SpyShelter Free is a Host Intrusion Prevention System software for Windows PC

SpyShelter, in its full-fledged form, is complementary to antivirus software. The paid version contains a firewall, keylogger detectors, and other malware protection services. However, we will review SpyShelter Personal free version only here. According to its website, SpyShelter claims that the free version provides protection in the following forms:

1. HIPS (Host Intrusion Prevention System)
2. Prevention of Screen Capture
3. Clipboard Capture Prevention
4. Keylogger Detection & Blocking

Thus, if you combine all the four above, you essentially have antimalware, with few added features – in this case, points 2 and 3. Most anti-malware from different brands – both paid and free – offer Host Intrusion Prevention System and Keylogger Detection.

What is HIPS or Host Intrusion Prevention System

For those new to the term HIPS, it is a system that alerts users about changes to the system. For you to get an idea of how it works, I lay it down in the following steps:

1. Collects information about the computer – settings, including control panel items
2. Creates a database using information collected in the above step
3. If any program or user attempts to change anything, it will lead to a change of the value of one or more fields of the database created in the second part.

In case any program tries to change system settings, SpyShelter will provide you with an alert. This again is dependent on whether you’ve set it to auto-learn or to ask you every time. It won’t tell you whether the attempt to change any system setting is okay or wrong. And if wrong, what could be the extent of the damage. It is up to the decision of the user to allow or prevent the change from happening.

Assuming there are people/users who might not know about system type alerts, there are chances of malware or hackers gaining access to your computer if the user authorizes any kind of malicious change. Thus, though HIPS is a good system, it relies on users’ ability to decide about system changes. For the most part, if you are installing any application, changes are bound to happen and you will be getting alerts.

Today, you also have User Access Control to alert you. Some firewalls (especially Comodo and ZoneAlarm) are good at providing alerts if any program or user tries or changes any particular system setting. There are some third-party tools too – for monitoring and locking system settings.

In short, HIPS is available with almost any anti-malware and also with stuff like WinPatrol. And because it cannot decide if a particular change is a malware or part of processing, it is only as good as the users’ ability to judge the change. Using the paid version of WinPatrol allows you to check out the details of the alert on the Internet. This feature aids you in deciding whether or not to approve a change.

Do you want Higher Security or Medium? This is a question asked by the installation package while you are installing SpyShelter. You can change the option later from Settings of SpyShelter free version. But for beginners, what is the difference between Higher security and Medium? The installation page/dialog tells us Higher Security means more protection and Medium means less alerts.

If I select Medium, what all changes would SpyShelter allow or deny without asking me? There should be a help button that assists users in deciding the best option for them. Without knowing what all alerts would be disabled, I don’t think anyone would go for Medium. This is an extra step and could be eliminated from the Installation process. People can always change the settings from the main window of SpyShelter once they get to know what all alerts are being shown by the application.

SpyShelter is set up to auto-learn what programs to allow and which ones to deny access to the core system components. Even if you set up the protection level to High, the alerts may be fewer if Sp Shelter has already learned that a particular program is safe. As such, the installation dialog asking to choose between Higher and Medium protection is just confusing and should be removed in my opinion.

SpyShelter Free Review

SpyShelter is anti-keylogger security software for Windows 10/8/7. It prevents Clipboard & Screen theft &offers Host Intrusion Prevention System or HIPS protection.

The first keylogger it detected soon after a pending reboot installation was WinPatrol. Probably because WinPatrol runs a check on every system resource to make sure no changes happened during reboot. Here is a screenshot that SpyShelter gave me upon reboot when WinPatrol started. It explained that the process is dangerous and asked me if I should allow it to run or block it. It also has a “Remember My Answer” type of checkbox so that you need not have to allow it every time you fire up your computer.

I downloaded and installed a few keyloggers including Spyrix. Initially, the auto rules created by SpyShelter denied installation. I had to exit SpyShelter to install the keylogger.

Later, as soon as I turned SpyShelter on, it added Spyrix to its program blacklist under the category of Anti-Keylogging and Anti-ScreenCapture. The image below shows you cannot install a keylogger if SpyShelter is active.

Anti-ScreenCapture & Anti-Clipboard

The PrintScreen button did not work for anything. However, I was able to use the Windows Snipping tool. SpyShelter added Snipping Tool to its whitelist under AntiScreenCapture allowing me to take snaps using the tool. In the image below, you can see that the SpyShelter marked it as Green – meaning it was allowing the Snipping Tool even though the Anti-Screen Capture was enabled.

SpyShelter has its own algorithms that help it in identifying programs and thereby in choosing whether or not to allow access to Clipboard etc.  According to the website of SpyShelter, the program is not dependent on any kind of database or fingerprints to identify malicious files. They say it checks the behavior of the file and based on the behavior, it allows or restricts access for that file.

The log file showed all the programs and applications I opened while SpyShelter protection was on. It also showed what all programs were being permitted to use Clipboard and which ones where blocked. For example, Microsoft Word was marked Green, meaning it can access the clipboard. Then there was a DLL that was marked Red meaning it could not access the clipboard.

Conclusion

Our SpyShelter Personal Free review concludes that the program is worth trying out for the following reasons:

• It is low on resources so you won’t slow down your computer.
• It auto-learns the behavior of programs on your computer. That way, even if you choose High Protection during installation, alerts decrease over time.
• Your computer is protected using program behavior and you need not update the database all the time
• Integrates encryption driver.

Sometimes, false positives may occur, as in the case of WinPatrol, but you can easily whitelist such cases. The free version now supports 32-bit, as well as, 64-bit systems too.

Download: Home Page.