|
|
 ThreatFire 3.5 By Neil J. Rubenking
5/8/2008 3:33:00 PMLast year PC Tools acquired Novatix's Cyberhawk, a behavior-based anti-malware utility, and rereleased it under the name ThreatFire 3. The free edition offered only real-time protection; the paid Pro version added on-demand scanning. With the release of ThreatFire 3.5, however, just about every aspect of the program is now free for personal, noncommercial use. The new version adds a few brand-new features and is more effective than ever at protecting your system from known and unknown threats.
Commercial users who pay for the Pro edition get phone support, while those using the free edition must rely on e-mail and Web-based support. Also, in the free edition, turning off the "community protection" feature that shares found threats with PC Tools' researchers also disables automatic updates (you can still update manually). But that's about as far as the differences go.On launch, ThreatFire now goes straight to a worldwide detection map that lists the current top ten malware threats and top ten adware threats based on information from the PC Tools ThreatExpert database. Click a threat to see its worldwide distribution; click a link to dig into online details. Also new is an elaborate System Activity Monitor that displays running applications, noninteractive processes, programs launched at start-up, system processes and services, and more. An expert might use this monitor to research a suspected malicious process. Version 3.5 includes a new option that controls the program's default action separately for suspected threats, known malware, and known grayware (potentially unwanted applications).Banishing Bad BehaviorThreatFire doesn't use signatures to detect malware; instead, it very specifically looks for patterns of activity that suggest malware. After a process's actions rise above a certain threshold of suspicion, ThreatFire checks to see whether this constitutes a known threat. If so, ThreatFire kills and quarantines known malware automatically, notifying the user with a red alert. If what is found is a known process that may have some validity, like certain types of adware, ThreatFire displays a gray warning box and asks the user what to do.
The real power of the program, though, lies in its ability to identify malicious software strictly by its behavior, not by matching it in any database. If an unknown process's actions look malicious, ThreatFire displays a yellow alert. The alert reports the action that pushed this process over the threshold, its risk level, and the type of threat associated with this action. The user can choose whether to quarantine and kill the process or allow it to continue. For testing purposes I always chose quarantine and kill.Last year, when I tested ThreatFire 3's ability to block installation of malware on a clean system, it scored 8.6 out of 10 possible points—quite a good score. I tested ThreatFire 3.5 in the same way but with a newer and even nastier collection of malware. I didn't expect it to eliminate the malware installers "on sight" the way many signature-based products do. That's not possible, because it actually has to see the program in action to spot malicious behavior. I made sure I actively launched any executable files that did get installed, giving ThreatFire a chance to evaluate their behavior.At some point or other, either during install or during a malware file's execution, ThreatFire recognized every single one of the samples. Over half got the red warning for known malware or the gray warning for possibly unwanted applications; ThreatFire nabbed the rest based strictly on their behavior. In some cases, ThreatFire needed a little time or a reboot before it could gather sufficient evidence to indict a program. But in every single case it either blocked installation of all executable files or successfully eliminated them once they started acting up. That's a perfect score: 10 out of 10 points! No other product tested with this particular collection of malware has scored that high. On a separate test using commercial keyloggers, ThreatFire behaved a bit differently. It red-flagged only one as malware, and it completely missed two others, including one that hides its components using rootkit technology. All the rest got hit with a yellow alert for their sneaky activities. Overall, ThreatFire scored 7.3 of 10 on this test, better than Spyware Doctor with AntiVirus 5.5 and, in fact, better than all other programs tested against this particular malware collection except for Webroot AntiVirus with AntiSpyware and Firewall (WAVASF), which scored 7.7.But let's hold on a minute. "Catching" all the bad programs is easy if you don't mind catching good programs, too. False positives are the downfall of many behavior-based protection systems. The problem is, if you ID too many good apps as bad eggs, you're essentially crying wolf, and users stop trusting you. To get an idea of how ThreatFire handles valid programs that may be using some potentially dangerous techniques, I installed 15 PC Magazine utilities that hook deeply into Windows. These utilities snoop port activity, modify the start-up sequence—even install a keyboard hook—but ThreatFire held its fire against all but one of these potentially tricky cases. It zinged Link Previewer, a browser enhancer, displaying a yellow alert to report an attempt at changing the browser's security settings. That's not so bad, though. If you're installing a known good program and you get a warning based on behaviors you know are part of the program, there's no real worry.—Next: Spotty RemovalSpotty RemovalThreatFire is designed to work alongside a signature-based antivirus/antispyware program, handling unknown threats that the signature-based scanner can't recognize. Nonetheless, it does include an option to run a quick or full scan of the system, doing its best to remove malware, rootkits, or both. You can even schedule a daily, weekly, or monthly full scan. My testing showed that ThreatFire does its best work protecting a clean system, not cleaning up one that's already trashed.
I installed ThreatFire on test systems infested with a variety of malware, including adware, spyware, rootkits, Trojan horses, polymorphic threats (those that use different names for file and Registry traces every time they install), and rogue antispyware. In some cases, the product's real-time protection kicked in before I could even start a scan. I didn't try to distinguish real-time cleanup from on-demand scanning; I just looked at the final results. Installation went smoothly, for the most part. When malware interfered with the installer on one system, I requested help via the Web-based support system and quickly received an answer that solved the problem.The scan went fairly quickly—about 20 minutes on my standard clean test system. Not unexpectedly, it wasn't as effective as the dedicated signature-based malware scanners. It missed a couple of the threats completely and failed to remove all executable elements of quite a few others. In some cases, the allegedly removed threat was visibly still running. Allowing full credit for removal of all executables and half-credit if some were left behind, I gave ThreatFire a score of 6.5 out of 10 points. That's still better than SUPERAntiSpyware Professional 4.0, which got 6.3, but all other products tested using this same collection did better. On a separate test using commercial keyloggers rather than malware, ThreatFire scored 5.5, which is actually a better score relative to the competition. Avira Premium Security Suite 8 scored 3.2 on this same test, while avast! antivirus 4.8 Home Edition and AVG Anti-Virus Free 8.0 both scored only a little higher (5.9). Keep in mind, though, that malware removal is not the focus for a behavior-based product like ThreatFire, wherein achieving even a moderately good score can be considered success. Just remember not to rely on it alone for cleaning up a malware-infested system.—Next: Bonus Features Bonus FeaturesYou can't miss the new Worldwide Detection map: It's what you see first when you open ThreatFire's user interface. In a separate tab on the main page is a set of protection statistics reporting what the product has done for you and for other users. According to the statistics page, ThreatFire has checked over seven trillion actions and blocked over ten million threats.
In the Advanced Tools area you'll find the custom rules editor, as in the previous version. This feature is too complex for most users, and even advanced users will rarely need to create a custom rule. Advanced Tools lets you define specific situations in which ThreatFire should offer to block a program using the rare blue alert window.Possibly more useful is the System Activity Monitor, which lists all running processes broken down into applications, programs launched at start-up, system processes, and services. Choose an application from any of these categories and the details pane reveals a wealth of information: publisher, if available; whether it's from a trusted vendor; names of all windows belonging to the process; files created, deleted, and so on; Registry changes; network connections; modules on which this process relies for support; and more. An expert user might be able to learn something about an unknown process using this information. On the other hand, if a process is so slippery that ThreatFire can't determine whether it's malicious, these details aren't likely to help even a skilled user make that determination. Standard signature-based antivirus and antispyware scanners can be very effective, but only for threats that have been around long enough to have a signature. ThreatFire 3.5 monitors every process and analyzes its behavior, looking for patterns that suggest malware. It detects malicious behavior from both known and unknown threats. It aced my malware-blocking tests with a perfect 10 out of 10 points. You can't go wrong adding this free tool to your existing signature-based protection.More Non-Signature Anti-Malware Reviews:
• NovaShield AntiMalware 2.0
• BufferZone Pro 3.0
• ThreatFire 3.5
• ThreatFire 3
• Norton AntiBot
• More
|
