"Our approach looks at the behavior of spyware, not at a database of definition signatures," said Gregor Freund, the chief technology officer of Zone Labs, which is part of the Redwood City, Calif.-based Check Point Software.
Rather than rely on spyware- and adware-specific definitions to detect and delete unwanted programs after they've gotten a foothold on a PC, the new ZoneAlarm Anti-Spyware looks for some 20 different spyware "behaviors," said Freund. That insures malicious code isn't inserted into applications, processes, Windows services, or the operating system's kernel.
"The basic foundation of any spyware prevention has to be the firewall, because it goes beyond reactive signature-based technologies," said Freund.
AntiSpyware uses Zone Lab's new OSFirewall technology -- which also is used in its ZoneAlarm and ZoneAlarm Pro personal firewalls -- to detect possible spyware.
Backup defenses include a blacklist/whitelist maintained on Zone Labs servers, and a home-grown conventional signature-based scanning engine, said Freund. The first time an application attempts to connect to the Internet, for example, AntiSpyware pings those servers to check against a 60,000-item blacklist and a 30,000-item whitelist.
"Our response is within a half a second," said Freund, who said that Zone Labs has been ramping up its server capacity to handle loads in excess of its current 30 million requests per day.
Defenses that depend exclusively on after-the-fact scanning for adware and spyware are doomed to fail at some point, Freund said.
"Signatures have a difficult time matching the rapid changes in spyware, which can mutate as many as ten times a day," he said. "Spyware's also using new technologies to embed its code in a system. Spyware makers are beginning to use rootkits, for example.
"And we just don't think it's acceptable for spyware to run wild until the next scheduled scan. You can't allow code like this running on your machine for 24 hours. That's like closing the barn door after the horse is gone."
Zone Labs, which also sells an Integrity line of enterprise-grade security software, will move this anti-spyware approach into those products too, said Freund. While he refused to comment on a specific date, he promised it would be "pretty soon."
ZoneAlarm Anti-Spyware is available immediately at $30 per individual user. It runs on Windows 98 SE, Windows ME, Windows 2000 Pro, and Windows XP.