Countering spyware

The browser-based administration UI was well-organized and very easy to navigate. Administrators can use the Network Explorer view to push-install client computers, create reports for one or all clients, and initiate on-demand scans with a single click.

Free IT resource Virtualization Insights from Top Experts - Learn how virtualization gets real! Sponsored by Dell Free IT resource TechNet: More ways to know it, share it, and keep it running. Sponsored by Microsoft Return to special report DOWNLOAD PDF Click here to download InfoWorld's special report Anti-spyware

Like the other products tested, SpyCatcher had no trouble enumerating my computers in Active Directory or across other Windows domains. Unique to SpyCatcher is the way it organizes your PCs into predefined groups in the Status Explorer view. I found this especially helpful when trying to identify PCs with out-of-date definitions or that did not have the agent installed.

Policy definition required little effort, due in part to the limited number of choices available. SpyCatcher does break out the various forms of malware into a number of groups, and administrators can define the action to take on detection for each group. For instance, I set SpyCatcher to quarantine everything but cookies, port scanners, and packet sniffers; these SpyCatcher just entered into the alert log. Admins can create multiple policies to meet the security needs of the network.

SpyCatcher’s real-time engine does not block the malware from entering the system; rather, it watches for its behavior when it’s in memory. There it quickly kills the application and keeps it at bay until the next full scan. I saw this process in action, and although it let the process execute, it ended the task almost immediately. In reality, because there is a delay before the application terminates, there is a chance that a malicious program could sneak off with personal information. I would like to see this real-time protection be more proactive and stop the intruder before it is in the front door.

The re porting engine gets the job done, but it has room for improvement. Reports are available in PDF or CSV (comma-separated value) only, and other than choosing a date range and report type, there is no other customization available.

SpyCatcher’s resource usage on a client PC was about average out of all products here, and, like all others, swelled to nearly 60MB and 95 percent CPU utilization while doing a scan. Admins cannot set thread priority during a scan, so make sure scheduled tasks take place after work hours.

SpyCatcher is easy to use and deploy, and it did prove resilient in cleaning spyware from my test systems. Given that this is a beta release, I expect some things, such as lower resource usage, to change before it is generally available. In future releases, I would like to see the real-time protection step up and keep the bad stuff out.

Trend Micro Anti-Spyware for Small and Medium Business 3.0
Trend Micro is one of the top anti-virus companies in the world, so it was a natural progression for the company to put together an anti-spyware product. Through technology obtained through the acquisition of InterMute in May 2005, Trend Micro has assembled what could be one of the better anti-spyware products for the enterprise — when a few kinks are worked out. Real-time protection is only average, but scanning remediation is among the best. Another solution with a browser-based administrative UI, TMAS (Trend Micro Anti-Spyware for Small and Medium Business) was easy to install and configure.

Like CounterSpy Enterprise and CA eTrust PestPatrol, TMAS is an anti-spyware point product -- it does not provide built-in anti-virus services. TMAS worked well alongside my Norton AntiVirus installation and didn’t complain about the Windows XP firewall. I had no trouble installing it on my Windows 2003 Server and pushing installations out to Windows XP Professional clients. The browser-based administration user interface is well-designed, and I found it very easy to navigate.

The network discovery portion of TMAS found all of my Windows domains and correctly listed all member computers. Installation of the TMAS agent was as simple as selecting a client PC from the list and clicking the Install button. A very easy-to-read Desktop Status window showed each client’s vital statistics, such as its status, last contact with the server, and the version of the agent running on it.

Creating various test policies took little time, simply because there weren’t that many choices to be made. Unlike in F-Secure Anti-Virus Client Security, most options are simply on or off. Options such as whether to do a quick scan or deep scan, whether to scan on startup, and if the policy should run on a schedule are all available.

Real-time protection, called Active Application Monitoring, works along the lines of Sunbelt CounterSpy. It doesn’t actively stop the malware from entering the system but allows it to save to disk and execute. Active Application Monitoring watches memory for specific processes, and, when detected, it terminates them before they can continue their dastardly deeds. In theory, this is fine, but as with CounterSpy, I saw a lag time between infection and termination, with one piece going undetected even after a scan and clean.

TMAS uses two small processes to monitor and maintain your client, using only about 21MB of RAM when idle. During a cleaning pass, a third process starts, and total RAM usage goes up to about 64MB, but CPU utilization stays around 50 percent. This is due in part to Trend’s dynamic CPU throttling. It will back off CPU usage when it sees other activity on the system, allowing for midday scans with minimal impact on end-user performance.