Re: Replacing antivirus soft with a real IDS/IPS

carlopmart wrote:

Hi all,

I am going to setup a testing lab with several windows XP virtual machines. My pourpose is to do some tests with HIDS/IPS software for windows and not to use antivirus software. Can you recommends me some HIDS software for windows ( free software if it is possible)?.

And another question, will windows survive to several attacks (virus, trojans, etc) without using antivirus software ??? Have anyone tryied this??

Thank you very much and sorry for my bad english.

Your english is fine.

Check out Osiris for central host monitoring:

  http://www.hostintegrity.com/osiris/

Also, I find central logging essential for analysis.
I recommend running a central logging console on
GNU/Linux, possibly the same system used as the
Osiris managment console.

Meanwhile, Snare satisfies me for getting Windows
to log remotely:

http://sourceforge.net/projects/snare/

But, I'm not really sure doing without anti-virus
software is a good idea.  My recommendations
are Kaspersky and Sophos, but there are Windows
versions of Clamav:
  http://www.clamav.net/binary.html

Good luck.

--
Excellence in InfoSec and Linux
http://www.altsec.info


------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 to learn more.
------------------------------------------------------------------------

Relevant Pages

  • Replacing antivirus soft with a real IDS/IPS
    ... I am going to setup a testing lab with several windows XP virtual machines. ... My pourpose is to do some tests with HIDS/IPS software for windows and not to use antivirus software. ... Find out quickly and easily by testing it with real-world attacks from CORE IMPACT. ...
    (Focus-IDS)
  • Re: Swapping Hard Drives
    ... Windows XP also records hard drive letters in its registry, so if you mount the new drive as D: and copy everything from C: to it, when you try to boot from it Windows/the registry will still think it's D:, which won't work very well. ... I =have= copied windows installations that way, generally by booting from yet a third copy, and hacking the registry to fix things, but it is fraught with peril and only recommended for the very desperate or penniless. ... Contact recommends the use of Firefox; ...
    (uk.comp.homebuilt)
  • Re: Repeat : Refreshing disc info after ripping
    ... should be missing from such a sophisticated program as WMP, but I am still unable to find out whether you can and if so, how - so does anyone know the scoop on this? ... a Windows or hardware problem. ... The CD drive is simply failing to tell Windows that the CD has been changed .. ... Contact recommends the use of Firefox; ...
    (microsoft.public.multimedia.windows.mediaplayer)
  • Re: Middle Finger Salute
    ... the very first time: It presents a screen that recommends turning on ... had a complaint about Windows. ... The original poster, a typical user, has a legitimate complaint. ... What Microsoft recommends, what you recommend, what I recommend - whatever - ...
    (microsoft.public.windowsupdate)
  • Re: New problems with 60csx
    ... If you are using windows right click on the drive and select properties. ... The file system will probably be FAT for a flash device and FAT32 or NTFS for a hard disk. ... Contact recommends the use of Firefox; ...
    (sci.geo.satellite-nav)