Member Avatar for kapura.ftw

I am trying to understand the different types of protection that a computer needs.
This is what I have learned:
-You cannot have multiple anti-virus software on your computer, because they will interfere with each other
-You need to stack up other anti-malware software, the more the better
-You can not have two firewalls on one computer, but you can have a firewall on a computer, then a firewall on the server that the computer is a part of.

But if anti-virus is a type of malware, why is it that you can stack the other types- but not virus protection?
How does the firewall on the PC that goes through the servers firewall not conflict?

Thanks for any information, I'm just struggling with how things ACTUALLY work. Its fine that this is the info that my teacher/my book want me to know, but I need to know WHY as well :)

  • 2 Contributors
  • 1 Reply
  • 334 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by CimmerianX

Dani AI

Generated

Short answer for : the reason you generally run only one resident antivirus is not a policy quirk — it’s technical. As hinted, modern real‑time AVs install low‑level hooks into the operating system so they can intercept file and network activity the moment it happens. Two different products trying to do that simultaneously can step on each other: file locks, race conditions, quarantines of the other product’s files, big slowdowns, even system instability.

More detail: endpoint AVs typically use kernel‑mode file‑system filter drivers and network hooks to inspect files on open/read and traffic in transit. Those drivers run before normal user programs and can interact in complex order. If both engines try to inspect or block the same stream at once you get contention (delays), inconsistent state (one thinks a file is OK while the other quarantines it), or deadlocks. That’s why vendors advise a single real‑time engine per machine and provide uninstall/cleanup tools to remove remnants cleanly.

Why multiple anti‑malware tools are often suggested: many are on‑demand scanners that run in user space only when you launch them. They don’t persistently hook I/O, so they can complement the main AV (different signatures, heuristics, removal routines) without causing real‑time conflicts. The catch: if an anti‑malware product offers a real‑time module, treat it like antivirus — run only one resident scanner or disable the extra real‑time feature.

Practical recommendation: use one up‑to‑date real‑time AV, supplement with one or two reputable on‑demand scanners, keep a host firewall plus a perimeter firewall, and if you see problems disable the extra product’s real‑time protection or uninstall it with the vendor’s removal tool.

Member Avatar for CimmerianX

Antivirus programs are usually 'Active'. This means that the program starts with the OS, is always running in the background, constantly checking files, webpages, downloads, etc.... it is always running. If you have 2 of these running at the same time, they start to step on each other every time they both want to check the file you just opened.

Antialware (i.e. malware bytes) is usually passive. You load up the antimalware run your scan, then you are out. Some, like spybot, can manipulate certain files (i.e. hosts file) to help protect you, but again you are in, run it, then you are out. Some malware apps do have a feature to always run in the background, but it's not a requirement like AV.

Firewalls enable/disable certain traffic. You only need 1 firewall. If you have 2 you double the complexity, but get no additional return.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.