For years, different techniques have been developed to detect malware on a computer, and one of the most important is analyze the behavior of its executable components. It's assumed that every antivirus has the resources to catch any malware variant red-handed, but it never hurts to study other options, such as Raptor, a new resident module developed by McAfee.
Behavior-Based Detection
If a program tries to elevate its privileges to modify system files, adds specific firewall rules without notifying the user, alters the content of files like the famous HOSTS file, or tries to disable security warnings, it definitely has a malicious objective in mind. Any one of these actions should be enough for any antimalware that considers itself as such to intervene immediately. However, the relationship between malware and antimalware is an arms race. A slight modification in the code can hide part of that destructive behavior, and by the time the antimalware reacts, it's already too late.
What Is Raptor?
That's how we arrive at Raptor, a new security module developed by McAfee. I understand that the relationship between McAfee products and its users has deteriorated a lot in recent times, but Raptor maintains a reasonable distance from its older siblings. Basically, it's a program designed to detect and intercept in real time any strange movement from an executable. The installation process doesn't show any message, and once finished, the Raptor icon will appear in the system tray. The program practically has no interface, and there are no advanced configuration options. If something appears that shouldn't be there, Raptor will present a window with the suspicious files and the option to send them to quarantine.
Availability and Beta Status
Raptor is available in 32 and 64 bits as a separate product, and as part of the Stinger program, which detects and removes specific viruses. The only warning is that Raptor is in beta, and it may cause conflicts with other preinstalled security solutions. At the same time, you must watch out for any possibility of false positives, especially with legitimate files.
