Is it ok to have 2+ antivirus programs and/or 2+ antispyware programs installed?

[black069]

Hi everyone. 

When trying to figure out how to maximize protection on my computer, I found a post on ComputerHope (see the link and post below) in one of the introductory pages about security (posted by an expert or similar title).  I’m relatively new at this and do not mean to second-guess, but I have read dozens of times in the help sections of antivirus programs and other places that you should definitely not have more than one antivirus program installed on your computer at any given time.  The reason, they say, is that the programs will interfere with one another, decreasing their functionality. I do realize that antivirus programs are different than antispyware programs (as the post below is specific to antispyware). That said, and, again, I may be mistaken, but I have also thought (from reading instructions on antispyware programs, forums such as these, tech support folks, etc.) that the same is true for antispyware programs (and firewalls for that matter)…that you should never have more than one present on your computer at the same time--even if disabled--for the same reason as with antivirus software. 

(By the way, I am also aware that you do need an antivirus program and an antispyware program and a firewall installed and operable at the same time; I’m talking about >1 of each particular type). 

I would love to have 2 or more antivirus (like AVG and Avast) as well as 2 antispyware (AdAware and Spybot) programs on my computer for extra security, but will this not cause all sorts of problems that outweigh the potential benefits? 

Thanks so much for your help,

SB

The link to the ComputerHope post (as well as the post itself) are below:

http://www.computerhope.com/issues/ch000578.htm

A computer can have any number of spyware programs installed at the same time and it's recommended that you have more than one to ensure your computer is not infected. When running these programs if the spyware returns after rebooting the computer boot the computer into Safe Mode and run the spyware programs while in Safe Mode. Additional information about getting into Safe Mode can be found on document CHSAFE.

[CBMatt]

I believe you have misunderstood that quote just a little.  In that section of the page, he is referring to anti-spyware programs only.  It's okay to have a couple of anti-spyware programs...but like you assumed, you should only have one anti-virus.  If you would like to have an additional anti-virus, however, you should look up ClamWin.  It's a great program, but it doesn't have live protection (you have to specifically instruct it to scan), so it won't get in the way of your primary scanner.  You should, of course, never scan with any two programs at the same time.

[black069]

Thanks for the response, CBMatt. 

To further clarify, I am wondering whether I could add Spybot (free edition) to my computer, which currently has Ad-Aware's free edition installed.  Spybot is billed as an antispyware program, but unlike Ad-Aware, Spybot has resident detection, which constantly runs in the background. According to Spybot's website, "[Its] Resident TeaTimer perpetually monitors the processes called/initiated. It immediately detects known malicious processes wanting to start and terminates them giving you some options, how to deal with this process in the future....In addition, TeaTimer detects when something wants to change some critical registry keys."

This, to me, complicates my knowledge of what antispyware functions are versus what antivirus functions are.  It seems that Ad-Aware (with its on-demand scans) is strictly antispyware, whereas Spybot is antispyware AND antivirus. 

Since I run AVG-Free as my antivirus program, I would be concerned that Spybot and AVG would interfere with each other (since like we said, only one antivirus program should be installed).  But with my limited understanding of these security features, I certainly do not know this for a fact.  In your (or anyone else's experience), can someone have Ad-Aware, Spybot, and AVG (free editions of each) installed on the same computer to optimize security?

One final question....We have decided that a computer should have only one antivirus program installed.  What about the "free online virus scanners" that many trusted sites recommend (for example...Panda ActiveScan 2.0, Trend Micro HouseCall 6.5, Kaspersky's Free Virus Scanner, etc.)?  These programs are not installed on your computer per se, but in my experience, they do install various files (and not just logs or temporary internet files) on your computer upon scanning just once.  Is this okay?  In other words, is it okay to have AVG-Free as the installed antivirus program, but also to, on occasion, run any of a number of these free online virus scanners (while AVG-Free is temporarily disabled? Or should AVG be completely uninstalled before running one of these programs?

Thanks for your assistance and patience,

SB

[CBMatt]

Well, to be perfectly honest, I actually tell most users to disable TeaTimer because it's a troublesome feature that often interferes with other programs.  Spybot is a great program, but TeaTimer (in my opinion) is junk.  However, if you would like to use it, I would say that it's okay to use it along with AVG because I believe they use different methods.  They may *censored* heads, though, because like I said, TeaTimer interferes with a lot of programs.  I would personally stay away from it and just stick with the AVG resident scanner.

As for online scanners...that's a really good question.  I've actually never thought much about it before.  I have never had problems with doing this, but to be safe, you may want to disable/close AVG before running online scans (you don't have to uninstall it).  But honestly, in this particular case, I don't think it's an issue because the activity of online scanners goes relatively unnoticed.

[BC_Programmer]

as an aside, the reason anti-virus programs interfere with one another is because anti-virus programs do a lot of system level stuff that viruses do, like hooking process creation and launching; so if you have two they might detect the behaviour of the other AV program as malicious via their internal heuristics.

[CBMatt]

as an aside, the reason anti-virus programs interfere with one another is because anti-virus programs do a lot of system level stuff that viruses do, like hooking process creation and launching; so if you have two they might detect the behaviour of the other AV program as malicious via their internal heuristics.

This is mostly true.  The more popular scanners are able to recognize each other and will leave each other alone.  The scenario described here is still a possibility, however, especially if using a program that isn't as well-known.

[BC_Programmer]

they usually recognize the popular ones, but there are new updates all the time; and they cannot possibly cover every possibility. And if they were to simply exclude certain executable names that are known AV programs- what would stop malware from adopting the name.

In any case, it's always best to only have one on-demand scanner, (disable the on-demand capability of any others) and simply run anti-spyware and anti-virus scans manually with the others every once in a while.

And my info was a little outdated, the last Anti-virus I actively used was VSAFE; and I ended up having to reformat my HD because of it, so maybe I've got a bad taste in my mouth from that experience.

[black069]

In any case, it's always best to only have one on-demand scanner, (disable the on-demand capability of any others) and simply run anti-spyware and anti-virus scans manually with the others every once in a while.

I've been thinking about the above statement for several days.  I am not trying to second guess an expert, but it seems to contradict itself.  Please tell me if I am wrong, but I thought there were essentially three methods that antivirus & antispyware software use to catch bugs: (1) Scheduled Scan where, for example, the program is set to run at 3pm every Monday; (2) On-Demand Scan which means that the user decides to run the scan at that moment, thus making it a manual scan; and (3) Resident Detection in which the scan is always running in the background.  If my assumption is true, then the statement in question is telling me to disable the ability to perform an on-demand scan on all but one program, while at the same time telling me to perform an on-demand scan with these "other" programs. 

I could understand the instructions if it read, "It's always best to have only one scanner with resident detection (disable the resident detection capability of any others), and simply run antispyware and antivirus scans using the on-demand function (ie manually) with the others every once in a while." 

But even then, can the user not simply do the following:  enable resident detection on only one program for real-time protection, and with any number of other programs, run either a scheduled or an on-demand scan occasionally, just making sure that only one such scan is running at any one time, excluding the program with the resident detection enabled, which is ALWAYS running in the background?....

        .....unless the user is supposed to disable the resident detection function of the one program any time a scheduled or on-demand scan using another program is conducted (so that the resident detection function of program A does not interfere with the scheduled/on-demand scanning function of program B)? 

Sorry for perhaps making things more difficult, but I have been performing these mental gymnastics, reading about the basic tenets of antivirus/antispyware programs, scanning forums on these topics, etc., yet I remain extremely confused, and now I have a massive headache on top of it. 

Could one of you computer geniuses help me clarify this so I can live in peace? 

(On a practical note, what I am running now as far as antimalware programs are the following:  AVG-Free (with resident detection enabled, plus scheduled scans); SuperAntiSpyware (which only allows on-demand scans with the free version); and Malwarebytes' Anti-Malware (which only allows on-demand scans with the free version). Plus I have the "shells" (for lack of a better word) of a few free online scanners downloaded (e.g. Panda ActiveScan 2.0, Windows Live OneCare Safety Scanner) so that I can perform on-demand scans using these programs if something looks suspicious to be extra cautious.  Is such a setup okay as far as the rules of program interaction we have been discussing?)

Thanks so much for everyone's generosity and wisdom. 

And Happy New Year to those of you who, like me, celebrate it tomorrow night!

Scott

[BC_Programmer]

Ant-Virus programs only have two modes. Manual, and ON-Demand... When I said "On demand" I meant the functionality whereby whenenver an Executable is launched, the anti-virus program kicks in and scans it (the resident functionality)

You should only have one Anti-virus program enabled for resident scanning of this sort. Even if they don't conflict (which they probably will, trying to open the file at teh same time), it'll take a while for two scans to finish, and the exectuable to be launched.

The "Scheduled" form you speak of is merely a portion of the resident part of the AV program- the resident portion will detect when the appropriate time has come and launch the scan. Although some are a bit smarter and actually use the task scheduler like they should.




as I said before, I didn't use the term "on-demand" to mean starting the program and running the scan; I meant it to refer to the functionality provided by the resident scanner when possible virus harbouring programs are launched; their files are then scanned on-demand. (alright, it's a bit roundabout, but it's what I meant)

here is a more clear version, though:
(read that as: here is the version that uses the more common terms)

In any case, it's always best to only have one resident scanner, (disable the resident capability of any others) and simply run anti-spyware and anti-virus scans manually with the others every once in a while.

I am not trying to second guess an expert

That's how we learn. Well, that and reading I suppose.

[evilfantasy]

The problem today with having two "real-time" antivirus installed is they are active in the background and pretty much "look" at everything you do. Two antivirus trying to protect you at the same time is actually as bad as not running an AV at all. By the time they stop "arguing" over which one is in control, if it's malware, it probably already gotten past them. It only takes a split second.

Here is my canned for running two AV's.

I (as well as Microsoft, McAfee and Symantec)  recommend that you DO NOT have more than one antivirus product installed and running on your computer at a time.

The real-time protection of two antivirus programs may conflict with each other and cause the following:

1) False Alarms: When the anti virus software tells you that your PC has a virus when it actually doesn't.
2) Conflicts: Your system may lock up due to both products attempting to access the same file at the same time.
3) Performance: More that one antivirus will cause your PC to become slow and it may even crash or blue screen.

I strongly suggest you either configure only one antivirus program to enable automatic real-time scanning, and leave the rest disabled, using them for on-demand scanners or go to Start > Control Panel > Add or Remove Programs and uninstall all but one antivirus program.

I have stopped including the last part of the canned.

I strongly suggest you either configure only one antivirus program to enable automatic real-time scanning, and leave the rest disabled, using them for on-demand scanners or go to Start > Control Panel > Add or Remove Programs and uninstall all but one antivirus program.

The problem today with that theory is that malware has gotten so aggressive in trying to defeat an AV that the AV vendors have made them extremely hard to turn off. No matter what process you kill, service you stop etc, the AV is almost always still running it's protection/scanning module. So the term "On-Demand" is sort of blurred now when you are talking about a full version of an AV. There is one truly on-demand scanner that is very, very good and that is Dr. Web CureIt. http://www.freedrweb.com/

The more popular scanners are able to recognize each other and will leave each other alone.

True. Just as the AV vendors have made the AV's more malware proof so have the firewall vendors. Many of the third party firewalls use a lot of antivirus technology now days. They have to recognize each other to a point or we wouldn't be able to run a firewall and AV at the same time. But like not running two AV's at once, one is usually the dominant figure and will have priority over what it specializes in doing, being an AV or being a firewall.

Plus I have the "shells" (for lack of a better word) of a few free online scanners downloaded (e.g. Panda ActiveScan 2.0, Windows Live OneCare Safety Scanner) so that I can perform on-demand scans using these programs if something looks suspicious to be extra cautious.

All you are really installing is an ActiveX object so the online scanner can "see" the definitions database through your browser in order to detect anything bad it finds. Nothing runs in real time once the scan is stopped. Turning off your installed AV is always suggested as there is always a remote possibility that both will be trying to scan the same file at the same time, which could cause any number of things to happen. Browser crash, blue screen, false positive and so on.

That's how we learn. Well, that and reading I suppose.

It's never ending! The malware writers figure out a new tactic and the rest of us try to catch up.