PC Tools is famed for its Spyware Doctor line of signature-based anti-malware protection, but whether you use Spyware Doctor or some other brand they hope you'll supplement it with PC Tools' own behavior-based ThreatFire 4.5. ThreatFire is designed to work alongside a standard signature-based product to catch zero-day threats that are so new they don't yet have signatures. And it's free--what more could you ask? Well, you might ask for a tool that leaves a little less of the decision making to the user, but, still, this is a very good addition to any personal security toolkit.

Unlike Prevx 3.0, whose behavior-based analysis is entirely cloud-based, ThreatFire does use a local database. Upon installation ThreatFire needs to check for updates. However, the database updates are minuscule compared to those of a full signature-based product. On my test systems, the initial update took about a minute and the rest of the installation no more than half a minute. That's great, compared to Spyware Doctor with AntiVirus 6.0, whose required initial signature update took up to 15 minutes, but it doesn't beat Prevx's near-instantaneous installation.

The product's main screen initially shows a list of top malware and adware threats along with a world map. Clicking a threat in the list updates the map to show the prevalence of that threat. It's cute, but I'm not sure how necessary it is. More interesting is the next tab, which displays statistics about ThreatFire's protection activities on your computer and on the 1.5 million other active ThreatFire installations. To make sure you know it's working hard for you, ThreatFire pops up a report of these statistics every two weeks.

What Is ThreatFire?

After installation, ThreatFire launches a tutorial to make sure users understand just what it is--and what it isn't. As a behavior-based product, ThreatFire looks only at processes that are running or attempting to run. It will never catch an inert file just by looking at it. After all, a file that isn't running doesn't have any behaviors.

ThreatFire does rely on both local and online databases to help identify known threats, but it doesn't consult these until after it detects dangerous behavior. If the process under analysis turns out to be a known virus, Trojan, spyware or other high-risk item, ThreatFire immediately disables the process, quarantines its components, and displays a red popup explaining what it did. If the database identifies the item as known adware or another low-risk "potentially unwanted application," it pops up a grey box asking the user for permission to remove the item.

Most signature-based products must include removal instructions in their signature databases, adding to their bulk. Prevx takes the unique approach of downloading removal instructions only after it detects a threat. Because ThreatFire's ActiveDefense is watching the behavior of all processes, it knows what files and Registry items have been created by the malicious process. This "tracker" technology lets its clean up traces of a threat beyond the specific executable file whose behavior ThreatFire detected.

ThreatFire also uses a technique PC Tools calls "behavioral profiling" to identify an unknown threat as belonging to a known threat family based on its pattern of behavior. If neither the database nor the behavioral profiling system can identify a process that's exhibiting bad behavior ThreatFire asks the user what to do.

The yellow alert popup for an unknown threat identifies the threat level – I've seen MODERATE, HIGH, and VERY HIGH. It also reports one of the behaviors that caused ThreatFire to identify this process as malicious. This can be confusing unless you realize the single reported behavior is just part of a pattern. You can click a link for technical details about item's components and behaviors.

ThreatFire occasionally reports some false positives (legitimate programs flagged as potentially malicious). If you're in the process of installing a trusted program and ThreatFire pops up a query, go ahead and allow the program to continue. But if a warning pops up when you're not installing anything, most likely you should block it.

I'm not a big fan of solutions that put security decisions in the user's hands. Most users aren't qualified to make an informed decision. At the very least I'd like to see a more complete breakdown of all suspicious behaviors from ThreatFire, like the detail list that was available in Norton AntiBot before Symantec subsumed that technology into their other products. Even better would be a system that can make its own decisions most or all of the time. According to Michael Greene, PC Tools VP for product strategy, that's exactly what PC Tools hopes to attain, which gives me hope for the future of this already impressive product.—Next: Scanning for Rootkits