Register a SA Forums Account here!
JOINING THE SA FORUMS WILL REMOVE THIS BIG AD, THE ANNOYING UNDERLINED ADS, AND STUPID INTERSTITIAL ADS!!!

You can: log in, read the tech support FAQ, or request your lost password. This dumb message (and those ads) will appear on every screen until you register! Get rid of this crap by registering your own SA Forums Account and joining roughly 150,000 Goons, for the one-time price of $9.95! We charge money because it costs us money per month for bills, and since we don't believe in showing ads to our users, we try to make the money back through forum registrations.
 
  • Locked thread
Discussion Quorum
Dec 5, 2002
Armchair Philistine

FronzelNeekburm posted:

Aw, cheeseballs. I just re-upped.

Yeah. My license ends in September so I don't feel like I'm missing out on too much by dumping it.

Was at Wal-Mart today and found Kaspersky Pure 1 year/3 PC (AV, firewall, backup, container encryption, password locker, remote admin) for $5 less than directly from Kaspersky. Normally I prefer to cobble together free/cheap components, but my fiance is the type who "just doesn't get computers," and she trusts the name "Kaspersky," so maybe this will help her be a little more engaged/proactive with security (and maybe I'll never see Win 7 Security 2011 ever again). Hopefully this will help me stay sane when I become the family IT guy.

Also, WM has NOD32 1 year/3 PC for $45, if anyone's shoppin'. Going back to grad school is bringing out my inner tightwad.

PopeOnARope posted:

What the gently caress? You pay for their Antivirus and they try to shoehorn malware onto your computer anyway? How much money is Uniblue offering these people?

45% kickbackcommission

Adbot
ADBOT LOVES YOU

Pope Guilty
Nov 6, 2006

The human animal is a beautiful and terrible creature, capable of limitless compassion and unfathomable cruelty.
I saw somebody awhile back claiming that Ad-Aware is now one of the best antivirus/antimalware suites. :stare:

jet_dee
May 20, 2007
Blah blah blah Nationstates is cool blah blah blah

Pope Guilty posted:

I saw somebody awhile back claiming that Ad-Aware is now one of the best antivirus/antimalware suites. :stare:

My friend's girlfriend's Hotmail was sending out bogus https://www.live.com phishing emails and I warned her about it via Facebook. When she asked what to do I recommended a virus scan plus changing her password, and suggested MSE, but she countered by saying her boyfriend had installed Ad-Aware. I was just as "wtf" as you but she linked the website to prove it does AV now. I didn't want to argue my point any further, it's just too much hassle and maybe she'll be safe (although I never learned how her hotmail was compromised).

PopeOnARope
Jul 23, 2007

Hey! Quit touching my junk!

Morris posted:

45% kickbackcommission

...Wow. Reading those affiliate testimonials, it's pretty obvious the people slinging this poo poo don't care at ALL about their user base.

RichieWolk
Jun 4, 2004

FUCK UNIONS

UNIONS R4 DRUNKS

FUCK YOU

Gilok posted:

Yeah, that's about what I thought. Can you explain why in any detail?

AVG doesn't catch enough viruses to be worth it. Also, when I ran the free version, there didn't seem to be an option to exclude folders, so it kept deleting my toolbox of rootkit removers, tcp stack patches, and other files that were suspicious but not dangerous.

It seemed to slow down my computer's performance too; way more than kaspersky or other AV options.

Scaramouche
Mar 26, 2001

SPACE FACE! SPACE FACE!

RichieWolk posted:

AVG doesn't catch enough viruses to be worth it.

This is the most important part; it's just really fallen behind on detection rates. About two years ago it was in my 'goto' kit but it just doesn't seem to have the chops any more.

pienipple
Mar 20, 2009

That's wrong!
Some people just don't trust a free anti-virus. Those people I direct towards Kaspersky or NOD32.

beyonder
Jun 23, 2007
Beyond hardcore.

pienipple posted:

Some people just don't trust a free anti-virus. Those people I direct towards Kaspersky or NOD32.

Some private clients were hesitant to go down the MSE route. Someone here in SHSC threw the "you paid for it, its included in Windows whatnot license" line and I used it. No more Norton or whatchamacallit bloatware.

Also. Is it worth the trouble to replace MSE with Forefront client security? I'm rocking MSE on personal machines but got FFSC from campus MSDNAA site.

abominable fricke
Nov 11, 2003

What does Pottsylvania have more than any other country? Mean! We have more mean than any other country in Europe! We must export mean.

Megiddo posted:

There's really a lot more to it than that, if you want to keep your machine secure:

Use Firefox or Chrome with NoScript and Adblock Plus and disable/uninstall any unneeded plugins. Make sure your browser is kept up to date with automatic updates. Check Mozilla's plugin check regularly to see if you have vulnerable plugins. Make sure you are receiving Microsoft updates for all Microsoft software (not just Windows), and keep all third-party software up-to-date that interacts with downloaded material of any kind, whether it has a plugin for a browser or not.

Only install Java when you actually need it and uninstall it promptly when finished. If you need to have Java installed all the time due to Java-dependent software, keep it updated at all times and disable Java plug-ins/add-ons in all your browsers. Keep in mind that Oracle rarely issues "out-of-band" critical updates/patches for Java, leaving security and bug fixes for the next quarterly release - and leaving you vulnerable until Oracle's next scheduled release. Unless you don't have it installed in the first place, of course.

Keep Adobe Acrobat, Adobe Reader, or any third-party PDF viewers up-to-date and ideally disable their plug-in/add-on. Make sure Acrobat/Reader security settings are set for maximum security: delete the Flash authplay.dll that's bundled with Acrobat/Reader, disable javascript, disallow multimedia operations, enable enhanced security, disallow opening of non-PDF files.

Keep Adobe Flash and Adobe Shockwave updated. Make sure Flash is set to check for updates automatically. Do not install Shockwave unless you actually need it as many people neglect to check for Shockwave updates and Adobe does not have an option to automatically check for Shockwave updates.

Keep Apple Quicktime updated, or either disable the plug-in/add-on on all browsers or just don't install Quicktime. If you use VLC, Winamp, or some other media player, make sure that it is updated as they have been known to have critical vulnerabilities with some types of files.

Any other programs that interact with downloaded files should be kept updated. For example, if you use uTorrent, even without a browser plug-in, you are still opening downloaded .torrent files that could exploit older versions of uTorrent with critical vulnerabilities.

If you're in a locked-down corporate, university, or public machine where you cannot update plugins, browsers, uninstall Java, etc. - use a USB flash drive with Portable Apps configured for secure and private browsing.

But good luck getting even experienced computer enthusiasts or professionals to do the above, let alone the casual user.

I added this info to the OP. Suggestions for further additions should be sent to me via PM as I don't check this thread regularly anymore. I am however very flattered that 3 years later it is still going strong.

Maniaman
Mar 3, 2006
Is it me or is MSE starting to miss a bunch of these new(ish) rogues? I'm seeing an increasing number of computers in our shop with MSE installed running WINDOWS 7 VISTA RECOVERY DISK etc that has just gone through and either disabled MSE or is going undetected by it.

Sikreci
Mar 23, 2006

This is just a little bit off topic, but I've gotten a couple stranger than usual emails lately and I can't make sense of it. Here's the raw text of the email from Gmail, scrubbed of personal info of course.

There's three things that make this seem really really strange, though. First of all, I've never heard of this person and I didn't actually receive a message on my Facebook account. Not particularly unusual if it was just a spoofed email, but that's the other thing, looking over all the headers and stuff, it looks completely legitimate. Finally, I don't use this email with my Facebook account, I have a completely different email tied to my Facebook account, so why would Facebook be sending any messages at all to that account?

After looking this email over and over again for about 15 minutes, I copy-pasted one of the links to reply since it pointed to www.facebook.com and I figured it couldn't do any damage, and it just redirected me back to www.facebook.com. I went back through all my privacy and security settings too, nothing changed there.

I got another similar "hey let's have sex" sort of message as well as this one, same deal, looked legit. It's pretty obvious these are spam messages of some sort, but I can't figure out why they're being sent by Facebook itself to a non-Facebook email I have, and what they're designed to accomplish once they arrive. Normally I'd just ignore stuff like this and be on my way, but the fact it seems to be getting sent by Facebook itself is a little bit worrying.
code:
Delivered-To: (my email account)@gmail.com
Received: by 10.42.224.133 with SMTP id io5cs224109icb;
        Sat, 11 Jun 2011 07:16:40 -0700 (PDT)
Received: by 10.42.82.75 with SMTP id c11mr3020437icl.92.1307801800122;
        Sat, 11 Jun 2011 07:16:40 -0700 (PDT)
Return-Path: <notification+zj4o_9j=z=9y@facebookmail.com>
Received: from mx-out.facebook.com (outappmail003.snc4.facebook.com
[66.220.144.157])
        by mx.google.com with ESMTP id t10si14571243icu.40.2011.06.11.07.16.39;
        Sat, 11 Jun 2011 07:16:40 -0700 (PDT)
Received-SPF: pass (google.com: domain of
notification+zj4o_9j=z=9y@facebookmail.com designates 66.220.144.157
as permitted sender) client-ip=66.220.144.157;
Authentication-Results: mx.google.com; spf=pass (google.com: domain of
notification+zj4o_9j=z=9y@facebookmail.com designates 66.220.144.157
as permitted sender)
smtp.mail=notification+zj4o_9j=z=9y@facebookmail.com; dkim=pass
header.i=@facebookmail.com
Return-Path: <notification+zj4o_9j=z=9y@facebookmail.com>
DKIM-Signature: v=1; a=rsa-sha256; d=facebookmail.com;
s=s1024-2011-q2; c=relaxed/simple;
	q=dns/txt; i=@facebookmail.com; t=1307801799;
	h=From:Subject:Date:To:MIME-Version:Content-Type;
	bh=V8QvMllSxNCRRYt/+drup4UylqNWjXPEpgC4uNka6yg=;
	b=uyUVnTQHJ7x8nWJAXS(intentionally obfuscated)EkbbKeFqwvKYJB2pRQ9x25T
	23AfwTRCtWaXUFwUH6vTPEDlP3HDb2/ubATO1jyghshOnAzTr7Trzji+Zzh1dRIK
	NcxwES/akTamAG+MGkyvHZtFzMsRG353A0iBEX5g114=;
Received: from [10.62.111.33] ([10.62.111.33:41282])
	by smout030.snc4.facebook.com (envelope-from
<notification+zj4o_9j=z=9y@facebookmail.com>)
	(ecelerity 2.2.2.45 r(34222M)) with ECSTREAM
	id CC/24-18426-7C873FD4; Sat, 11 Jun 2011 07:16:39 -0700
X-Facebook: from zuckmail ([MTI3LjAuMC4x])
	by www.facebook.com with HTTP (ZuckMail);
Date: Sat, 11 Jun 2011 07:16:39 -0700
To: (my email account)@gmail.com
From: "Susan Weber" <notification+zj4o_9j=z=9y@facebookmail.com>
Reply-to: noreply <noreply@facebookmail.com>
Subject: Remember me?Check my wall!I have news for you
Message-ID: <5baee0e1da5334b8a947b84f20@www.facebook.com>
X-Priority: 3
X-Mailer: ZuckMail [version 1.00]
X-Facebook-Notify: msg; from=100002402548948; t=2185750606137;
mailid=45d75f5G5af6cG2f019G0
X-FB-Internal-Notiftype: msg
Errors-To: notification+zj4o_9j=z=9y@facebookmail.com
X-FACEBOOK-PRIORITY: 1
MIME-Version: 1.0
Content-Type: multipart/alternative;
	boundary="b1_5bae(intentionally obfuscated)f20"


--b1_5ba(intentionally obfuscated)f20
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Susan sent (my email account)@gmail.com a message on Facebook.



To reply to this message, follow the link below:

http://www.facebook.com/p.php?i=3D2548948&k=3DZW2(intentionally obfuscated)&oid=3D218137


--b1_5baee(intentionally obfuscated)7b84f20
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
    <head>
      <title>Facebook</title>
      <meta http-equiv=3D"Content-Type" content=3D"text/html; =
charset=3Dutf-8">
    </head>
    <body style=3D"margin: 0px; padding:0px;" dir=3D"ltr">
      <!-- container table is 98% b/c yahoo mail needs 1% to display right =
-->
      <table width=3D"98%" border=3D"0" cellspacing=3D"0" =
cellpadding=3D"10"><tr><td width=3D"100%" style=3D"font-family: 'lucida =
grande', tahoma, verdana, arial, sans-serif;"><table cellpadding=3D"0" =
width=3D"532"><tr><td colspan=3D"2" height=3D"25" =
style=3D"background-color: #3b5998;"><div style=3D"margin-right: 18px; =
padding-left: 9px; font-family: 'lucida grande', tahoma, verdana, arial, =
sans-serif; color: #fff;"><span style=3D"font-weight: bold; =
letter-spacing: -0.02em; font-size: =
16px;">facebook</span></div></td></tr><tr><td align=3D"left" =
bgcolor=3D"#ffffff" width=3D"100" style=3D"padding: 10px 5px 10px 9px;" =
valign=3D"top"><div> <img src=3D"http://profile.ak.fbcdn.net/static-ak/rsr=
c.php/v1/yV/r/Xc3RyXFFu-2.jpg" style=3D"border :1px solid #c0c0c0;" =
width=3D"100" alt=3D"" /> </div><div style=3D"text-align:right; =
font-size:13px; padding-top:3px;">Susan Weber</div><div =
style=3D"text-align: right; font-size: 11px; color: #777777;">7:16am Jun =
11th</div></td><td align=3D"left" bgcolor=3D"#ffffff" style=3D"padding: =
9px 0px 10px 10px; font-size:11px;" valign=3D"top" width=3D"400"><div =
style=3D"color: #333333; font-size: 15px; font-weight: bold;">Remember =
me?Check my wall!I have news for you</div><div>To (my email account)@gmail.com<div =
style=3D"border-bottom: 1px solid #ccc; line-height:5px;">&nbsp;</div><div =
style=3D"padding-top: 5px;"><br /><br />To reply to this message, follow =
this link:<br /><a href=3D"http://www.facebook.com/p.php?i=3D1000024025489=
48&amp;k=3DZ6E3Y3S2W2ZOVFLJP(intentionally obfuscated)&amp;oid=3D2185750606=
137">http://www.facebook.com/p.php?i=3D100002402548948&amp;k=3DZ6E3Y3S2W2Z=
O(intentionally obfuscated)&amp;oid=3D2185750606137</a></div></td></tr=
><tr><td></td><td style=3D"padding-left: 10px;"><div =
style=3D"border-top:1px solid #eee; text-align:left; color: #666666; =
padding: 5px 0px 0px 1px; font-size: 11px; font-family: 'lucida grande', =
tahoma, verdana, arial, sans-serif;">If you do not wish to receive this =
type of email from Facebook in the future, please click <a =
href=3D"http://www.facebook.com/o.php?k=3D57e5dc&amp;u=3D105332556&a=
mp;mid=3D45df(intentionally obfuscated)">here</a> to =
unsubscribe.<br/>Facebook, Inc. P.O. Box 10005, Palo Alto, CA =
94303</div></td></tr></table></td></tr></table></body></html>



--b1_5baee0e(intentionally obfuscated)2c947b84f20--

Sikreci fucked around with this message at 23:55 on Jun 14, 2011

Dad Jokes
May 25, 2011

Just wondering, does anyone have experience with Symantec Endpoint Protection? My school is offering it for free and is really encouraging students to use it, but their reasons are literally "it's free and won't expire".

I'm using Microsoft Security Essentials right now, but should I switch over? I can't seem to Google up any reliable comparisons on which one is better.

ddiddles
Oct 21, 2008

Roses are red, violets are blue, I'm a schizophrenic and so am I
You should try and snatch up as many licences of that from your school as you can and throw them into a fire in hopes that they run out of keys to give away.

In short, no.

mindphlux
Jan 8, 2004

by R. Guyovich
it's about time for me to put together another compendium of my 'AMAZING ANTIVIRUS SAVIOR CDROM/USBSTICK 6.0'

my last one was my first one, I'm just getting back into the game as far as virus purging goes. so, I'm looking for some feedback of anything I might be missing. one thing I know I want but am having trouble finding is a good bootable indepth antivirus/malware program for systems where I can't even boot into windows. I looked at the kaspersky boot cd one, but the very first system I tried it on, it wouldn't detect the harddrive (on a dell laptop) or some bullshit and basically wouldn't finish booting up - so obviously it's out.

anyways, here's what was on my last one :

combofix
desktoptaskmanager
mwbam
MSE installer, x64/x86
TDSSkiller
gmer
superantispyware portable with defs
rkill
procexp
an avgfree installer for kicks

critical feedback encouraged!

Dexo
Aug 15, 2009

A city that was to live by night after the wilderness had passed. A city that was to forge out of steel and blood-red neon its own peculiar wilderness.

mindphlux posted:

it's about time for me to put together another compendium of my 'AMAZING ANTIVIRUS SAVIOR CDROM/USBSTICK 6.0'

my last one was my first one, I'm just getting back into the game as far as virus purging goes. so, I'm looking for some feedback of anything I might be missing. one thing I know I want but am having trouble finding is a good bootable indepth antivirus/malware program for systems where I can't even boot into windows. I looked at the kaspersky boot cd one, but the very first system I tried it on, it wouldn't detect the harddrive (on a dell laptop) or some bullshit and basically wouldn't finish booting up - so obviously it's out.

anyways, here's what was on my last one :

combofix
desktoptaskmanager
mwbam
MSE installer, x64/x86
TDSSkiller
gmer
superantispyware portable with defs
rkill
procexp
an avgfree installer for kicks

critical feedback encouraged!

The AVGfree is pretty much useless.

Proud Christian Mom
Dec 20, 2006
READING COMPREHENSION IS HARD

Dad Jokes posted:

Just wondering, does anyone have experience with Symantec Endpoint Protection? My school is offering it for free and is really encouraging students to use it, but their reasons are literally "it's free and won't expire".

I'm using Microsoft Security Essentials right now, but should I switch over? I can't seem to Google up any reliable comparisons on which one is better.

SEP is barely a speedbump to things now.

Prosthetic_Mind
Mar 1, 2007
Pillbug

Dad Jokes posted:

Just wondering, does anyone have experience with Symantec Endpoint Protection? My school is offering it for free and is really encouraging students to use it, but their reasons are literally "it's free and won't expire".

I'm using Microsoft Security Essentials right now, but should I switch over? I can't seem to Google up any reliable comparisons on which one is better.

We have a saying in the ticket thread- SEP stands for Someone Else's Problem. Unfortunately I manage some of the administration and dispatch the desktop support guys from the virus logs of SEP, and most of the time to actually get rid of the virus they have to use a portable version of another AV. Symantec is probably the second or third worst of the major antiviruses right now.

At least it isn't McAfee, having McAfee is worse than having a virus in most cases.

TwoKnives
Dec 25, 2004

Horrible, horrible shoes!

Prosthetic_Mind posted:

We have a saying in the ticket thread- SEP stands for Someone Else's Problem. Unfortunately I manage some of the administration and dispatch the desktop support guys from the virus logs of SEP, and most of the time to actually get rid of the virus they have to use a portable version of another AV. Symantec is probably the second or third worst of the major antiviruses right now.

At least it isn't McAfee, having McAfee is worse than having a virus in most cases.

What about Norton? Are their latest offerings as terrible as their older suites?

Gothmog1065
May 14, 2009
Quick question with Ketarin: Is there a way to force updates? I have it set up to run daily, but some of the more important files aren't updating at all.

bbcisdabomb
Jan 15, 2008

SHEESH

TwoKnives posted:

What about Norton? Are their latest offerings as terrible as their older suites?

Not nearly. They're still poo poo, though.

lazer_chicken
May 14, 2009

PEW PEW ZAP ZAP

mindphlux posted:

it's about time for me to put together another compendium of my 'AMAZING ANTIVIRUS SAVIOR CDROM/USBSTICK 6.0'

my last one was my first one, I'm just getting back into the game as far as virus purging goes. so, I'm looking for some feedback of anything I might be missing. one thing I know I want but am having trouble finding is a good bootable indepth antivirus/malware program for systems where I can't even boot into windows. I looked at the kaspersky boot cd one, but the very first system I tried it on, it wouldn't detect the harddrive (on a dell laptop) or some bullshit and basically wouldn't finish booting up - so obviously it's out.

anyways, here's what was on my last one :

combofix
desktoptaskmanager
mwbam
MSE installer, x64/x86
TDSSkiller
gmer
superantispyware portable with defs
rkill
procexp
an avgfree installer for kicks

critical feedback encouraged!

SafeMSI (or instructions for how to do it manually) is really useful if you're like me and forget how to do it every single time.

anne frank fanfic
Oct 31, 2005
Is windows firewall worth using, or should I get a third party one? Any good free third party firewalls, and what type of settings should the average person use?

TwoKnives
Dec 25, 2004

Horrible, horrible shoes!
The general consensus is that windows firewall is good enough. You should make sure the firewall on your router is enabled too.

mindphlux
Jan 8, 2004

by R. Guyovich

lazer_chicken posted:

SafeMSI (or instructions for how to do it manually) is really useful if you're like me and forget how to do it every single time.

hey presto, I didn't even know about this. Thanks, that will be useful - I wasted an hour on a machine a couple weeks ago trying to figure out how to do windows installer in safe mode - I just figured it was truly disabled - didn't even think to google it.

The Dirtiest Harry
May 31, 2011

"Now you know why they call me Dirty Harry: every dirty job that comes along."

TwoKnives posted:

What about Norton? Are their latest offerings as terrible as their older suites?

Generally, yes. Norton is basically what you buy if you want a flashy looking GUI frontend, but dont actually give a crap about securing your computer. Personally, I find having MSE running in the background and scanning with SUPERAntiSpyware and MBAM occasionally to be more than enough, and they're all free!

TwoKnives
Dec 25, 2004

Horrible, horrible shoes!
Thanks. I was arguing with some guy on another forum who was trying to convince people that you paid suites are inherently better and the only way to stay safe. He runs an IT shop, so he has an obvious agenda. It says everything that he's still recommending Norton.

Assepoester
Jul 18, 2004
Probation
Can't post for 10 years!
Melman v2
Had a laptop with Windows Recovery in, but MBAM cleaned it right up. It's a good thing it didn't get anything else as well or that could have made it more difficult.

Put MSE on it and it's good for now.

Tagra
Apr 7, 2006

If you gaze long into an abyss, the abyss will gaze back into you.


Shardivh posted:

Generally, yes. Norton is basically what you buy if you want a flashy looking GUI frontend, but dont actually give a crap about securing your computer. Personally, I find having MSE running in the background and scanning with SUPERAntiSpyware and MBAM occasionally to be more than enough, and they're all free!

A friend of a friend was quite hostile when I suggested that I wouldn't necessarily trust Norton over MSE, and they pointed to http://www.av-comparatives.org/ to "prove" that it was one of the best. (Despite that site ranking MSE very highly as well...)

I didn't bother to argue with them because I suspect it would be like arguing with a brick wall, but if they start pushing it again, are there any sources about lack security that I can point them at to make them shut up?

Nam Taf
Jun 25, 2005

I am Fat Man, hear me roar!

Morris posted:

Paid Avira users are now getting spam from Uniblue (the registry cleaner scamware people). I thought their mailing list had been stolen or something.

Nope! It's official, Avira is now marketing Uniblue's products, and my new laptop is getting Avast or NOD32 instead.

http://forum.avira.com/wbb/index.php?page=Thread&threadID=131604

Well I guess I'll be moving myself and my family away from them. Pity, they've served us well ever since the free-av days.

edit: By the looks of it, AVG has fallen off the wagon so I guess MSE is the best bet now?

Nam Taf fucked around with this message at 05:55 on Jun 24, 2011

co199
Oct 28, 2009

I AM A LOUSY FUCKING COMPUTER JANITOR WHO DOES NOT KNOW ANYTHING ABOUT CYBER COMPUTER HACKER SHIT.

PLEASE DO NOT LISTEN TO MY FUCKING AWFUL OPINIONS AS I HAVE NO FUCKING IDEA WHAT I AM TALKING ABOUT.

Nam Taf posted:

Well I guess I'll be moving myself and my family away from them. Pity, they've served us well ever since the free-av days.

edit: By the looks of it, AVG has fallen off the wagon so I guess MSE is the best bet now?

MSE is the best free offering, NOD32 or Kaspersky if someone insists on a paid AV.

Agreed
Dec 30, 2003

The price of meat has just gone up, and your old lady has just gone down

Nam Taf posted:

Well I guess I'll be moving myself and my family away from them. Pity, they've served us well ever since the free-av days.

edit: By the looks of it, AVG has fallen off the wagon so I guess MSE is the best bet now?

I switched to MSE and it's great, but the dance with AV software seems to be finding the one that is currently both 1. free and 2. pre-bloat. Eventually they all go loving nuts with features you don't need and resource hogging, some of them put it to better use than others and actually do something with the resources they're hogging while AVG has a crazy high miss rate (and throws up a lot of false positives for me, too, when using anything that intercepts memory - a combination of poor heuristic detection and insufficient automated protection plus its steadily increasing opaqueness and difficulty meant that switching to MSE was a welcome relief, frankly).

MSE now reminds me of AVG in 2007.

How is MSE's spyware side of things? I'm hard and soft firewalled and run noscript, adblock, all that jazz, and browse carefully - haven't had a spyware infestation since I was a teenager - but it's good to know where you stand, and I don't like Spybot S&D's dramatic and fairly silly "immunization" compared to just a quality "nope, denied" from a program. MSE fit the bill, or is there a new name in spyware detection and elimination I should look into?

Agreed fucked around with this message at 07:01 on Jun 24, 2011

PopeOnARope
Jul 23, 2007

Hey! Quit touching my junk!
Regarding those Windows x Recovery infections, if you need to find the start menu items, they'll be in the temp folder in a directory starting with the letters "sm"

any colour you like
Jul 19, 2006

Prying open my third eye
Has anyone encountered Windows AV Component? It seems to be pretty new, the oldest entry I can find about it is about 2 days old.
A guest at the hotel where I work came down with this and I offered to remove it since I've removed those fake anti-viruses a gazillion times before for friends. Alas I was unable to do anything. It prevents me from running taskmanager, so I am unable to kill the process, which prevents me from deleting the file. I've tried doing it in safe mode and all that jazz. Will deleting the registry entries connected to the software help at all? I'm kinda bummed that the virus/trojan bested me.

PopeOnARope
Jul 23, 2007

Hey! Quit touching my junk!

any colour you like posted:

Has anyone encountered Windows AV Component? It seems to be pretty new, the oldest entry I can find about it is about 2 days old.
A guest at the hotel where I work came down with this and I offered to remove it since I've removed those fake anti-viruses a gazillion times before for friends. Alas I was unable to do anything. It prevents me from running taskmanager, so I am unable to kill the process, which prevents me from deleting the file. I've tried doing it in safe mode and all that jazz. Will deleting the registry entries connected to the software help at all? I'm kinda bummed that the virus/trojan bested me.

Use safe mode. If that doesn't work, use safe mode with command prompt. If you can't use the task manager proper, try doing "Run as Administrator" on %systemroot%\system32\taskmgr.exe . If that doesn't work, try [url=http://dimio.altervista.org/eng/]D Task Manager]

If Safe Mode / Safe Mode with Networking won't get the pesky thing to stop launching, it's time for you to do it manually! Safe Mode with Command Prompt, Recovery Console, or Repair your Computer off the Windows Disk.

Check the following locations:
%userprofile%\appdata\local
%userprofile%\appdata\local\microsoft
%userprofile%\appdata\roaming
%userprofile%\appdata\roaming\microsoft
%programdata%

Make sure to run rd %temp% /s too to make sure that's nuked.

Or just be lazy and run system restore. Peasy.

\/ Welcome.

PopeOnARope fucked around with this message at 20:51 on Jun 27, 2011

any colour you like
Jul 19, 2006

Prying open my third eye
Thanks a lot. That did the trick :)

co199
Oct 28, 2009

I AM A LOUSY FUCKING COMPUTER JANITOR WHO DOES NOT KNOW ANYTHING ABOUT CYBER COMPUTER HACKER SHIT.

PLEASE DO NOT LISTEN TO MY FUCKING AWFUL OPINIONS AS I HAVE NO FUCKING IDEA WHAT I AM TALKING ABOUT.

any colour you like posted:

Has anyone encountered Windows AV Component?

Actually just got one in today with this on it, but this customer is known for his porn and piracy habits so it's no surprise he got it. Standard tools worked fine in this case (Combofix, Hitman Pro, MBAM, SAS Portable).

Dilbert As FUCK
Sep 8, 2007

by Cowcaster
Pillbug
Does anyone have that list of virus domain names? I am trying to test out some stuff.

Oh wait I found it

Okay, I have 3 evils to choose from...
AVG, standard A/V 2bucks/yr
Norton, not the enterprise version
Trend Micro, not the professional one

which is the "best"

I am looking at AVG as it is like 2 bucks a seat, the machines are beefy enough to handle it E5800 3.2ghz dual core, 2GB ram, 7200RPM HDD 250. Norton Well I have never had a good experience, Trend Micro seems like Macafee to me, but I have never used it.

Dilbert As FUCK fucked around with this message at 19:29 on Jun 29, 2011

Scaramouche
Mar 26, 2001

SPACE FACE! SPACE FACE!

Little update on the latest TDSS variant:
http://www.theregister.co.uk/2011/06/29/tdss_alureon_advances/

4.5 million infections in 3 months.

Maniaman
Mar 3, 2006
Is TDSSKiller still good at catching tdss/tdl4? I've been running it on every machine we get in for virus removal, and I don't think it has found anything in the past month or so.

Some of these viruses are starting to get downright nasty, marking profiles as hidden, moving desktop icons, start menu items, etc into random folders, patching the mbr to load infected drivers and being able to bypass patchguard/kernel patch protection.

And it seems like MSE is starting to fail at preventing some of these infections. I've also been seeing multiple machines with viruses that actually just plain trash MSE and render it unusable.

Adbot
ADBOT LOVES YOU

PUBLIC TOILET
Jun 13, 2009

Scaramouche posted:

Little update on the latest TDSS variant:
http://www.theregister.co.uk/2011/06/29/tdss_alureon_advances/

4.5 million infections in 3 months.

quote:

TDL-4 also adds the ability to communicate over the Kad peer-to-peer network. In the event there is a takedown of the 60 or more command and control servers used to maintain the TDSS botnet (hard but not impossible given the recent eradications of the Rustock and Coreflood botnets), the infected TDSS machines can receive instructions using a custom built Kad client.

:ughh:

  • Locked thread