NWA-PCUG Newsletter Article, June 2008
ThreatFire Offers New Level of PC Protection
By Ira Wilsker, APCUG Director;
Columnist, The Examiner, Beaumont, TX; Radio & TV Show Host

Iwilsker@apcug.net
(click to email author)


WEBSITES:
http://www.threatfire.com
http://www.threatfire.com/requirements
http://www.threatfire.com/download

For over a decade, both on my weekly radio show and in this column, I have been harping on the need for all PC users to have adequate security software installed on their computers. Initially, in the early days of computer bulletin boards and the infancy of the internet, it was considered adequate to only have a good antivirus program installed, and updated every few days. Later, as bulletin boards faded and the internet started to mature as connection speeds increased, the need for a firewall became more apparent. As malware became more prevalent and evolved into an increasing threat, anti-spyware software became a requirement. Recently, the new threat of rootkits appeared a type of malware that traditional security software would not likely detect and neutralize. Now, as broadband speeds are the rule, and over a million malware threats are in existence, the contemporary triads of protective product suites (antivirus, anti-spyware, and firewall) are being overwhelmed by new classes of threats that the suites are ill equipped to deal with. These new threats which are appearing in increasing numbers and viciousness are appearing too fast for the traditional antivirus companies to deal with, and are generically known as “zero-day” threats.

Antivirus and anti-spyware software products are generally dependent on digital signatures in their respective proprietary databases. These signatures are typically “reactive” and not “proactive” in that they are created in response to a newly identified virus or spyware threat. This process of discovery, analysis, signature creation, and distribution may take from hours to days for each of the thousands of new threats daily to be distributed to the users of antivirus and anti-spyware software. Another analogy would be reading this morning’s newspaper; it may be dated today, but it is really yesterday’s news. The same thing happens when our protective software is updated; today’s update may be yesterday’s viruses and spyware, leaving us with little or no protection from the thousands of new threats appearing for the first time today. This may create a dangerous and false sense of security when we have just updated our security software with the most current signatures, and feel that we are protected from whatever may threaten us, when in reality we may be very vulnerable to the new threats that have appeared today. This new threat, for which no protection may yet be distributed, is the “zero-day” threat that may wreak havoc on our computers despite having reputable proactive software installed and frequently updated.

The well known security company PC Tools recently released version 3.5 of its product explicitly designed to protect from zero-day threats and other malware typically missed by traditional security products; this product is disseminated under the name “ThreatFire” (http://www.threatfire.com). Available in a “free for personal use” version and a $30 “Pro” version with a few more features and support, ThreatFire has proven itself as a valuable adjunct in the war against malware. ThreatFire is unusual in that it is not a replacement for our existing protective software, but a product that runs alongside our current software, enhancing its protective capabilities. In addition to providing real-time protection against zero-day and other known threats, ThreatFire also includes an on-demand scanner that will scan for viruses (using the proven PC Tools on-demand AntiVirus scanner), that will also detect and quarantine or remove rootkits, worms, Trojans, and many types of spyware. ThreatFire runs in the background utilizing minimal system resources, and does not significantly degrade PC performance. The ThreatFire installed on my computer periodically displays a small “balloon” over its icon near my clock, indicating that it has been automatically updated.

Instead of requiring the frequent updates that other protective software requires, ThreatFire monitors the processes running on the computer intelligently searching for unusual behavior patterns. If a suspicious behavior is detected, ThreatFire instantly notifies the user of the potential threat and allows the user to decide what to do based on the best available information. Much of this information is based on a massive international community of ThreatFire users, and utilizes data gathered from this immense community of knowledge and experience. It should be noted that participation in this community is strictly voluntary, and that no personal or identifiable information is shared with the community. The only information that is optionally shared is the threat that has been discovered, and the decisions made. My copy of ThreatFire 3.5 (free edition) has identified several suspicious activities, often while installing new software. The threat is identified and explained, and then indicates if others have encountered that same threat; a line in the display indicates statistically what the community did when that threat was encountered. For example, while recently installing XP Service Pack 3, ThreatFire detected an unusual behavior in several critical system files; the small window displayed and showed the rate by which the community responded to that same threat, mostly a 98% to 100% allowed the process to continue.

ThreatFire 3.5 was easy to download and install, and offers excellent protection using the default settings. While providing sophisticated system protection, ThreatFire does not require any special configuration or tweaking, and runs fine without any tinkering. Of course, there will always be geeks who want to play with new software and try and tweak it; ThreatFire obliges by allowing such tweaking through its menus, but I have found the nerdy tweaking to be unnecessary. ThreatFire will run on computers with Windows 2000, XP, 2003, and Vista (32bit). Published studies have indicated the additional levels of protection that ThreatFire provides over the major security software when run in conjunction with it. Market leaders Symantec (Norton) and McAfee demonstrated substantial improvements in detection and protection when ThreatFire is run concurrently with them. Symantec and ThreatFire combined provided 83% more detection and protection than the Norton Internet Security Suite alone, and McAfee showed an improvement of 15%. The CA (Computer Associates) Internet Security, provided by many broadband providers as their “free” security suite showed a 126% improvement when run with ThreatFire, and the Trend Micro Internet Security Suite showed a 243% greater rate of detection and protection with ThreatFire. These dramatic improvements were noted by PC Magazine when it awarded ThreatFire its coveted “Editors’ Choice Award”. PC Magazine stated, "ThreatFire 3's ability to block installation of malware strictly by identifying bad behavior is phenomenal. It did a better (and faster) job than Norton AntiBot and even beat out Spy Sweeper, our current Editors' Choice for signature-based anti-spyware. This free tool is an excellent addition to your security arsenal."

I currently have ThreatFire 3.5 (free version) installed and running on my computer, and recommend that it be installed on all compatible PCs. Additional protection without any significant degradation of performance is always a good idea. It does not matter if you have Symantec (Norton), McAfee, Kaspersky, Panda, Trend Micro, CA, or any other protection suite installed, you still need ThreatFire to run concurrently with it to greatly enhance your protection. I use it and feel much more secure having it installed and running. You should use it too.

Click here to return to top



==================================================================