mkey

Even with a firewall, you need to get infected first for it to be "effective" i.e. to be put to good use. I believe Comodo Firewall is a pretty good solution, but most of time it sits idly by. Why? Well firstly because nobody is attacking me or nobody my firewall can detect is attacking me. Secondly, there is no crap on my system that would like to connect online and call back home with whatever information.

Some of the apps that I use have the auto-update feature I turn off or disable by other means (usually a registry fix or some file removal does the trick -> automated batch script). So if you use proxy or HotSpot Shield you are even more secure/private online then you are with a firewall. Of course, if we assume you know what you're doing.

Some of the people I worked for had loads of protection - nod32, comodo firewall or zonealarm or whatever, trojan hunter, various spyware removal and detection apps. And they still hit the porn sites and they still get infected while their system performance goes down the drain in no time.

Stating that you and your precious data is safe merely because you hit porn sites regularly with an AV installed is complete and utter gibberish. Data loss can happen for a number of reasons (malware, power surges, faulty components) and there is no excuse for performing regular backups and keeping the system clean.

This is not aimed at you lyla personally, it's just a general comment.

lyla

"""Even with a firewall, you need to get infected first for it to be "effective" i.e. to be put to good use"""

Firewalls pretty much do nothing once you are infected...They mainly stop you getting infected.

To give a lame analogy...

If your computer is a house with a garden.

The firewall is the wall + gates, antivirus is the dog.

So once the burgular has walked through your open gate, i.e. no firewall, having a closed gate does nothing to protect your house once he is in, as firewalls only prevent intrusion. And do nothing to stop anyone leaving. And also nothing to the person once he is in.

As for the Dog, well it depends on your antivirus software as to whether your dog has a good sense of smell, has any bite, and how often it p*sses on the carpet.

mkey

Please, do explain how does a firewall prevent a virus from getting on my machine?

Not such a lame example - let's say I want to check my mail and forgot to equip my brain that morning. So I fire up the mail client (not an actual event, just for show) ... firewall doesn't mind. I see an email titled "OMG, you just HAVE to see dis!!!!!11!!" ... firewall doesn't mind. I open it up and there is an attachment. Zip file. I download it ... firewall doesn't mind. I run the zip, but oh noez it wasn't really a zip but an exe with a familiar icon. Since my extensions are hidden and the file is named something.zip.exe I think it's a zip file. So I open it, the virus executes and does its thing.

The only possibility for the firewall to do anything here is through the active memory/process/whatever monitor. Comodo has it, but it detects loads of stuff so I usually turn it off. When you install the said program to some random users PC, he doesn't know what all those prompts ask for so he just allows everything anyway. Zonealarm had it also (haven't been using it in a while though) and it cried wolf a lot.

As I see it, firewalls (good ones that is) are useful for two things

1) they block random port scanning so someone out there might think you are not even present
2) blocks unwanted outgoing connections

So, you see, when you get infected firewall does help because it can prevent the malware to go online without your knowledge (spyware and the likes). It might make you aware of the threat so you maybe you manage to get your machine rid of that crap.

lyla

a firewall can stop malicious code accessing a weakness in lets say Windows or Internet explorer which allows injection of code. It does not necessarily stop a virus retrieving more once in, depends on your rules but if it piggy backs a trusted but flawed program, it would be allowed.

Quite a few parts of windows are watching for remote access, and have been able to be exploited in the past, where a simple firewall prevents this.

It depends on how open your computer but one of many examples:

"Helkern" exploits a security breach ("Buffer Overrun") in Microsoft SQL Server that was first detected in July, 2002. To accomplish the "buffer overrun" exploit the worm sends a special request to a target computer. When the request is processed the system automatically executes the worm's code contained in this request. In this way a malefactor can run malicious code without a user's knowledge.

and there are and have been plenty of these type of attacks that apply to windows/.NET/IE etc.

mkey

Yes, and again, this depends on the settings. For someone who installs loads of crap, this will not work because they have made the habit of constantly clicking allow all the time.

Also, comodo is able to pick up (as probably others are able, too) those programs trying to connect through other programs as it keeps track of any addresses those regular ones usually connect to and notifies the user something funky is going on. Now, what the user will decide at that point is entirely different subject.

anonemus

Recommended by maximumpc

Regeneration

Remember the DCOM vulnerability? (Sasser) something like that could happen again. Firewall could prevent it.

mkey

OK, but something like that would be, in a later stage, blocked with a security update by MS.

My point was that firewall has the main function to cover your tracks while surfing the web and provide outbound protection. And also that good habits can serve you better then any AV can.

zme-ul

not exactly
recently I came across a worm that spread using port 80 because of a security hole in XP, a legitimate port; only way to stop it was with an AV
firewall can cover your inbound connection as long as they look suspicious

__________________
人は地獄を作った

Cannyone

I have to change my Vote... I tried Panda. What a PoS!! It killed my Media Extender to my Xbox 360. It had to be disabled when installing updates, and caused both a Printer driver and a Video card driver install to fail... and the list goes on and on.

Probably the worst part is that Tech Support are such tards! They didn't even want to respond to my email for help. I had to call "Customer Service" and get someone there to goad them into sending me a response.

I've since switched to Kaspersky. It's not as frugal on system resources as NOD32 was but it has allot more features. It looks at programs that I run, but hasn't tried to delete a program half way through an install. And it doesn't block my Xbox.