NWA-PCUG Newsletter Article, October 2010
Free Online Scanners Detect and Remove Malware
By Ira Wilsker, APCUG Director;
Columnist, The Examiner, Beaumont, TX; Radio & TV Show Host
iwilsker@sbcglobal.net
(click to email author)

WEBSITES:
http://quickscan.bitdefender.com
http://www.eset.com/online-scanner
http://onecare.live.com/site/en-us/default.htm
http://onecare.live.com/site/en-us/center/howsafe.htm

In recent weeks I have written about a variety of utilities that can detect and remove malware from an infected computer. Some of the utilities can be downloaded and installed, and run as necessary to detect and remove any malware that may have penetrated the primary security software that was installed on that computer. Other utilities discussed previously in this column are portable and could be run from a flash drive to detect and remove malware, while still others are intended to remove stubborn malware by utilizing a bootable CD that has the anti-malware software installed on it. One of the simplest and most popular ways to detect any malware that may have infected a computer is the free online scan, provided by several of the security companies.

For many years I have been using TrendMicro's Housecall (housecall.trendmicro.com) as a tool to check if a computer is infected, but like all other online scanners, Housecall requires a functional internet connection. TrendMicro recently released Housecall version 7.1, which will run on most browsers, including Internet Explorer and Firefox, and on any Windows system with at least Windows XP installed. While 32 bit versions of Housecall have been available for years, Housecall now has versions explicitly for 64 bit systems running Windows 7-64 or Vista-64. When using Housecall, the user needs to select a build by clicking on "Download HouseCall 7.1 (32-bit)" or " Download HouseCall 7.1 (64-bit)". Housecall will download and install a small web based launcher (1.4 mb) that is a "Stand-alone, browser-independent implementation (which) eliminates compatibility issues associated with browser-activated scanners." The user can select a quick scan which utilizes a "targeted scanning of critical system areas and active threats, reducing scan times to within a few minutes." I typically do a quick scan as one of my first tasks when cleaning a computer. A full scan will be much more comprehensive, but take much longer; a recent scan I performed on a Vista laptop took over an hour, but most recent full scans I performed were completed in as little as 15 minutes. The new version 7.1 of Housecall also allows the user to selectively scan chosen folders (Custom Scan), which may be a time saver, but will only check the selected folders, possibly missing some malware; this is precisely why I prefer the slower full scan. As is the current technological rage, Housecall uses cloud computing as the source of malware signatures, greatly improving download times and processing speed, while always using the absolute latest malware information. In addition to detecting and removing viruses, Trojans, keyloggers, and other common threats, Housecall can even detect and remove the difficult to find rootkits, as well as other sophisticated threats.

The well respected security vendor BitDefender offers one of the fastest online scanners, that will detect, but not remove active malware. It is often important to quickly know if a computer is infected or not, and that is precisely the service offered by BitDefender. The scanner offered is BitDefender Quick Scan which runs from the browser, and is compatible with most major browsers, including Microsoft Internet Explorer, Mozilla Firefox and Google Chrome. Quick Scan will run on Microsoft Windows 2000, XP SP2, Vista, and Windows 7. This Quick Scan is very fast, often completing a scan in about one minute. One major advantage of BitDefender Quick Scan is that you can use it without having to uninstall your existing data security product." The online scan engine is always up to date, as it is updated automatically each time it is run. The BitDefender Quick Scan is invoked simply by clicking on the "Start Scan" button, which connects the computer to the "cloud" where other very fast computers do much of the work. There are no malware signatures to download, as they are maintained and constantly updated in the cloud, and all actual scanning is done by the remote servers in the cloud; this is why BitDefender Quick Scan does not drain system resources on the computer, and can run so quickly. One other reason for the speed is that, "QuickScan only detects viruses which are active in memory or present in files that are run at system startup. Inactive virus bodies are not scanned for and therefore not detected." To perform a thorough scan, and remove both the active and inactive malware components will require a scan with another scanner. I use the Quick Scan as a very fast check to determine if a computer is infected, and if so, then I determine the subsequent action.

ESET has a complete free online scanner and malware remover " ESET Online Scanner" at http://www.eset.com/online-scanner. It is browser based, and will run on Microsoft Internet Explorer 5.0 or later, Firefox, Opera, Netscape, and Safari, and is implemented with a single mouse click. Only requiring a paltry 32mb of memory, ESET Online Scanner will run on Microsoft Windows 7, Vista, XP, 2000, and NT, and supports both 32 bit and 64 bit platforms. ESET Online Scanner uses a graphical user interface (GUI) that is intuitive and easy to use, and detects both known and unknown forms of malware, viruses, worms, Trojans, phishing and spyware. ESET performs a deep scan which also looks inside archived and packed files for malware. The user can select a full scan, or only selected files or folders. This scanner can detect and neutralize hidden rootkits, one of the latest and most difficult to detect types of threats. Rather than deleting infected files, all compromised files are moved to a quarantine folder where they no longer can threaten the security of the computer, but can be later repaired, restored, or deleted permanently. For those concerned with privacy, the scanner is used anonymously, and does not require any registration in order to use the free service. I have used the ESET Online Scanner several times, and found it to be a capable and effective free online scanner; it would be a good choice for anyone who wants to check his computer for all forms of malware, and remove anything that may have penetrated his existing security.

Microsoft also offers a free online scanner, and being a Microsoft product, has a large and loyal following. Windows Live OneCare Safety Scanner is available at onecare.live.com/site/en-us/default.htm. This online scanner uses many features that are in common with Microsoft's free full time security product, Microsoft Security Essentials. Windows Live OneCare Safety Scanner is a multi-function utility that can detect and remove malware, but also clean junk files on the hard drive, and tune up the computer, improving PC performance. Initiated by clicking on the "Full Service Scan" button, this utility it designed to "... help ensure the health of your PC." While intended to be used with Microsoft's Internet Explorer browser, Microsoft has posted special instructions for using it with Firefox. Users of Firefox must install the free Firefox add-on " IETAB add-on" (link provided by Microsoft) which adds an Internet Explorer tab to Firefox that allows utilities designed explicitly for Internet Explorer to run on Firefox. There are also special versions of the Safety Scanner that are required for Vista and Windows 7, which are also linked from the Safety Scanner website. For those who do not want to clean their hard drive, or tune up their computer, the Safety Scanner can selectively perform scans, including the "Protection Scan". To scan the computer for malware using the Safety Scanner, the user should go to onecare.live.com/site/en-us/center/howsafe.htm and click on "Protection Scan". The other scanners can also be individually selected from the menu on the left margin of the page. While not as sophisticated or as fast as some of the competing online scanners, Microsoft's Windows Live OneCare Safety Scanner is capable of detecting and removing most malware, and is a useful utility to check a computer for infection and clean whatever malware is detected.

Other free online scanners are available from Kaspersky, F-Secure, Panda Software, a-squared (Emsisoft), SUPERAntispyware, McAfee, Computer Associates (CA), and Comodo. While free, the Kaspersky and McAfee online scanners do not remove malware, only detect it, and require their respective paid versions to remove the malware so detected. The other products listed will all do a credible job of detecting and removing malware, and are viable alternatives to those discussed here.

An online scan is by no means a substitute for having a comprehensive, full-time, on demand security utility installed and frequently updated, which provides continuous security. The online scanners should be used to frequently check to see if security has been breached by malware, which is a good practice since the installed utilities can only detect about one-half of the total threats in circulation, but are typically quite good at protecting from the most common threats. Still, many of the contemporary threats are designed to penetrate traditional security defenses, or are so called "zero-day" threats that spread faster than the security companies can update their software. Since most online scanners utilize always updated cloud systems, they can provide a level of detection lacking in the installed scanners, and are a valuable adjunct to any security system.

Personally, I perform an online security scan with a variety of online scanners from providers other than the publisher of my installed security suite on a regular basis. I do this just to provide that little bit of an edge searching for threats that may have penetrated my layered and redundant security system. It would be a good idea for you to do the same. A little time invested now may save a lot of grief later.

Click here to return to top



==================================================================