Poobell's Config - Webroot Complete or Kapersky Total Security 2015

[Poobell]

I have been using Webroot for a few years. Also use Kapersky on another laptop (6 month trial). Webroot is for sure faster. Kapersky has a new version of Pure that I read about called ULTIMATE PC PROTECTION TOTAL SECURITY. Does anyone know about this version being cloud based?

Reading many reviews on both Kapersky and Webroot. Looking for advise for best protection.

Appreciate hearing about your experience and opinions, thanks

 

[hjlbx]

Kaspersky is 32-bit so it cannot hook some 64-bit processes. Consequently, Kaspersky HIPS will not alert on some 64-bit processes... this is all covered in the Kaspersky User's manual.

Webroot cannot protect Windows firewall or UAC; some malwares can disable both.

Webroot's firewall controls are disabled on both W8/8.1 and W10 systems - not because of Webroot, but because of Windows.

Webroot does not rollback some screenlocker ransomware.

If use Webroot, then use Guest Account and\or antiexecutable such as VooDooShield or NoVirusThaks Exe Radar Pro for best security. You should use limited Guest Account anyway.

In any case, I use AE with all my AV softs.

Between the two, Kaspersky decisively offers better overall security - even on 64-bit system.

 

[Poobell]

Kaspersky is 32-bit so it cannot hook some 64-bit processes. Consequently, Kaspersky HIPS will not alert on some 64-bit processes... this is all covered in the Kaspersky User's manual.

Webroot cannot protect Windows firewall or UAC; some malwares can disable both.

Webroot's firewall controls are disabled on both W8/8.1 and W10 systems - not because of Webroot, but because of Windows.

Webroot does not rollback some screenlocker ransomware.

If use Webroot, then use Guest Account and\or antiexecutable such as VooDooShield or NoVirusThaks Exe Radar Pro for best security. You should use limited Guest Account anyway.

In any case, I use AE with all my AV softs.

Between the two, Kaspersky decisively offers better overall security - even on 64-bit system.

Thank you, I will look into VooDooShield

 

[Tony Cole]

I really do not understand this argument that Kaspersky 'lacks' security in key area's on a x64 bit OS, I have indeed read the manual, but a company like Kaspersky would receive serious compliants from both home and corperate user(s). Considering most of the Windows OS's impliment a x64 architecture Kaspersky would certainly not risk it.

Webroot SecureAnywhere Business edition is very good, but I must say, Kaspersky excels in 'all' areas'

 

[hjlbx]

I'm still using windows 7 what your talking about is making a system recovery disk which is done by using a cd or usb it requires the product key but i don't have those at the moment and about windows 8 you can in the net but I don't have money and due to my problem it's not possible

I really do not understand this argument that Kaspersky 'lacks' security in key area's on a x64 bit OS, I have indeed read the manual, but a company like Kaspersky would receive serious compliants from both home and corperate user(s). Considering most of the Windows OS's impliment a x64 architecture Kaspersky would certainly not risk it.

Webroot SecureAnywhere Business edition is very good, but I must say, Kaspersky excels in 'all' areas'

If malware installs, for example, a malicious 64-bit service or other unhookable malicious 64 bit processes, then Kaspersky HIPS will not alert when that service or those processes run...

Will such a thing make a difference between preventing or allowing an infection - probably not - as Kaspersky will likely detect the file via signature. If not, and it is Unknown, then Kaspersky Application Control will assign it to Low or High Restricted.

Once assigned to Low or High Restricted and executed... Kaspersky HIPS will not alert to certain 64-bit processes. The typical user is not going to know that HIPS alerts are missing\not being generated - or even if they were generated - what the hell those alerts mean.

Anything assigned to Low or High Restricted in Kaspersky will activate HIPS alerts - and there will typically be an overwhelming amount of them. Typical user does not know what to do - Allow, Allow Once, Block - what ???

The fact that HIPS alerts are generated means that the infection is being installed - or - is already installed on the system. In either case, an infection is present on the system.

So it is debatable whether or not the missing 64-bit services\process HIPS alerts would have made any kind of difference in stopping the infection and in the grand scheme of things.

That's the problem with Classical HIPS - it is entirely dependent upon the user's knowledge and experience.

The real issue is that with Kaspersky, certain sophisticated 64-bit malware can get onto the system and do a whole lot of damage - the whole time being undetected - except perhaps by the firewall... but I wouldn't count on it.

Case in point was Gamma International's FinFisher FinSpy Surveillance Suite that created so much hub-bub when the reports were WikiLeaked.

Comodo and Emsisoft (64 bit) detected it - the only ones to do so - on all system installs.

Kaspersky, BitDefender, Avira, etc, etc - either missed it completely or only detected it partially in isolated cases. Part of the problem with Kaspersky is that it is only 32-bit.

I suspect if Kaspersky had 64-bit version then it would have done better job at detecting FinFisher FInSpy.

If you use antiexecutable or default-deny configuration - and pay very close attention to software activity - then you don't worry about such things.

 

[Tony Cole]

Sorry to hijack this post, if I have Kaspersky set at untrusted, trusted applications mode enabled and I followed your advice to uncheck trust digitally signed applications and load rules from KSN. I tried Voodoo Shield, but it has too many alerts/configuration for me, plus I would never understand an alert. Is there anything else, apart from CryptoPrevent, Malwarebytes Pro, Malwarebytes Anti-Exploit and HitmanPro.Alert I can do?

 

[hjlbx]

Sorry to hijack this post, if I have Kaspersky set at untrusted, trusted applications mode enabled and I followed your advice to uncheck trust digitally signed applications and load rules from KSN. I tried Voodoo Shield, but it has too many alerts/configuration for me, plus I would never understand an alert. Is there anything else, apart from CryptoPrevent, Malwarebytes Pro, Malwarebytes Anti-Exploit and HitmanPro.Alert I can do?

If you have Kaspersky configured for antiexecutable\default-deny then you are essentially covered.

Tony, if you are using all those security softs, then VooDooShield will be no problem for you... the alerts are extremely simple = Allow, Block or Sandbox. Now I know you are more than capable of handling that level of decision making.

Besides, you do not need to add VooDooShield unless Kaspersky Application Control is screwing-up by moving files randomly from Trusted to Untrusted zone - which is nothing more than an inconvenience. In that case, you can revert to old Kaspersky settings, then add an antiexecutable to compensate for settings change.

The real problem is if Kaspersky is allowing any files to be installed after you have enable its antiexecutable settings. Only if this happens should you absolutely add an AE.

You have very strong configuration - but you worry too much...