difference between anti virus and firewall?

[Icon Generator]

i have problem regarding antivirus and firewall. i installed avg antivirus on my pc, but virus attacked on my system again, somebody told me to install any firewall. i am using cable internet

[Jean-Luc]

Hi,

Average computer users do not need a firewall.

To be on the safe side, you need :
1. to keep your Windows version up to date
2. to use an antivirus software
3. to think twice before you click a link

Point 3 is the most important. Artificial intelligence (= antivirus and/or firewall) does not replace natural intelligence. Do not open an attachment in an email if you were not expecting it. Do not enter confidential informations (user name, password, personal data,...) just because someone asks you for. If action is urgently required, double-check everything. Manipulating emotions is the strongest weapon of pirates.

Jean-Luc

[innominds]

Antivirus software is used to prevent, detect, and remove malware, including computer viruses, worms, and trojan horses.

A firewall is a part of a computer system or network that is designed to block unauthorized access while permitting authorized communications. It is a device or set of devices configured to permit, deny, encrypt, decrypt, or proxy all (in and out) computer traffic between different security domains based upon a set of rules and other criteria.

Source: WIKIPEDIA

[Clint1]

I see you got your answer for the question of this thread, sorry but I definitely must disagree with "Average computer users do not need a firewall."

An AV program, all of them, are not going to stop everything. They are only as good as their current def's, updating daily, and their max'd out settings (to which most are oblivious). Even using the best, with their heuristic scanning options also max'd out, cannot stop traffic to/from potentially malicious places. If your AV software doesn't identify something bad on your PC or somewhere else (and again, it happens all the time), like a keylogger or Trojan downloader, backdoor, etc., harmful events associated with the event will occur and continue to happen.

Then there is also (dare I call them), "benign" files which no AV program will ever identify as malware, because technically they're not malware, it's only their behavior that is nefarious, and will send/receive traffic from/to malicious places. Only a FW will protect against that.

An example: I use KIS and I have rather frequently over years downloaded something "benign", only to click it then see a FW warning from it that I know from experience should not be happening. If I immediately check the Task Manager, I see something new running, trying to send/receive data from a (obviously at this point) malicious place. Now while perfectly clean, safe and legit software can do this, (again, from experience I know when something is bad, either by the domain name or IP address) ; such as if you download some M$ product for example and this happens and the file is trying to communicate with "*.microsoft.com" or one of their IP's, that's ok (but I still block it). But if you "think" you downloaded and installed something from M$ and it's trying to communicate with a domain or IP on APNIC, RIPE, LACNIC, something ain't right. So these FW warnings of such can protect a user from their malicious behavior.

While XP's Native FW is better than nothing, it only blocks incoming traffic and does not block outgoing data, like for example disclosure and sending of sensitive data on your PC. So a true FW is needed that not only blocks traffic both ways, but that is more "intelligent".

There's many free FW's out there, and while you generally get what you pay for, even they are better than nothing. Last time I checked, Comodo was ranked among the best FW's, and it's free. So there is no excuse for not using one.

[innominds]

Hello Clint1! I support your opinion.

Actually, I'm also using the same KIS 2010 ediction and experiencing the same problem.
I don't say KIS doesn't efficiently but Comodo can be a good addition.
Some internet providers say they have inbuilt FW.

[Clint1]

Originally Posted by innominds

Hello Clint1! I support your opinion.

Actually, I'm also using the same KIS 2010 ediction and experiencing the same problem.

What problem is that? If you mean this: "An example: I use KIS and I have rather frequently over years downloaded something "benign", only to click it then see a FW warning from it that I know from experience should not be happening.", what I was saying is the file really is benign. No scanner will identify it as malware because it's not "technically" malware. Only its actions after being clicked become malicious. A lot times afterward they will actually download some actual malware, and that of course should be and is detected. But sometimes they will just open a port or two for data access, which is why a FW is needed.

Some internet providers say they have inbuilt FW.

Really? I never heard of that before. I'm not sure how that would be possible.

[wige]

I agree wholeheartedly, a firewall is as necessary as antivirus today. A good firewall should be able to not only block incoming and outgoing traffic based on the port, but also based on the talking or listening application. I don't know of any OS firewall that gives this capability - Windows, Mac, Linux - all need a supplemental firewall.

I have seen a few different types of ISP firewalls. Sometimes this refers to a hardware firewall that is built into the modem, and other times the filtering is done before the signal comes into your building. In either case, the purpose of these firewalls tends to be preventing the user from accessing certain ports - while these setups often block some of the more commonly exploited ports, their true purpose is to enforce the terms of service of the ISP (for example, by blocking incoming FTP, HTTP and HTTPS traffic) and they are not the most effective option for dealing with security issues. For that, a software firewall is the first line of defense.

[wige]

I agree wholeheartedly, a firewall is as necessary as antivirus today. A good firewall should be able to not only block incoming and outgoing traffic based on the port, but also based on the talking or listening application. I don't know of any OS firewall that gives this capability - Windows, Mac, Linux - all need a supplemental firewall.

I have seen a few different types of ISP firewalls. Sometimes this refers to a hardware firewall that is built into the modem, and other times the filtering is done before the signal comes into your building. In either case, the purpose of these firewalls tends to be preventing the user from accessing certain ports - while these setups often block some of the more commonly exploited ports, their true purpose is to enforce the terms of service of the ISP (for example, by blocking incoming FTP, HTTP and HTTPS traffic) and they are not the most effective option for dealing with security issues. For that, a software firewall is the first line of defense.

[Clint1]

Originally Posted by wige

.......I have seen a few different types of ISP firewalls. Sometimes this refers to a hardware firewall that is built into the modem, and other times the filtering is done before the signal comes into your building.....

Yeah I've seen those, I have one on my DSL modem (and router). From the way he said it it sounded like he meant (or the way I took it) some kind of "line" FW, as in some kind of "something an ISP does to the line" that's a FW, or "something they do to their service", as opposed to hardware the ISP provides that has a FW in it.

[wige]

Some do that too - that is the filtering before the signal gets to your building that I was referring to. Essentially, the ISP simply doesn't allow traffic over certain ports. They claim it is to increase your security, but the effect is that you are limited to only being able to use certain services on your Internet connection.

[Clint1]

Originally Posted by wige

Some do that too - that is the filtering before the signal gets to your building that I was referring to. Essentially, the ISP simply doesn't allow traffic over certain ports. They claim it is to increase your security, but the effect is that you are limited to only being able to use certain services on your Internet connection.

Ok, I've heard of that. My ISP did that (if that's what you mean) to SMTP port 25 for any of my domains' email, forcing people to have to use them as the SMTP server (mail.ISP-name.com, slower and buggy). I found a way around that by using port 26 and a few other settings, and I could use my domain again (mail.mydomain.com).

[chrisJumbo]

I had AV (Norton) and Spybot and still got a virus. Whether it was a malicious flash ad or one of my kids accidently clicked an ad, I don't know. But the software didn't protect me. The program installed itself and then began to send data back and forth. After the damage was done, Spybot picked it up.

A firewall would have alerted me to the outgoing traffic. My new router has a firewall, but I'm going to double-check its settings.

I ended up switching to AVG because the software had better reviews and isn't quite the memory hog that Norton is.

cd :O)

[Clint1]

Originally Posted by chrisJumbo

I had AV (Norton) and Spybot and still got a virus. Whether it was a malicious flash ad or one of my kids accidently clicked an ad, I don't know. But the software didn't protect me. The program installed itself and then began to send data back and forth. After the damage was done, Spybot picked it up.

A firewall would have alerted me to the outgoing traffic. My new router has a firewall, but I'm going to double-check its settings.

I ended up switching to AVG because the software had better reviews and isn't quite the memory hog that Norton is.

cd :O)

I can go into more detail on this later when I have time, but a hardware FW isn't generally going to alert you to anything. With a software FW, they are much more easily modified, with tons of settings and options, and with alerts/warnings that you can accept or deny.

As far as AVG, sorry to have to say it but that's one of those times when you get what you pay for. It's never at the top of any AV review sites' lists. There are many top-notch respectable companies out there that do little but test and review AV software, and no stake at all in the outcome of any results. Those are the types of sites you should read for AV software info. AV-comparatives.org is one that comes to mind. You have to dig around a bit, but you'll find their reviews somewhere there, usually in PDF files. It's confusing because they do different tests instead of one overall rating. (At least that's how they used to do it). You'll see the first PDF link on this page and it's near the bottom, (and most surprisingly, although a large gap between, KAV next to it now!! I've been suspecting that). When I change I've been thinking about G-DATA, I've been eye-balling it in recent years.