The Writers Workbench: Anti Maim

Once upon a time, in the stone ages of the computer world, I had a tech friend who dismissed the idea of something called the "computer virus." None had ever been found, he insisted (this is how long ago we're talking), and they were just urban myths. As adamant statements of foresight go, this stands up with the Chicago Tribune's banner headline, "Dewey Wins!," on the morning of Truman's election.

Viruses exist in swarms and are significant problems when they hit, crushing systems with the maiming force of a rogue pack of Transformers. Happily, anti-virus programs have fought back, and as mature defenses have helped deal with the problem. Here's a look at one of the major names.

KASPERSKY ANTI-VIRUS 7

Kaspersky has long been among the leaders in anti-virus software. Its new version 7.0 has added a few wrinkles that, while not significant as a major release, offer solid benefits.

One of those improvements is how the program updates definitions, which are the heart of any AV program. Definitions are what tells the software what to look for. All paid-programs today offer some manner of automatic downloading updated definitions to keep your system current, a necessity since new viruses or adaptations of old ones creep into the wild regularly. As a result, the question of concern is no longer "does your program automatically update?" but how often. And that's one of the new features of KAV 7 that's perhaps most noteworthy: it now updates definitions every hour.

Another notable improvement is cosmetic -- but an important one: the GUI (or Graphic User Interface, basically the look of the program). KAV has had a makeover and for the better. Security alerts are laid out prominently at the top. The main page is now nicely divided into clearly-defined sections for things like "Protection" (what is being checked), "Scan," "Update," "Reports" and such. A click, and the proper section slides open. Equally important, within a section, the required information is laid out at your fingertips. (Earlier versions weren't as intuitive.)

For instance, under "Scan," the left side of the screen lists all the default scans (Full computer, critical areas, startup objects) - and when you click on any one of them, the right side provides the details. What will be scanned, when the last scan was, its status (running or completed), even when it anticipates the scan to finish, if currently running. Also, the information notes when you have it next scheduled to run a scan, and provides an easy link to change this and other settings.

The Settings are where Kaspersky shows its muscles, though for most people you'll want to leave the default settings as they are. But anyone who likes tweaking has plenty under the hood to work with.

You can tell the program how to deal with a virus when found, what to look for (by file extension or content, for instance - the default is by content, since extensions can be maliciously spoofed), whether to use heuristic analyzing and much more. Heuristics are the ability of a program to determine if a new, as-yet-undefined action is a virus by studying its characteristics.

One default setting here, however, may be worth changing for some people and isn't well-documented. That's for scanning attachments to email. By default, this is left unchecked under Protection/Mail Anti-Virus and then "Customize." Only when checking the Help button (or reading the manual, two things most people don't do, alas) does it tell you that if you don't have a firewall, you should check the box. It would seem better to have it protectively checked by default.

For the most part, the Help feature is very good. Clicking "Help" in any area of the program brings up a context-sensitive response. No searching for the proper topic is required.

All along the way, Kaspersky Anti-Virus keeps you well-informed with highly-detailed reports, letting you know every step that's been done, and if any errors have been found.

KAV also provides a detailed online Knowledge Base, where you can track down answers to most questions, as well as an easy link to their User Forums for asking questions and reading up on prior discussions.

The Help files are generally well-written, and the Knowledge Base often provides very nice, animated demos to show how actions are done.

A few quibbles here though -- a question I had about scheduling a scan of Startup Objects became bewildering. The Help File and manual both say that such a scan is automatic when booting your system. However, when leaving the "scheduled scan" box unchecked, your homepage information states that such a scan is "manual," raising the question of whether you're automatically protected or not. The User Forum had a discussion on the topic, which answered the question in part, though not fully. A contact through the PR department to a tech employee resolved the issue with a simple answer - the language is unclear. Whereas earlier versions of KAV provided a "Run on system boot" option, that clear phrasing has been dropped, and it's now called "At application startup," which isn't precisely the same thing. (One support oddity: the User Forums are set up for various languages, and you can select yours. But after doing a topic search, certain options mixed all languages together after selecting "Get active topics for this week", which needless-to-say became confusing. To be clear, this isn't its general operation during normal "non-search" usage.)

KAV scans your files, email and web usage, and now includes what they call Proactive Defense. This will analyze applications when they run and also protect your Registry for attempts to change it. (Guarding the Registry was a feature of version 6. It works well, popping up whenever it recognizes an unapproved task. Some may find it too aggressive, however, asking about normal procedures, but a simple click adds the questioned-program to a Trusted list. Of course, you can always disable Registry Guard, if that's your taste.)

Also, Kaspersky has added an excellent feature which allows the program to run in the background, if you choose. Because scanning can be a system-intensive process -- and because KAV is not the fastest program on the block -- allowing other programs you're using to have priority when running is a great option.

Another good, new feature will rollback your system to a previous database if your current definition database gets corrected. Since this makes a signification change, it would be nice if a protective "Are you sure?" window popped up before making the rollback, however.

Of course, with any anti-virus program, its ability to block viruses is the primary concern. Though tests can differ from real-world usage, independent testing services have nonetheless consistently rated it highest or among the highest. One worth checking out is the well-regarded AV-Comparatives.org, with particularly comprehensive testing and side-by-side results.

Other than the "Startup Objects" question mentioned above, there were a two additional issues worth noting.

When I installed KAV 7, the Setup Wizard didn't run, which is where questions are asked how you'd like the program to operate (what files you'd liked scanned, when scans should be scheduled and so on). These can all be configured after the fact, of course. And you can run the Setup Wizard later by returning all your setting to the default - something people may not be anxious to do though, if you're one of those souls who've made a lot of changes. Similarly, the Kaspersky logo - which is supposed to appear if you check that option, to let you know it's installing - didn't load. Part of the problem with both of these issues may be related to Kasperky recommending you uninstall Version 6 before installing Version 7, which I didn't -because the documentation doesn't say that anywhere. I only discovered it later, after the fact.

Another matter worth noting is Kaspersky's way of speeding up its scanning. It uses two technologies called iSwift and iChecker, introduced in version 6. The short version is that these tags files and keep a database of what files have been checked, and if there have been no changes, they don't get scanned again, until they do change. There's been a bit of controversy over the features: to accomplish this, Kaspersky uses "APIs" (source code for the operating system) in a way Windows allows, though didn't intend. As such, if one does a "chkdsk" (a process that checks your system for broken files and bad sectors), the huge iSwift/iChecker databases can significantly slow the process. And these issues remain even if you uninstall the program. Some people have reported other problems, though there's no way of knowing if they're precisely related. At its heart, the issue is one of just slowing your system during a "chkdsk" -- and not telling users that this change is being made. For the most part, this shouldn't be a problem for users, but it's worth noting. Also, Kaspersky has released information that they're working on getting rid of this in Version 8. Click here to read the document, if interested.

Kaspersky Anti-Virus retails for $60, slightly more than the other leading programs, though it provides excellent quality. If you're unprotected at the moment, or unhappy with your anti-virus program, KAV is well-worth considering. However, if you don't want to deal with the question of iSwift, it might be best to wait until version 8, If you already are running version 6 it might okay to hold on until version 8 comes out next year, as well, though there are improvements.

To see the entire "Writers Workbench" column, complete with product graphics and additional "TWW Notes," please click here to visit the WGA website. "The Writers Workbench" appears in full monthly on the website for the Writers Guild of America.

Comments

[scottellington]

Speaking of urban myths, my all-time favorite is the one that identifies malware makers as the direct beneficiaries of anti-malware revenue streams. It puts a nice, ironic face on the cost of doing business.