Battle Kaspersky Free Antivirus or Avast Free Antivirus for Default-Deny Protection?

[Wraith]

So guys this setup will be for one of my friends who is just an average Joe. He had his laptop infected with all sorts of malware and god knows what I had to do to restore the laptop. I flashed the BIOS, Secure Erased the HDD using Parted Magic, reset the Router to its defaults and then installed Windows 10 Home 64-bit ver 1809. I need to minimise the attack vectors. So far I've installed SysHardener(applied the tweaks)and OSArmor 1.4.2(just in case some malware manages to revert the changes made by SH). I had installed hard_configurator but it was too much of a hassle for my friend since he is unable to execute his softwares which he is downloading from the web. Maybe I'll try Comodo Firewall but that too I think will be too much for my friend since he is not so geeky. So it comes down to Avast free or Kaspersky Free. I like the System Watcher in KAF but it only jumps into action after any malicious activity is performed. I'm considering Avast just because of the Hardened Mode(Aggressive) since it will prevent any unknown file from executing. So what's your opinion guys? In this scenario which one should I choose? Avast or Kaspersky?

 

[Andy Ful]

Actually when I applied H_C, I hid the Run as Administrator option and so he was unable to execute files by double clicking. He has some softwares(like Teamviewer, Winrar, Daemon Tools, Thunderbird, Teracopy and VLC) which he needed to install after I reinstalled the OS. So when he downloaded these and tried to install them by double clicking them, H_C blocked them from executing.

Why did not he use 'Run As SmartScreen' ? This is a safe replacement for 'Run as administrator' applied by H_C in recommended settings.

 

[brod56]

An excellent suggestion mate. Can You recommend me a good DNS?

I currently use 1.1.1.1, which is the fastest in my country, but for content filtering, I recommend Neustar Recursive. Still, use DNS Jumper or similar to check the faster DNS for you which has site blocking

 

[oldschool]

Why did not he use 'Run As SmartScreen' ? This is a safe replacement for 'Run as administrator' applied by H_C in recommended settings.

That's the question I had and never saw it raised in the thread until now! Installing software is easy with H_C., IMO.

Edit: Then the AV choice is easy, whatever the user prefers on his machine.

 

[Andy Ful]

That's the question I had and never saw it raised in the thread until now! Installing software is easy with H_C., IMO.

Edit: Then the AV choice is easy, whatever the user prefers on his machine.

Some AVs (like BitDefender TS) have the ATP modules, which can block a few of H_C features, for example, making the System Restore Point during the installation of H_C.
H_C restrictions are suited to default-deny setup, so if the user wants to use default-allow setup then SysHardener is OK.

 

[oldschool]

@Andy Ful - My understanding improves once again. Clear and simple explanation.

 

[DSD27]

Avast hardened will be totally and completely useless to your click-happy friend because he will simply override it. It is too easy to click past the protection -- it is just a recommendation, not a brick wall. Give him Kaspersky. He won't be able to click past it.

It's quite the opposite, Hardened Mode both moderate or aggressive, won't show any notification or popups, it just prevents everything unknown from being executed, then it will check cloud database and decide if it restores or keeps it blocked/deletes it.

Kaspersky's System Watcher acts after malicious activity is done, if able to identify it, then tries to rollback its changes.

I think that for 0-day, Hardened Mode is better, Kaspersky free is better at signatures/scanning.

 

[harlan4096]

The most similar Kaspersky module to Avast Hardened Mode is not SW but TAM, but as it has been removed in the upcoming K2021, just in Default settings -> moving unknowns apps to UnTrusted in Application Control, would easily emulate the behaviour... later an additional tweaks can be done, but only for more advanced users...

 

[stefanos]

For this year I suggest Kaspersky. I have installed it on all my Greek friends here in Belgium. It is more complete and stable in cloud free version and has no problems. Avast is in a period that makes changes in the latest version. Had quite minor problems and tries to fix them. The settings remain even be like a puzzle. The web filter has these small problems and Avast trying to fix it.

 

[Andy Ful]

It's quite the opposite, Hardened Mode both moderate or aggressive, won't show any notification or popups, ...
...

Are you sure? Look at this video:

App Review - Avast Free (Hardened Mode) vs Ransominator

I'm genuinely surprised to see Avast Free blocking my LOLbin inspired ransomware while Kaspersky Free allowed it to execute and encrypt my files. Is this the end of Ransominator?

malwaretips.com

 

[jerzy601]

I tested Kaspersky Free and Avast free and I liked it the most and it is Kaspersky.
Kaspersky is better in signatures as well as in scanning.
this is my opinion but the decision is yours.

 

[DSD27]

The most similar Kaspersky module to Avast Hardened Mode is not SW but TAM, but as it has been removed in the upcoming K2021, just in Default settings -> moving unknowns apps to UnTrusted in Application Control, would easily emulate the behaviour... later an additional tweaks can be done, but only for more advanced users...

And you're talking about Paid, not Freee.

Are you sure? Look at this video:

App Review - Avast Free (Hardened Mode) vs Ransominator

I'm genuinely surprised to see Avast Free blocking my LOLbin inspired ransomware while Kaspersky Free allowed it to execute and encrypt my files. Is this the end of Ransominator?

malwaretips.com

yep, I'm sure, he was using moderate, aggressive is better. Great video btw...
ps: you can always add your browser to Game Mode (avast adds it automatically) and you won't have any notification, even with moderate.

 

[harlan4096]

Yeah in paId, but even in Free We can't compare Hardened Mode with System Watcher, 1st is a kind of anti-exe module (similar to TAM) and the second is a BB...

 

[DSD27]

Yeah in paId, but even in Free We can't compare Hardened Mode with System Watcher, 1st is a kind of anti-exe module (similar to TAM) and the second is a BB...

And that's why it is better. It's 'free and comparable to the other's paid versions.

 

[LDogg]

How can you compare an Anti-exe module with a Behaviour Blocker, they both do different things.

~LDogg

 

[DSD27]

I tested Kaspersky Free and Avast free and I liked it the most and it is Kaspersky.
Kaspersky is better in signatures as well as in scanning.
this is my opinion but the decision is yours.

If you see the tests, Kaspersky wins on signatures/scan but for a very small margin. There were testes when Avast came out on top. It depends on the month.
It's up to you to choose between signatures/scan or better real time protection against unknown threats.

 

[DSD27]

How can you compare an Anti-exe module with a Behaviour Blocker, they both do different things.

~LDogg

And Avast has both, HM and Behavior Shield. The comparison is: One has it, the other doesn't. It's obvious what's better, to have it.
So because Avast has Hardened Mode for free, it shouldn't be compared to Kaspersky. because it doesn't offer you its counterpart for free? That makes no sense.

 

[LDogg]

The comparison is: One has it, the other doesn't. It's obvious what's better, to have it.
So because Avast has HM for free, it shouldn't be compared to KSCF. because it doesn't offer you its counterpart for free? That makes no sense.
Avast has both. HM and Behavior Shield.

Firstly you were trying to debate @harlan4096 regarding Kaspersky and he happens to be this forums resident expert on Kaspersky. Further on up you trying to compare Hardened Mode w/ Kaspersky's System Watcher, you NEVER mentioned compared Avast's behaviour shield against System Watcher:

It's quite the opposite, Hardened Mode both moderate or aggressive, won't show any notification or popups, it just prevents everything unknown from being executed, then it will check cloud database and decide if it restores or keeps it blocked/deletes it.

Kaspersky's System Watcher acts after malicious activity is done, if able to identify it, then tries to rollback its changes.

I think that for 0-day, Hardened Mode is better, Kaspersky free is better at signatures/scanning.

When debating remember what you were discussing and it's matter of the original point you made w/ System Watcher vs Hardened Mode, not Avast's Behviour Shield which is a BB.

~LDogg

 

[DSD27]

Firstly you were trying to debate @harlan4096 regarding Kaspersky and he happens to be this forums resident expert on Kaspersky. Further on up you trying to compare Hardened Mode w/ Kaspersky's System Watcher, you NEVER mentioned compared Avast's behaviour shield against System Watcher:

When debating remember what you were discussing and it's matter of the original point you made w/ System Watcher vs Hardened Mode, not Avast's Behviour Shield which is a BB.

~LDogg

I was debating the free products avast vs kaspersky,... read the title of the topic.
My point is that one has both features, while the other only has one of them in its free version. That's how you compare hardened mode to system watcher, system watcher is alone and they don't offer you the hardened mode equivalent.
I've just explained everything, its up to you if you want to understand or not.

 

[LDogg]

I was debating the free products, not the specific feature... read the title of the topic.

I'll quote you this one as well bro:

The comparison is: One has it, the other doesn't.

Both software has a Behavioura Blocker, Kaspersky's is System Watcher, Avast has Behaviour Shield. Hardened mode is simply an anti-exe module, if this is what you referring to then I apologise, I'm only going off the pretense of what Harlan stated and what I've see you using in your discourse. From the offset it looks like you're trying to compared the Hardened Mode vs System Watcher.

~LDogg

 

[DSD27]

My point is that one has both features, while the other only has one of them in its free version. That's how you compare hardened mode to system watcher, system watcher is alone and they don't offer you the hardened mode equivalent.