Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 9 down vote favorite
1

I have Kaspersky Internet Security (KIS) installed on my system. I always keep it disabled, yet using a few practices, I kept my system virus free for years:

  • I disabled autorun using these tricks;
  • I installed the freeware Panda USB Vaccine;
  • Every time I get a new file from the web or by other means, I run KIS on it. When in doubt, I check it using VirusTotal.com. If still in doubt, I run it via Sandboxie;
  • I keep my Windows & other software updated.
  • I enabled Windows Firewall.

Believe me or not, these simple tricks made my system 100% immune against malware.

However, while keeping KIS disabled frees the system of performance degradation, there is one drawback: Programs can freely access the web.

I need a lightweight firewall (for Windows XP) which does not have any extra features; that is, it only controls the connection. There are many free/commercial firewalls, like Comodo, ZoneAlarm, Outpost, Privatefirewall, etc., but they have a lot of extra features, like Application Integrity Check and other application controls (whether an app can create/terminate process, can use interprocess communication, can setup hooks, etc.).

To sum up:

I need a lightweight firewall which is capable of setting what apps can access what ports/protocols/etc., but does not bother me with other application checks.

Edit: Anyone has experience with Jetico Personal Firewall? It seems to be very lightweight (the installer package is about 3.5 MB). I recall an older version once ruined my XP and I had to reinstall it. Yet newer versions might have come with bugfixes.

share|improve this question
Similar to my answer to this question, it's important to note that this will only block low hanging fruit. More complex malware will be able to bypass this, if you're running it on your endpoint. One way or another. – AviD♦ Dec 15 '10 at 23:49
@AviD: Sure, but I'm not after protecting from malware. As I said, I'm pretty sure that malware is not lurking on my system. I just want to find what apps try to connect (say, for instance, to check for an update), and prevent them if needed. Legal apps usually do not use dirty tricks to circumvent a firewall. – Sadeq Dousti Dec 16 '10 at 3:42
"Usually" being the operative word ;) – AviD♦ Dec 16 '10 at 7:31
3  
You say "100% immune" which is just plain wrong. Besides malware which may slip thru, there are many zero-day attacks out there for most any complex application which accesses either the Internet or other data over which you have no control. – nealmcb Dec 16 '10 at 20:49
2  
@SadeqDousti - cartoonstock.com/newscartoons/cartoonists/mba/lowres/… – Iszi May 16 '11 at 17:14
show 1 more comment

2 Answers

up vote 2 down vote

Why not just use the built in Windows Firewall? It does exactly what you've asked and is extremely lightweight.

share|improve this answer
Windows Firewall usually warns when an application wants to bind to a local address (i.e. work as a server). But it does not warn otherwise. For instance, I recently installed a new web browser, and it does not warn me when I wanted to access to web via it (the browser didn't have a digital signature). – Sadeq Dousti Dec 15 '10 at 23:25
Right, but you can still lock it down so only approved applications can connect outbound using a whitelist. IMO you'd be better off if something didn't pop up and just blocked it by default. – SteveS Dec 15 '10 at 23:41
1  
Note that "approved applications" is something that can also be misused, abused, and bypassed. E.g. via DDE, automation, DLL hooking, etc. In effect it has low value against (custom) malware, but it does give you some element of control on standard apps. – AviD♦ Dec 15 '10 at 23:51
@AviD: As I told, I'm sure malware is not present on my system. Yet I want to know what apps try to connect (directly), and restrict them if I wanted. AFAIK, Windows Firewall does not provide this functionality. Please correct me if I'm mistaken. – Sadeq Dousti Dec 16 '10 at 0:10
1  
Yes, I understand that note, but important to point out (as you say, control not security). Also you are mistaken re Windows Firewall - but it depends which version Windows. On 7, you can go to the Advanced section and create per-program rules. – AviD♦ Dec 16 '10 at 0:14
show 2 more comments
up vote 0 down vote

When I'd previously looked at firewalls on MSWindows (admittedly some time ago), kerio stood out as being significantly more secure and manageable than any other product available.

At that time I believe it was available in a free evaluation version - but this appears to have been withdrawn leaving only the paid for version.

share|improve this answer
Well, I took a look at it. Kerio Control is about 70 MB, which is far from being lightweight. – Sadeq Dousti Dec 16 '10 at 13:27

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.