Forums | MacLife

We should sticky this thread:
http://www.macaddict.com/forums/topic/77081

This question gets asked a lot...

Anywho, Ted give it a read...lots of options.

Ad-Aware & AVG. Firewall is built into the router.

This thread got me to investigating some AV tools. The only one that actually scans files I download with Firefox is Clamwin with the Camwin Glue extension. All of the following do absolutely nothing if I download an infected file with Firefox. I have no way to know if they work with IE.

AVG - free and trial version of AVG+Firewall
Avast! - free
Antivir - free
eTrust Antivirus - trial version
Zone Alarm Security Suite - trial version
Symantec Internet Security - OEM version that came with my PC

All of these offer on demand scanning and all flagged the eicar test file when this feature was used. None of the commercial products found anything any of the free ones didn't, with exception of ZA which says Antivir contains a trojan - Win95.SK, if it matters. Personally, I suspect this is a false positive, but who really knows. Also interesting, only Clamwin could detect the sample virus code in the test files included with the clamav source package.

So, Clamwin is the only viable choice for use with Firefox, at least here.

AVG and Avast! do scan email with Thunderbird. Antivir free does not scan mail at all. Zone Alarm and eTrust only work with Outlook. I could not tolerate Symatec long enough to see if it works with Thunderbird.

MantaBase wrote:

test wrote:

Norton AV (not NIS - though it should catch them too) should raise an alarm upon launch.  As would I think some others.

You can't base effectiveness on DLing alone (or at all).  Not really a fair test IMO.

Manta

PS - if it works with FF on PC, it should work on any browser on PC....  The hueristic is the same.

I assume you mean Norton et al will warn me of viral activity when I try to open an infected file. This seems too late to me. I want something that scans files as they are downloaded, [i]before[/url] I try to open them. Maybe I am too paranoid (like that is possible) or I just don't understand the whole malware thing very well, never having had to deal with it.

Anyhoo, I did get Avast! to scan some files as Firefox tries to download them. I had disabled the .Net Runtime Optimisation service and this is apparently needed by the Avast! Web Shield module. Now if I try to download an infected file with a regular http connection Avast! blocks it and flashes a warning message. It does nothing about files downloaded with https connections and I feel good about this. I'm not sure how I would feel knowing some app could snoop on SSL connections in real time. Clamwin works on all downloaded files because the FF extension triggers it when the file is closed. Basically, if something gets past Avast! then the FF extension tells clamav to scan it. I also get 2 "Scan With" AV options in the contextual menu. So I feel like I am pretty well covered for AV software.

Spyware presents another challenge. . .

MantaBase wrote:

Do you know you are DLing an infected file? or is Avast just warning you it might be bad?

It could be that Norton just is not as effective.  *shrug*, top 5 doesn't mean best.

At anyrate, there is no way for any AV system to stop all virii before launch (and even after launch if its an unknown applet/script with common behaviour - or non-suspect behaviour).

If your happy with what you have, kewl   Sounds like its working.

Manta

BTW- - I'm not pimping Norton AV.  I got a two year freebie on it for multiple systems, so I use it.  There are obviously other choices.

I downloaded the eicar test file and the source distribution of clamav. If I understand the purpose of the eicar test file then any AV tool should see it as infected. The source distro of clamav also contains several test files which (I believe) should be picked up by any AV tool.

I realise no AV software can catch everything. But, no AV software will catch anything if it isn't used. I figure auto-scanning every download and every email before I open them is the minimum I should do.

I gather Norton is quite fussy - if it likes your system then you are golden, if not there is nothing you can do except dump it and try something else. Norton does not like my system. Or I don't like the way Norton works. I don't know exactly where the clash is but using Norton feels like driving a Cadillac or a Lincoln and I am more of a Kawasaki H2 kinda person.

test wrote:

I realise no AV software can catch everything. But, no AV software will catch anything if it isn't used. I figure auto-scanning every download and every email before I open them is the minimum I should do.

I gather Norton is quite fussy - if it likes your system then you are golden, if not there is nothing you can do except dump it and try something else....

True enough....

Norton NIS is very fussy and your description of how it acts is perfect.  Its crap IMO.  I've had a lot better luck with the stand alone AV though.

Time is comming to actually extend my Norton or change it....so the topic is timely.  I'll check out what you are lookin at.

Manta

My PC has cooties too... Our entire network seems to be infected with a nasty virus that sprea ds from machine to machine , slowing preformance to a crawl, and eventually making the computer virtually unuasable.......... no..wait.. that's not a virus....That's the operating system......no wonder the IT Guys hate me...