Win32 Virus Removal

When did you last see a 3.5" diskette? Those dinosaurs of storage are rare now, replaced by the ubiquitous USB thumb drive. But if you can find a 3.5" diskette (and a drive to read it) you can copy Webroot SecureAnywhere Antivirus ($39.95, Direct) onto it and have plenty of room to spare. The installer takes less than 600 KB on disk, as does the installed program.

Antivirus installers typically run from 50 to 100 megabytes and install dozens of files that occupy perhaps twice that much space on disk. Bitdefender Antivirus Plus 2012 ($39.95 direct for three licenses, 4 stars), while quite effective, took nearly a gigabyte of disk space, so much that I had to delete programs from my virtual machine test systems to make room for it.

How can Webroot be so tiny? The answer is twofold. First, its handling of malware is almost entirely cloud-based. It uses only the tiniest local database of especially virulent threats. Second, the product was totally rewritten using the most economical coding practices possible.

Origins
The cloud-based behavioral detection featured in this product came from Webroot's acquisition of Prevx last year. In an impressive show of confidence, the company discarded the existing Webroot antivirus engine, relying strictly on the Prevx code.

Principals from Prevx moved over to Webroot along with the acquisition, including the company's senior software engineer Joe Jaroch. Jaroch's team wrote the entire user interface and local client using the unadorned C language. No libraries, no objects, not even any resources like button and checkbox controls. Everything you see is rendered directly to the screen. As Jaroch likes to point out, a bitmap screenshot of the main window occupies more space on disk than the program itself.

Because this product is brand-new, the independent labs haven't had a chance to test it. There's no point in reporting on existing lab results, as they refer to a completely different product.

Lightning-fast Installation
This tiny program installs very quickly. As you might imagine, installing this compact program takes just seconds. Enter your registration code, click "Agree & Install," and in seconds it's installed and running a scan. On my infested test systems the initial scan finished in about five to fifteen minutes, depending on how badly infested the system was. On a totally clean system, it finished that scan in less than two minutes.

I asked the Webroot representatives whether the next step would be to launch what they call a "deep scan." They responded that the initial scan was the deep scan, that no further scanning is needed. Needless to say, I was impressed.

I started my testing before Webroot's back-end virus-cleanup server was active. That didn't matter for most of the test systems, but two of them really needed the cleanup server to remove widespread virus infestations. I put those on hold until the back-end systems were entirely ready, at which time Webroot scanned and cleaned them without incident.

Very Good Cleanup
After running all the full scans I happened to leave one of the test systems running. Coming back to it, I noticed it had run another scan and found more traces to remove. It turns out that the product's behavior-based detection catches some threats immediately, but may need to monitor others for a little while before it detects the behaviors that let it flag them as malicious.

To better emulate a real-world scenario I gave all of the infested systems a little more time, rebooting each and letting it sit for an hour or so. Webroot found a number of additional items to clean up and noticeably improved its scores.

Webroot detected 94 percent of the threats, the best detection rate among products tested with the current sample collection. Panda Cloud Anti-Virus 1.5 Free Edition (Free, 3.5 stars) previously held that record with 91 percent. Webroot scored 6.9 points for overall malware removal, quite a bit better than Panda's 5.9 points. Norton AntiVirus 2012 ($39.99 direct, 4.5 stars) didn't detect as many threats, but better removal earned it 7.1 points, the only score higher than Webroot's.

Webroot detected 100 percent of the threats that use rootkit techniques to hide from antivirus, as did about half of the 2012 products. Its score of 7.3 points is beaten only by Norton's 8.9.

Like most current products, Webroot detected 100 percent of the scareware threats. Norton and Malwarebytes' Anti-Malware Free 1.51 (Free, 4 stars) removed all the scareware completely and earned a perfect 10 points. Webroot scored a decent 8.8 points for scareware removal; AVG Anti-Virus Free 2012 (Free, 4 stars) and several others beat that with 9.5 points.

For an explanation of where these numbers come from, see How We Test Malware Removal.

It's important to remember that Webroot works differently from almost all of its competition. Except for a very tiny collection of signatures for specific problem viruses, it relies totally on monitoring process behavior and correlating that behavior with data from its immense cloud database. That same behavior monitoring lets it identify which other files are owned by the threat. I'm quite impressed that it can manage a top-notch cleanup job without the baggage of a signature database.

This entry passed through the Full-Text RSS service — if this is your content and you're reading it on someone else's site, please read the FAQ at fivefilters.org/content-only/faq.php#publishers. Five Filters featured article: A 'Malign Intellectual Subculture' - George Monbiot Smears Chomsky, Herman, Peterson, Pilger And Media Lens.