NWA-PCUG Newsletter Article, April 2008
Evaluating Your Anti-Spyware Program
by Vinny La Bash,
Member of the Sarasota Personal Computer Users Group, Inc.
vlabash(at)comcast.net (click to email author)

Obtained from APCUG with the author's permission for publication by APCUG member groups.

For many years the most acute danger to your computer was some kind of destructive virus. Today the danger has shifted from software that is programmed to destroy files, corrupt programs, and disable systems to something more insidious, and perhaps even more treacherous. This threat comes in two broad categories known as Spyware and Trojan Horses.

Spyware started out as a stealth program surreptitiously installed on your system to track your web surfing habits. The developers of spyware didnít want to damage your computer. They wanted only to sell you something. That may be annoying, but there is nothing criminal about it.

A Trojan Horse is a program that pretends to be something other than what it really is. For example, a screensaver could be designed to install a program that will take over your system to forward spam to other machines. Trojan Horses have been used to initiate denial of service attacks, where the target such as a bank, credit card service or other high profile web site becomes so saturated with external requests that it cannot respond to legitimate traffic.

When selecting an anti-spyware program, start out by selecting one with a comprehensive signatures database. The best anti-spyware programs have databases that can recognize more than 750,000 different kinds of spyware and Trojan Horse programs. Read the documentation or call the company. This is important.

The best signatures database wonít do you any good if it isnít updated frequently. The bad guys never seem to rest. They release new poison daily. Donít buy any solutions that require manual updates. You have better things to do. Insist on automatic updates.

Another important capability is active monitoring of your system. Wouldnít you rather prevent a malicious program from installing rather than removing it after the damage has been done? Avoid any program that removes infections found only after conducting a manual scan. This probably means avoiding some otherwise adequate free programs. Thereís an old saying about getting what you pay for. The best anti-spyware programs prevent spyware and Trojan Horses from ever being installed on your system.

Go for a program that allows you to customize your scans. We donít all use our computers in the same way. Some people require more comprehensive scans than others. If you are constantly browsing the internet, you are likely to benefit from a daily scan that checks active memory, system folders, the registry, and all hard drives. If you rarely use the internet or find yourself visiting the same six sites over and over, a weekly scan may be all you need.

You should be able to schedule unattended updates and scans. Your machine should be yours to use as you wish. Any decent anti-spyware program should be able to run in the background unattended, and not require interrupting your activities. The program should work according to your preferences, not the other way around. Choose a program that permits unattended maintenance and administration.

Itís also important that an unattended scan can quarantine infections without requiring intervention from you. Why do some anti-spyware programs ask if you want to remove infections? Of course you do! Of all the features in anti-spyware programs, that is the dumbest.

There are innumerable derivations and iterations of spyware being created. This makes it difficult for even the best anti-spyware programs to catch and destroy them. If you open the Processes tab in Windows Task Manager, you will observe the Process Manager in action. You will see a list of objects running on your system. Some of them are applications like word processors. Others are mysterious entities that donít provide a clue as so what they do, but you canít run Windows effectively without them. Among them would be Windows Explorer, Internet Explorer, Media Center, Windows Mobile Control Center, and many others.

Beyond shutting down a process or resetting its priority, there isnít much a non-specialist can do with this feature. Clever programmers can create spyware that wonít show up in the Process Manager. Any decent anti-spyware program has to have its own built-in process manager that will recognize, track down, and eliminate malevolent software that may not even be in the signatures database.

Anti-spyware programs should be able to monitor programs that load when Windows starts up. There are many very sophisticated spyware programs that to not show up in the Process Monitor or in Control Panelís Add/Remove section. If your anti-spyware program lacks this capability, find another one.

Assuming your anti-spyware program has the capabilities mentioned above, it is an excellent choice for individuals. However, businesses or organizations with multiple computers will require even more. Whoever is in charge of PCs will not have time to manually monitor or administrate individual machines. It is simply impractical in a large organization for support staff to visit every workstation, apply updates, schedule scans, and ensure that infestations are removed. If this applies to you, look for a program with a centralized administration console. This capability has the unfortunate drawback of being quite expensive, but the time saved generally justifies the cost.

This article has been provided to APCUG by the author solely for publication by APCUG member groups. All other uses require the permission of the author (see e-mail address above).

Click here to return to top