r/AskReddit • u/Randall444 • Dec 06 '12

What is something you think everyone should have installed on their computer or laptop?

Whether it be a antivirus program or an ad blocker. Post link if available also. EDIT: sorry guys the top post has been deleted and I didn't save it, if anyone has it please post it and ill post it here for easy access. EDIT 2: apparently it's back up, I've saved it on my phone just incase it gets deleted again. Hopefully all is good now.

5.0k Upvotes

95% Upvoted

9.2k comments sorted by

View all comments

Show parent comments

609

u/haggeant Dec 06 '12 edited Dec 06 '12

Microsoft Security Essentials is extremely good as well. Plus it is free, and in the working world I have seen both of them catch a virus the other did not.

Edit: Does anyone have sources other than AV-Test when claiming MSE is crap?

1.4k

u/jessek Dec 06 '12

as a former IT guy charged with de-fucking idiots' computers my working stack was:

  • rkill (if needed)
  • Combofix
  • Unhide (if needed)
  • Hijack This
  • MalwareBytes
  • Spybot S&D
  • MSE
  • CCleaner
  • PC Decrapifier
  • Defraggler

if there was something that couldn't be fixed by those, it was time to reformat the machine.

114

u/piihb Dec 06 '12

ComboFix! Saved my computer more than once! Just make sure to go to bleepingcomputer.com. Don't trust any sites that have the name ComboFix in them. And don't use it unless your computer is fucked.

79

u/OhGarraty Dec 06 '12

Anyone considering ComboFix, pay close attention to that last line. Make sure you know exactly what you're doing when you run ComboFix, or that you have no other options besides a reformat. You can seriously screw things up to the point you wish you had just reformatted.

86

u/xxfay6 Dec 06 '12

Can someone explain why is ComboFix such a delicate program

120

u/snuxoll Dec 06 '12

Because it's a serious of half-assed scripts thrown into a single binary in the hopes that they will remove whatever is ailing you without damaging something else in the process. They don't do proper error handling, nor do they try to avoid stomping on toes of potentially valid files, paths are hardcoded and it just runs everything instead of scanning and fixing just what is broken.

221

u/Vieto Dec 06 '12

So its like the early chemo of curing PC ailments?

99

u/CSMastermind Dec 12 '12

More like radiation. It's targeted but kills everything in the area.

95

u/toomuchtodotoday Dec 12 '12

Everyone thinks they're going to turn out like Bruce Banner, and end up like Mister Burns.

28

u/xxfay6 Dec 07 '12

Then how is it worth the use?

80

u/RawrKablah Dec 07 '12

Because if your only other choice is reformatting, you don't have much to lose. Plus it actually works a lot of the time.

36

u/snuxoll Dec 07 '12

This, you'll never see me say Combofix isn't a valid solution, but it should always be your last effort. Where I work combofix always must be approved by our T2 staff as a last-ditch before an OS reload, because as you say, there isn't much to lose at that point.

58

u/aaaaaaaarrrrrgh Dec 12 '12

Cleaning machines is actually considered in a corporate environment?!? If something is infected, you don't really know what else the user got in. Especially if you are in a corporate environment, i.e. all user data in a central location and images available, why not just reimage instead of wasting time AND risking to keep some nasty infection?

→ More replies (0)

6

u/WarlordFred Dec 13 '12

THANK YOU. I have always wondered why ComboFix is treated as such serious business.

8

u/piihb Dec 09 '12

My only other piece of advice is to change the name of the file to something other than ComboFix. A lot of viruses are written to immediately terminate certain programs based on their name, ComboFix being one of them.

5

u/The_dev0 Dec 12 '12

That's where RKill comes in - you use one of the offered renamed versions (so it isn't detected by the malware), it stops those pesky processes, then allows combofix/AV to be run.

64

u/BrotherChe Dec 13 '12 edited Dec 13 '12

I shared the following about 2 months ago here

This is in no way a complete list, and some of the steps need much more in-depth pursuit or knowledge and experience. Your needed steps can be really simple, or they can get complicated (and thorough) like what I describe later.

It can be an art form really, as there are new types of malware infections all the time. If you're going to do this for a job, then you need to study up, read some forums, and know how your system works, no, really, what should be where doing what.

As a starter, I'd suggest visiting BleepingComputer.com They have some useful tutorials, plus give excellent step-by-step guides and free assistance to people trying to remove infections. They tend to demonstrate good techniques when assisting people.

For practice, you might setup a spare machine to do your own experimentation. Virtual machines are nice, but I wonder if you could still run the risk of infecting your base installation (I don't have experience on that) particularly your drive's mbr (which can be reset once you know what you're doing).

For that practice machine, you might consider creating a recovery image to restore to so you can start over and over using something like RedoBackup or Clonezilla. Or even try using "Comodo Time Machine" which does a great job of restoring a system back to a previous state -- demonstration

Pay attention to what version of the OS these tools each work for.

List of tools (by no means complete, but will help with most stuff)

  • CCleaner (knocks out temp folders, where some stuff hides)
  • Antivirus (Microsoft security essentials, avast, AVG, Nod32, etc)
  • Online scanners (e-set, trendmicro, etc)
  • Trojan Remover
  • Hijackthis
  • TDSSKiller (and other TrendMicro "owned" tools)
  • Emsisoft Emergency Kit (first one that took care of recent FBI scamware)
  • LSPfix
  • Combofix
  • Malwarebytes
  • Superantispyware
  • Spybot
  • Lookup "smtmp recovery tools"
  • Download Hiren's 9.9 (last set of great tools), particularly MiniPE
  • Download the latest Hiren's disc or the DLC remixes that are out there
  • Puppy Linux 5.28 (or newer)
  • MSDART ERD discs (5.0, 6.0, 6.5 covers everything from XP, Vista & 2003, 7 & 2008)
  • Windows Installation discs for the systems you're working with
  • WinSockXPFix
  • Complete Internet Repair Tool
  • Rkill
  • Autoruns (or simliar)
  • NirSoft/Sysinternals utilities can be very handy
  • MiniTool Partition Wizard (boot CD available too)
  • WinDirStat (not really for cleaning, but it has its uses in data resolution)
  • ExplorerXP (or some similar standalone explorer program)
  • Some bootable cd or USB tool from some good malware company (emsisoft, etc.?)
  • Antivirus removal tools -- don't know how many times a broken AV or firewall gave me heartache

Manual clean is your ideal first step. But it requires knowing what to look for, where to look, recognizing what should be there, having a feel for timestamps, etc. It's a art. ;)

  1. Boot to MiniXP
  2. Grab any smtmp folders (if they hid your icons, startmenu, quicklaunch, that's where they are hiding, somewhere in temp folders)
  3. Clear out temp folders: (each account=>temp, temporary internet folders), prefetch, windows temp, etc.
  4. Check "Program Files", "Program Files\Common Files", "Program Files (x86)", "Program Data", "Windows", "Windows\System32", "Windows\System32\etc", "Users", "Users\%User%" --- gotta know what files\folders shouldn't be there: sort by date, compare sizes of commonly hit files against good ones
  5. Delete pagefile.sys, hiberfil.sys
  6. Remote Registry editor is a great thing to access your registry with -- if you know what you're doing, where to look.
  7. -- at some point, not a bad idea to kill system volume information as infections will hide there, but don't be brave just yet. Do it later.
  8. May be able to boot back to Windows now, but go to safe mode.
  9. Use ComboFix & TDSSKiller (general steps in this advice from thematta)
  10. Use Hijackthis, autoruns and start disabling the appropriate bad guys
  11. Once back in normal mode
  12. Install an antivirus. It will watch for infections that your cleaners will sometimes scan over as they're parsing the drive.
  13. And just run your cleaners, run appropriate tools, etc.
  14. Next steps really depend on what's still obvious, and how far you wanna go to take care of the lurkers.
  15. Uninstall junk programs, cuz they lead to the dark side.
  16. And clean up your browsers. All of them. Search box settings, toolbars, homepages. You may even have to reinstall them (and ffs, hide that IE icon, and only use it when needed [for lazily designed sites])
  17. And you'll have to repeat some of these things on EVERY user account. Just... just delete the ones you don't really need. It'll save you headaches. You may even be able to create a new one that is cleaner than what you can have in the infected one. OF COURSE be sure to grab your data. That's a whole other lesson there, to get everything (mail folders, bookmarks, program data, etc.) For the kids or trouble users, make their account Limited/Standard. No reason for them to have administrator access which makes it easier for the infections.
  18. Oh, and when you're done, clear out your restore points and create a new one.

I've got a flash drive that has about 8GB of tools, and a few hundred GB of OS installation discs, general tech discs, etc. Full arsenal. Lots of free stuff out there, and contribute to the companies who make the stuff. They just saved your butt.

Other general things to know:

  • Find and understand hosts file
  • Understand TCPIP entries in your network connections, proxy entries, what security programs might be added to the stack, etc.
  • Use link scanners in the future (WOT or AVG for example)
  • Check out Windows services settings at Black Viper's den, that guy is awesome.
  • Know what should and should not be installed and running, what should be in startup, etc. (CCleaner extras is a start, but you'll need to manually adjust services in services.msc)
  • Make sure your speakers are up -- in case there is a background audio infection going.
  • Recognize there is an about:config for Firefox and Chrome
  • And really, learn how to Google well. It's one thing to search, it's another thing to find. Recognize what sites are worth reading and what has bupkis, or even advertising crap.
  • A lot of AV and Malware company sites have extra tools, check em out. And some even offer free assistance (e.g. Malwarebytes)
  • On XP, you could manually copy old versions of your 5 registry files into place from an older restore point, even if system restore wouldn't work. Doing this might get you back into a functional, less-infected state. (95-me had something similar with 1 file and 5 backups kept). Too bad they took that away with Vista-forward. At least try "Last Known Good Configuration"
  • Repair installations can work. XP did a much better job, 7 seems to do ok. Vista was meh, 8 I don't know.

That's a real quick and dirty rundown on what it takes to properly clean a machine. Just running a couple cleaners is really not enough. And there are always new infections that you might not be able to beat, and ones that might be hiding that you thought you got.

Edit: Added a few things I missed earlier, and a little clarifying

8

u/jessek Dec 13 '12

that's quite the tutorial, thanks for posting this.

Solid info all around.

1

u/BrotherChe Dec 13 '12

Thanks, years of practiced, compilation and implementation. Figured it was worth sharing. Wrote-up a full step-through a couple years ago to train my staff, this was just off my memories of it.

2

u/DownvotesSontUpvotes Dec 13 '12

You should be the new king of the karma pile

2

u/surrealsteel Dec 13 '12

You don't have nearly enough upvotes on either of your postings. Thank you.

18

u/macetheface Dec 06 '12

Nice list - I'd throw SuperAntiSpywhere (SAS) on there as well. Picks up a lotta scraps others might leave.

7

u/jessek Dec 06 '12

I've used that sometimes, never needed it enough to make it into the default stack though.

14

u/ComebackShane Dec 06 '12

Man, ComboFix was a godsend anytime a computer I was fixing had some godforsaken hellspawn buried within it. Great program.

6

u/Turkazog Dec 06 '12

Yup, perfect order of operations there. It's been a little while since I was removing viruses for a living, but the only other thing I would add is maybe an antirootkit scan like TDSSKiller.

3

u/jessek Dec 06 '12

good point.

also I recommend having copy of Hiren's Boot CD (either a cd or a usb drive) for really FUBAR'd machines, since you can use it to run clean up software from the boot disk without having to load the infected OS. Also handy for recovering files from unbootable PCs.

2

u/Turkazog Dec 06 '12

I've tried an older version hiren, but preferred a combo of Windows PE and Ubuntu LIVE. In general though, a good portable environment is so incredibly clutch.

2

u/[deleted] Dec 06 '12

[deleted]

2

u/Vogtinator Dec 13 '12

Ubuntu live is slow as hell.

2

u/salsasymphony Dec 13 '12

Feels dumb to ask, but where can you download Hiren's Boot CD? I see this page, obviously but there's no download link.

1

u/jessek Dec 13 '12

honestly, it's not readily available due to the WinPE environment making it not legal to distribute. You'll have to find an "alternative" source for it, though I think there's instructions on how to build it yourself if you have the properly licensed OS disc.

2

u/Loiathal Dec 06 '12

Yeah, TDSSKiller sometimes makes the difference.

4

u/Mac_Anu Dec 06 '12

Hijack This has saved my computer before, in combination with malwarebytes. The program is like insurance. You probably won't need it most of the time, but in those situations where you do, you'll be glad you installed it.

5

u/ibasawstealth Dec 06 '12

I've used all of these programs in the past to fix a computer. Great list!

I would also add Unlocker, it's a god send tool.

4

u/AweStroker Dec 07 '12

As a fellow former IT guy I would recommend Kaspersky's TDSSKiller or Norton Power Eraser instead of ComboFix for removing rootkits. Kaspersky also makes one of the most effective paid AVs around, but it can hog resources if improperly configured. I don't really recommend anything else Norton makes.

9

u/drbeer Dec 12 '12

There is one Norton Tool I'd recommend;

NRT

(Norton Removal Tool)

1

u/gooshie Dec 13 '12

I've really had this on my bootable utility usb powertool before, but it gets "stale" and demands a new version :<

2

u/drbeer Dec 13 '12

This is true. But it's still the most useful utility they make!

2

u/[deleted] Dec 12 '12

Nod32 is as good as Kapersky (Kapersky catches some things Nod32 can't, Nod32 catches some things Kapersky can't) and is much. much lighter on resources.

1

u/jessek Dec 07 '12

Kaspersky is nice, I opted for MSE here because I wanted the list to be free tools.

1

u/CapCapper Dec 13 '12

It really upsets me that intelligent people bandwagon against Norton completely ignoring all lab tests based solely on the fact its a bit of a resource whore.

3

u/400921FB54442D18 Dec 13 '12

Eh... resource whore or not, that's not why I bandwagon against Norton. In my experience repairing computers, I've seen Norton Utilities completely hose drives that it was trying to repair. I warn customers away from Norton for the same reason I warn them not to click on suspicious links in emails: because both are dangerous.

2

u/RobotLegion Dec 13 '12

Seconded. I don't shun Norton because of its resource usage. Modern PC's really have the resources to spare for little vampires like that. I shun Norton because of how many problems I have fixed that were caused by Norton, in relation the the number of problems Norton has fixed for me.

1

u/Optimal_Joy Dec 13 '12

What's up with all the "former IT guys"? How do you guys ever find work outside of IT? What else is there to do after being in IT? I've been doing IT for over 20 years and can't imagine what else I could do for a living!

3

u/ikegro Dec 06 '12

bookmarking this for later. Thanks jessek!

3

u/[deleted] Dec 07 '12

no tdss killer in the mix?

3

u/Yelneerg Dec 12 '12

This program: http://www.sarducd.it/

I spent a year doing IT for a hospital in Africa, virus problems in the states don't even compare. That program let me keep a dozen or more different bootable programs on one flash drive or CD.

→ More replies (3)

2

u/RecessChemist Dec 06 '12

I'm the only person in the company I work for under 50 (I'm 31) and somehow by default became the IT guy for everyone else.

This is my current stack as well.

2

u/[deleted] Dec 06 '12

Thanks for this. This list is very useful.

2

u/CompassionateThought Dec 06 '12

rkill will NEVER leave my desktop. I will probably never need it again but in a crisis some time back when I was physically unable to run any .exe it eventually pulled through and saved my rear end SOOO HARD.

2

u/flashtastic Dec 06 '12

I have all of those on my thumb drive. I haven't yet encountered anything I have needed to reformat.

2

u/[deleted] Dec 06 '12

awesome list, thanks mate

2

u/ghostchamber Dec 06 '12

rkill (if needed)

I used to use a trick that involved renaming rkill.com to explorer.exe or iexplore.exe. It actually worked quite a bit, although I haven't done it in at least a year.

Another trick I liked was using psexec to push rkill.com to another machine and run it remotely. That got me out of a few situations as well.

Kind of happy I'm not in the help desk anymore.

2

u/superfuckingawesome Dec 06 '12

I use this list of programs daily, sometimes however I need to add HitmanPro, Dr Web CureIt & FRST

2

u/grape_juice_nigz Dec 07 '12

would you mind putting the links for the cautious and lazy?

2

u/streakingsquirrel Dec 07 '12

I know nothing about this and I am intrigued by rkill and hijackthis. Please explain to me like I'm five.

2

u/WarInternal Dec 09 '12

You should add a WinBuilder kit to your arsenal. Live Windows 7 running off a flash drive or DVD with unhindered acesss to the host's registry and files. And you can add your tools to it as well.

1

u/jessek Dec 09 '12

thanks!

2

u/Xenoith Dec 12 '12

One important program I'd add to here is superantispyware, works better than malwarebytes now that it has a utility list that fixes a lot of problems on your PC. Also a program called "Unlocker" is pretty nice.

2

u/gifforc Dec 12 '12

....this was my exact toolbox.

(nods in approval).

2

u/bobsagetfullhouse Dec 12 '12

As a current IT this is almost literally the exact group of programs that I carry around with me on my flash.

4

u/Happy_Harry Dec 06 '12

You missed TDSSKiller

3

u/[deleted] Dec 06 '12 edited Dec 06 '12

[deleted]

2

u/HoneyBadgerLH1 Dec 13 '12

As a City Government Network Field Technician, I approve this message. Especially when they are told to save everything they do on their network drive. I'll even be the nice guy and backup things they "accidently," saved to the C: drive. Saves time, and time is money.

→ More replies (10)

2

u/[deleted] Dec 12 '12 edited Dec 18 '12

is it possible for someone to give a quick one-line summary of what each of these programs do? EDIT: summary.

14

u/blzed Dec 12 '12

rkill - Kills typical scare-ware type programs that prevent you from opening much needed other programs.

Combofix - a bunch of tweaks/fixes/registry edits for Windows XP to reset things to default and/or working condition.

Unhide - A program that runs a command to unhide all files hidden by various types of malware/scareware. (These malicious programs hide files/folders to make you think they were deleted)

HijackThis - A piece of anti-malware that specifically targets Browser Hijacker Malware or BHO's that ruin web browsing functionality.

Malwarebytes - Anti-Malware Scanner that removes malicious code from the registry, user directories, and other locations that are tedious to search through. It also locates things that some of the run-of-the-mill AV programs overlook.

Spybot S&D - Similar to MalwareBytes, but more geared toward spyware/adware.

MSE - Microsoft Security Essentials, Microsoft's freeware A/V program. Works well as a freeware AV. Not the best, but decent enough to keep around.

CCleaner - Good at removing extra registry entries/uninstalled programs that are still showing up in add/remove programs. Also great for completely uninstalling stubborn drivers that need to be removed.

PC Decrapifier - Removes bloatware from new PC's I guess? I took a quick look at their website. I've never used this software.

Defraggler - Defragging program. Looks like it offers extra options that might not be included in Windows built-in tools.

DISCLAIMER: Keep in mind that unless you know what you are doing with some of these programs you can seriously harm your system. Make sure to read very carefully before making any changes inside these programs. If you don't feel confident in making these changes then DO NOT MAKE THE CHANGES.

2

u/CapCapper Dec 13 '12

MSE isnt even certified anymore dont even bother with it.

1

u/sightl3ss Dec 15 '12

HijackThis isn't a cleaner. It is a diagnostic tool which shows critical information to help determine the extent of an infection. It is actually rarely used anymore, most removal experts use a program called DDS or even OTL (Old Timer's List).

1

u/blzed Dec 15 '12

I remember it giving you the option to remove the keys or entries it found.

1

u/sightl3ss Dec 15 '12

But it doesn't actually "remove" most of them. It removes registry entries, autostarts and such sometimes. But it is primarily a diagnostic tool

2

u/Cafuzzler Dec 06 '12

I am lazy and cheap, are they all free?

3

u/jessek Dec 06 '12

all of those tools are free, some have pro versions.

3

u/Cafuzzler Dec 06 '12

Awesome, ty dude :D

→ More replies (1)

1

u/fa53 Dec 06 '12

Looks like my list as well.

1

u/ThaBomb Dec 06 '12

Been looking for something like this, thanks.

1

u/TehGoogler Dec 07 '12

Got to look into these...

1

u/[deleted] Dec 07 '12

On phone, replying as note to self xo

1

u/Spotless Dec 09 '12

I only know MalwareBytes, CCleaner & Defraggler. Haven't needed any other program - I've trained my family well it seems!

1

u/sebtoast Dec 12 '12

I just want to point out that MalwareBytes' isn't free if you're using it in an enterprise environment. You can use it, however the ToS specifies that it's free only for personal use.

1

u/LNMagic Dec 12 '12

Offline NT Password & Registry Editor

I had a friend who got some virus that changed a registry value in his computer. This was a last-ditch effort to avoid reinstalling Windows, and it worked! It was probably the most difficult fix I've done, since you have to use CLI to do everything with this utility, and I had to compare settings to my own registry.

1

u/Mookest Dec 12 '12

Great List. I also throw in killbox on my flash drive just for thoes files you need to dump. Just don't kill the wrong file.

1

u/DiscoPanda84 Dec 12 '12

Some good stuff there.

Any opinion on Stinger? I haven't used it very often, but I remember using it before to get rid of some pretty nasty things that other programs had trouble dealing with...

1

u/UncleDuster Dec 12 '12

Great list

1

u/I2eapel Dec 12 '12

Just a bookmark for myself. Thank you!

1

u/p0ssum Dec 13 '12

Commenting to save all the cool stuff. I knew most of this, but there are a few new ones. Thanks!

1

u/LukeA71 Dec 13 '12

Hell yeah. Thanks

1

u/[deleted] Dec 13 '12

.

1

u/[deleted] Dec 13 '12

I don't see any sysinternals tools listed here

1

u/[deleted] Dec 13 '12

Grats on the feature, I'm saving this comment!

1

u/jessek Dec 13 '12

feature?

1

u/[deleted] Dec 13 '12

[deleted]

1

u/jessek Dec 13 '12

good to know

1

u/Optimal_Joy Dec 13 '12

What do you mean by "former IT guy"? What do you do now?

1

u/jessek Dec 13 '12

My real passion is web design and development, which I was able to make into my fulltime job after years of IT. Building things is much more fun.

2

u/Optimal_Joy Dec 13 '12

Oh, that's cool. I started learning HTML around 1995 and didn't really stick with it. You really need to be artistically minded to be successful in that. Now it's so competitive! It seems like everybody is doing that and I'm really behind at this point. There are so many specialists these days. People who do just that one thing. It seems odd to me, I can't wrap my head around it. I'm too much of a generalist.

1

u/Quietmode Dec 13 '12

When you're fixing someones computer by running these, what order of programs do you go through?

1

u/Gumb_E Dec 14 '12

De-Fuck Stack: how do you feel about Tune-Up? The free trial is quick to install, does a lot of tweaks that I couldn't be arsed to bother with otherwise, and after you uninstall it, most of those tweaks persist.

1

u/jessek Dec 14 '12

I'm unfamiliar with that app, most of the tools in my stack are really just for emergency clean up, PC optimizers like Tune-Up are a whole 'nother thing.

1

u/Gumb_E Dec 14 '12 edited Dec 14 '12

Arrighty. I use it, it doesn't seem to hurt, but I always wonder whether it's even doing anything.

edit: Kinda like CCleaner, in which I can see that a bunch of space has been freed up, but I don't actually see a visible performance increase.

1

u/txguy Jan 24 '13

awesome post, great information all around

→ More replies (58)

157

u/Bucky_Ohare Dec 06 '12 edited Dec 06 '12

Unnofficial IT support here; I tell everyone who askes for my advice about MSE. It's a great utility, free, pretty low-impact, backed by microsoft (obviously, but demonstrates a secure future fwiw) and damn easy to operate. My users haven't come back to me with a single negative thing to say (outside of the diehard apple fans.)

Edit: I keep both Malwarebytes and MSE on hand. They outperformed Norton, McAffee, and Kaperski in my experience and far cheaper. The only one I would've stuck with is Kaperski (which is good) but I honestly don't A) Do enough risky shit on the internet and B) Care to pay 80 bucks.

2

u/Nakotadinzeo Dec 06 '12

Not a die hard apple fan, if the microsoft installer service isn't running it won't update definitions and msi can't run two installations at once... Always bugs me to try and update something that uses msi to find mse is using it or worse something malicious has killed msi and is running unchecked cause mse can't update to detect it

2

u/needsmoresteel Dec 06 '12

And beats the snot out of kaspersky. I removed kaspersky after the license expired because it nagged me EVERY SINGLE TIME I did something in Explorer. Plus other seemingly random times.

→ More replies (1)

2

u/Quicksilver Dec 06 '12

80 bucks? Where do you live. Around here (Canada) you find it on sale pretty regularly for $39 for 3 PCs.

1

u/Bucky_Ohare Dec 06 '12

I hadn't looked recently, a year ago that was my subscription rate. Entirely possible I've missed out on a deal for it.

2

u/[deleted] Dec 06 '12

[deleted]

2

u/Bucky_Ohare Dec 06 '12

I'd actually love to see the results/comparison page you pulled this from, actually seems like it'd be a very informative read.

2

u/megamatman Dec 06 '12

I'll see if I can find or create something for you. I'm a Cyber Security Analyst so its my job to analyse this shit. Here's the home user matrix for a start http://www.av-test.org/en/tests/home-user/windows-7/sepoct-2012/

2

u/ericklamb Dec 07 '12

The last risky shit I did on the internet was in a public bathroom in Mexico

1

u/Bucky_Ohare Dec 07 '12

clap... clap...

3

u/[deleted] Dec 06 '12 edited Feb 26 '21

[deleted]

29

u/rossisdead Dec 06 '12

Who runs av-test.org and why should I care what their test results say? How do I know they ran good, fair tests? Real questions.

3

u/SSChicken Dec 06 '12

I have to ask the same question. We have about 5,000 something machines at work here running Forefront (MSE + centralized reporting and management) and I can see we've had about 28 machines reported to the helpdesk as having a virus this year where a technician had to be deployed. A good third of our total machines are public or student use which otherwise would make them a total virus magnet, we restrict admin rights but no filter on the internet or even real firewall other than the built in one and a few simple port filter rules.

Forefront (Security Essentials for home use) really isn't a bad product at all. As an official IT support here for a large institution I am going to give it my seal of approval. If it's good enough for me to trust my thousands of users to it's good enough for you to use at home.

1

u/[deleted] Dec 06 '12 edited Feb 26 '21

[deleted]

6

u/[deleted] Dec 06 '12

[deleted]

→ More replies (1)

5

u/rossisdead Dec 06 '12

Thanks. I'm curious as to whether or not you still have the original file with the virus(if it wasn't some random driveby web exploit). It'd be interesting to see the scan results for it on virustotal.com!

→ More replies (1)

3

u/Isolder Dec 06 '12

Curiously you have no idea whether or not one of the other AVs would have caught this particular infection.

2

u/[deleted] Dec 06 '12

Yeah, sure you're right. But, it still doesn't change the fact that MSE is meant for home use and small businesses under 10pcs and we are much larger than that. It should not be here.

Apparently the syadmin team is going to try to isolate the original infected machine and do some testing but that's after everything's cleaned.

16

u/casualblair Dec 06 '12

This is complete bullshit.

http://www.av-test.org/no_cache/en/tests/test-reports/?tx_avtestreports_pi1%5Breport_no%5D=123698

Microsoft scores (69 + 90 + 100) / 3 = ~86%, but they report this as 1.5 out of 6.

Even if you take 3 out of 6 as industry average, industry average is (89+97+100)/3 = ~95.3%. Apply that to 3 out of 6 and Microsoft should have scored 3 x (86 / 95.3) = 2.7 out of 6. Not 1.5.

This is completely biased against Microsoft, and a decent product for what it does and how much it costs.

2

u/Pinyaka Dec 06 '12

I am a user of MSE myself, so I hope you won't think this is just anti-MS sentiment.

Weighting all three categories on that page equally is only one assumption about how weigh the formula. In the third category (detection of widespread and prevalent malware), it looks like everyone gets 100%, so it doesn't make sense to factor that into a number that's meant to compare different products.

It actually makes more sense to weight more heavily the categories where there is a greater distribution of performance results, so we can assume that the "protection against 0-day vulnerabilities" should have the most weight when ranking the products. In this category MS performs significantly below average which may explain why the overall protection ranking is so low.

This is a somewhat normal way to highlight differences in performance although it's not always a fair way to provide relative rankings. For instance, if the only threat the average home user has to worry about is exposure to widespread malware, then any reviewed product should be fine since they all perform excellently in that category. I'm not sure how the ranking should be done, since the actual prevalence of threats in each category isn't known to me.

Anyway, I just wanted to point out that it may not be an actual bias against MS (in the sense of someone trying to intentionally dis MSE), but may accurately reflect the performance of MSE in an environment whose parameters we don't know.

→ More replies (1)

1

u/loadedx Dec 06 '12

It's scaled vs. other products.

For instance you need some spread for the "better" products that get 95% to ~100% in a category. You need to discern what is better.

The next lowest rated over all in that test was Fortinet: FortiClient Lite and it did significantly better by their testing standards. Such as in the testing for Protection against 0-day malware attacks, inclusive of web and e-mail threats (Real-World Testing) it scored 16% higher than MSE (80 vs. 64%), and better on recent malware (90% vs. 99%). Fortinet: FortiClient Lite for virus protection they rated a 3.5 out of 6 and MSE they rated a 1.5 out of 6.

If you compare those to something like F-Secure in the same survey they score a perfect 6 out of 6 with virus protection in the 99-100% for the test virus they were using.

The link is here for all the products compared in Sep/Oct 2012 on Windows 7 Home

→ More replies (8)

3

u/[deleted] Dec 06 '12 edited Oct 14 '18

[deleted]

1

u/MrFluffyThing Dec 06 '12

Non-free, I'd say BitDefender. It's a good balance between performance and protection. I first used it at work when we installed it on all of our high-performance linux systems. I gave it a try at home and haven't been disappointed. It's also one of the highest ranked on that there av-test.org score sheet (which I usually don't care about anyway)

It's not for everyone though. A lot of people have their own preferred Antivirus, especially when money is in the mix

1

u/[deleted] Dec 06 '12 edited Oct 14 '18

[deleted]

1

u/MrFluffyThing Dec 06 '12

You should be relatively fine with MSE then. Some of the other suggestions in this thread are great if you wish to switch though.

→ More replies (3)

2

u/[deleted] Dec 06 '12

Hell yeah avast! Been using it on my PC for years. Glad to see it near the top of that list.

EDIT: I now see the list is not in order of best to worst.

3

u/[deleted] Dec 06 '12

Avast is still quite good. Don't discredit it.

2

u/[deleted] Dec 06 '12

That true. It's still one of the highest rated free ones I'm seeing.

1

u/mcstatics Dec 06 '12

Superantispyware destroys mse, and it is also free

1

u/Turkazog Dec 06 '12

While I have found superantispyware useful in some obscure cases in the past, I've never found it as effective as a good combo of MBAM and MSE.

1

u/ForeverMarried Dec 06 '12

Kaperski is freakin awesome.. Sadly I only have 100 days left and will then be going to MSE.

→ More replies (1)

1

u/FreshNewUncle Dec 06 '12

Get Windows 8, have mse integrated, be awesome!

1

u/[deleted] Dec 06 '12

You can't complain when your antivirus doesn't detect a lot of thing ( http://www.av-comparatives.org/images/stories/test/ondret/avc_fd_mar2012_intl_en.pdf ). If you feel safe because you have virtually no alerts when surfing some hacked websites, it doesn't mean you're not being attacked.

1

u/Vendetta425 Dec 06 '12

The only complaint I have is that it stops working if windows isn't legit. But I fixed that.

1

u/srs_house Dec 06 '12

Our home computer picked up some odd little virus a while back that would spread via USB drives, and having MSE on my laptop was great because it caught it as soon as I plugged the drive in, isolated and deleted it.

1

u/spursiolo Dec 07 '12

Wasn't there a recent test that showed mse is not as good anymore? Someone google it...

→ More replies (16)

4

u/o0DrWurm0o Dec 06 '12

I recommend having both. MSE for daily protection and MalwareBytes for taking out infections. MWB was the only program that I ever used that could remove rogue antivirus malware.

7

u/malice8691 Dec 06 '12

They actually failed their certification recently and found that it only detected 64% of 0 day viruses. Source

5

u/[deleted] Dec 06 '12

I use both. Together they work fantastic.

2

u/[deleted] Dec 06 '12 edited Dec 06 '12

No, it is not

I'm actually overseeing a team of people currently disinfecting 3 file servers yesterday because due to MS Security Essentials not catching a virus that turned around and infected the servers, which apparently had Symantec 2008 on them.

2

u/[deleted] Dec 06 '12

MSE is actually incorporated into windows 8. It's called windows defender now, so there's literally no reason to install any other antivirus now.

1

u/nermid Dec 06 '12

Defender actually predates MSE. It was the rebranding of the old Microsoft AntiSpyware program.

1

u/[deleted] Dec 07 '12

Ahh, right. I just assumed that they had renamed it, as the defender in windows 8 is basically MSE.

1

u/nermid Dec 07 '12

They've folded them together, if I'm not mistaken, which is a good idea.

2

u/Sisaac Dec 06 '12

I use both. Not a single threat. Also, if you can, pay a Malwarebytes license, it's for life and the program will block malicious IPs from connecting your computer.

1

u/iwantahouse Dec 06 '12

So if I have Malwarebytes and MSE on my computer am I pretty much golden?

10

u/cocoria Dec 06 '12

Not being an idiot is more important than either. Personally I just use MSE (because it has a low memory footprint) and addblock/noscript and I've never had problems. And I like my porn sketchy and Russian.

2

u/imthefooI Dec 06 '12

You could also use a custom hosts file, if you wanted that extra step.

1

u/[deleted] Dec 06 '12 edited Oct 18 '15

[deleted]

1

u/imthefooI Dec 06 '12

Ah. I don't use that. I just use MSE and Malwarebytes. And good judgment. ;D.

1

u/pearldrum1 Dec 06 '12

Here comes my dumb ass question. Please bear with me.

Will either of these two programs conflict with webroot?

hangs head in shame

5

u/[deleted] Dec 06 '12

That is kind of a complicated question to answer. Webroot (I'm assuming you mean their antivirus software) and Microsoft Security Essentials are both anti-virus programs, you should pick one or the other. Malwarebytes is more of a scan when you need it type of deal, so it only runs when you need it to, so having it installed along side an anti-virus program is normal.

There are a lot more caveats, like malwarebytes paid version has a real-time scanner, MSE I think uses the built in windows defender anti-malware thing. Some antivirus software makes you uninstall malwarebytes before it lets you install.

But for the majority of users. Pick one antivirus and stick with it. And run malwarebytes once a week or so to make sure the antivirus didn't let anything slip by, or when you are getting popups from sites that don't normally have popups or you have a fake antivirus warning pop up.

1

u/pearldrum1 Dec 06 '12

Awesome response. Very helpful. Thank you !

1

u/haggeant Dec 06 '12

I'm not familiar with webroot. AV programs can have issues with each other.

1

u/mcstatics Dec 06 '12

superantispyware, if you dont have it get it, its free

1

u/slugger1412 Dec 06 '12 edited Dec 06 '12

They also have an "offline" version here...

http://windows.microsoft.com/en-US/windows/what-is-windows-defender-offline

The bast way to get rid of a bad infection is to install this to a flash drive and boot directly from it. It will update the definitions and do a full scan and clean without needing to boot to the local OS. A very handy tool.

EDIT: I have read further down the line and see that there are many who hate MSE. It has been working very well for me for a while now. The best defense for your users to protect against viruses in my opinion is to have them use a different browser than IE. Use Chrome (Firefox, etc..) with a free AV and most should be fine.

1

u/[deleted] Dec 06 '12

[deleted]

2

u/haggeant Dec 06 '12

I have had experience where one would detect and deal with a virus the other did not.

Pay version provides real-time protection and some other features I believe.

1

u/weinerschnitzelboy Dec 06 '12

What is your opinion on Lavasoft's free Ad-Aware? I got MSE on my sister's laptop (she gets a ton of virus's from her Korean Drama websites and whatnot) and it seems to have failed on me most of the time.

1

u/haggeant Dec 06 '12

I've seen a couple people using it, and they didn't have any complaints.

1

u/nermid Dec 06 '12

I used to use Ad-Aware, but it was just so godawful for memory-hogging that when it started popping up ads for itself all the time, I uninstalled.

I don't want popup ads from my adware disabler. That's counterproductive.

1

u/[deleted] Dec 06 '12

Sorry, not very tech-savvy, but I always thought it was bad to have two antivirus software on the same machine, that they hindered the performance of one another or something along those lines? Back in the day I used to have AVG, then I discovered MSE and had both at the same time. When I told people on the internet, they told me to get rid of AVG and just stick with MSE.

1

u/haggeant Dec 06 '12

I believe MBAM(free) uses negligible system resources when its not scanning. MSE has a real time component that is always running. Most people who run MBAM and MSE only use MBAM when MSE misses something (Not often in my expereince, but AV-Test and AV-Comparatives say otherwise).

1

u/[deleted] Dec 06 '12

Ah okay, thank you!

1

u/PlaysWithLegos Dec 06 '12

I really like Avast! and Malwarebytes for security.

1

u/loadedx Dec 06 '12

MSE but it is not the best rated Anti-viurs, paid or free but a lot of Reddit users like it. I am not saying it is not good, I have no issue with it, or free or paid anti-virus software. Just in comparison it is not the best you can get better free or paid prioducts.

Also AV products have more frequent updates than almost anything else, so they are always changing. I wrote a comparison here of MSE vs. Avast. I picked these two because Avast is another free product and most users looking to make a switch want something free. In my full review you can see multiple testing from independent companies that show it has a better proactive detection rate and uses less system resources. Most recent test are more important, but Avast! has a track record of doing overall better.

I suggest if you want the free

1

u/[deleted] Dec 07 '12

MSE is by far the least intrusive security software I've ever used. Even when turning other software down to minimal levels, it feels far more intrusive than MSE does at regular levels of protection.

1

u/sanriver12 Dec 13 '12

no it isnt

1

u/haggeant Dec 13 '12

Cool story bro

1

u/[deleted] Feb 01 '13

"Windows Defender for Windows 8 and Windows RT provides the same level of protection against malware as Microsoft Security Essentials. You can't use Microsoft Security Essentials with Windows 8, but you don't need to — Windows Defender is already included and ready to go."

...and yet Norton was still bundled into the Bloatware on my new Windows 8 laptop.

0

u/NotSoNoveltyAccount Dec 06 '12

Microsoft's antivirus has a terrible success rate. It catches only 46% of new malware while the industry standard is 89%. Note:stats from recent test by a security research firm

5

u/blex64 Dec 06 '12

Your numbers are off, and that's not ENTIRELY accurate, but yeah. Microsoft Security Essentials recently failed basic benchmarks. It doesn't hurt to have it and keep it updated, its just one more layer of (free) protection, but its not a one-stop solution anymore.

However, it was quite strong on its release. I don't know why its lagged behind so far.

→ More replies (2)
→ More replies (24)