Sandbox security versus the evil Web

Five products strive to trap drive-by downloads and other threats in a virtual Web browsing space, with mixed results

And the winners are...

In the end, the reviewer's favorite products were Prevx and Sandboxie. Prevx provided the best identification of malware and prevented most of the exploits thrown at it, though by no means all. It's nice to be told what was trying to infect your system instead of having to make trust decisions on the fly. Plus, Prevx was the only product able to detect previously installed malware, and its interface was elegant. Sandboxie was a surprise. It provided fairly accurate infection prevention and, in most cases, excellent cleanup. It requires a bit more technical knowledge when picking which changes should and shouldn't be kept, but it's free price tag makes it a winner.

Now on to the individual reviews...

Prevx 2.0

I've been a big fan of Prevx for years. It was one of the first players in the Web security space and tends to be on the cutting edge of browser defense. The product's maturity shows in the end-user interface, operational aspects, and availability in 64-bit and business versions.

Prevx provides a multipronged defense, with heavy reliance on heuristic host-intrusion detection techniques. It provides distinct protection to Internet browsers, e-mail programs, critical file and memory areas, and startup program areas, and it supplies additional defenses against keyloggers, buffer overflow programs, and network connecting malware. Although real-time monitoring and heuristics are certainly its sweet spot, Prevx contains multiple signature-based mechanisms and relies heavily on its community-based malware reporting database, which requires an active Internet connection to utilize.

After the initial licensed-based install, Prevx did a scan of some of the critical system components and checked for program updates. Prevx has the best user interface in this roundup review (see Figure 1). There wasn't a part of it I did not like. It looks good, displays what the user needs when required to make a decision, and hides when it is not in play. There are three operation modes: ABC, which is the default for beginners, and two expert modes.

When the user surfs to a malicious Web site, Prevx notes any system modifications it detects while the related files are identified and compared to a local database or sent to the larger community-based database. If identified as malware (see Figure 2), the malicious programs and system modifications are removed and the system rebooted. Suspicious programs are placed in "jail" (see Figure 3), where the user can restore or tell Prevx to quarantine or delete. Cleaning always results in a mandatory reboot, followed by an additional rescanning of critical areas and an uploading of any found changes to the community database. I especially liked this feature because it can find modifications missed on the first pass. Nice touch.

Sadly, Prevx didn't always keep my system clean. On just the fifth malware Web site, a password-stealing Trojan was able to infect the test system. Prevx had noted system changes and uploaded multiple files to the community database, but it completely missed one of the Trojan files, even after the reboot and second scan (see the program called SSUUDL in Figure 4, Figure 5, and Figure 6). In further testing on the same site, Prevx removed every infectious file nearly all of the time, but not every time. And although it detected and prevented the XP Antivirus malware program, it did not stop the Adobe Flash clipboard hijack. If Prevx could improve its accuracy, it would easily be the best product in this review.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection

Tags software applicationsmalware

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Roger A. Grimes

InfoWorld
Show Comments

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

David Coyle

Brother PocketJet PJ-773 A4 Portable Thermal Printer

I rate the printer as a 5 out of 5 stars as it has been able to fit seamlessly into my busy and mobile lifestyle.

Kurt Hegetschweiler

Brother PocketJet PJ-773 A4 Portable Thermal Printer

It’s perfect for mobile workers. Just take it out — it’s small enough to sit anywhere — turn it on, load a sheet of paper, and start printing.

Featured Content

Product Launch Showcase

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?