Author Topic: Another reason to drop Kaspersky? (Read 50796 times)

Stoic Joker · « **Reply #25 on:** September 25, 2010, 10:46 AM »

I'm thinking the original is signature-based and the new beta (which I'm running at work) has (some) heuristics. But I wouldn't bet money on it...Just have a vague recollection of it being discussed.

You're right about the 0-day privilege escalation thing ... But I can't help but think of Defensive Driving, because nothing is 100% fool-proof. User is (supposed-to-be) the first line of defense.

I just wish the definitions updates would run automatically independent of Windows Update. Because it's easy to miss an update on a 24/7 machine that's waiting for you to hit go.

Bamse · « **Reply #26 on:** September 25, 2010, 11:34 AM »

superboyac, you should read closely what CWuestefeld wrote. Norton Internet Security has something similar but are those core features of Kaspersky monster really unknown to you? They are not stupid bloat at all but made to improve less than perfect scanners, including MSE. Risky tactic but in theory you can click and install anything you want, nothing can go wrong as long as you do not interfer, like white listing quarantined files. Dumping real time protection would be stupid when you deliberately seek problems. With such demands you have probably made a good choice in Kaspersky if you decide to use it at full force. KIS is not overkill and MSE is not made to be tested the way you seem to compute. Will go wrong sooner than later. Visit any hacker forum to see how easy it is to avoid simple scanners. At least search "virus FUD", may be more hits with "fully undetectable". Test in a Virtualbox. Not being holy, just stating facts which might include some risk of FPs but not much to do about that.

May be you should consider the 100% foolproof method as was mentioned in another thread. Stop learning and worrying, just re-image computer. Returnil and others can do that. Windows SteadyState was mentioned as well, supported until 30. juni 2011.

patthecat · « **Reply #27 on:** September 25, 2010, 11:11 PM »

I just wish the definitions updates would run automatically independent of Windows Update.
-Stoic Joker (September 25, 2010, 10:46 AM)

I have several machines that are on 24/7 with Windows autoupdate turned off and yet the MS Security Essentials definitions are automatically updated daily.

superboyac · « **Reply #28 on:** September 25, 2010, 11:23 PM »

superboyac, you should read closely what CWuestefeld wrote. Norton Internet Security has something similar but are those core features of Kaspersky monster really unknown to you? They are not stupid bloat at all but made to improve less than perfect scanners, including MSE. Risky tactic but in theory you can click and install anything you want, nothing can go wrong as long as you do not interfer, like white listing quarantined files. Dumping real time protection would be stupid when you deliberately seek problems. With such demands you have probably made a good choice in Kaspersky if you decide to use it at full force. KIS is not overkill and MSE is not made to be tested the way you seem to compute. Will go wrong sooner than later. Visit any hacker forum to see how easy it is to avoid simple scanners. At least search "virus FUD", may be more hits with "fully undetectable". Test in a Virtualbox. Not being holy, just stating facts which might include some risk of FPs but not much to do about that.

May be you should consider the 100% foolproof method as was mentioned in another thread. Stop learning and worrying, just re-image computer. Returnil and others can do that. Windows SteadyState was mentioned as well, supported until 30. juni 2011.
-Bamse (September 25, 2010, 11:34 AM)

This is exactly the kind of thing I need to consider. You guys really don't have to tell me about the software I use. I'm very familiar with Kaspersky. I've used those sandboxing features, they are largely useless to me. Sandboxing doesn't do anything for me. Unless I start trying everything I install in a sandbox first, it is no good to me. It's not like I intentionally download bad stuff and realize that I should probably run it in a sandbox first. The only stuff I sandbox are large installations that get their fingers everywhere (MS Office new versions, Adobe stuff, Nero, etc.) And I don't do it because I think they are unsafe, I do it because they are huge installs and i first want to see if it's worth it before committing to them. For the sake of protection, i'd have to know i have a bad thing before i sandbox it. That's why the whole sandboxing thing is nonsense to me. if I knew it was bad, i wouldn't even bother testing it in the first place! it's not like I'm thinking, "I'm pretty sure this is bad...I'll just sandbox it to be sure." If I have any doubt, I don't do anything other than Shift-Delete.

I don't want to think. I just want to be protected AND fast.

bamse, i know turning stuff off is risky. That's why i don't do it. I'm just curious if i can actually speed up my computer and still be idiot-safe. The answer may be no, but I'd like to explore the possibilities. So i agree with everything you are saying, and I may not find an answer.

I also don't like the image solution. Imaging is a tough thing to do regularly. Each image is so huge. I've never found a way around that. I'm really bad with imaging. I intended to image regularly (monthly) but I never actually did it. I did an initial image when Windows was first installed, but not much since then. Like I said yesterday, I'll eventually have a home server with dozens of hard drives, and I'll be backing up and imaging and RAID-ing like a muthafu--a!

Bamse · « **Reply #29 on:** September 26, 2010, 05:11 AM »

Well then you don't need Kaspersky or any other suite. You don't have to chose interactive instead of automatic http://support.kaspe...m/faq/?qid=208281922 But I still say you should check out their forum and FAQs. Solution is manual tweaking of settings only those with program installed know about, have you set up a list of trusted apps? http://support.kaspe...1/tech?qid=208282089 Iswift/Ichecker is on? Do you need System Watcher when you don't see much point in sandbox theory? http://support.kaspe...m/faq/?qid=208281830 Some modules might only become unnoticeable by turning them off, others can be tweaked. PDM used to be the big one, several versions ago http://support.kaspe.../start?qid=208281949 Trial and error.

Slow Kaspersky is cpu spiking while doing X or Y?, crazy file activity? impossible to put finger on any Kaspersky process in task manager or monitor software, but computer runs much faster without prgram? May be only Kaspersky can fix your problem with a new patch. Most useful section of their forum could be BETA one http://forum.kaspers...dex.php?showforum=16 What they are trying to fix will point at problems with current version. That way you can get hints on how to tweak effectively.

Bamse · « **Reply #30 on:** September 26, 2010, 06:44 AM »

If you dump Kaspersky you could test Mamutu with a normal superfast AV program. If not MSE then one which lets you keep Windows Defender active. 65% discount http://www.softpedia...irewall/Mamutu.shtml but test it first of course. Make your own little suite. Is lightweight, well read what they claim http://www.emsisoft..../en/software/mamutu/ Has a paranoid mode with lots of pop ups but in normal it is not much trouble. You probably should not test with Kaspersky installed. If you also encrypt passwords, use password manager in one way or another, is that not enough? If you bought a suite to avoid collecting stuff left and right this will not be too interesting.

superboyac · « **Reply #31 on:** September 27, 2010, 10:02 AM »

Well, just last night, my computer was hanging. I had like 20 windows open of different stuff, and then things just started hanging. I opened task manager to see that Kaspersky (avp.exe) was using like 280MB of memory! Now, i don't really know what that means, but the next largest item was using only 50MB memory. I killed the avp.exe, and everything got unfrozen and was working top-speed! Man, I f-ing hate AV programs if not for the protection.

I wonder if it would be better to try something like Mamutu for the real-time monitoring, and using Kaspersky to run weekly or daily scans. Is that good?

Bamse, I'll have to check out those links later.

Darwin · « **Reply #32 on:** September 27, 2010, 10:52 AM »

Well, I suspect that this may be related to you AV checking files as they are opened or copied. Does Kapersky have an option in its real-time protection settings to turn OFF checking files? I've noticed that this problem exacerbates itself when running a tabbed internet browser...

superboyac · « **Reply #33 on:** September 27, 2010, 10:57 AM »

Well, I suspect that this may be related to you AV checking files as they are opened or copied. Does Kapersky have an option in its real-time protection settings to turn OFF checking files? I've noticed that this problem exacerbates itself when running a tabbed internet browser...
-Darwin (September 27, 2010, 10:52 AM)

I think you are right. I'm going to look into that. It's always either the memory leak in Firefox slowing my computer down, or it's Kaspersky. But, man, after I killed the Kaspersky exe, my computer was SOOOOO fast.

Darwin · « **Reply #34 on:** September 27, 2010, 11:03 AM »

Well, I suspect that this may be related to you AV checking files as they are opened or copied. Does Kapersky have an option in its real-time protection settings to turn OFF checking files? I've noticed that this problem exacerbates itself when running a tabbed internet browser...
-Darwin (September 27, 2010, 10:52 AM)
I think you are right. I'm going to look into that. It's always either the memory leak in Firefox slowing my computer down, or it's Kaspersky. But, man, after I killed the Kaspersky exe, my computer was SOOOOO fast.
-superboyac (September 27, 2010, 10:57 AM)

I hear ya... I'm uneasy about turning this feature off in VIPRE, but that is what Sunbelt recommends. As noted elsewhere, I was amazed at VIPRE's light footprint but lately it's getting bigger. I'm probably going to run MSE when my current VIPRE subscription ends.

superboyac · « **Reply #35 on:** September 27, 2010, 11:45 AM »

Cool. I'm glad we're trying different things here. I hope we find a solution that is fast, yet effective. I think that will be a big help to a lot of people.
I have a feeling the best solution is going to be using multiple software. This seems to always be the case. Whenever a software tries to do multiple things, eventually it becomes bloated, slow, and frustrating. When I first started using Kaspersky, I only used the AV. Then, I started using it for everything security related. Now, I'm thinking of going back. The special problem with security software is that there's always that warning, "Don't use multiple AV programs at once." Now, I don't know if that's entirely applicable anymore. Back in the day, that used to be a problem all the time. But I think it's not so uncommon these days to use multiple programs for security, so that kind of thinking may be outdated. Let's look into that.

But here's how I'm looking at it:

1) My opinion is that Kaspersky is still my favorite for signature based AV stuff. I wouldn't mind keeping it for that part.

2) I use Ad Muncher for ad/banner blocking. Nothing beats it at all. It's super fast, super lightweight, and super effective. I will always keep this. So that means I don't need any other banner-blocking program, including the one in kaspersky.

3) For spam, I use AntiSpamSniper for the Bat. Again, nothing beats it for me. So I don't need Kasperky's anti-spam module.

4) Malware. I'm pretty sure there are better anti-malware alternatives than Kasperksy's. Maybe Mamutu is one of them. The only thing I'm confused about is what is malware and what is a virus? I don't get that. So without understanding that, it's hard for me to judge whether I need kaspersky, malwarebytes, mamutu, etc.

5) Firewall. I used to use Outpost before I got the IS suite for Kaspersky. I'd be interested in using a standalone firewall once again if it proved to play well with other security software and was fast/lightweight. Is Outpost still good for that? What are other options?

6) Is there anything left to cover? Please advise.

tranglos · « **Reply #36 on:** September 27, 2010, 12:21 PM »

2) I use Ad Muncher for ad/banner blocking. Nothing beats it at all. It's super fast, super lightweight, and super effective. I will always keep this. So that means I don't need any other banner-blocking program, including the one in kaspersky.
-superboyac (September 27, 2010, 11:45 AM)

I've learned to ignore web ads most of the time, but I do use Adblock Plus in Firefox. With an increasing frequency it blocks legitimate content images though. (I've seen it block book cover images on Amazon, for example). If this holds up, I'll have to drop it eventually.

3) For spam, I use AntiSpamSniper for the Bat. Again, nothing beats it for me. So I don't need Kasperky's anti-spam module.
-superboyac (September 27, 2010, 11:45 AM)

Same here. I have the Pro version, which learns friendly addresses as you reply to email. Overall it does a very good job detecting spam, with a minuscule number of false positives.

4) Malware. I'm pretty sure there are better anti-malware alternatives than Kasperksy's. Maybe Mamutu is one of them. The only thing I'm confused about is what is malware and what is a virus? I don't get that.
-superboyac (September 27, 2010, 11:45 AM)

Seeing as we have the same knowledge gap here, one of us should post a question at Wilder's

5) Firewall. I used to use Outpost before I got the IS suite for Kaspersky. I'd be interested in using a standalone firewall once again if it proved to play well with other security software and was fast/lightweight. Is Outpost still good for that? What are other options?
-superboyac (September 27, 2010, 11:45 AM)

Every firewall I tried eventually became bloated, sluggish and unstable. I started with Zone Alarm a long time ago, moved to Kerio, tried a number of other options, finally settled for Outpost. I used Outpost from 2004 to 2007. I liked the interface, but for years it was plagued with known issues, which could only be fixed by manually tweaking some config file or could not be fixed at all. Always used to have a hard time getting FTP clients to work with Outpost. Since version 4 it too got bloated, sluggish and unstable on my system, it went out the window soon after.

When I changed my ISP and got a dynamic IP address behind a router, I dropped firewalls altogether. I do allow Windows Firewall to run; it pops up very infrequently (for Total Commander's FTP connection, once), I click Allow and it won't bother me anymore. Sometimes I would still like to have egress control, because I hate it when apps send info home behind my back, as plenty of installers do these days for instance, but I'm not going to let a a heap of bloat on my system just for that. I don't think there is a non-bloated, fast and lean firewall to be found anymore.

Meanwhile, running MSE, I'm seeing unusual CPU spikes and brief little freezes when clicking around in Firefox. In KAV I always disabled the browsing-related stuff, but MSE does not have any settings for that. I don't know if MSE monitors the browser or not, but I'm seeing things that were not happening with KAV: click a link in the browser, and it freezes for a split second, and/or mouse movement becomes sluggish, jumpy. Mouse drivers run at very high (or realtime) priority, but apparently MSE somehow manages to interfere with that (I guess that indicates a very serious CPU load from the kernel code). There is one site I visit often where this is particularly manifest - open a link to that site in a new tab, and Firefox freezes completely for a few (3-5) seconds. That did not happen before I installed MSE, so I'm pretty sure of the culprit.

Darwin · « **Reply #37 on:** September 27, 2010, 12:40 PM »

One thing to be aware of with MSE is that for some bizarre reason it is not set to ignore itself. Thus, everytime it scans a file it winds up scanning its own logfiles and whatnot! So, go into options and direct it to ignore the following locations:

C:\ProgramData\Microsoft\Microsoft Antimalware

C:\ProgramData\Microsoft\Microsoft Security Essentials

C:\Program Files\Microsoft Security Essentials

Source: http://www.1stbyte.c...using-high-cpu-time/

This tamed MSE under both XP (32-bit) and 7 (64-bit).

superboyac · « **Reply #38 on:** September 27, 2010, 01:13 PM »

I'm avoiding MSE for now, just because going to the big names is always last on my list.

Seeing as we have the same knowledge gap here, one of us should post a question at Wilder's

Maybe I just won't use a firewall. How crazy is that? What if I had everything else going nicely, but I didn't have a firewall? How much risk am I actually incurring? I used to just have AV and malware stuff without a firewall. Do I really need one? I'd really like to do away with it.

I don't think there is a non-bloated, fast and lean firewall to be found anymore.

If that's the case, all the more reason to find out if I can just do away with a software firewall.

When I changed my ISP and got a dynamic IP address behind a router, I dropped firewalls altogether.

I also use DynDns (I don't know how you do it). Is that really an alternative to a firewall?

superboyac · « **Reply #39 on:** September 28, 2010, 11:07 AM »

I disabled a few modules in Kaspersky yesterday. I don't remember which ones exactly

. But one of them was System Watcher, and a couple of other web-related ones. I think it has already helped.

CWuestefeld · « **Reply #40 on:** September 28, 2010, 11:10 AM »

I've got several things in KIS 2011 disabled (like spam protection). Now the stupid thing continually warns me that I'm at risk because I'm not using all those modules. Does anybody know if there's a way to say "this is the configuration I want, only bug me if it deviates from this"?

superboyac · « **Reply #41 on:** September 28, 2010, 11:52 AM »

I've got several things in KIS 2011 disabled (like spam protection). Now the stupid thing continually warns me that I'm at risk because I'm not using all those modules. Does anybody know if there's a way to say "this is the configuration I want, only bug me if it deviates from this"?
-CWuestefeld (September 28, 2010, 11:10 AM)

yes, open up the messages window (by clicking on the big "light" button or next to it). Then where it shows that message, click the "hide this message" or something like that button.

Also, for more extensive notification settings, open the settings dialog and somewhere towards the bottom are some settings for notifications in a matrix display. Just uncheck those notifications you don't want. That's one great thing about Kaspersky, it is very customizable.

Bamse · « **Reply #42 on:** September 28, 2010, 11:56 AM »

They have a huge support section for each program http://support.kaspersky.com/kis2011 Can be viewed as good consumer support or support demanding programs

superboyac · « **Reply #43 on:** September 28, 2010, 12:04 PM »

They have a huge support section for each program http://support.kaspersky.com/kis2011 Can be viewed as good consumer support or support demanding programs
-Bamse (September 28, 2010, 11:56 AM)

I am not a fan of their support forum. First of all, i always come to DC for my questions initially. The people here are very helpful for all things, and the forum interface is really really excellent.

In the Kaspersky forums, they always demand you send them ALL of your computer information (using the ksapersky collect information tool) before they even consider answering any questions. And then, after sending them all your info, they tell you you're using some cracked version of some little program and because of that they can't help you. It's almost as if they think they're the piracy police of the entire internet.

A while back, I went through this. They found something on my computer. I think it was some kind of hacked AIM thing my little sister was using (back when I lived with my family). So, they got all on my case about it, saying ridiculous things like "we can't help you if you use dangerous software". So I removed it, and had to "reprove" myself to them. And in the end, they weren't able to help much. I just find them to be generally a little too much holier-than-thou attitude over there.

Bamse · « **Reply #44 on:** September 28, 2010, 12:15 PM »

I meant support section of site not so much forum - which you can use for searching, tried "slow"? I thought they helped with removal of infections as well but apparently not. Most similar forums are also protective of their stuff and even most neutral or almost neutral security forums are also crazy if you ask for help, like insist on removing any p2p software, including utorrent. They must have policies any idiot can follow or they risk doing wrong

superboyac · « **Reply #45 on:** September 28, 2010, 12:29 PM »

I meant support section of site not so much forum - which you can use for searching, tried "slow"? I thought they helped with removal of infections as well but apparently not. Most similar forums are also protective of their stuff and even most neutral or almost neutral security forums are also crazy if you ask for help, like insist on removing any p2p software, including utorrent. They must have policies any idiot can follow or they risk doing wrong
-Bamse (September 28, 2010, 12:15 PM)

I searched their forum and support pretty thoroughly last month, and didn't find any particularly useful information. Again, it's hard to go to the actual developer's forum and try to get an unbiased answer. If I say my computer is slow because of Kaspersky, they'll say "No, you just have some conflicting settings with other programs." I can't really ask what are the effects of disabling certain components and expect an honest answer. They'll say, "Well, we don't recommend putting yourself at risk, and if configured properly, the components should not be slowing your computer down." So we go around in circles with no solution.

But the real problem is: Security software will slow down your computer. The manufacturer will not want to help you to figure which components can be disabled for performance. That will be like admitting their software is bloated. Why would they do that? So they will always revert back to, "What is wrong with your computer? Surely, it can't be Kaspersky!"

Most other forums are really really bad and unhelpful. That's why I just stick to here if I can help it.

Bamse · « **Reply #46 on:** September 28, 2010, 01:44 PM »

It is not the easiest type of program to give advise on. Conflicting programs could be your real problem even though you exclude that possibility. Security programs = potential for head aching troubleshooting. Just the way it is and KIS being one of the most feature rich makes it worse. Resort to good old exclusion method, I did not say "trial and error" as a way to ignore problem. What you can do. A more positive way of putting it is tweaking or personalizing program.

You have a local problem which must be solved locally but not what you like to read. How can others tell you what to do? With security software it can be risky to suggest since every move must be adjusted to what computer is used for and by who. And what is the point of using KIS if you disable main features? How about you got stubborn and adapted to trial and error mode?

Hours of fun but if you would really prefer to keep Kaspersky avoid program is flawed, I am a victim, official help is useless thoughts. Go Kaspersky works for everyone else but me and I have messed up. What give best result?

tranglos · « **Reply #47 on:** September 28, 2010, 04:00 PM »

In the Kaspersky forums, they always demand you send them ALL of your computer information (using the ksapersky collect information tool) before they even consider answering any questions. And then, after sending them all your info, they tell you you're using some cracked version of some little program and because of that they can't help you. It's almost as if they think they're the piracy police of the entire internet.
-superboyac (September 28, 2010, 12:04 PM)

I wonder if you realize how close you are to the actual/factual truth. Internet police is exactly what Eugene Kaspersky (the founder) wants to be:
http://www.zdnetasia...-enough-62058697.htm

Spoiler

Q: What's wrong with the design of the Internet?
A: There's anonymity. Everyone should and must have an identification, or Internet passport. The Internet was designed not for public use, but for American scientists and the U.S. military. That was just a limited group of people--hundreds, or maybe thousands. Then it was introduced to the public and it was wrong…to introduce it in the same way. 'd like to change the design of the Internet by introducing regulation--Internet passports, Internet police and international agreement--about following Internet standards. And if some countries don't agree with or don't pay attention to the agreement, just cut them off.
(More at the link)

On edit: there's even better, but the link is dead:

Government should control 'Net, Kaspersky says at CeBIT

Joris Evers, IDG News Service\Amsterdam Bureau
March 13, 2003, 06:40

Governments of the world have to take control of the Internet to save
it from buckling under the increasing pressure of worms, viruses and
other cyberattacks, Eugene Kaspersky, head of antivirus research at
Kaspersky Labs Ltd. of Moscow said.

http://www.idg.net/go.cgi?id=791234

superboyac · « **Reply #48 on:** September 28, 2010, 04:31 PM »

Wow!! Is he out of his mind!? I had no idea, man. Wow. it almost makes me want to stop using his program. I don't agree with that at all.
Why do all big companies want to ruin our freedom? They continue to show such disdain for the people. I'm sorry, but the Eugene is nuts. The man has lost touch with the people. I love how companies always take the easy way out when things get complicated. There are viruses? Oh my, we should shut down the internet! People are unlocking their cell phones?? Oh my, we should shut down the 3G network! The smart people can figure out solutions that make both sides happy. The lazy say just shut it down.

SKA · « **Reply #49 on:** September 28, 2010, 10:01 PM »

In defense of Kaspersky:
He knows his co's resources are not enough , and Govts have more resources than his company, to combat malwares worldwide. He was just trying to enlist their support, that's all.

In offense at MS:
If robust file & process sensors("monitors?") came in-built in Windows OS's, malware / trojans problems could be more manageable. Hence the shift to Mac, Linux, BSD etc

SKA