Countering spyware

Spyware outbreaks are escalating from a frustrating productivity problem to an outright security issue. All it takes is one careless user who decides to satisfy his MP3 addiction by downloading a free file-swapping program poisoned with malware. A backdoor application and keylogger install themselves, and next thing you know, your company’s Web sites have been compromised and are acting as a file-sharing FTP site, and your domain registrations have been changed to an offshore company.

Free IT resource Virtualization Insights from Top Experts - Learn how virtualization gets real! Sponsored by Dell Free IT resource TechNet: More ways to know it, share it, and keep it running. Sponsored by Microsoft Return to special report DOWNLOAD PDF Click here to download InfoWorld's special report Anti-spyware

Whether you call it adware, malware, or spyware, these malicious programs are not only capable of tracking where a user goes on the Internet, but they’re capturing sensitive information such as user names, passwords, and customer data, such as credit card information.

Fortunately, vendors are working to provide smarter and better antispyware tools to help protect against these digital sneak attacks. I recently took ten enterprise antispyware operatives and put them through a series of real-world tests to see how good they are at intercepting malicious programs and protecting end-users computers and sensitive company information. Participating companies included: Computer Associates, Eset, F-Secure, LANDesk, McAfee, Sunbelt, SurfControl, Tenebril, Trend Micro, and Webroot.

Enterprise Ready?
Last year, I reviewed two of the first enterprise-geared anti-spyware apps -- Tenebril SpyCatcher 3.0 Enterprise and CA eTrust PestPatrol Corporate Edition 5.0 -- and saw just how far products on the market were from being truly enterprise-ready. The latest versions of both applications are included in this year’s roundup, and I’m happy to say that both -- and just about all of the others reviewed -- can truly be considered for the enterprise. Deployment, management, and reporting are all easily managed from centralized consoles, and all of the products scale easily into the thousands of installed seats.

All but one of the products integrates easily and thoroughly with AD (Active Directory), as well as simple workgroups. By hooking AD, admins can directly access domain PCs and more easily push installations and updates to clients. All of the anti-spyware products come with centralized reporting, again some better than others. Trend Micro creates very nice looking -- though static -- HTML reports, whereas LANDesk Security Suite includes one of the most flexible and powerful reporting systems in the roundup.

Agent deployment was one area where the vendors shared a common theme; they all support the push delivery method. Further, all the products allow for either .exe or .msi distribution via scripting or software distribution tools. An area where the solutions vary greatly is in how managers interact with installed clients. F-Secure does a great job of allowing an administrator to view protected PCs and manage policies and definitions, but it doesn’t have a way to start an on-demand scan of a client.

Real Time Makes a Real Difference
Support for real-time protection also varies among vendors. McAfee’s, Trend Micro’s, and Tenebril’s versions allow the malware to install, but prevent it from executing, thus leaving it installed but neutered until a removal scan is started. Others, such as Sunbelt CounterSpy, block most malware installs while missing others, and, like Trend Micro, remove existing traces on next scan. F-Secure did the best job of preventing initial installations, blocking all spyware and malware attacks.

To be fair, the real-time protection offered by all of the products tested is far and away superior to what was available just a year ago -- and absolutely better than using nothing at all. Real-time protection must achieve the same effectiveness we expect from our anti-virus protection: it must be capable of blocking the installation from ever occurring. Simply watching for a process isn’t enough; it needs to be eliminated, either out of the HTTP stream or as it is being installed.

All of these solutions provide scanning and cleaning services both on-demand (aside from F-Secure) and on a schedule, all from the admin console. Not all client-installed agents allow the end-user to initiate either a scan or clean task. In fact, the products from Computer Associates, SurfControl, Tenebril, and Trend Micro don’t even show an icon on the system tray or have a way for an end-user to interact with the agent. Scan and clean events are usually going to be scheduled by the administrator, but it would be nice to allow users the choice of launching their own scans.

Since my previous review, all of these anti-spyware products have also matured insofar as managing product and definition updates. All of them centrally manage definition updates, acting as a single distribution source. LANDesk Security Suite 8.6 goes one better by allowing clients in the same subnet or workgroup to download updates in a p-to-p fashion even before looking to the central server, and Spy Sweeper designates distributors, special Spy Sweeper clients in different subnets, to help share program and definition updates.

Click for larger view.

For my tests, I used a list of nine Web sites and URLs that are sources of malware, spyware, and viruses, and all were effective and convincing in their delivery. Two of the sites actually showed step-by-step how to install the ActiveX control they were trying to deliver. To make sure I tested each product the same way, I scripted my browsing experience using Macro Scheduler 7.3, by MJT Net. For the products that did not include anti-virus protection, I installed Norton AntiVirus Corporate Edition 7.6 and updated it with the latest definitions. My test PCs and servers were a mix of Windows 2000 Server, Windows XP Pro, and Windows 2003 Server Standard.

Computer Associates eTrust PestPatrol Anti-Spyware Corporate Edition r5
One of the most established brands in anti-spyware, Computer Associates eTrust PestPatrol comes with an updated detection engine and a smaller memory footprint. PestPatrol’s Active Protection (the company’s real-time implementation) is very weak, and reporting is nearly as bad. It does, however, provide good scanning and cleaning capabilities, and its UI is the easiest to use.