|
|
 ewido anti-spyware 4.0 By Neil J. Rubenking
7/25/2006 11:07:00 AMIn April, Grisoft acquired ewido networks and its main product, ewido anti-spyware. Version 4.0 is the first post-acquisition release. But although it has a new user interface and a number of added features, I just can't recommend it while there are other apps that cost the same and do a much better job.
Like Grisoft's AVG antivirus, ewido comes in both a free and a more powerful paid edition. The product runs under Microsoft Windows 2000 or XP and claims tested compatibility with 80-odd antivirus products. New users of the free edition get the full product's features for the first 30 days.The utility's main page displays program status and has handy links for scanning the system, updating antispyware definitions, or changing settings. You can choose from four predefined scans or create a custom scan profile, but the product is speedy enough that I wouldn't recommend anything less than the Complete System Scan. It scans inside archives, compressed executables, and NTFS Alternate Data Streams and attempts to detect unknown malware using heuristic techniques. The paid version, but not the free one, can now schedule scans, which you can set to run daily, every other day, weekly, or monthly at a particular time of day or following start-up after a specific delay. Oddly, you can schedule custom scan profiles, but nothing else. So to make one of the four predefined scans happen at a set time, you have to duplicate it as a custom profile. You can set the utility to suppress a scheduled scan if a game or other full-screen application is running, and you can tell ewido to ignore a missed scan until the next scheduled time or to catch up as soon as possible.The Resident shield feature, available only in the paid version, offers some degree of real-time protection against malware. It scans files on execution, looks for malware in memory, and protects itself against attack. But its architecture doesn't come close to the elaborate layered protections of Spy Sweeper or Spyware Doctor, which watch for home-page hijacking, protect the HOSTS file, and rebuff attempts to change the start-up sequence. The software will, however, provide a list of quarantined files and (new in this version) a list of exceptions—files that should be ignored in future scans.Tech-happy users can dig into the system using the Analysis page, which lists running processes, active connections, and programs that launch at start-up. If something looks suspicious, you can kill a process, terminate a connection, or remove a program from the start-up sequence. It also offers detailed data about browser plug-ins and LSPs (Layered Service Providers, software tightly woven into a computer's networking services), with an option to remove unwanted plug-ins. A bonus Tools tab pulls together a number of Windows settings related to security and Internet connectivity and also offers secure file deletion.The 12 minutes ewido took to scan a clean system was more than Spyware Doctor or Spy Sweeper required on the same system, but completely acceptable. But then I subjected it to my usual torture testing, with abysmal results. It never requested a restart to complete spyware removal, but in a number of cases it blandly reported error while quarantining without suggesting any remedy. Grisoft admits the current product is not geared to handling keyloggers, and indeed, out of eight commercial keyloggers in my test set, ewido completely missed four and recognized but failed to remove three others. And while it does a dandy job of detecting spyware, recognizing 15 of my 16 spyware samples, it successfully removed just four of those. It left behind executable files and other significant traces of the rest. Some allegedly removed threats showed up as running processes in Task Manager. Others continued blithely popping up unwanted advertising windows, even after ewido had supposedly quarantined them. Not good!Being a smaller player does have some minor benefits. One of my spyware samples actively attacks certain antispyware products; I had to run Spyware Doctor, Spy Sweeper, and ZoneAlarm in Safe Mode to scan the system containing this sample. And since OneCare won't run in Safe Mode at all, it was effectively defeated by this direct attack. Ewido suffered no such attack. Conversely, it made no attempt to remove this threat.When I tried installing the same collection of threats with ewido running on a clean system, its Resident shield protection was rather more successful than the scanner. It still wasn't strong against keyloggers, totally missing three of the eight and unsuccessfully trying to block three others. It didn't exactly block installation of the other two; rather, it damaged the installation sufficiently that they couldn't function. Close enough! Challenged to protect the system against my spyware samples, ewido finally showed some backbone. Out of sixteen samples, it smacked down nine the moment the installers tried to launch. Three others managed to install quite a few files and Registry traces, but ewido killed off the executable files, I gave it credit for blocking all 12. It totally missed two and didn't succeed at blocking two others.You'll shell out the same $29.95 for the paid version of ewido as you will for Spy Sweeper or Spyware Doctor, but it performs terribly by comparison. The Analysis and Tools pages are fun for tweakers, but they don't make up for a product that fails at its main task. I've seen the free version recommended for use as a "second opinion" scan. But the free version only offers on-demand scanning and removal, with no real-time protection, and spyware removal is the product's weakest point. Until Grisoft beefs up ewido so it can reliably clean an infested system, I don't recommend using it.More antispyware reviews:
• Webroot AntiVirus with AntiSpyware 6.0
• VIPRE Antivirus + Antispyware 3.1
• a-squared Emergency USB Stick
• Ad-Aware 2008 Pro
• AVG Anti-Virus Free 8.0
• More
|
