UAC and Windows Defender - OFF or ON

[pdsnickles]

I am just generally against running Windows firewall and Windows defragger and stuff like that. I heard many times that in XP these things were not as good as the commercial programs and it was a good idea to turn them off and use a good one instead.

So with that logic I turned off UAC as soon as I got Vista because, well, IT WAS ANNOYING AS HELL... and then I turned off Windows Defender because my AVG Firewall has always seemed to protect me from everything in the past (I've used it for years, done a lot of downloading and never had a virus or trojan or anything like that (knock on wood).

But I thought I'd ask here. If you think they should be on, please tell me why. I am not sure whether AVG will even allow Windows Defender to run, but I guess I could turn on UAC if I really felt it necessary. But yechhh, I hope not!

 

[pdsnickles]

I just found one answer on the net that I think makes a lot of sense.
Anyone disagree with this? Check it out:
Am I at risk if I disable UAC?

It is part of a site that offers a free tool to alter and control the way UAC works. I am not endorsing it in any way, I don't know how or if it even works! But I liked the logic of the reason why it's okay to turn UAC off.

I also read some other very good criticisms of how UAC was poorly implemented, and I agree. The idea wasn't that bad, but the implementation was very poorly thought out and poorly executed. IMHO.

 

[Ayporos]

I personally recommend UAC and windows defender ON, also DEP if you have it.

They're great features and hardly affect PC performance so imo there's no gain switching them off.

 

[rive0108]

Both ON, or you will find youself infected with malware (i.e., clickjacking, Drive-by-downloads), and then suffering data corruption/data loss on top of windows crashes/

Running without UAC will allow Malicious programs to install and run without you being aware that they are doin so in the background.

 

[JimJoe]

I have both off as I feel the programs I run are better. Ad-Aware, Avast, Zone Alarm, and a few others.

I am the only user on the computer and it is shutdown when I am not using it.

 

[pdsnickles]

I see that there is agreement on this!
First of all, I am not sure I CAN run both Defender and my AVG Firewall. I have a question about that into AVG but so far no answer. (They are not nearly as good at tech support as they are at making a good Firewall/Anti-Virus.)

Rive018, is there something different about Vista that would make it MORE prone to malware than XP SP2 was?

I ask because with XP SP2, I only ran AVG Firewall, I do a LOT of surfing the net and downloading, and I never got a virus or trojan or any kind of malware thanks to AVG. Now, if I can run Defender AND AVG and Defender does not drive me nuts like UAC does, I will run it just for that extra defense.

But as for UAC, it is totally annoying and poorly conceived. I would run it ONLY if I were convinced that my AVG Firewall were not enough. I have run tests against AVG Firewall where the site is hoping to find security holes so they can sell you THEIR firewall, and I have always passed as 100% secure with AVG. That's why I use it, that and the fact that I never have had a bug since using it.

Without UAC and Defender on, is Vista LESS secure than XP SP2? Or the same? If it's the same then I think I will stick with UAC off. But I welcome more comments and maybe someone could convince me otherwise.

By the way, did you read the link I posted above? I think it makes a lot of very valid points re this discussion:
http://www.tweak-uac.com/am-i-at-risk-if-i-disable-uac/

 

[rive0108]

I see that there is agreement on this!
First of all, I am not sure I CAN run both Defender and my AVG Firewall. I have a question about that into AVG but so far no answer. (They are not nearly as good at tech support as they are at making a good Firewall/Anti-Virus.)

Rive018, is there something different about Vista that would make it MORE prone to malware than XP SP2 was?

I ask because with XP SP2, I only ran AVG Firewall I do a LOT of surfing the net and downloading, and I never got a virus or trojan or any kind of malware thanks to AVG. Now, if I can run Defender AND AVG and Defender does not drive me nuts like UAC does, I will run it just for that extra defense.

But as for UAC, it is totally annoying and poorly conceived. I would run it ONLY if I were convinced that my AVG Firewall were not enough. I have run tests against AVG Firewall where the site is hoping to find security holes so they can sell you THEIR firewall, and I have always passed as 100% secure with AVG. That's why I use it, that and the fact that I never have had a bug since using it.

Without UAC and Defender on, is Vista LESS secure than XP SP2? Or the same? If it's the same then I think I will stick with UAC off. But I welcome more comments and maybe someone could convince me otherwise.

By the way, did you read the link I posted above? I think it makes a lot of very valid points re this discussion:
Am I at risk if I disable UAC?

Vista is less suceptable to malware than XP. Better firewall (to see firewall test results: see post #34). , its got UAC (which prevents malware from obtaining elevation rights to run or execute on the sly, or in the background unnoticed), and Defender. Running without these will comprimise system security, and put you on par with XP that runs in Admin mode all the time, and is suceptable to amongst other things, drive-by-downloads (malware), and click Jacking. [as a result of the User aways running with full elevation rights]

Second of all, AVG isnt very good of late. Out of three 3 star certification it got only 1.
There are other, better and free antivirus programs available.

Avira Antivir (downloadable free software)
Avira is one of the best Antivirus vendors on the market. ((AV-comparative 2008)

Avast! (Alwil) (downloadable free software)
Free Home Edition antimalware progam.

 

[pdsnickles]

I personally recommend UAC and windows defender ON, also DEP if you have it.

They're great features and hardly affect PC performance so imo there's no gain switching them off.

What id DEP?

 

[rive0108]

I personally recommend UAC and windows defender ON, also DEP if you have it.

They're great features and hardly affect PC performance so imo there's no gain switching them off.

What id DEP?

It is hardware/software data execution prevention. helps prevent damage from viruses/security threats

 

[pdsnickles]

Vista is less suceptable to malware than XP. Better firewall (to see firewall test results: see post #34). , its got UAC (which prevents malware from obtaining elevation rights to run or execute on the sly, or in the background unnoticed), and Defender. Running without these will comprimise system security, and put you on par with XP that runs in Admin mode all the time, and is suceptable to amongst other things, drive-by-downloads (malware), and click Jacking. [as a result of the User aways running with full elevation rights]

Second of all, AVG isnt very good of late. Out of three 3 star certification it got only 1.
There are other, better and free antivirus programs available.

Avira Antivir (downloadable free software)
Avira is one of the best Antivirus vendors on the market. ((AV-comparative 2008)

Avast! (Alwil) (downloadable free software)
Free Home Edition antimalware progam.

What I meant to ask was, is VISTA - WITHOUT the Defender and built in Firewall - less secure than XP is, without its firewall? In other words, let's say we do not run any 3rd party software at all - no AVG or Avast or whatever anti-virus, Firewall and anti-virus. Is Vista any worse off than XP would be under these circumstances?

If not, then I should be okay without UAC because I never had it with XP and I never had any problems because I used AVG Firewall and various other programs and policies.

As to AVG not being as good as it was before, that could be true. But where are you getting those ratings?

I am somewhat skeptical as to that chart you inserted because in my experience both McAfee and Symantec/Norton (whatever it's called now) are both really lousy anti-virus software, yet they put them above Avast, AVG, etc. I have heard great things about Avast lately.

In any case, I have already paid for another 9 months or so of AVG so unless I hear something really conclusively bad about it, I will stick with it to the end of my license period. Did that site give specific reasons why it is no longer good? My problem with it has been that since 2 updates ago - back in Fall of '08 - it began being a little buggy. But I've still never had a virus or trojan or anything.

Now, as to UAC:

Both ON, or you will find youself infected with malware (i.e., clickjacking, Drive-by-downloads), and then suffering data corruption/data loss on top of windows crashes/

Running without UAC will allow Malicious programs to install and run without you being aware that they are doing so in the background.

When I used XP, I didn't have UAC and I had no malware, etc.. So, if I use the same security programs with Vista that I used with XP, why would I now get it with a UAC-less Vista?

Why should we have to put up with all those nag boxes every time we make a move? They should have made this UAC function less invasive, give you options to always allow certain apps or certain types of activities to the Admin's preferences.

Or how about acting like AVG Firewall where it allows you to answer the question once for a program then it gives YOU the option to nag you again, or not, for that activity?

UAC is universally disliked, so I think it's clear that it was not well implemented. Does it do its job? Yeah, probably (though one should read the link I gave - it makes the argument that UAC really is pretty useless). But does it do it in a way that doesn't annoy the hell out of Vista users? No. It gets an "F" there, for sure!

It is a very ill-designed and implented program in my opinion and isn't a good firewall and good anti-spyware program just as good, without UAC?

Again, I am open minded about this, but so far I am not seeing much evidence that UAC is all that necessary.

 

[H2SO4]

Adding my AU$0.02 while rive0108 is sleeping

What I meant to ask was, is VISTA - WITHOUT the Defender and built in Firewall - less secure than XP is, without its firewall? In other words, let's say we do not run any 3rd party software at all - no AVG or Avast or whatever anti-virus, Firewall and anti-virus. Is Vista any worse off than XP would be under these circumstances?

No, it's better than XP under those circumstances. It's architecture is inherently more secure in many ways. ASLR, for example, randomises the load addresses of DLLs in process memory space so that malware can no longer expect to know precisely where to find key APIs - VirtualAlloc, CreateWindow, WSAConnect... on XP each of those "control knobs" always sits in the exact same spot in memory on each machine. In Vista, they move around on each reboot so malware has to work that much harder even if it somehow gets onto the machine.

If not, then I should be okay without UAC because I never had it with XP and I never had any problems because I used AVG Firewall and various other programs and policies.

That seems intuitively logical, but security is about unknown threats, not known ones. If it was feasible to predict the domain, range, and precise vector of every future security threat, there would be no need for firewalls or AV at all. You'd just make the software around those known attack points so robust that all malware would be rendered obsolete. Unfortunately, threats continue to evolve and so must the security mechanisms, or one day you find out (the hard way) that what used to be sufficient protection - no longer is

Why should we have to put up with all those nag boxes every time we make a move? They should have made this UAC function less invasive, give you options to always allow certain apps or certain types of activities to the Admin's preferences.

It's reactive. UAC reacts to operations which are sensitive. In theory, once a box is configured to the user's preferences, they would never see another UAC prompt unless they were doing "privileged" operations like changing system configuration. In practice, many apps are written with very questionable security standards, in that they attempt to write to places in the registry and file system where they shouldn't. If an app causes incessant UAC prompts, you'd be justified to send an email to the developers and ask why their app triggers so many warnings.

Or how about acting like AVG Firewall where it allows you to answer the question once for a program then it gives YOU the option to nag you again, or not, for that activity?

By itself, that is almost trivially bypassed by malware. If your firewall is set to always allow internet access to "iexplore.exe", all that malware has to do is to either inject itself into the browser process or call itself "iexplore.exe" and Robert's its father's brother - instant internet access for malicious payload.

UAC is universally disliked, so I think it's clear that it was not well implemented. Does it do its job? Yeah, probably (though one should read the link I gave - it makes the argument that UAC really is pretty useless). But does it do it in a way that doesn't annoy the hell out of Vista users? No. It gets an "F" there, for sure!

The fundamental issue is that Windows users and many of the squillions of existing Windows apps out there are unfamiliar with the concept of a Least-privileged User Account (LUA). A good *NIX admin knows that she must never perform daily tasks while logged on as root ("administrator"), because that is inherently dangerous. Arguably, while the steeper learning curve with UNIX-based OSs has always kept out relative novices and those not interested in the computer for the computer's own sake, my 70-something mother-in-law has a Windows machine that she uses to design quilts. She no doubt considers it "annoying" that she must sometimes elevate to perform system maintenance tasks (when my wife and I are not around!), but then she probably would prefer not to type in a password when the machine boots up. Some of that convenience must be sacrified for security.

Once a user gets over the fact that at least two accounts are necessary - privileged and unprivileged - and that only the latter is to be used for daily work, the process of elevation no longer seems strange or annoying.

 

[rive0108]

to add to H2SO4

It comes down to this, if you want to run without UAC, without Defender, without an enabled firewall, with a second rate Antivirus/Antimalware, That is entirely your choice, the chances that you will suffer malware/viral infection are very high, as is the likelyhood that you will suffer catastrophic Windows corruption and failure in the near future.

If you do not want to defrag that is ok to, but unless you go spend money to get a standalone program, your computer will eventually slow to a crawl. Vista has utilities for disk check and an advanced command prompt for a full defrag (http://www.vistax64.com/tutorials/165576-how-make-vista-more-responsive-faster.html?filter)

Chances are also good you do not backup regularly (if at all), so may lose all your music/data/documents/files due to corruption or the inevitable loss of the ability to boot into Vista.


My suggestions to you:
Do a full complete pc image every six months (http://www.paragon-software.com/home/db-express/download.html), use Vista file backup utility weekly
and DO NOT use a reg cleaner.

Good luck!

 

[pdsnickles]

to add to H2SO4

It comes down to this, if you want to run without UAC, without Defender, without an enabled firewall, with a second rate Antivirus/Antimalware, That is entirely your choice, the chances that you will suffer malware/viral infection are very high, as is the likelyhood that you will suffer catastrophic Windows corruption and failure in the near future.

If you do not want to defrag that is ok to, but unless you go spend money to get a standalone program, your computer will eventually slow to a crawl. Vista has utilities for disk check and an advanced command prompt for a full defrag (http://www.vistax64.com/tutorials/165576-how-make-vista-more-responsive-faster.html?filter)

Chances are also good you do not backup regularly (if at all), so may lose all your music/data/documents/files due to corruption or the inevitable loss of the ability to boot into Vista.


My suggestions to you:
Do a full complete pc image every six months (Drive Backup Express - Free Download!), use Vista file backup utility weekly
and DO NOT use a reg cleaner.

Good luck!

If your latest message above is meant for me, I think you have misunderstood or made a lot of wild assumptions that are not based on what I have said here.

I have never said that I do not intend to use a Firewall, that I don't back up or that I do not defrag. In fact it has been my habit to do all of these.

What this thread was about - what I was asking was specifically whether or not UAC was that important IF you have a commercial Firewall (such as AVG) and whether or not UAC is necessary IF you have a commercial Firewall instead of Vista's Firewall.

After what you and H2S04 have said I am almost inclined to re-enable UAC, and I have already re-enabled Windows Defender, once I was sure it was okay to run alongside AVG.

I have used Perfect Disk 6 for the past couple of years and am probably going to upgrade it to the new one (can't use 6.0 on my Vista 64bit OS).

I use AVG and though you say it is not that good anymore, I am willing to trust it at least until my paid license runs out, then I will consider getting Avast. Surely it is better than Vista's firewall, at least.

I am still skeptical about whether UAC won't drive me absolutely nuts and ultimately that IS a factor. No one who uses their computer a lot (I sometimes use it 8+ hours a day) and does a lot of different activities (downloads, usenet, playing media on various players, internet, Winrar, QuickPar, Reget, Dreamweaver, etc. etc.) wants to be annoyed all day long by a pop-up (we usually buy software specifically to avoid those!). In my view there just HAS to be a better way to safely use one's computer than to put up with the way UAC currently operates. But maybe I'm wrong. Or maybe I'll change my mind.

I think I already mentioned that I use Paragon Backup Express and made a copy of my Recovery Partition as soon as I got the new computer. Today I am making an image of my whole hard drive (with software installed) and putting that on a new WD USB HD I just bought ($90 for 750 gigs!) before I try shrinking my C drive down to 110 gigs, with Paragon Partition Manager 9 Pro. But it's good that you put the link to Backup Express for others who may land here. It may be THE best free software available! [Though I am less enamored with their Partition Manager but I guess so far it has worked, at least. I'll have more to say on it after I try creating the above partition.]

Thanks to all who have answered this thread. I'm happy to hear more opinions especially if you can back them up with experience.

 

[rive0108]

Paragon Partitioner
Burn ISO Partitioner to CD (ISO is a disk image. for free ISO image burning software):BURNCDCC

for 64-bit Vista you must use a bootable partitioner. I uploaded the partitioner, simply burn it and use it.

 

[Ayporos]

Rive, let's be honest... vista's built in defragger is... below-standard to put it mildly.

If you want proper disk defragmentation tools I recommend a very good one that I have used for years and works great (also has a 64bit version btw):
O&O Software - O&O Defrag 11 Pro

It allows you to schedule disk defrags, schedule WHAT disks to defrag, and also HOW to defrag.

Options for defragmentation include:
complete/NAME: this will sort files by name (directory path), thus speeding up the opening of folders and reducing load on hdd motors as they dont have to fly all over the disk reading chuncks of data just to load 1 folder.

complete/modified: this will sort files by last modified, putting OLD files at beginning and newest files at end.

complete/access: this will sort files by last accessed, meaning all the files you've accessed lately (and are thus more likely to access again) will be put at the end of the data cluser.

 

[Mr Smiley]

Hi pdsnickles

The following two tutorials will help you I think.

The first is "How to Elevate Administrators UAC Privilege Level in Vista"

... and the second is "How to Turn DEP On or Off for a Program in Vista"

Hope this helps.

Neil