Webroot's Spy Sweeper Enterprise 3.0 stops rootkits

The anti-spyware system for Windows PCs is now also easier to deploy and manage

Webroot today (12 June) unveiled version 3.0 of its Spy Sweeper Enterprise anti-spyware tool to protect Windows PCs. The new edition includes protection against rootkits, and improvements to allow easier deployment across a large number of networked systems.

Spy Sweeper Enterprise 3.0, available immediately, sports a completely redesigned client with an improved user interface and a kernel mode driver that offers protection before Windows starts.

"We load before the operating system and before any spyware can load," said Vinay Goel, vice-president of marketing for Webroot. The client checks the registry, INI files, and other configuration settings to see if anything has been changed.

According to Goel, the number of spyware infections in businesses has remained constant for the last six quarters, even though more than 70 percent of firms claim to have protection against spyware.

"Although enterprises are using anti-spyware, a lot of them are running consumer-style freeware applications that aren’t doing the job properly," Goel said.

New in Spy Sweeper Enterprise 3.0 is protection against rootkits, a type of malware that can conceal itself from detection and may be difficult to remove. Spy Sweeper scans the PC hard drive and compares all executables it finds against information in the registry, flagging up any discrepancies to an administrator.

The client also has a number of new blocking technologies to prevent spyware getting onto a system, Goel said. An ActiveX shield checks downloaded ActiveX controls in the browser against a signature list of known threats before allowing them to run.

An administrator can decide which browser plug-ins users are allowed to install via the browser helper object shield; and an IE Trusted Sites Shield stops programs from making changes to the Trusted Sites settings in Internet Explorer.

Finally, on PCs running Spy Sweeper, the Spy Communication Shield blocks any traffic going to or coming from known spyware sites.

For IT managers, Webroot has added an Advanced Admin Dashboard that gives an overview of the status of spyware across the entire company. The Spy Sweeper client can also now send an SNMP alert if spyware is detected.

Spy Sweeper Enterprise 3.0 is now easier to install and manage, with a new deployment tool that can distribute the client to tens of thousands of desktops by IP address range, according to Goel.

"We also now support incremental updates, which just provide a daily update to client systems of about 20kB in size," Goel said, adding that this reduces the network load for firms with many desktop systems.

Other key features include the ability to completely hide the Spy Sweeper client from the user, or to delegate control of specific settings to users. The client can also use “throttling” to stop it consuming too much processor time when file or memory scans are in progress.

Spy Sweeper Enterprise 3.0 costs €20 (£14) per seat, which falls to "single digits" for volume licenses, Goel said.