In the world of AV software, there are two varieties: The first, based on signature which can’t hope to keep up with the variants emerging all the time, and the second based on behavior which is supposed to detect/identify any suspicious behavior and quarantine/delete the offending software and notify you to decide what you wish to do. There are other software types (one of which will ship with Windows 10) which will lock down target areas (files, etc.) which viuses/trojans target.
Raptor (beta) is of the second type, which senses/identifies suspicious behavior and which is not signature dependent. You can get Raptor, or both and they are currently free. Raptor installs itself in C:\Program Files\McAfee\Raptor without installation dialog and runs in the background afterwards. The program folder stores log files and the quarantine as well. In fact, the only way you’ll know it’s there is a systray icon, and the Raptor.exe in Tyour ask Manager.
Raptor will on right click show:
- Start — Raptor starts monitoring system for malicious behaviors.
- Stop — Raptor stops monitoring the system.
- View Log — Displays detection details for malicious files found.
- Quarantine — Creates backup of files that were repaired to restore if required.
- About — Provides details about Raptor client and build version.
- Remove Raptor — Uninstalls Raptor from an endpoint.
- Exit — Quits Raptor program. Raptor will resume on the next system reboot.
You can download/read more here: http://www.mcafee.com/us/downloads/free-tools/how-to-use-raptor.aspx
Two things to know: Raptor collects and transmits info about your system…
“Q: What user or system details are collected by Raptor?
A: Instead of sending the whole file, Raptor sends the behavioral trace of the file execution which is typically a few bytes of information. This is the minimum amount of information necessary for Raptor to determine the nature of the file. The behavioral trace information includes file name, file path, process ID, event, the OS version, and a randomly generated GUID of the machine.” – ibid
Raptor and Stinger (traditional AV signature app) come together also…but only for x64 systems, whereas solo Raptor comes in two flavors (x486 and x64). You can download the combo here: http://www.mcafee.com/us/downloads/free-tools/stinger.aspx
I wish I could give you comparison data with other AVs and other behavioral detectors…but it just isn’t available at this point. Raptor should not interfere with your native AV…but again, no data is available. It probably does not conflict with Stinger…but no data on that either. Also…Raptor isn’t supported yet:
“Q: How can I get support for Raptor?
A: Raptor is not a supported application. McAfee makes no guarantees about this product.” - McAfee
You’d think McAfee would publish at least initial testing results, but they haven’t: Add no support and I say wait for some kind of reporting before installing it/them.
And have a good weekend!