Gizmo's Support Alert Newsletter Issue 138, 19th October, 2006.
Can't give link as it is in my mail box...
2.3 A Free Anti-Spyware Program with Active Protection
Ad-Aware and SpyBot Search and Destroy have long been the
mainstays in the free anti-spyware utility category but, alas,
their stars have fallen in the last year as these once great
products have been overwhelmed by the latest generation of
malware products. Hopes for another solution were raised when
Microsoft bought out Giant's excellent Antispyware product and
released it for free. However, these hopes were dashed when
Microsoft changed the Giant product into Windows Defender. It
was no enhancement; in fact, a step backwards. So I've been
keeping my eye out for a new contender, particularly one with
good active protection to prevent initial infection. One such
product is Spyware Terminator [1]. I've known about it for quite
a while but have approached it cautiously as there was a cloud
hanging over the reputation of the vendor [2]. Thankfully, that
cloud has now been lifted. Installation proved to be very simple
as the product has an excellent configuration wizard that walks
you through the setup. One option offered is the capacity to
harness the open source anti-virus product ClamAV to provide
another layer of detection in addition to Spyware Terminator's
only inbuilt detection. This is a nice idea; ClamAV is not the
most effective AV scanner on the market but it's certainly
competent and the additional protection can only be a plus. The
Spyware Terminator (ST) user interface is very clean and
professional, a complete cut above the amateurish look of
products like SpyBot S&D. Perhaps the most impressive aspect of
ST is its comprehensive active protection. Over fifty different
system variables are monitored in four separate areas.
Additionally, there is a built-in HIPS system that works in a
similar manner to products like WinPatrol to prevent programs
starting up on your PC or making changes without your
knowledge. A nice feature here is the ability to set the HIPS
warnings to a level appropriate to user experience. Other HIPS
products could do well to offer a similar feature.
Unusually for a free product, ST allows you schedule scans
automatically. Updates, too, can be set to automatic.
Scanning proved to be on the slow side. A full spyware scan
took 896 seconds to scan 21000 objects while Windows Defender
took only 503 seconds to scan 78000 objects. A combined Spyware
and AV scan took even longer.
I tested spyware scan detection rates on a limited sample of 110
currently circulating malware products obtained from P2P
networks. ST detected around 31% by scan and 49% on execution
compared to 34% and 56% for Windows Defender and 42 and 71% for
the class-leading product WebRoot SpySweeper. The sample size
here is too small to get pedantic but it would be reasonable to
say that ST approaches Windows Defender in performance but is a
distinct notch below the top commercial anti-spyware products.
This conclusion needs to be qualified. ST has a much stronger
HIPS capability than Windows Defender and this provides
additional protection for experienced users who now how to
interpret and respond to warning messages. Less experienced
users will benefit less.
In the technical area ST was less impressive. It can be easily
terminated using basic methods; Windows Task Manager was
sufficient. It doesn't detect rootkits, can't detect process
injection, it doesn't scan within archives and can only handle a
limited number of compressed executable schemes. Mind you, most
other anti-spyware products perform badly in these areas as well.
Where ST does shine is active protection against hostile web
sites. Here it is the HIPS that is carrying the main load but
the result is impressive. ST protected my PC against infection
at my three standard hostile sites, easily outperforming most
other anti-spyware products with the exception of SpySweeper.
In conclusion, Spyware Terminator is an excellent free spyware
scanner with useful auxiliary anti-virus capabilities. Its
active protection is well ahead of the other major free anti-
spyware products: SpyBot, Ad-Aware, and Ewido Free. Its
detection rates are good, just a notch behind Windows Defender
but well ahead of Ad-aware and SpyBot. It does not, however,
approach the rates achieved by the top commercial anti-spyware
products.
So do I prefer it to Windows Defender? For users of older
Windows systems it's a non-question as Windows Defender will not
work on these systems. Windows 2000 and XP users do, however,
have a choice. I'd have to say at a technical level I think
Spyware Terminator's HIPS gives it the edge however this is
offset in my mind by lingering concerns over how a high-support
product like this can remain viable as a free product.
Freeware, Windows 98 and later, 2.3MB
[1] http://www.spywareterminator.com
[2] http://www.spywarewarrior.com/rogue_anti-
spyware.htm#spyterm_note