What's good in AV software these days?

[Winter_Wolf]

Seeing as the new computer purchase is moving apace, I'm thinking I want to go something different than Avast for my antivirus software. I'm not opposed to paying for service, but I don't know what's good these days.

My last experience with Norton was about 10 years ago and it was bloated as hell. Not too keen on the "we'll automatically renew (and bill you) when your current service contract expires in a year (and you forget to cancel beforehand)." My last experience with AVG was even longer ago and for whatever reason didn't play well with my then OS which lead me to try Avast. Which has gotten progressively more annoying.

I mean, is whatever Windows 10 comes with decent? Or am they better off with a little more muscle? I don't expect to have Chinese hackers knocking on my virtual door, but then again I don't expect them not to if I go online in China. VPNs are really limited in what works while there, and those that do are not shy about stating they're in bed with the Watchers of the Internet. Not that I have much in the way of top secret info, not even my garlic chicken recipe which is pretty much exactly what it sounds like. Anyway, yeah, what's good in antivirus software these days?

[Fri]

From what I heard, Windows' inherent firewall is actually good enough. Antivirus is a bit limited these days because how virus works nowadays, the most important part is to always keep up your firewall, use no-script/adblock in your browsers (because people can really hijack your pc from seemingly passive ads), don't click suspicious links, etc. Malwarebytes is good addition, just update and run it regularly.

I personally use Avira, though more from momentum rather than anything, so I don't know if it's any better or worse than other antivirus. The only downside from the free version is that it will pop up an ad to remind you to upgrade to premium version once per day in your toolbar.

[scalyfreak]

Norton has gotten better, but to my knowledge still aren't free.

Personally I am happy with Avast, but if you want alternatives, I've made a list with alternatives I or knowledgeable friends have enjoyed in the past. Fair warning that several of them are ad-supported, behaving like the Avira "reminder" Fri described.

360 Total Security
BitDefender Free
Comodo Antivirus
Panda Free
Sophos

Malwarebytes is the brilliance of black diamonds, but you have to pay them for their equivalent of the active real-time protection a free AV gives.

Keep in mind though that if you click the "install" button in the unexpected pop-up window, none of the above will save you. The best home security system in the world is useless if you disarm it before unlocking the door and leaving the house. Practice Safe Surfing!

And install an ad-blocker or script-blocker. Seriously. This is the internet equivalent of washing your hands after touching raw chicken, using condoms, clicking your seat belt, and not waving cash around openly in a very bad neighborhood.

[Fri]

And install an ad-blocker or script-blocker. Seriously. This is the internet equivalent of washing your hands after touching raw chicken, using condoms, clicking your seat belt, and not waving cash around openly in a very bad neighborhood.

Don't tell me what to do!

*Wash hand in cash after touching condom with raw chicken and wave seatbelts around in bad neighborhood*

[scalyfreak]

That made me laugh.

Thank you. After the most recent work week from hell, a good laugh was well overdue.

[factotum]

Erm, silly question--why do you not want to use Avast anymore? Knowing what it is you don't like about it would help people give you alternatives. On the other hand, if you're happy using Avast, keep doing so on the new PC, seems to make sense to me to do that.

[Misereor]

Seeing as the new computer purchase is moving apace, I'm thinking I want to go something different than Avast for my antivirus software. I'm not opposed to paying for service, but I don't know what's good these days.

Ever consider using a virtual machine? Install, take a snapshot, do your thing on the Internet, and reset to snapshot after session.

The world is going from device based protection solutions to data protection, but it'll be some time before operating systems are ready for it.
In the meantime malware is requiring more and more effort to keep up to date with. You may or may not be one of the people for whom it's just not worth the effort.
The above workaround isn't perfect, but it has very few vectors for infection.

[snowblizz]

Seeing as the new computer purchase is moving apace, I'm thinking I want to go something different than Avast for my antivirus software. I'm not opposed to paying for service, but I don't know what's good these days.

My last experience with Norton was about 10 years ago and it was bloated as hell. Not too keen on the "we'll automatically renew (and bill you) when your current service contract expires in a year (and you forget to cancel beforehand)." My last experience with AVG was even longer ago and for whatever reason didn't play well with my then OS which lead me to try Avast. Which has gotten progressively more annoying.

I mean, is whatever Windows 10 comes with decent? Or am they better off with a little more muscle? I don't expect to have Chinese hackers knocking on my virtual door, but then again I don't expect them not to if I go online in China. VPNs are really limited in what works while there, and those that do are not shy about stating they're in bed with the Watchers of the Internet. Not that I have much in the way of top secret info, not even my garlic chicken recipe which is pretty much exactly what it sounds like. Anyway, yeah, what's good in antivirus software these days?

I trusted the Windwos 10 stuff to go at it alone. Last year about this time my computer was botted and gutted (I got the message when my ISP shut me off becasue I was disturbing the network traffic). Windows protection is not enough.
I run the Free AVG and other than the bi-weekly sure we can't sell you something?, at the most inopportune moments, I don't have massive complaints. Though thinking of it they've not been bothering me as of late.

[Winter_Wolf]

My big issue with Avast is their constant corner pop up trying to upsell me to something when I'm doing things online like banking or looking at online shopping. And the random upsell on computer boot. And the random upsell for no particular reason. I don't buy from pushy salespeople, I'm not more inclined to do so from an automated "psst hey buddy". Also the "you'll get better protection if you slip us a little somethin' somethin', we swear!" literally day after letting something nasty and hard to remove on my computer.

On principle, unless they really are The Best, I don't see why I shouldn't give something else a try. New slate and all that.

[scalyfreak]

Most free antivirus programs will do that though. They're businesses, and they want to stay in business. Giving things away for free is not the best way to do that.

Annoying but true.

My Avast gives me a pop-up reminder rather rarely. It feels like twice a week or so... certainly not often enough to aggravate. There is either a difference in our settings, or in our tolerance levels.

[factotum]

Most free antivirus programs will do that though. They're businesses, and they want to stay in business. Giving things away for free is not the best way to do that.

What's really annoying is when they keep doing it when you've actually paid for the software, as AVG has started doing for me...

[Domochevsky]

Ever consider using a virtual machine? Install, take a snapshot, do your thing on the Internet, and reset to snapshot after session.

The world is going from device based protection solutions to data protection, but it'll be some time before operating systems are ready for it.
In the meantime malware is requiring more and more effort to keep up to date with. You may or may not be one of the people for whom it's just not worth the effort.
The above workaround isn't perfect, but it has very few vectors for infection.

Y'know, if you want to go down this path (which I think is a good idea) you could go lighter and peruse sandboxie. It's a "per app" VM. So you could sandbox your browser, for example, to prevent anything from digging into your computer via that. (If it got in it'd not be able to exit the browser box) Also a lot less disturbing to your regular computer use than using a full on virtual machine, since it doesn't have a heavy overhead. So gaming is just fine with it.
You can separate each program into their own unique sandbox. (with the paid version. The trial allows for only one concurrent sandbox active at a time.)

It's what I use at this point for pretty much every program (including games) instead of an AV. But it does might mean a shift in thinking about security (replacing your AV with per-app sandboxing) on your part.

[Winter_Wolf]

Well there is something to think about. Is it an automatic thing, is there and extra "do you want to do this?" screen, or do I have to remember to do it for each application? Not opposed to it, but I'd like more info from a first hand user. All options are worth a look at least.

[obryn]

I paid for a subscription to BitDefender, and so far I'm extremely happy with it. Windows Defender let some malware onto my PC; I was able to remove it, but it soured me on the built-in option I'd previously spoken so highly of.

BitDefender is updated very frequently, and it's really cheap for 3 PCs at a time. I don't bother with anything past the Antivirus, but even that comes with web protection, ransomware protection, etc. I think it was like $25 for the year.

[scalyfreak]

What's really annoying is when they keep doing it when you've actually paid for the software, as AVG has started doing for me...

Now that's just rude.

*adds AVG to list of AVs not to recommend to friends and family*

[memnarch]

I've not had any pop-up messages from avast, but that might be because I put it in silent mode.

[Domochevsky]

Well there is something to think about. Is it an automatic thing, is there and extra "do you want to do this?" screen, or do I have to remember to do it for each application? Not opposed to it, but I'd like more info from a first hand user. All options are worth a look at least.

Hm, lemme see... the process goes as follows:

Step 1, create an initial sandbox with all the settings you like (like dropping admin rights for whatever runs in it, even if you yourself have them. Do be aware though that many programs want (if not need) admin rights to at least install themselves. You can drop them afterwards for regular usage. Limits the attack vector massively if anything malicious gets in.) this is also a place to set the box to be as unobtrusive as possible. By default it puts a set of ## into the sandboxed programs titlebar and gives it a yellow border. I like the ##, but the border is something I disable by default. Some programs also have a legit need for internet access while others do not. You can set that individually as you see fit.

Step 2, right click on the installer in your file explorer for what you want to install and say "run in sandbox..." and select the one you created.

Step 3, go into the sandbox and run the program (also create a shortcut to it outside, since it cannot do that on its own. Unable to modify anything outside the box and all that). Since it is physically located inside a sandbox now it will automatically start within it.

Step 4, no further action required. It's in the box and stays in the box. Any program started inside of the sandbox folder will be started in that sandbox. You can move files at will, or configure your particular sandbox to recover files that are dropped into a particular folder automatically. (So you could have, say, a "downloads" folder inside the browser sandbox, and whenever a new file shows up in there the box asks you if you want to recover it to the outside location now.)
The sandboxie control program also lets you see what is going on inside of each box, like which programs are running.

Step A, a new program comes along that you want to install. Create a new sandbox, telling it to copy the settings of the box you already have. Saves the initial setup. Plus, the security works best when each program does indeed get its own sandbox, so the least damage is incurred when something goes aggressive. Then make some modifications to the box's settings if need be. (Internet access, admin rights, file access...)

Step B, see Step 2 and onwards. (Assuming that the installer is not currently sitting inside of a sandbox. It will stay in there in that case.)

Do be aware: there are some programs that currently cannot run sandboxed, either by incompetence or malice; but development of Sandboxie is ongoing. So odds are in the next version that might already be fixed.

A scenario:
By default any program in a sandbox can read outside just fine, but only write inside of its own box, to have the least disturbance of procedure. So what would happen here if you caught a crypto virus:
The thing would read your entire harddrive and start making encrypted copies, filling up your sandbox with an encrypted copy of your harddrive, fail to delete anything outside of it, write some startup settings inside the sandbox which have zero value to your computer's startup procedure, and then present you with a ransom request.

At which point you can go "snrrk", kill all programs in that box with two mouse clicks (or just restart your computer) and start cleaning the contents up to get your harddrive space back. Or delete the box contents entirely with a different set of two mouse clicks, likely taking your browser (if that was the box it came in with) and its settings with it.
Backups might be useful. (Bonus: Once you've installed your browser into a sandbox and set it up the way you want you can copy the entire sandbox folder as a backup and put it somewhere. Restoring that backup is then merely a matter of emptying the sandbox and copying those files back in.)

The inability of any malicious virus, worm, or what-have-you to lock itself into your system via autostart functionality is quite powerful. So all it takes it one reboot at most to end the problem. And often not even that. But the cleanup is on you.

It is a bit more of a "hands-on" approach instead of letting an AV "just do its thing" and hope for the best, but I appreciate the increased feeling of control about what's going on with my PC and each program on it.

[Misereor]

Y'know, if you want to go down this path (which I think is a good idea) you could go lighter and peruse sandboxie. It's a "per app" VM.

Don't know it, but Symantec does something similar with Altiris Deployment Solution (7+), where you can put your applications into virtual layers that you can switch on or off as needed.
A bit expensive for home use though. I've noticed that Steam also likes to install .net and activex on a per game basis, so I'm guessing it does something similar.
Personally I don't use antivirus software. Or take backups for that matter. (I know. I'm an idiot.)

[factotum]

What happens, out of interest, if you've sandboxed your browser but you actually want to download something to run on your machine, such as a game from GOG or a video card driver?

[Domochevsky]

What happens, out of interest, if you've sandboxed your browser but you actually want to download something to run on your machine, such as a game from GOG or a video card driver?

That is where the aforementioned "recover from sandbox" option becomes relevant. You can either go into the sandbox yourself via file explorer and take the file of your desire out, or set up an auto-recovery, that automatically asks you whether or not you want to recover files going into a particular folder (say, called "c:/downloads/" for example). Or, as a third option, you allow the sandbox to write to a particular folder outside of it ("c:/art/" for example), bypassing the protection for that folder. (Which is useful if you sandbox your art programs separately from each other, but still want all the stuff you're working on to be directly accessible/modifyable to all of them.)

[Avilan the Grey]

Sure it has been said already but the Big Two are excellent if you are prepared to pay for it:
Norton and Bitdefender. We use Bitdefender.
A tip is to always look for offers, Bitdefender has regular sales and never buy it or more importantly renew it without waiting for a sale.

If you are going for a fee alternative go with either Avira free anti-virus or AVG free anti-virus and Windows firewall (if you are running Windows 8 or later.).

[Winter_Wolf]

I may try Bitdefender. Question for Domochevsky/Sandboxie users, how well does it play with AV? I'd like to cover my bases, seems from my experience (limited yet first hand via family--or is that secondhand?) that Win10 is prone to getting smacked around by seemingly innocuous things. Then again said users have 10 Home and I'm hopeful that my planned upgrade to Pro will help a little.

Agh, have the computer and I still need to shove money into it. At least I can call it a write off because it can (and shall) crunch numbers besides gaming. I can probably even justify the new SSD. But anyway, I'll see what BitDefender is about and add it to the pile of contenders.

[ace rooster]

There seems to be a line of thought around avoiding AV software these days, because of the inherent insecurities in having 3rd party software so deeply embedded in everything. For example, if you try to put some software in a sandbox, but still have AV software running on it, the AV software is a route out of the sandbox. Some software calls that should not be able to leave the sandbox may be actually called by the AV, and hence not are sandboxed. AV pluggins also often have requirements in order to function that they impose on browsers, and these requirements can open the browser up to exploits. Fixed memory layouts is a good example. Randomised layouts are far more secure, but don't play nice with AV. The solution that some AV companies imposed was to disable the randomised layout!

This is before you consider the performance hit that AV causes. Firefox in particular has far worse memory performance when coupled with AV.

AV companies will do all they can to scare you, and convince you that they are required, but they are sort of out dated and not able to protect you anyway. The best security is good modular architecture, which AV companies are an obstacle to.

Sandboxes are better, but still not perfect. The issue is that the most dangerous attacks need privilage escalation anyway, and because sandboxes need to provide some interface to system resources. It is getting those resources to do something funny where the danger is. If it worked outside the sandbox, it probably still works inside the sandbox. Most modern operating systems do a good job of sandboxing anyway.

Defender has a bad rep, but a lot of this is transparency bias. If defender has a bug, we hear about it. If AVG were exploitable in a way that ran arbitrary code with AVG's privilage level, we would not. Defender is written by people who know the design philosophy behind what it is designed to defend, so can have a much better integration with that. It is also maintained with huge resources, and does not generate revenue from fear.

The best personal defence is keeping everything up to date. Operating systems are getting to the point where they are secure enough that putting 3rd party software over the top will make things worse.

[Avilan the Grey]

I must say I definitely disagree with the above post;
AV, and preferably a full suite, is more or less essential.

As for performance... Since you are buying a new laptop the impact of a full AV / Internet Security Suite is minimal. Seriously. Besides, what really slows browsers down are tons and tons of extensions and plugins. I am running Brave at the moment (Switched from Opera two days ago) and since it really don't have extension support (it's in beta and does not use the Google store) but has adblocker, forced HTTPS and Disconnect directly coded into it... and it runs like greased lighting compared to both Chrome, FF and Opera.

Anyway, sandboxing is annoying as hell if you are actually using your computer for more than to sit and look at your sandboxed applications.
As for the "I know what I am doing so I don't need protection" explanation a lot of people adopting this philosophy insists on: Do you also drive without seatbelts and have removed all your demolition zones and airbags from your car? Because that's what driving without an AV is. It works fine, until something happens. Then it's reinstall time.

[veti]

I must say I definitely disagree with the above post;
AV, and preferably a full suite, is more or less essential.

I would disagree. The most important thing is to keep Windows, and other software, fully patched. The second most important thing is to be careful what you click on - this is why businesses are at much greater risk than home users, they can't afford to just ignore the files people send them. The third important thing is to think very carefully about everything you install on your machine. Don't click "Allow" unless you were expecting to be asked.

(For instance, among the things you really don't need: any browser toolbars, or addons that advertise themselves to you. Never install something just because it advertises itself: always make sure you're the one who takes the initiative, searches, researches and identifies the things you want. Oh, also Flash: the only important site I know that still requires that is the BBC, and they'll see sense one day. And Java: if you must install that, at least don't connect it to your browser.)

If you visit a website and it says "Plugin required to play media" - congratulations, you're doing it right. Go browse something else.

[ace rooster]

As for the "I know what I am doing so I don't need protection" explanation a lot of people adopting this philosophy insists on: Do you also drive without seatbelts and have removed all your demolition zones and airbags from your car? Because that's what driving without an AV is. It works fine, until something happens. Then it's reinstall time.

It is more a case of not allowing a 3rd party to strip down my car and replace parts with aftermarket versions. Sure, there was a time when cars didn't come with adequate safety features, and in those times getting aftermarket features would have been wise. Now they are not. Now cars are designed with safety as an objective from the start.

When you have security people from two of the top browsers saying that AV software is making their job harder, you have to start to take note.

The concern is news like this. The highlight is that Kaspersky responded by implimenting stack buffer overflow protection, suggesting that before then it didn't have it! This is software that is installed with kernal access. If it is any worse than bulletproof, it is worse than useless.

[scalyfreak]

I've always suspected that people who insist no one needs and AV on their computer, don't use their computers the way the average Windows user does.

Wanna Cry is crippling large businesses not because they "can't afford to ignore file attachments", but because a small number of the employees at those businesses are uninformed idiots who open file attachments from strangers they don't expect file attachments from. They didn't check the file extension on the attachment, they didn't use the preview feature, they didn't bother to wonder why the subject line looked weird and why someone would send them an empty email with an attachment out of nowhere. And lastly, they clicked on everything that showed up on the screen in a fit of panic.

And that is the average computer user. Absolutely YES they need anti-virus software, because they are their won biggest online security risk and no amount of education and reminders can change that.

That said, I think it's a safe assumption that everyone in this thread knows better than that.

But third-party AVs can give peace of mind, and add features and functionality that Windows Defender just doesn't have. It makes web surfing easier to have an AV you trust than to mess about with a sandbox for everything, and for a surprisingly large number of people, that's high priority. And if an AV has a noticeable impact on computer performance, it's probably time to upgrade that computer.

[ace rooster]

I've always suspected that people who insist no one needs and AV on their computer, don't use their computers the way the average Windows user does.

Wanna Cry is crippling large businesses not because they "can't afford to ignore file attachments", but because a small number of the employees at those businesses are uninformed idiots who open file attachments from strangers they don't expect file attachments from. They didn't check the file extension on the attachment, they didn't use the preview feature, they didn't bother to wonder why the subject line looked weird and why someone would send them an empty email with an attachment out of nowhere. And lastly, they clicked on everything that showed up on the screen in a fit of panic.

And that is the average computer user. Absolutely YES they need anti-virus software, because they are their won biggest online security risk and no amount of education and reminders can change that.

That said, I think it's a safe assumption that everyone in this thread knows better than that.

But third-party AVs can give peace of mind, and add features and functionality that Windows Defender just doesn't have. It makes web surfing easier to have an AV you trust than to mess about with a sandbox for everything, and for a surprisingly large number of people, that's high priority. And if an AV has a noticeable impact on computer performance, it's probably time to upgrade that computer.

The vulnerabilities exploited by wannacry were patched by microsoft in March, so keeping windows up to date is effective against it. On the other hand, third party AVs do not protect against it. The peace of mind provided by them is dangerous. Those average users you describe on large businesses should not have admin privilages, so if the operating system is secure they should not be able to compromise the system, no matter how incompetent. This has not been true in the past, but it is a reasonable assumption now (with up to date software, and decent IT). The days of being able to screw your system without admin privilages are gone (unless you have AV which always has a back door).

There is no such thing as a computer that has enough memory to survive a memory leak, and yes, AV software has exibited those! Crashes will still happen with an uber machine too, just faster. Do those count as a performance impact?

[scalyfreak]

There is no such thing as a computer that has enough memory to survive a memory leak, and yes, AV software has exibited those! Crashes will still happen with an uber machine too, just faster. Do those count as a performance impact?

How many self-made geeks do you know who recommend McAfee? No one in this thread has suggested it. Do you have a link that proves Avast, AVG, Avira, or BitDfender, have the same problem?

[Avilan the Grey]

How many self-made geeks do you know who recommend McAfee? No one in this thread has suggested it. Do you have a link that proves Avast, AVG, Avira, or BitDfender, have the same problem?

Indeed. McAffee was a great product in... 1996.

Anyway, I don't get the Third Party Phobia. Especially since well... Unlike Apple or Android (but only on Google phones), Everything is third party. If you don't trust "third parties" to have "too much access to your stuff" why are you using Windows? Windows is the biggest security risk in itself. On top of that it is a third party program. Everything except the BIOS setup is a third party program on the PC. Windows? Absolutely. Firefox? Oh hell yes.
Also, of course AV software makes the coding of other software more difficult, just like Windows Security Updates do. It's their job to make sure coders won't use quick and easy shortcuts that not only aren't really supposed to be there and will eventually be be blocked (Windows Update) but also might be security risks (AV software).

But then there's a lot of stuff I don't get with various PC subcultures anyway. The Religious Worship Of Open Source for example, who can't use ANYTHING except if it's Open Source. Who don't TRUST anyone who isn't 100% open source. And that sounds like disappointed Hipsters as soon as they find out someone on their favorite project decided to try to make some money. "Sellout!!" they cry and rush off to the next thing.

Again, third party AV software is still the best solution. Because Windows own isn't yet up to snuff. The Firewall is, if you tweak the settings to actually monitoring OUTGOING traffic as well (It might already do that in W10, I don't remember), but their AV has a detection rate that is quite a bit lower than the top Third Parry ones.

The vulnerabilities exploited by wannacry were patched by microsoft in March, so keeping windows up to date is effective against it. On the other hand, third party AVs do not protect against it. The peace of mind provided by them is dangerous.

Oh third party AV's does indeed protect against it. It's called "Ransom Ware Protection" and is most definitely part of BitDefender (and I assume Norton).
All of this reminds me of old frontier guys, or rather wannabe old frontier guys: "You can't trust your fancy security system or the police to do your work! The only thing that makes me sleep well at night is not sleeping at night but patroling my yard with my shotgun!".
I mean yes, I know what I'm doing, but BitDefender still jumps to the rescue from time to time (mainly blocking suspect webpages; so far I have not had an infected file on my computer for 6 or 7 years).