In today’s Internet world, protecting end-user PCs from the unknown is one of the most important things you can do. No matter how a system is compromised — be it a virus or a “drive-by” install of malicious code via a Web site — there is no end to the amount of irritation and potential financial damage that the user or company might suffer.
With most attacks zeroing in on identity theft, can you really take a chance?
The best way to defend PCs is to have some sort of anti-virus and anti-spyware protection — and real-time protection trumps traditional on-demand scans.
Real-time anti-virus protection has been around for years, but only recently have we started to see vendors roll out real-time analysis and detection of malware. Like its real-time anti-virus counterpart, this approach ensures malicious code is stopped before it ever lands.
Among companies packaging real-time protection against viruses and malware is Webroot Software. The recently released 5.5 version of Webroot AntiVirus with AntiSpyware and Firewall provides real-time and on-demand detection and remediation for virus and malware threats, and it boasts an easy-to-use user interface.
Resource utilization is minimal, and in my tests, there was no noticeable slowdown while browsing the Web. This package is intended for single users or small office installations; there is no administrative console or central management. Business users that need more administrative tools should look at Webroot AntiSpyware Corporate Edition with AntiVirus.
United front
The Webroot system comprises two separate yet complementary engines. Through its partnership with Sophos, Webroot is able to totally integrate Sophos’ anti-virus protection into its package, providing protection against all types of digital threats.
New to this release is the addition of behavioral detection in the anti-virus product; previously, only signature-based virus detection was available. Now even zero-day threats can be dealt with as the system monitors the overall behavior of the running processes and data streams.
I tested Webroot AntiVirus with AntiSpyware and Firewall on a Windows XP Pro PC with 512MB of RAM (both packages are Vista-compatible) and carefully monitored system resource utilization during all aspects of my testing.
Under normal operation during my tests, RAM usage averaged around 5MB and jumped up to about 90MB during full system scans. CPU usage during a full scan averaged around 25 percent with some spikes, but they were nearly unnoticeable when using the PC. The solution now supports Firefox in addition to Internet Explorer but is available for 32-bit operating systems only.
Webroot AntiVirus with AntiSpyware uses a number of shields to define the type and level of protection offered by the product. For example, the Execution shield monitors and protects the PC against executing applications, while the File System shield looks at each read and write to disk for suspicious activity. In all, there are 17 different shields organized into five groups protecting the various portions of the PC’s system.
To protect and serve
The Network Shields go a long way toward helping prevent infections. Here, Webroot will block access to common ad sites, lock down the HOSTS file, and most important, deny access to Web sites known to be sources of malware.
Webroot maintains the list of potentially malicious Web sites and updates it daily. When testing this feature, I tried to browse a lyrics Web site that Webroot deemed a threat. The solution prevented access to the site and displayed a warning as to why it was blocked.
The system does allow a user to access a site if he or she believes it was blocked incorrectly (at the user’s own risk, of course). In this release, there is no way to whitelist a specific Web site while blocking others, meaning that if a user returns to the same blocked site at a later time, he or she will have to go through the blocked/override process again.
When Webroot detects viruses or malware, the default action is to quarantine them. I found it very easy to manage the items in my quarantine and even rescued programs. Users can right-click a quarantined item and tell Webroot to ignore it on future scans. Another feature I like is that Webroot creates a list of scanned items, and as long as they haven’t changed since the previous scan, Webroot will skip over it, reducing overall scan times.
I tested all aspects of Webroot’s detection ability, trying to infect my test PC over the network and Internet. I attempted to compromise my system first by copying infected files from a network share, then by pushing files to a file share on the test systems. Both times Webroot either blocked the file as it was being copied, or when accessed, it prevented me from infecting my PC. This was true no matter how the virus was packaged: as a normal file or compressed inside a zip archive. Testing over the Internet involved malicious Web sites as well as virus-infected e-mails. In all cases, Webroot correctly denied access with no false positives.
Fight fire with fire
Webroot’s Desktop Firewall is available free of charge to Webroot customers, and it comes bundled with the AntiVirus with AntiSpyware package. Unlike a lot of other “free” utilities, Desktop Firewall actually comes packed with quite a few features, far surpassing Microsoft’s built-in firewall. There are customizable levels of protection, and it allows for different security profiles for home, office, and remote access.
It includes a learning mode that builds a baseline profile for CPU use, running processes and such, and works with the baseline to clamp down on unusual activity. Also included are real-time lists of running processes and port usage to help identify abnormal activity.
Webroot AntiVirus with AntiSpyware and Firewall is a very good value and offers a lot of first-rate protection for a very reasonable price. The real-time malware and virus protection work very well, and the quarantine service is easy to manage. I like how the various shields worked together to provide the overall security posture while still allowing a level of customization. When shopping for an anti-virus, anti-malware product for your home office or small business, don’t overlook Webroot’s offering.
