|
|
|
Home::Malware
Two Wales - theory of fighting against spyware/malware/adware
Author : Joseph Boyd (Arovax)
Two Whales
"Two whales" are two basic ways of fighting against
spyware/malware/adware. In this short article we will tell you
about the "two whales" of mankind's confrontation with the
misfortune called "spyware". So, from this point on, talking
about spyware/malware/adware we will mean software which is
installed (launched) at a user's computer without the user's
knowledge, impedes their work and of which the user certainly
wants to rid themselves to return to their normal full life.
Whale One - protecting the territory
The first thing you need is to prevent the enemy from getting to
you territory. To locate it just when it crosses your border and
to destroy it. To understand how to do this, it's necessary to
learn all paths that the enemy can use to cross the border and
set there your traps. This method of protection is called
Real-Time Protection (sometimes you can also come across the
term IDS - Intrusion Detection Software). Many producers of
anti-spyware build real-time protection mechanisms into their
products to a greater or lesser extent. Such a mechanism tracks
key settings of the operating system and informs the user of any
attempt to modify them (Arovax Shield is one of
such products). Then the user decides if the modification should
be allowed or denied. However, there is one big drawback. Not
only spyware applications change these settings but normal
programs also do. If the software producer uses a signature base
and blocks only what is known to them, they risk letting through
a new, unknown enemy. If the software blocks all modifications
(like Arovax Shield
does), then the right to decide is passed to the user, but not
all the users deeply understand all system settings (and
besides, they do not have to). Probably, the best solution would
be a combined mechanism. At the moment when the system is
modified, you not only issue a notification to the user but also
indicate if the corresponding spyware is found in the signatures
base.
Whale Two - cleaning the territory
This is like a cold war. Both parties are constantly increasing
their military potential. Producers of anti-spyware software are
improving their fight methods while producers of spyware are
looking for new insidious ways to get in the user's PC and dig
in deeply. And it's not always that the formers outdo the
latters. And when the first frontier is broken and the enemy
crossed the border, the Weapon Number Two appears on the scene -
a spyware remover. Remover (or Cleaner) is the program which
will help to remove already installed spyware. First of all, it
includes a reliable scanner which will scan the user's computer,
detect saboteurs (the installed spyware) and eradicate them. The
most important thing at this stage is a good spyware base. The
more signatures it includes, the more the possibility to detect
the enemy.
Here are the mandatory components of such a product:
* Scanner which performs the PC scan and spyware
detection by the known signatures.
* Remover (or Cleaner) which is responsible for
eradication of the detected spyware.
* Quarantine. If a user is in doubt if the detected
spyware should be removed, they can place it in quarantine
before the removal and then remove. Later they will have the
possibility to restore the removed information.
* Ignore List. Sometimes the scanner detects something
that the user does not consider spyware/malware/adware or does
not want to remove. Then such records are placed on a special
list and will be ignored during the following scans.
Concerning selection of a spyware remover we recommend to pay
your attention not only to the availability of the above four
components but also to the quality of the signature base. A very
important issue is how quickly the producer responds to the new
threats appearance and updates the base.
(c) Arovax, LLC
Related articles
|
|
|
