Product Reviews

Webroot's AntiSpyware uses adaptive recognition techniques to find and remove spyware and rootkits even when they've managed to infiltrate themselves into the OS itself.

Webroot also includes a number of software components (Smart Shields) that operate whenever an activity occurs that might indicate malware. General system protection is provided in a number of areas. The Windows Registry is protected by the Start-up Shield, which blocks unauthorised attempts to write Registry keys, while the Windows File System is protected by the On-Access Shield, which prevents known or suspected malware programs from reading, writing or executing any file or process. Any executable file can be added to the list of prohibited programs, giving a further level of control over which programs can be run. NTFS's Alternate Data Streams are included and provide no hiding place for malware. System memory is also scanned at startup and at intervals throughout the day.

The Internet Communication Shield can prevent access to websites known to host malware, while another shield will remove any unwanted tracking cookies. Internet Explorer is a favourite target. The ActiveX Shield can block malware installation through ActiveX controls, while

ADVERTISEMENT

another shield tracks Internet Explorer's security settings to prevent unauthorised additions. It also prevents the installation of helpful toolbar extensions, as these may also have been modified. Even the local hosts file can be a source of problems, and Webroot monitors the state of the hosts file to prevent unauthorised changes.

Although the array of malware detection and prevention features is impressive, their effectiveness is considerably improved when antivirus functions are added. Instead of simply being a standalone component, the antivirus engine is combined with several shields to prevent the installation of malware in the first place. This close integration extends Webroot's functionality to include Sophos' proven antivirus capabilities and avoids the problems that can occur when separate antivirus and antispyware products operate on the same system.

Installation is straightforward. The software uses a central server as a software and signature repository. Large networks can use one or more satellite servers to distribute the software to each client, while smaller networks can simply use the central server. Once installed on the central server, Webroot can examine the network and identify the clients either directly or through Active Directory. The client software is then pushed out to each system. When everything is up and running, the clients report back to the central server, which produces a summary dashboard display of the network's status. And when laptops and other remote systems, not always connected to the network, connect to the internet at any time the software will automatically download the latest updates from Webroot's servers.

Webroot's range of detection tools combined with Sophos' antivirus technology provides a comprehensive defence against malware of all kinds.