Countering spyware

Where VirusScan Enterprise and Anti-Spyware shine is in the reporting capabilities. Rivaling only LANDesk in comprehensiveness, VirusScan uses Crystal Reports and allows administrators numerous ways to view activity on the network, from top infected machines to current outbreaks. Each report has a wide range of filters that can be applied to further create the specific reports needed. Each report is interactive, allowing an admin to click and drill down for more detailed information.

Free IT resource Virtualization Insights from Top Experts - Learn how virtualization gets real! Sponsored by Dell Free IT resource TechNet: More ways to know it, share it, and keep it running. Sponsored by Microsoft Return to special report DOWNLOAD PDF Click here to download InfoWorld's special report Anti-spyware

Enterprise administrators are always looking to eliminate or minimize the number of consoles they have to deal with on a daily basis. VirsuScan Enterprise and Anti-Spyware make excellent use of ePolicy Orchestrator, an awesome management platform. Its real-time protection is weaker than that of some others, but its scanning and cleaning abilities are right near the top. Management is inherently cumbersome due to all of the options available, but the excellent reporting engine makes ongoing monitoring much easier.

Sunbelt CounterSpy Enterprise 1.5
CounterSpy Enterprise 1.5 was one of the easiest products to deploy and configure, with all policy options nicely tabbed and logically laid out. Real-time protection was average, and follow-up scans proved to be effective at wiping any existing traces away. I found the Crystal Reports engine to be just as easy to use, but reports didn’t benefit from Crystal’s drill-down feature.

CounterSpy Enterprise is a pure-play anti-spyware solution that does not include client firewall services or anti-virus protection, although they are planned to follow soon. It does coexist well with the Windows XP firewall and Norton AntiVirus. Installation was straightforward and one of the easiest to complete. I installed the management console on a Windows 2003 Server and easily pushed the agent to my Windows XP Professional clients.

Policy creation is very intuitive and allows for quite a bit of flexibility. After a policy is defined, admins can add computers to it by searching the Active Directory or by viewing PCs in the local workgroup. As the policy attempts to update the selected PC, if the agent isn’t already installed, the Agent Deployment Wizard takes over and walks you through the process.

I like the simplicity of CounterSpy’s policy engine. It isn’t overwhelming, yet it provides enough granularity to meet most needs. For instance, I was able to define different thread priorities and options for quick and deep scans, as well as different run schedules. Each policy allows admins to specify how detected threats are handled, with different choices for real-time and on-demand scans.

Reporting is good, if not overly exciting. CounterSpy uses the Crystal Reports engine, which makes it easy to print and e-mail reports directly from the report viewer. Unlike McAfee ePolicy Orchestrator, CounterSpy doesn’t make full use of Crystal Reports drill-down features to filter displayed data. Also, admins cannot create custom reports; they are limited to the seven reports built into CounterSpy.

The update engine is streamlined and effective in retrieving and distributing new program and definition updates. Updates are retrieved by the management console on a specified schedule, and admins can force an immediate check. Each policy has its own settings for how often to check for updates, as well as an Update Now button.

CounterSpy’s agent installs five services on a client PC, with a small 16MB memory footprint. When a scan starts, however, memory usage swells to over 62MB. Real-time protection, called Active Protection, was much like Trend Micro’s; it allowed the malware to download and start running in memory, where it killed the process before allowing further execution. This process was not always 100 percent successful, and it allowed a couple of adware pop-up applications to launch. By design, Active Protection will stop a process from running, but it relies on a system scan to really remove the threat.

Quick and deep scans proved to be capable of eradicating leftover pieces of malware, with the deep scan checking more locations. On subsequent reboots, I never experienced a reinfection of any malware that slipped through the real-time protection.

CounterSpy Enterprise is one of the most intuitive and configurable anti-spyware products in this roundup. The reporting is good, if not flashy, and if its real-time protection were a bit more proactive, it would be hard not to make CounterSpy the top choice for enterprise anti-spyware protection.

SurfControl Enterprise Protection Suite -- Enterprise Threat Shield
SurfControl Enterprise Protection Suite -- Enterprise Threat Shield blocks not only known malicious software, but also any application defined as unwanted by the organization. Real-time protection was above average, allowing only one piece of adware to sneak through. The reporting engine is browser-based, and the whole system uses MSDE -- or your existing SQL installation -- for its data repository. Mobile users, meanwhile, only have some protection while disconnected.