reccomended but when I download it now it prevents my OS booting up. Now I try to uninstall it in safe mode and it stops doing anything at the part wher it says "uninstalling kernel driver". I can 'to use my computer with it and I can't remove it either!?

hooah
Feb 6, 2006
WTF?
I'm getting more activity on that flag icon in my system tray again. The password one's gone away, but now I see two messages about antivirus/spyware apps. The first says "Tap or click to see antispyware apps (Important)", and the second says "Check virus protection (Important)". I have Avast running and up to date. Why am I getting these?

NeoSeeker
Nov 26, 2007

:spergin:ASK ME ABOUT MY TOTALLY REALISTIC ZIPLINE-BASED ZOMBIE SURVIVAL PLAN & HOW THE ZOMBIE SURVIVAL VIDEO GAME GENRE HAS BEEN "RAPED BY THE MAINSTREAM":spergin:
Currently I'm using Avast and Malwarebytes as my system security. Avast isn't really doing poo poo at the moment. It doesn't seem to be actively working against malware in the background. Malwarebytes works fine as far as I can tell. I don't think Avast's firewall is working properly.

Are there any combinations of free programs that are better than my current repertoire? I'm willing to guess Microsoft Defender and Malwarebytes is a better combo, am I wrong?

cinci zoo sniper
Mar 15, 2013




NeoSeeker posted:

Currently I'm using Avast and Malwarebytes as my system security. Avast isn't really doing poo poo at the moment. It doesn't seem to be actively working against malware in the background. Malwarebytes works fine as far as I can tell. I don't think Avast's firewall is working properly.

Are there any combinations of free programs that are better than my current repertoire? I'm willing to guess Microsoft Defender and Malwarebytes is a better combo, am I wrong?

I think you mean Microsoft Security Essentials instead of Windows Defender.

Fruit Smoothies
Mar 28, 2004

The bat with a ZING

NeoSeeker posted:

Are there any combinations of free programs that are better than my current repertoire? I'm willing to guess Microsoft Defender and Malwarebytes is a better combo, am I wrong?

In terms of detection, there's not much in it (Avast likely has the edge). However, Windows Defender (Security Essentials in Windows < 8) is much better in terms of nagging and system impact.

Khablam
Mar 29, 2012

NeoSeeker posted:

Currently I'm using Avast and Malwarebytes as my system security. Avast isn't really doing poo poo at the moment. It doesn't seem to be actively working against malware in the background. Malwarebytes works fine as far as I can tell. I don't think Avast's firewall is working properly.

Are there any combinations of free programs that are better than my current repertoire? I'm willing to guess Microsoft Defender and Malwarebytes is a better combo, am I wrong?

Software firewalls are dumb in 98/100 usage scenarios, so it's likely working just fine in that it has absolutely nothing to do.

I've never known Avast! to not work, and it's definitely the most robust of the free options. Why do you think it doesn't work? Have you tried it against the EICAR test files?

MSE has lovely detection rates and if you want to use it because of it's "install and forget" nature, Bitdefender free works in the same way but with solid detection rates.

Adbot
ADBOT LOVES YOU

Entropic
Feb 21, 2007

patriarchy sucks

kalstrams posted:

I think you mean Microsoft Security Essentials instead of Windows Defender.

It's called Defender now in its Windows 8 incarnation.

  • Locked thread