Prevx, Lightweight Heuristic-Based Malware Scanner

Signature-based protection of your PC against malware has been the standard security for a long time. And antivirus companies generally competed in providing the user with the most database updates in the shortest period of time. The more the updates the more the user benefited from a tighter security against cyber-critters floating online.

The flaws of this type of protection have been revealed on numerous occasions and the test of an antivirus did not include only detection and disinfection ratio, but also the impact on system resources. Habitually, scanning made the user put all other activities on hold and for as long as malware assessment took, you could hardly do anything else.

But recently there has been a turn in the computer security industry with the exploitation of cloud technology, which offers a huge database and access to collective experience that leads to enhanced protection.

Prevx is a new type of malware fighter that does not follow any of the standard lines seen by now in the first choice of antivirus solutions on the market. The innovation consists in the fact that it does not carry any signatures with its installer (which is 798KB in size) nor does it download them afterwards and keep them on the computer. Also, the amount of system resources necessary for Prevx to do its job is measly enough not to be noticed by the user or impact on the performance of the system. But the cornerstone feature that makes all this possible is the connection to the Prevx cloud database.

Without an Internet connection the application installed on your computer is useless as it requires connection to the centralized database where all the scanned files get analyzed (for preserving the bandwidth only part of the file is sent). That's why it brings advantages such as a small footprint on resources and improved detection.

It can be used freely for as long as you want, but no removal capability is available in this mode. The free use covers only scanning, detection and real-time infection monitoring. For the malware removal component you will have to cover the $29.95 price tag.

The interface is friendly enough to help any type of user put up a fight against malware with no effort at all. Every option is easy to understand and unlike the traditional antivirus software on the market all settings are reduced to minimum while detection and elimination rates are maxed out.

Installation is so fast that it seems like a blink of an eye is all it takes to set up into your system. And after this completes it'll find its way to the system tray and start scanning in the background looking for malware. Although it is in a continuous search for threats (background scan) it won't put any load on the resources while performing this operation.

During our testing the peak for RAM usage was of about 85MB (on-demand scan) and around 50% use of the CPU. The test computer these values were recorded on was a Dual Core Processor at 2GHz with 3GB of RAM running Windows Vista.

Prevx gives you the opportunity to initiate both on-demand scans directly from Windows Explorer context menu as well as perform all-system checks for malware. What is great about the application is that after detecting a threat (or a bunch of them) and eliminating it, it'll need to scan the entire system once more, just to make sure that there is no malware left. The method used by Prevx to detect and disinfect malware is different from the traditional, signature-based one in that the application needs constant connection to the Internet in order to function; connection to the cloud database is an absolute must, and lack of uplink will render the app impotent to scan the system.

When it comes to disinfecting the computer Prevx needs to download the necessary files in a temporary location. After all has been treated these will be automatically deleted, giving you back the occupied free space. The cleanup procedure is a three-step operation that calls for disconnecting the PC from the Internet and disabling other security products such as antivirus or antispyware you may have installed.

In some cases malware may have affected a system file. When this event takes place Prevx will eliminate the infected file and replace it with a healthy one from its database. Should this not be possible it'll ask for your Windows disk in order to get the healthy file and place it on the system.

The Prevx developer guarantees removing all the threats from your PC, otherwise you'll get your money back. Where the application fails there is the human line of defense consisting in expert assistance from Prevx engineers. They will connect to your computer and manually disinfect it. It sounds pretty invasive but the EULA of the software clearly states that all information sent from your computer to Prevx community through the application will be done anonymously. This means that no personal data is to be collected, but only reports on intrusion events.

Prevx is simple in structure and the principle it guides by when eliminating the threats is also pretty basic, but much more efficient than the signature-based products. However, despite all this it supports configuration, allowing you to enable enhanced rootkit detection, password protect the configuration options, enable real-time master boot record or block files.

Moreover, it relies heavily on heuristics and, as such, lets you choose the level for advanced heuristics, program age heuristics and program popularity heuristics. There are four levels to pick from, according to how tight you want heuristics to be.

With these three forms of protection at your disposal chances are that zero-day and zero-hour threats will hit a wall when trying to execute on your system. For each of the levels you choose for either of them you will benefit from information on the results it would have.

Additional settings integrated in Prevx include a scheduler to program system scans as often as you want or after booting, specify files to be treated in a certain way, upon detection (block or allow the file) and self protection configuration. With the latter you get to pick a protection level (minimum, medium and maximum) for Prevx itself, especially if other security solutions are installed on the system.

Under the Tools menu you'll find the report sheet for the last scan, rollback cleanup actions and restore specific files. Unfortunately, if there is more than one file you want to restore you will have to perform the action one file at a time as multiple selection is not yet available.

If you want Prevx to take a break at one point, the application provides a simple way to stop its protection by suspending the activity for a preset period of time that goes from 5 minutes to 24 hours. Of course that this does not have to be this specific and there is the option to re-enable it on rebooting the system.

There is also an Advanced Scan section for the application, which permits initiating a quick check (verifies the files in memory), deep scan (checks for rootkits, trojans and any other threats), full check of the hard disk(s) and removable drives as well as a custom verification to whatever file/folder you wish. Regardless of the chosen option Prevx will move amazingly fast.

Testing the application against a database of 50 rootkits and a pool of several thousand spyware and viruses, we could make an idea of its detection rate. Facing it with such amounts of malware showed that Prevx could deal with a limited number of threats at a time, and this is the reason for the post elimination scan.

Out of the 50 rootkits included in the test it eliminated only 41 of them. We were expecting to achieve a higher rate upon launching the undetected files. Unfortunately Prevx was static and did not even blink. With spyware, viruses and other types of malware the application behaved quite the same, in the sense that it did not score outstanding results but managed to rise above 60%. However little this may seem, the database used for the test did not comprise the latest threats and some of them would generally be picked up only by a small hand of scan engines.

Prevx's heuristics is quite an advantage to keeping your system safe from the latest threats that have not yet been signed by major antivirus vendors. But I have to mention that during our testing it also came up with a few false positives for major programs such as GIMP and OpenOffice. On the upside, declaring them safe to the system is as easy as right clicking them in the scan result list. The next time they will definitely not be picked up by the scanner.

Registering Prevx brings you the advantage of managing the license as well as viewing online statistics of the number of computers the registered product is installed on or number of PCs infected. Moreover, you have complete management over the license keys or PCs they are installed on. With MyPrevix you get a full view over computers protected by the application, infections detected (you can view scan results) or manage MyPrevix users.

The Good

The Bad

The Truth