Best Anti Trojan

[arman]

Hello!
What do you think is the best anti trojan software out there???

And installing Outpost, should I also need an anti trojan???

Thank you.

[chrisclu]

I hear Tauscan is very nice :):):) And it works with OutPost::):):)
Chris

[Jack Benny]

The best depends a lot on individual needs, experience, compatability with other software, degree of user-involvement (set-it-and-forget-it vs constant tinkering), susceptibility to infection (single, cautious user vs multiple user PC). In other words, no such thing as best. Too many factors involved. You're going to have to try some yourself and see how the feel.

No matter how many good opinions you can get about a particular product, you can always find an equal number negative ones.

As for needing an AT along with a firewall, remember that while a FW can stop many Trojans from sending info out, they can't stop them from running and possibly damaging your PC, and they can't clean them off your system.

All that said, I use Tauscan. One of the easiest to setup and use. On the other end of the spectrum would be a product like Trojan Defence Suite which has more features and is designed for experienced users.

You can find a list here, but beware of the free ones, as most are not supported (or updated), with the exception of Gladiator which is still in Alpha stage and has no real-time monitor:
http://www.staff.uiuc.edu/~ehowes/soft5.htm

[bassbag]

I agree with Jack having used tauscan and TDS3 i would say tauscan is easier to set up and use , but i would also reluctantly say thats TDS3 is better overall with many more functions (though as Jack said you may not even use many of them)and it has usually better detection rates,and is updated normally daily,although as of present it doesnt detect firewar.exe which tauscan does.Whetehr firewar is a trojan in the true sense is open to interpretation but full marks to tauscan for including it anyway.
me

[davidovv]

Well, the best surely is the one able to cope with all/the most techniques used in regard to trojans and backdoors. In this context, built-in unpackers are vital.

Most sophisticated trojans/backdoors are packed and/or crypted. In case an antitrojan isn't able to unpack for example wwPack32, ASPack2.12, UPX2.13 etc. the antitrojan is fairly useless.

An example: take the latest Bionet, pack it with Armadillo, and let it go on your system having an antitrojan installed. Do one and the same with for example the latest Optix Killer.

Tauscan fails - as do 99% from the available antitrojans available.

On a side note: personally, I do prefer an antitrojan doing the job as it should above any antitrojan that isn't doing the job, but easy to use. False sense of security will be the result.

And firewar [/i]isn't[/i] a trojan/backdoor, for the record :).

Enjoy the holidays, and a happy 2003 to all!

regards.

Paul Wilders

Wilders Security (www.wilders.org)

[bassbag]

"Tauscan fails - as do 99% from the available antitrojans available"


What is the 1% that doesnt? :)
me

[safemode]

What is the 1% that doesnt?
im sure TDS3 & trojan hunter.

[bellgamin]

Am I missing something? When someone says something is the best does that mean...

>> The best without regard to cost?
>> The best without regard to whether the program is "friendly" enough that it will, in fact, actually be used by a "non-geek" to the full extent of its capabilities?
>> The best without regard to the degree of the threat that such capabilities will actually be necessary?
>> The best to the extent that the cost of recovering from a potential infection is so great that a high cost of protection is fully justified?

If the person who is seeking the best is an IT or Network Administrator, responsible for protecting a large and costly system, then the answers to my questions likely would be "Yes."

But would that be true for an average home user like myself? Yet in some security forums [NOT this one], if you even ask these kind of questions, you are immediately subjected to scorn. In some forums, if you say that such-&-such a program is a bit hard to use they almost ALWAYS respond with something to the effect that, "Who would want an easy to use program that isn't doing the job?"

The implied answer to that question is, I suppose, "Only an idiot would want such a nasty old easy inconsequential program."

However, the question itself is loaded. It carries an unspoken implication that "easy to use" is pretty much synonymous with "ineffective."

When someone says [or implies] that a program "fails" against such & such a threat, I must ask: How LIKELY is it that that particular threat actually will occur?

To ask this question is NOT to say that I know that the threat is remote. I ask an honest question. HOW likely is the threat? I find it interesting that, in some forums, such questions are seldom asked or answered.

I find it interesting that some folks seem to feel it is only necessary to name 2 or 3 threats that a certain program won't handle and then infer "case closed." Why do they NOT feel it is necessary to put any size of magnitude against the likelihood of their 2 or 3 examples ever actually afflicting an average home user?

Me, I have no AT at all, as such. I have OP and a decent AV. I also have System Safety Monitor [an application/registry firewall that root likes] & Adinf [suggested by FanJ to will tell me if a snake is ALREADY in the henhouse] and good back-up's so I can rebuild the henhouse if I have to burn it down to kill the snake.

I truly do believe the experts when they say that such-&-such a program is the best -- on an "absolute scale of bestness."

I do NOT question their motives -- I think they are very sincere and mean well. However, I also think that some of the best programs have attained the status of being grossly over-priced for the average home user such as myself.

Is that a "false sense of security" as some have said? I don't think so. Yes, I surf the internet because it is fun and relaxing to do so. I am, I think, reasonably cautious, but I do not regard the internet as a form of "guerilla warfare."

I don't want to reach the state where protecting my computer more or less becomes my main purpose for even having a computer. Even so, I spend a fair amount of time in this forum. Why? Because the people here are friendly and helpful and fun to talk to. And security IS a very fascinating and necessary topic.

So that's my $.02 worth [your mileage may vary].

aloha and peace unto you all...........bellgamin

[Acadia]

Here's one opinion:

http://www.anti-trojan-software-reviews.com/

[bassbag]

Hi bellgamin/acadia
Ive used and tested a few ANti trojans including tds3 /tauscan/trojan hunter/and the cleaner.I still actively use tauscan and tds3(tauscan for second opinion).I used the cleaner for quite a while but was disappointed with update frequency(although out of the anti trojans ive tested it is the only one that will tell you when a file is "locked" by a resident av that wont permit the cleaner to scan it.Others normally dont say anything ).Trojan hunter i did not test for very long because it failed a quite common trojan dropper so i didnt test it for long.Maybe i should try it again.Out of them all TDS3 significantly came top in detection /update frequency/customer service and actually updating trojan database when a file was submitted.It is not the easiest anti trojan to operate though and use properly.Although i respect all the other anti trojans ,after testing and using them my personal bias would point to tds3(soon to be 4 apparently)as the best anti trojan available.Whetehr you need an anti trojan at all is another thing ,as a few avs have very good detection rates of trojans although the best ones are usually the pay for ones which you have to pay for updates.Most anti trojan programmes let you upgrade trojan defs indefinitly after purchase and there is no yearly subscribtion like avs,so maybe thats something to think about.
me
me

[arman]

Hello all!
I thank you for all your opinions.

Quote from Jack Benny:
As for needing an AT along with a firewall, remember that while a FW can stop many Trojans from sending info out, they can't stop them from running and possibly damaging your PC, and they can't clean them off your system.
I see now. How about AVs (such as McAfee, NAV, KAV and PC Cilin). What's their effectiveness (in general / roughly) against trojans if we compare to the sole anti-trojan products???

Quote from bassbag:
TDS3 is better overall with many more functions (though as Jack said you may not even use many of them)and it has usually better detection rates,and is updated normally daily
Do you know how often Tauscan database gets updated???

Quote from davidovv:
An example: take the latest Bionet, pack it with Armadillo, and let it go on your system having an antitrojan installed. Do one and the same with for example the latest Optix Killer.

Tauscan fails - as do 99% from the available antitrojans available.
Won't the AT detect he trojan when it's running?? I think a program must be unpacked first before it's executed. Some people even say that an AV does not really need to scan Zip files as the virus will be detected once the infected file is unpacked for execution.
BTW, what is Optix Killer???
If you (davidovv) happen to read this message, could you pls elaborate your last statement: "Tauscan fails - as do 99% from the available antitrojans available" - which 1% that succeed???
Thank you.

To bellgamin:
I was just pointing a general question that's opened for any opinions. I'd "personally" prefer best as the one priced under $50, can be understood by me (for comparison I'd say KAV is friendly enough for me). I'd answer No to your 4th question, but I'll prefer Yes to the 3rd question. But pls don't limit yourself to this "definition"...
Yes, the threat may be rare and remote. In fact we can run just fine with NO AV, firewall, nor AT... the chances of infection/attack are relatively small... yet it depends on how do we definite "small"...

I apologize if you consider this thread as a scorn...
After all one of the reasons why I pointed this questions is to increase my knowledge on security.

[bassbag]

Sometimes tauscan may not be updated for a few weeks ,other times it may be a few days.TDS3 mostly has updates daily.Thers some info here on optix and other trojans (its from tds3 site under main threats)

http://tds.diamondcs.com.au/
Also eric howes trojan tests
http://www.staff.uiuc.edu/~ehowes/trojans/tr-tests.htm
And more elaborate tests here (the tests here are a year and a half old and some Anti trojans not included there like TDS3 and some are not around anymore..nevertheless many people find this list useful as a guideline)
http://www.claymania.com/tests-trojan.html


me

[Acadia]

Originally posted by arman
How about AVs (such as McAfee, NAV, KAV and PC Cilin).

There is one and only one anti-virus that has a good, even excellent reputation for also catching Trojans and that is KAV, which I have never used. No, viruses and Trojans are coded differently (please let's not get technical, I couldn't anyway) and many anti-virus do a poor job catching Trojans. Trojan scanners are designed to ignore viruses and to search ONLY for the special coding of Trojans, although even some Trojan scanners do a poor job of finding Trojans. Some anti-virus scanners are getting better at finding Trojans, some have improved greatly but if you want anything close to 100% detection (and who doesn't) you either have to have both kinds of scanners or use KAV. Good luck.