Countering spyware

New to this release of Security Suite is LANDesk’s Trusted Access technology, which helps LANDesk identify and quarantine infected client PCs. It also works with Cisco NAC and other third-party access control systems for better end point management. LANDesk does not include anti-virus protection, but it will manage and make sure Symantec, McAfee, and Trend Micro anti-virus engines are up-to-date.

Free IT resource Virtualization Insights from Top Experts - Learn how virtualization gets real! Sponsored by Dell Free IT resource TechNet: More ways to know it, share it, and keep it running. Sponsored by Microsoft Return to special report DOWNLOAD PDF Click here to download InfoWorld's special report Anti-spyware

Real-time protection was better than average, allowing only one piece of adware to slip through and blocking all others. It ran well alongside Norton AntiVirus and behind the Windows XP firewall. When malware is found on a client PC, it -- like Trend Micro Anti-Spyware for Small Business -- takes two passes to clean a system. The first job is to detect the malware; the second is actually to clean it from the PC. To test LANDesk’s cleaning ability, I created a repair task based on the spyware detected on my client, and set it to run at a specific time. Like clockwork, the repair job ran and removed the spyware from my PC. Security Suite uses 17MB of RAM on a client and 20MB with 35 percent CPU utilization during a scan or repair operation.

LANDesk’s reporting system is one of the best available. There are scores of predefined reports, and each one can be customized and saved for reuse later. I like that I can save my reports as HTML, Microsoft Word and Excel, PDF, and even rich text. Reports include categories such as spyware detection, vulnerabilities, and security compliance.

For anyone already familiar with LANDesk Management Suite, the capabilities of LANDesk Security Suite should come as no surprise. Security Suite is a truly enterprise-class management tool with good spyware protection and terrific reporting, but for the untrained it offers a confusing and unintuitive administration interface.

McAfee VirusScan Enterprise 8.0 with Anti-Spyware Enterprise Module 8.0
The latest release of McAfee VirusScan Enterprise sees the addition of Anti-Spyware support bundled tightly with it. Part of the overall McAfee enterprise family of products, VirusScan with the Anti-Spyware module scales to exceptional heights and provides one of the most robust platforms to secure the enterprise. Its real-time virus and anti-spyware protection are only average, but its reporting is the best of the group.

Installation of VirusScan on my Windows 2000 Server went smoothly. VirusScan and the Anti-Spyware module are all managed through McAfee’s ePolicy Orchestrator (ePO). This provides a single console for all of your McAfee enterprise products, and even some non-McAfee products.

Using the Getting Started Wizard, I went through the process of creating a VirusScan deployment task to get agents installed on my Windows XP PCs. Then, I was able to create and update policies based on directory, groups, and PC. Admins have to import AD information into ePO; ePO doesn’t directly support Active Directory.

Policy creation in VirusScan is similar to that in LANDesk Security Suite: easy if you know what you’re doing. After I understood how the policies are nested and what to do, management went from seemingly impossible to just laborious. Also like LANDesk, the number of configurations possible and the true enterprise scalability of ePO means spending some time understanding how everything works together to get the most out of it.

Real-time protection for VirusScan stopped all of the viruses cold but did allow a couple of crafty adware pieces through. Much like the real-time protection in Trend Micro Anti-Spyware for Small and Medium Business, VirusScan waits for a write operation to inspect the file. Although it was able to stop most of the attacks, it didn’t stop them all.

To check VirusScan’s cleaning ability, I created an on-demand scan job and launched it from ePO. The scan located and cleaned the pesky programs and returned the system to a clean state. One nice feature in VirusScan’s cleaning utility is its capability to mark a file for removal later; for instance, during an overnight scan. This feature helps eliminate system hangs during a clean operation or a pesky reboot in the middle of a workday.

VirusScan’s resource usage was on par with most other products, chewing up about 62MB of RAM at rest, and 78MB and 98 percent CPU utilization during a scan-and-clean operation. In fact, one time the system became so unresponsive during a scan that the only way I could regain control was to power-cycle the system.