Win32 Virus Removal

Yesterday's roundup article Lab Testing Antivirus Software triggered two interesting reactions. I got an e-mail message from IObit stating that "IObit Security 360 is an anti-malware application, not an anti-virus program, so it's unfair to compare it with other anti-virus products". And someone posted a comment to the article calling it "The worst and most unqualified reviews I've ever seen... IObit Security 360, Double Anti-Spy Professional are not antivirus programs, they are anti-spyware programs in fact. What a ridiculous test".

These comments reveal some serious misunderstandings about the various types of malicious software. Time for a refresher course!

In simplest terms, the word virus refers to malicious code that spreads by modifying other programs. Nothing happens until the user launches that infected program; at that time the virus code seeks out and infects more programs. Spyware refers to malicious code that steals your personal information. Right away we have a problem with consistency - a virus is defined by how it spreads while a spyware threat is defined by what it does. It's completely possible for the same threat to match both descriptions.

But wait, it gets worse.

A worm is similar to a virus, except that it spreads without needing a user to launch it. A Trojan, or Trojan horse, is a program that looks valid and useful but conceals a malicious payload. Rootkits hide all traces of their existence and malicious activity from Windows. Adware programs pop up unwanted advertisements. There are many different kinds of malicious software, and a single threat can match multiple categories. To cut through this confusion, we use the catch-all term malware for any kind of software that's designed with a malicious purpose.

So why do we still even use the word "antivirus" for software that protects against malware? In short, because you want us to. As this Google Trends chart shows, when you're looking for protection you almost always search for antivirus, occasionally for antispyware, and almost never for antimalware. But a modern antivirus should remove all kinds of malware and standalone antispyware-only tools are going the way of the dodo.

Now let's get back to those comments about the antivirus roundup. There's no reason to omit Double Anti-Spy Professional, given that it relies on the same full-scale anti-malware engines used in SunBelt's VIPRE Antivirus + Antispyware 3.1 and Agnitum's Outpost Security Suite Pro. In fact, Avanquest's chart that showed Double Anti-Spy soundly beating Spyware Doctor and Webroot was bogus because they compared their full virus/spyware protection with the lame-duck spyware-only versions of Spyware Doctor and Webroot. There's no doubt that Double Anti-Spy is intended to clean all types of malware, and in fact it made a decent showing in my tests.

As for IObit, the company's own Web site touts the product as "advanced malware & spyware removal utility that detects, removes the deepest infections, and protects your PC from various of potential spyware, adware, trojans, keyloggers, bots, worms, and hijackers" and "detects the most complex and deepest spyware and malware in a very fast and efficient way." Nowhere does it say the product specifically won't remove viruses, and nowhere does it recommend that you use IObit alongside your antivirus program for full coverage.

And here's the kicker: Viruses don't feature prominently in the collection of malware samples I use for testing. There's exactly one that I can identify strictly as a virus, and no other category. Eliminating that one from the results would not have raised IObit's score appreciably.

In my next round of security suite testing, I'm eliminating separate scores for antivirus and antispyware, as that distinction no longer makes sense. A security product that limits its protection to some limited subset of all possible types of malware just isn't trying hard enough.