Classes Of Anti-spyware Products

CLASS: Signature-Based Scanners
Known spyware programs are tagged with a signature to allow for future detection. Signature-based scanners maintain a log of these spyware program signatures and are then able to identify and block these files from dropping on a computer.
PROS: Signature-based scanners are highly accurate and offer a low rate of false-
positives. They “clean” a computer by tagging portions of a spyware program’s code so it can be identified and removed.
CONS: Signature-based scanners can only identify spyware programs that have been tagged with a signature. Thousands of new spyware programs are created daily, making it extremely hard for vendors to keep updated. Detection is reactive and might come too late to provide protection.
CLASS: Heuristics
Heuristics are generally used to supplement signature-based scanners by searching for suspicious code that might indicate a file is spyware.
PROS: Heuristics assist the signature-based scanners to identify spyware by scanning code for suspicious instructions that may have transformed spyware programs and made them undetectable by a current signature.
CONS: Heuristics are not as reliable as other forms of security and will often trigger false-positives, incorrectly tagging a file as infected. The effectiveness of heuristics in detecting unknown malware is uncertain.
CLASS: Behavioral Blockers
Behavioral blockers, or HIPS, identify spyware by monitoring a system’s performance, as opposed to a program’s code. If a program attempts an action associated with spyware, such as modifying host files or browser settings, the behavioral blocker will identify it and stop the program.
PROS: New spyware programs cannot modify code to evade detection because behavior blockers don’t rely on signatures to identify spyware. They detect spyware by blocking common malicious program behaviors without the need for signatures.
CONS: Behavioral blockers rely heavily on the judgment of the computer user, asking confusing and frustrating questions to determine if a blocked program is spyware. This poses a problem for the average home computer user, who doesn’t have the expertise to differentiate between good and bad software.
CLASS: File Blocker
A File Blocker detects all programs trying to perform a computer function and treats all of them as threats. It will not allow any of these to load on a computer without first getting the user’s permission.
PROS: File Blocker Technology is proactive. It doesn’t rely on signatures for detection of spyware and it will not burden users with alerts or ask confusing, technical questions.
CONS:File Blocker Technology does not “clean” existing spyware off a computer. It stops all program files – good or bad – requiring the user to suspend protection in order to download a program from the Internet.

  AURA  1.4

[ Home ] [ Submit ] [ Advertising ] [ Contact Us ] [ F.A.Q. ] [ Privacy Policy ]

Copyright © 2006 The Nets Greatest