Someone asked me if it’s possible to have a system frequently using the internet to have no real-time antivirus, but still prevent viruses. I said yes, but it’s risky. Then he asked me if I could make a kind of scheme on how it could be done. I’m no expert, but this is how I figured it would look.
The most important of them all: Common Sense. Basically, most virus sources are already dubious. You can avoid them by common sense. If I’m not mistaken, viruses often require to be manually run by the user. So checking first the net before running it, better yet, before downloading it is greatly helpful.
Firewall for obvious reasons
USB Guardian/USB Disk Security to prevent USB borne, autorun-dependent viruses. Just in case you really don’t want an antivirus running.
On-Demand scanner (AV with real-time shields disabled, automatic updates, scans external drives automatically as well, scans weekly)
Download manager so downloads can be easily monitored aside from faster downloads. Apparently, also prevents some downloads from automatically running (this is yet to be confirmed). It can also be configured to scan all downloads with the av selected.
Sandboxie, or preferably, virtualization softwares such as returnil or something of the like. for testing dubious programs/sites if needs arise.
Emsisoft Emergency Kit. Some helpful tools in case of infection.
Back-up DVD/recovery CD. Just in case. Some people are too lazy, hence the above.
Depending on your browser of choice, add a script blocking utility, such as Noscript and use it properly. Doing so will eliminate a very large proportion of web based/drive-by malware.
I think such security setup must have HIPS and on demand scanner.
There must be HIPS. I can offer 2 variants:
1.1 There exists one prog - DefenseWall Personal Firewall (paid, 30-days trial). It doesn’t have av, it’s very strong HIPS, passes all tests I’ve seen. The developer says it can be the only protection. I think that’s true.
1.2 CIS with av monitor disabled - maybe used as the only protection as well.
Regular scans with Hitman Pro or/and MBAM can be added as well.
Well, the browser – no, the products would be entirely up to them since it is a personal choice. However, I did not indulge in the browsers since some of these add-ons provide for productivity (some university sites use scripts and i’ve observed that most sites I visit do not work well without scripts and flash. This is okay for the technology-inclined, not so much for others. I would like this to be useful to most people rather than a select few), time-constraints often cause frustrations. It would not be a good idea to add these security add-ons to those frustrations. Hope this clears things out.
I’ll be enumerating my comments regarding the above for easier reading.
Don’t most firewalls include a HIPS component, nowadays? Popular ones often do, so I didn’t bother to add it.
Hitman Pro and MBAM is under the category of on-demand scanners. And so is a resident AV with shields/components disabled. So I left it out. The products are a personal choice. I try not to suggest too much so they could find one that best suits their system.
Thank you for the link. It is of great help and am considering their comments along with others.
I’ve referred people who asks me to this section as well. Thanks for the reminder. I’ll be adding it later.
Most popular products, by default, update automatically. Or am I mistaken? Mind if I ask for a few examples if I am? Just to make sure that mine isn’t one of those.
Ought to be optional, I agree. Since many encounter problems with these kinds of products. Not really for people who are non-technology-inclined, hence, it wasn’t mentioned. This can be supplied by the recovery cd anyway. And much easier and less of a gamble to use in my opinion.
I supposed this is also a rescue disk? Or is that an error on my part?
If firewall’s HIPS is as good as of D+ or DW that’s ok.
Disabled resident av is anyway some burden on the system. On-demand scanners give no load at all. Cloud scanners like Hitman Pro are supposed to have much larger antiviral base.
Yeah, useful.
Yeah, useful.
Yeah, all products I know update automatically. Anyway a user must be vigilant on the point.
It depends. Time machines are less reliable but more convenient - handy.
Sure, that must be a rescue disk or an image in another partition. That’s more reliable then a Time machine but less convenient.
Yes, I find that most people complain less to me when they used HIPS such as WinPatrol or sometimes even Defense + in clean pc mode than using NoScript, FlashBlocker or anything of the like. Quite possibly because these people install less and uses the browser more than any other program. In addition, they quite often visit different sites for research and found the dr. web scanner, wot, mcafee add on, or add-ons of the like much convenient for them (they told me this because they have little things to do with these add-ons and it also provides them with feedback from other people so it makes researches easier for them).
With HIPS, it hardly does anything for them since they hardly install anything at all.
