Two Antivirus? -- Only Using One for Real-Time Protection

[Kool Rock]

Hey folks!

I've been driving myself nuts for the past couple hours trying to find the answer to that. I know that having two AV running real-time protection is defintley a bad idea, but, I was wondering about just breaking one out as solely a scanner.

Any thoughts?

Thanks for having me!

--Windows 10

 

[Neemobeer]

In many cases you can use two for real-time protection but you will be using up quite a bit of extra system resources running two which will likely impact the user experience noticeable and secondly they may fight over quarantine of threats or in some cases may quarantine each others components. If you want something that can act as a stand alone scanner I would simply use a tool that is designed for that purpose such as the free version of malware bytes or Spybot.

My honest opinion is if something breached your real time protection in many cases the damage is already done such as malware that is considered info stealing, acting as a botnet, and ransomware to name a few.

IMHO you should be more interested in adding layered defenses vs two the same security tool type. This is referred to as defense in depth.

Having tools like
Endpoint protection (media usually just refers to as anti-virus)
Firewall (either host based or at your network perimeter)
Leverage a DNS service that helps protect against spam/phishing and malware (there are free services that you simply need to point your router at for your DNS forwarders)
Use a password manager and have unique passwords per site/resource to help protect you from credential stuffing and data breaches
Backing up your data to protect against ransomware
This list could go on and on but these are some of the easier/cost effective things people can do at home

 

[ussnorway]

can i ask why
i mean what senario are you hoping to defend against?

 

[Kool Rock]

In many cases you can use two for real-time protection but you will be using up quite a bit of extra system resources running two which will likely impact the user experience noticeable and secondly they may fight over quarantine of threats or in some cases may quarantine each others components. If you want something that can act as a stand alone scanner I would simply use a tool that is designed for that purpose such as the free version of malware bytes or Spybot.

My honest opinion is if something breached your real time protection in many cases the damage is already done such as malware that is considered info stealing, acting as a botnet, and ransomware to name a few.

IMHO you should be more interested in adding layered defenses vs two the same security tool type. This is referred to as defense in depth.

Having tools like
Endpoint protection (media usually just refers to as anti-virus)
Firewall (either host based or at your network perimeter)
Leverage a DNS service that helps protect against spam/phishing and malware (there are free services that you simply need to point your router at for your DNS forwarders)
Use a password manager and have unique passwords per site/resource to help protect you from credential stuffing and data breaches
Backing up your data to protect against ransomware
This list could go on and on but these are some of the easier/cost effective things people can do at home

Hey Neemobeer!

Thanks so much for getting back to me. I really appreciate that.

And thanks for the detailed response. I'll stick with Malwarebytes.

Thanks again & have a great weekend!

 

[Kool Rock]

can i ask why
i mean what senario are you hoping to defend against?

Hi ussnorway,

Nothing really specific; I'm just super paranoid haha. It can be a drag.

Hope you're having a good weekend!

 

[Neemobeer]

Some after thoughts. Many endpoint protection platforms (EPP) aka what the media and layman just refer to as anti-virus are typically pretty effective. Many sit in the 90-95% and anything that claims 100% is probably full of sh*t. This is why I advocate for people to look at other protection layers. EPP will with the exception of of the more expensive "suites" (those with add on features only look at things written to disk (and some will also do in-memory, which is really good). This is why I recommend looking for tools that will help protect you before something is written to disk.

More advanced firewalls can inspect the traffic, or the bad things (malicious binaries, DNS, web sites etc) and can block the bad stuff before it even touches your system (where the EPP kicks in)

FREE - DNS services like Comodo DNS that can filter out requests to bad or untrustworthy sites before the traffic would ever hit your firewall

FREE - Sublime.security offers a limited feature free phish/spam detection service that will even work with many mail providers like gmail

Low Cost - Backup your important personal data (photos docs etc) frequently to avoid having to pay a ransom in a ransomware attack

FREE or Low Cost - Using a password manager and unique passwords per site or at the very least (your email account, financial accounts and anything that can have transactions)

 

[ussnorway]

honestly the best defence is knowledge... that last 5% risk tends to be human error

 

[Neemobeer]

Heh it's probably higher than that. Phishing consistently has a high degree of success in getting credentials and/or foot holds into companies/homes