Monday, 25 July 2011 09:00:30 (US Mountain Standard Time, UTC-07:00)
We have taken a look at Ashampoo programs before, and have been impressed with the performance. However, the problem has always been that the programs aren’t free. In fact, they usually cost upwards of $30. Granted sometimes there are promotions, but the Ashampoo antivirus programs have been conveniently left out of them. Anyways, come along to today and I found out that Ashampoo has released their first free antivirus called Virus QuickScan. The program is an on demand scanner that attempts to detect threats via the cloud. The unfortunate part about the scanner is that it doesn’t have a real time shield and needs to be run every time one wants to detect viruses.
The installation of Ashampoo Virus Quickscan was easy because there really isn’t one. Simply download the executable and start the scanner. The download is a small 1 megabyte in size and the installation less install means that it can be transferred to computer to computer for fast scans.
Ashampoo appears to scan for direct malware traces and processes. While these are the most common and troublesome areas for malware infection, it seems to leave out file based scans. The first scan scanned 53,164 malware traces and 243 processes. The program also looks for cookies but I deleted them all before the scan and zero were detected. Once the scan was finished, there was an option to Clean/Protect. The link launches the browser and actually starts at an Emsisoft URL . It appears that Ashampoo utilizes a form of Emsisoft technology in their scanners and therefore is an affiliate of Ashampoo. Unfortunately, to remove malware one has to install the trial version of Anti-Malware.
The full system scan finished in a quick 37 seconds and didn’t detect any malware on the test system. There is a handy log file which displays what was scan and where the items that may have been detected are found. The initial launch of the program starts the “Ashampoo_virus_quickscan.exe†process which uses 6.7 megabytes of RAM. Once a scan is started, the process uses anywhere from 12 to 23 megabytes of RAM and about 13 percent CPU usage.
I think Quick Scan needs some improvement before it can be recommended. The problem is there are many other free antivirus that offer more functionality. It needs more features like a built-in cleaning engine, the ability to scan the registry, and perhaps trusted files based scanning. However, it’s a start and I hope to see more free programs from Ashampoo in the future.
Wednesday, 18 May 2011 18:31:28 (US Mountain Standard Time, UTC-07:00)
Brigade is a relatively new antivirus that is based in Indonesia. Some of the main features of the program are how lightweight it runs, USB flash drive scanning capability, a fairly extensive virus database of over 6,000 items, a USB flash drive guard, and Windows 7 support. Even though the interface may be slightly lacking in the appearance department, it’s nice that it includes more features than the average free antivirus.
The installation of Brigade Antivirus 2011 was straightforward. The program download was only 2.8 megabytes in size and came inside of a .rar file. Amazingly, the setup only required a total of 11 megabytes which makes it one of the smallest around. After the setup was finished the program quickly started. Unfortunately, there is no option to auto update the antivirus from the free version. One will have to upgrade to the Pro version for this capability.
Brigade 2011 offers three scanning modes, the scan all drives, scan USB flash disks, and the custom scan option. The surprising thing is that the scanner is fast and indicative of a well designed engine. The program scans at approximately 5 megabytes per second and about 10 files every second. If one’s curious as to what exactly Brigade 2011 is scanning for simply head over to the check database option. There the publisher has painfully classified each of the virus detected in addition to whether they are Trojan horses, backdoors, adware or viruses. Briefly looking through the list I found conficker, sality, and other up to date virus definitions. Brigade detected four viruses on the test system. They appeared to be false positive shortcuts which were identified as harmful.
In addition, to virus scanning, Brigade 2011 offers a real time shield and also a heuristic protection known as sniper. There is a quarantine, but the detected virus never made it inside. The toolkit 1.0 allows one disable the windows firewall and show hidden files. There is also a ping utility to check network connectivity. Unfortunately, some of the English translations aren’t exactly accurate.
Resource usage is excellent with Bridge antivirus. The program uses approximately 15 megabytes of RAM and about 11 percent CPU power when scanning. When idle, the CPU usage returns to zero and the program utilizes the same about of memory.
Wednesday, 06 April 2011 17:33:58 (US Mountain Standard Time, UTC-07:00)
ZenOK has recently released their 2012 version. While a couple of websites report only a few minor changes in the new version, I found some additional ones. The updated program now includes a new installer, security toolbar, tutorial wizard, excellent resource usage, automatic updates, and a slightly modified GUI. Also, according to Wilders Security Forum, the latest version uses a form of the Bitdefender scanning engine. So one can expect good virus detection capability.
The installation of ZenOK 2012 went well. The download was 44.4 megabytes in size and started immediately on the Windows 7 test system. The setup file now automatically detects potentially conflicting security software and offers the capability to remove it (detected Panda Secure Vault). However, the publisher has also added an option to continue without uninstalling the detected software (handy and not included on most of the free antivirus tested). The installer then prompted for a required restart. After this was completed, the program displayed a new helpful tutorial outlining how the program works. The program also starts an initial scan and automatically updates. Finally, the program prompted to automatically backup important files.
Unfortunately, ZenOK 2012 only offers one scanning option in addition to the real-time shield. The “antivirus full scanâ€, scans at approximately 10 megabytes per second which is faster than the average antivirus. The scanner also reported that it was scanning at an average of 160 files per second which is a two fold increase from the previous 2011 version. The scanner detected one potential threat item located at C:BootBCD which was labeled as “file locked†. While this is a false positive, it’s nice that the program brought this file to attention. However, one problem with the antivirus system in general is that all services can be stopped via task manager. This could make it relatively easy for a virus to disable the antivirus.
In addition, to the scanner ZenOK 2012 has full cloud backup system installed. I think more free antivirus need this type of feature because most viruses are detected after they have already wrecked havoc on a machine. With the option to backup files, important files are protected on ZenOK’s servers and cannot be accessed by a virus. If a virus corrupts a file, simply download an uninfected copy from the cloud. Some additional features allow one to snooze the real time shield for a predefined time and also a full quarantine.
Resource usage is now one of ZenOK 2012 strong points. The program uses about 2 megabytes of RAM while idle (still actively scanning). During a full system scan, the program uses approximately 30 megabytes of RAM and about 6 to 10 percent CPU power. These numbers are well below the benchmark free antivirus.
 Some things that could be improved are the antivirus self defense and more configurable settings. I also noticed that the scanner paused by itself at times but, I couldn’t reproduce it more than once. The program could also have support for more languages and have slightly faster scanning when opening new explorer windows.
Saturday, 02 April 2011 14:35:58 (US Mountain Standard Time, UTC-07:00)
AVZ Antiviral Toolkit is an advanced malware removal tool that is sponsored by Kaspersky. The program can detect and remove all forms of malware including viruses, adware, spyware, hack tools, and riskware quickly. The main purpose is to give the user the capability to find obscure malware and remove it. While the interface may not be the prettiest, the software has an update utility (definitions released as recently as March 31) and 288,197 signatures. AVZ also uses advanced heuristics to check for suspicious services and TCP stack entries. Surprisingly, the program even includes a real time shield.
The installation of AVZ was simple. The download size was only 5.88 megabytes and comes in a zip file. When extracted the program uses approximately 6.5 megabytes of hard drive space and doesn’t need to be installed; simply run the main executable. Given the functionality, it’s clearly a tightly coded program when compared to the standard free antivirus. I updated the program after the install (a ridiculously small 800 kilobytes in size) via the File menu, Database update option.
AVZ Antiviral Toolkit has several scanning and removal options. For each of the detectable malicious items listed above, one can have it remove, report, or ask the user. The scanner also looks at running processes, heuristic system check, and can also search for vulnerabilities. As far as automatic removal goes, I would precede with caution given that the program inherently has false positives because of its heuristic system. To just scan active processes (essentially a quick scan) do not select a drive and click start. This scan finished within in about 1 minute and scanned 300 items. I then tested out a scan of the local C drive. The scanner is unfortunately kind of slow and accesses the hard drive at about 4 megabyte per second. This is slower than the benchmark free antivirus and also Kaspersky’s own scanners (4 times slower). However, scanning is really quite in-depth. The scanner looks at suspicious open ports (an IDS system), detects suspicious keyboard hooks (keyloggers), attempts to detect rootkits via API hooks, scans for suspicious system drivers, analyzes the Winsock stack, checks for dangerous services (found Remote registry and remote desktop services enabled), verifies if disk autoruns are enabled, checks for administrative shares, whether anonymous access is enabled and more. The heuristic sensitivity can also be modified via a convenient slider. AVZ Antiviral Toolkit didn’t detect any specific malware on the system but highlighted risky areas. One will have to a do a bit of digging through the log file to find what was detected. There is also the option to run the standard or user created scripts to automate scans etc.
 The real treats of the program are the tools which number about 50. A neat feature is the disk inspector in which one can take a previously scanned log and run a comparison of the system at a later date to show which files were modified. The system analysis area is like HijackThis on steroids and outputs a handy html report with tons of system information. The system restore option can reset all critical areas of Windows including unlocking the registry editor to repairing DNS. The services and drivers manager can do an analysis via the registry to enumerate all known entries (great for finding rootkits). There is an IE extensions manager, printing system extensions, protocols and handlers, and windows explorer extensions manger etc. Basically, if one has malware AVZ Antiviral Toolkit can help one find it and is the most advanced I have seen.
Resource usage is on par with most on demand scanners. The program uses approximately 72 megabytes of RAM and about 12 percent CPU power.
The technology in AVZ is excellent but the interface has problems. If the publisher could package this program in a new interface, it would be great.
Tuesday, 29 March 2011 11:55:07 (US Mountain Standard Time, UTC-07:00)
Ikarus is relatively new and is widely used in Austria. The program has a real time shield that is VB100 and PC Security Labs certified. The engine also protects against spyware and is even used by Emsisoft A2 in their software. There has been extensive testing in which users credit the antivirus with having excellent detection rates. However, some users’ state that the program has higher resource usage (evident in tests). The program offers several different scanning options, scheduling, and frequent updates.
The installation of Ikarus Virus Utilities went well. The setup file is a tiny 15.5 megabytes in size. The only problem is that by default the installation is significantly outdated (late 2009) and required a time consuming update (the program folder increased to approximately 175 megabytes and the update took about 25 minutes to download with a broadband connection). The installer detects conflicting security software via registry entries. However, some of the software detected was actually uninstalled months ago. After the installation, the program immediately launched.
Ikarus Virus Utilities offers four different scanning settings, the entire computer, fast system, system partition, and a removable media scan. The unique thing is that the program displays an approximate time to completion for each scan. For the fast scan, Ikarus stated that it would take approximately 10 minutes to complete and it actually turned out to be relatively accurate. The program scans at a brisk 8 to 10 megabytes per second which is faster than the average free antivirus. The scanner didn’t detect any viruses on the test system and scanned an impressive 89,948 files. It seems that the scanner automatically goes into a background mode once the scan is minimized. I detected a slight slow down on the test system when a folder with a large amount of files was opened. In addition to the pre defined profiles, one can create scan profiles that can include a wide range of folders and start at a specific time period.
Ikarus Virus Utilities is generally a pretty barebones antivirus and includes a only a handful of features. There is email scanning but it only seems to support Outlook. One can customize where the scan report is placed within the email and if attachments are scanned. There is a quarantine which offers a few unique options in addition to a simple restore and delete functionality like most free antivirus. One can temporary unblock a quarantined item which allows it to function until the next reboot. There is also the option to save a backup of the file(s) and delete the original virus. Settings are kind of sparce, there is the option to configure a dial up connection, create file and folder exclusions, restore the default settings, and unfortunately not much else. However, it’s nice that there are 12 languages supported from Chinese to Turkish.
The resource usage of Ikarus Virus Utilities is mediocre. While idle, the GuardX service used approximately 102 megabytes and the tray icon, 4 megabytes. Thankfully, during scanning, the memory usage only increased by about 5 megabytes and used about 5 to 10 percent CPU power.
I would like to see a few improvements in future versions, including the ability to pause a virus scan, interface improvements (I sometimes had difficulty canceling a scan), more settings to modify the scanner, and better logging formats.
|
|
