NWA-PCUG Newsletter Article, January 2012
Free, Supplemental Malware Scanning in the Cloud
By Ira Wilsker, Radio Show Host,
Columnist, College Professor and deputy sheriff
(click to email author)


It never ceases to amaze me how many computers continue to get infected by malware, despite being protected by reputable security software. While the major free and paid security products generally offer excellent protection from malware, none are absolutely invulnerable to the latest threats, which may allow an otherwise well protected computer to be compromised by the latest creations of cyber crooks.

I frequently hear something like, "The salesperson at (big box store) told me that this (name brand security package) was the best on the market, and that it offered absolute protection from all threats." For the word "salesperson" above, other users have substituted "husband", "the boy next door", "that lady on the radio", "the geek at work" or some similar real or self-described security expert who recommended some particular security product. While generally well intended, and often based on positive personal experience, it should be noted that in heavy penetration testing using the latest varieties of malware, virtually all of the major security products can be and are often penetrated by malware.

While almost all major security products implement a variety of techniques to protect against unknown malware, so called "zero day" attacks have been especially successful in penetrating most security utilities. Most of us have security software that is frequently updated with the latest collections of the digital signatures that have been detected and analyzed by the security companies; these frequent updates, which we may often see taking place, give us a sense of security that our protective software is busily at work protecting us from all of the evils that can threaten our computing safety. While we may be incrementally more secure with each of the frequent updates, we are typically vulnerable to the very latest threats prowling the net for victims.

A traditional analogy about security software updates is to our daily newspaper; today's newspaper in the driveway is actually yesterday's news; likewise today's security update may include malware discovered yesterday, but will not likely include new malware that just started circulating. These security updates are more often "reactive" and generally not "proactive". Some of the published tests of the updates of the major security software indicate that it may often take hours, if not days, for newly detected malware to be analyzed and countered, before the updates are pushed to the user. An update just received may be for threats discovered several hours ago, leaving us little or no protection for new threats that appeared since the previous threats were detected. With thousands of new cyber threats appearing daily, sometimes at a rate of over a thousand per hour, the security companies are often overwhelmed with the sheer volume of new threats encountered. A silent "truth" of the security industry is that each of the new threats is evaluated as to the degree of threat, and those that are evaluated a "low" may not be analyzed further and thus not incorporated into the next data update. A related issue is the speed in which malware can spread around the globe; some of the most malicious malware can spread globally in just a matter of minutes, implying that a recent security update, released prior to the endemic spread of a malicious new form of malware, will offer no protection from that new malware, leaving us open and vulnerable.

Another type of threat that we are often vulnerable to is the "zero day" threat. According to Wikipedia (en.wikipedia.org/wiki/Zero-day_attack), "A zero-day (or zero-hour or day zero) attack or threat is an attack that exploits a previously unknown vulnerability in a computer application, meaning that the attack occurs on "day zero" of awareness of the vulnerability. ... Zero-day attacks occur during the vulnerability window that exists in the time between when a vulnerability is first exploited and when software developers start to develop and publish a counter to that threat." Since these threats are spread prior to detection and the implementation of protective measures, they may easily infect and compromise otherwise well protected computers. Many of the recent zero day threats are also designed and written to target known weaknesses in specific brands of security software, thus rendering them helpless in stopping these attacks.

When malware infects an otherwise protected computer, it often neutralizes the installed security software, opening the computer to a coordinated follow-on attack. It is well documented that some of the better malware authors make enormous profits selling access to the computers that they have compromised, allowing identity thieves and other cyber crooks roaming access (for a fee) of the purloined machine. The victim is typically unaware, as their trusted security software gives no indication of the attack (it is often effectively dead, in terms of protection), but to the user, still appears to be alive and well, even looking like it is still completing its periodic updates. If the user performs either a scheduled or manual security scan using the unknowingly deactivated security software, the malware infection will not be detected. This is precisely why it is often vital to perform frequent security scans with unrelated third party security software.

I have written frequently about the assortment of updated portable security software that I carry on a USB flash drive on my car keychain, and of several third-party security products that I typically install on every computer that I work on. In recent months a new breed of third party security scanner and malware removal utilities have started to become popular. These new security products, which are generally free to use, are using cloud based technologies to perform fast and effective security scans. Being cloud based (on powerful internet servers) allows this new breed of security scanners to include in their threat databases a much larger number of potential threats than the databases typically included on PC based security systems. The threat data in the cloud is continuously updated, minimizing the threat gaps common in the PC based systems. Two of the free, cloud based scanners that I recently experimented with and found effective were Comodo Cloud Scanner and Panda Cloud Cleaner.

Comodo Cloud Scanner (http://www.comodo.com/home/internet-security/cloud-scanner.php) was extremely fast, in that it seemed to scan my hard drive faster than any of the other scanners that I have used. In addition to effectively scanning and removing viruses, worms, trojans, and other malware, Comodo Cloud Scanner can also detect junk files, suspicious items in the registry, and hidden processes that may be running on your computer, a possible indicator of an active malware infection. This utility can also detect and alert the user of privacy issues and threats, and can identify traces of private information on the hard drive that may possibly be waiting for retrieval by a cyber crook. Combining the power and features of two of Comodo's popular desktop utilities, Comodo Internet Security and Comodo System Utilities, this Cloud Scanner connects to Comodo's servers to run the scan, rather than consuming the processing power of the PC, allowing it to run much faster. Since the cloud servers are continuously updated with the latest threats in real-time, the security scan is performed with the latest available threat library, greatly increasing the chance of detecting threats missed by the installed security software. Comodo Cloud Scanner will run on all 32bit and 64bit builds of Windows XP, Vista, Windows 7, Server 2003 and Server 2008. As with all of the other on-demand scanning utilities, this is not a substitute for a full time security suite, but instead an adjunct utility to verify protection, and to detect any malware that may have penetrated the installed security software.

The other free online cloud scanner that I experimented with was Panda Cloud Cleaner (pandacloudcleaner.pandasecurity.com). According to its webpage, "Panda Cloud Cleaner is an advanced disinfector based on Collective Intelligence (scanning in-the-cloud) that detects malware that traditional security solutions cannot detect." Once downloaded and installed, this utility has a very clean interface that requires no complicated configurations; simply clicking on the large "SCAN" button will start the process. As are most other cloud scanners, Panda Cloud Cleaner is very fast, as the actual scanning is done online on Panda's cloud servers, rather than by the computer itself. Since the data files on the cloud servers are continuously updated, the latest digital signatures are always used during a scan. In addition to scanning all types of files for malware, Panda also scans the registry for any additional indications of malware infection. Upon completion of the comprehensive cloud scan, Panda will present the user with a list of findings and threats which can be immediately neutralized. As with most of the other cloud scanners, Panda Cloud Cleaner is explicitly designed to coexist with the other security software installed on the computer, and will not interfere with it.

Both of these cloud based scanners do a very credible job performing a security scan which can detect any malware that may have penetrated the installed primary security software. If a major malware infection is found by these cloud based utilities, it will likely be necessary to reinstall the original security software that was on the computer, as it had likely been compromised. Both Panda and Comodo cloud utilities can be installed and run alongside the existing security software without interference. Neither product offers continuous protection (there are other cloud based products that perform that task), and are strictly on demand scanners, only active when manually run by the user. These products are not a substitute for full time protective security software. In practice, both are very fast scanners, primarily influenced by the size of the hard drive being scanned, and the speed of the internet connection. The actual files on the hard drive are not uploaded to the cloud for analysis, only a digital signature of those files is sent, thus personal data is not sent to the cloud by these utilities. While both utilities offer excellent malware detection and removal, the Comodo Cloud Scanner product also performs other necessary maintenance tasks in addition to malware scanning.

It would be a wise "good practice" to install either (or both) of these free utilities and periodically verify the integrity of the computer's security system by detecting any malware which may have penetrated the protective screen. If a material problem or threat is found, the user can then take appropriate corrective action.

Click here to return to top