Out of that collection of tools, I’ve consistently stuck with this subset of offerings for use on my own or family member’s machines:

• AVG Anti-Virus Free Edition: I have *LOTS* of test machines, and a free product is pretty helpful for the many that so often come and go in my lab
• Norton Internet Security: I abandoned this product in the mid 2000′s as its resource requirements mushroomed and it turned into a bona fide system hog. But the newer, leaner and meaner 2009 and 2010 versions have earned their way back onto numerous desktops in my house.
• Webroot: Spy Sweeper was the first hot-dog antispyware product that I got to know while writing my book, and it has remained a popular and effective tool ever since
• PC Tools: Spyware Doctor is another hot-dog antispyware product that continues to earn accolades and special status as a leading antispyware package. The company’s combo offering (with PC Tools AntiVirus) and Internet Security suite also work very well.

Though I’ve occasionally strugged with components of the PC Tools environment — see my September 2008 blog for ViztaView.com “Best-of-Breed Apps Aren’t Always Best for Vista” — by and large their products have done me and my desktop and notebook PCs more right than wrong. This is born out in recent results from the latest round of VB100 testing from Virus Bulletin in April, 2010. Though products from a surprising group of vendors that include eEye, Frisk, Norman, and even Microsoft (Security Essentials) failed to earn the once-coveted but now obligatory VB100 rating for Windows XP SP3 platforms in this latest round of testing, the PC Tools products (and those from the other vendors I mention in my preceding favorites lists) continued their ongoing streak of VB100 status.

In talking with members of the PC Tools development team to understand how they’ve kept up, especially in light of recent changes to the Virus Bulletin wild list and other testing changes and shake-ups I learned that the company maintains a dedicated team of researchers and testers to keep up with (and help to guide) the composition and execution of its testing operations. And of course, as is customary for most major anti-malware operations these days, this group also monitors reports from its own customers and various shared security and vulnerability reporting resources (like the Mitre database of common vulnerabilities and exposures known as the CVE), so that it knows when to begin work on the various signatures, heuristics, and other detection, avoidance and repair tools that drive daily efforts in such organizations. In fact, heuristics- and behavior-based detection and avoidance is an area where the PC Tools products really shine, thanks in large part to the development efforts behind its ThreatFire module, which observes and blocks suspect system behavior and potentially dangerous file system access and activity.

If you’re looking for a solid and reliable anti-malware solution for Windows PCs, any of the items on the list at the head of this blog will do the job, but I recommend the PC Tools products as a particularly good value for the money you’ll have to shell out to install most of them on one or more PCs. The PC Tools Internet Security suite, in fact, offers comprehensive and capable all-around security coverage and protection for up to 3 Windows 7 PCs for about US$50 per year (or less, if you search for discount codes online, such as this 25% off offer available from Offers.com)

Event details for the pctsSvc.exe crash

I’ve already switched from this product to Norton Internet Security 2010 on my primary production machine (I didn’t want to leave the machine in an uncertain state while working through this problem), but I’ve left it installed on one of my test machines and am working with PC Tools technical support to try to understand and resolve this issue.

Last Thursday, I conducted a Web chat to report my problems and ask for some advice. The support tech had me stop the Spyware Doctor run-time environment (right-click the icon in the notification area, then select ShutDown from the resulting pop-up menu), uninstall the running version of Spyware Doctor, download a fresh clean copy from their Web site, and reinstall the program. After three days with no problems I was starting to hope that my failure to halt the previous version of the app before doing the first install of the current version caused the problems, but when I logged into my test machine first thing this morning, I found the pctsSvc.exe app crash message waiting for me on that machine when I checked in.

I’ve forwarded the information to PC Tools, along with the same screen cap you see in this blog, and will be curious to see what happens next. The tech I worked with last week said they would e-mail me a copy of the Belarc Advisor, and have me install and run it, so they can examine its output to understand more about my PC. Just for grins I visited the Belarc website to download and run the free version of the Belarc Advisor on a different PC, and here’s what popped up:

The free Belarc version omits the important security stuff

It looks like a pretty informative tool, but I didn’t see anything in the output from the free version that would help me or anybody else tackle the Spyware Doctor issues, so I’m guessing the commercial version that PC Tools will send me will  provide a bunch more detail, especially on security -related matters. One big concern for many such software companies is the presence of malware that could inhibit or block correct behavior on  a PC (which I’m 99% sure is NOT true for this machine, having scanned it with Trend Micro Housecall and the Norton Security Scan and come up clean on both), while another has to be the presence of other programs, drivers, or runtime environments that interfere with the PC Tools runtime environment’s proper operation.

This promises to be an interesting and educational adventure as I work with PC Tools to figure out what’s bollixing Spyware Doctor with Antivirus on my test machine. I’ll keep you posted as things develop further.

[Note added 11/21/2009]: I never heard back from PC Tools Tech Support despite an e-mail follow-up on 11/17. I guess I’ll have to start a new trouble ticket tomorrow. Count on me to keep following up as more info becomes available. In the meantime, pctsSve.exe crashed again on 11/18 and 11/19.

• The OS demonstrates only limited built-in malware blocking capabilities: it cannot block 84% of common malware elements, including some of the most common and well-known malware and spyware versions.
• Some malicious code was able to install at administrative privilege level, execute code, and use a keylogger, but Windows Defender could neither detect nor stymie its installation or run-time activities.
• Signature updates for malware were also observed to be “extremely slow” on Windows Vista.

What’s the point? Try this quote for size “…security experts…cautioned users that the default malware blocking software as well as the anti-virus programs of Microsoft may fail to provide them comprehensive protection…” Duh!?

When it comes to news like this, I’d like for them to tell me more about what they learned in doing their analysis, and how other threat prevention mechanisms fared as well. Everybody knows that additional protection is necessary for Windows PC active on the Internet, and most corporate security policies require specific and more powerful antimalware coverage anyway. What would have been more interesting and potentially useful would have been a comparison of effectiveness for leading antispyware programs (including Webroot’s own Spyware Sweeper, PC Tools Spyware Doctor, and so forth and so on), as well as speed comparisons for signature updates and scanning for XP, Vista, and Windows 7.

I’m hoping more and more of that detailed information becomes available as Windows 7 heads for commercial release in October. And gosh, would I ever love it if somebody stepped up to fund an organziation like Virus Bulletin for the anti-spyware community. There may never be an AntiSpyware 100 (AS100) like the VB100 if what I know about spyware remains true — and things show no signs of changing in this regard — but it would be nice to have AS80-plus or AS90-plus ratings to help separate the merely adequate antispyware packages from the real star performers. To me, that would be some real news!