Slashdot Mirror
Failing Grades For Most Anti-Spyware Tools
serbach writes "Steve Gibson posted this link to a superb test of about two dozen top Anti-Spyware programs: Eric L. Howes conducted the test over a two-week period in October. The results surprised me: only 3 ASW programs had a 'batting average' of better than .500 when it came to eradicating the broad range of spyware in the test. Freeware star Spybot Search & Destroy came in a distant 7th with an average of only .376. The top three? Giant Anti-Spyware, Spy Sweeper, and Ad-Aware. These test results are well worth your time."
Ars-technica also just did a review. Check it out.
o va l.ars
http://arstechnica.com/reviews/apps/spyware-rem
$_='while(read+STDIN,$_,2048){$a=29;$b=73;$c=142;
I've been using a few different anti spyware tools in parallel because it seems as if there isn't a single tool that can reliable remove all spyware.
Free Firefox news reader.
The attitude to directed advertising programs or "spyware" on Slashdot. Especially when you step outside the parochial echochamber that is Slashdot discourse and speak to people who actually use these programs. On the whole, they are actually happy to get these novelties for "free", like the funny little desktop buddy, or the search bar, weather report or stopwatch.
I used to work for one of the companies that distributed a "spyware" program through download.com, and we had continual PR problems with being lumped in with the worst offenders of the spyware world. We didn't do drive by installations, or hide our intentions: we just traded our customers data for use of our program. What, exactly is wrong with that? Why is Slashdot pretending all of us are as bad as each other, as if in this, as with all fields, there isn't a spectrum of behaviour?? Even some linux users are bad, just look at the DDOS at sco.com. I'm sure noone here would condone that behaviour.
(Posted anonymously, not interested in karma bonus.)
I gonna get firefox and ad-aware asap. I also want to get screwed! No more than 2 weeks right?
I wonder what it is like...
Well Spybot may not do great, but it certainly does enough to clean up a persons PC so it works again without crashing every 5 minute.
My reccomendation is firefox or mozilla or even opera if you prefer it.
I do however note that if you take a clean system and then visit msn.com, then run spybot etc you will find that there are little evils that appear on your system.
It now appears that the best option is to wave goodbye to MS if you can. Pick a nice linux distro (eg Ubuntu or whatever suits you) or even MacOS X and feel that little bit safer.
The general public relies on Adaware's auto-execution ability and launches FireFox by clicking on the 'e' in their toolbar.
...though I would have liked to see how the pre-emptive SpywareBlaster changed the results...
I've always found a combination of Ad-Aware and HijackThis do an excellent job of keeping all things spyware under control. Ad-Aware for more frequent scans, and the odd hit of HijackThis when things seem screwy. Admittedly, I don't know how much spyware I actually miss but it seems to keep XP happy for most part :)
What's your secret? I have Ad-aware, Spybot, SpywareGuard, Spyware Blaster, Zone Alarm on my main PC. I use Firefox. I hardly ever (to be honest) visit pr0n sites. I hardly ever do any P2P stuff. And occassionaly, I DO still find the odd malware on my PC.
Never is a loooong time. Even Sean Connery learned Never to Say Never Again.
I've seen spyware targeted at firefox and java applets that would want me to install something I was not curious enough to see. Fortunately, I was always asked if I want to install (security mechanism in Java and Firefox). I think grandpa' will click ok on those boxes, without reading them first.
I'll do the stupid thing first and then you shy people follow...
you never know where your internet connected peecee might be sending it's bytes.
hmmm why is that activity LED blinkin?
Now I'm the grandest Tiger in the Jungle!
This isn't a standard issue MS bashing troll but you do have to question whether given the ease at which programs (which is what spyware is) can install themselves on someone elses computer with little or no user intervention , Windows is fit to be allowed on the internet. If all windows systems were taken offline then almost all viruses and the like would disappear almost immediately along with spambots and other unpleasent creations of the black hat fraternity. I'm not pretending this is feasible but you have to wonder what the net would be like if only relatively secure OS's were allowed to use it.
If you can limp yourself to download it, I've found Ad-Aware does an outstanding job in most cases. But you must have the new (free) version to do any good, The rate of evolution of these beasts are high, and they apparently came up with a new engine for Ad-Aware SE, that I've seen fund hundreds of objects that Ad-Aware 6, a moment before with current updates, had missed.
Makes most machines usable again, and quickly.
http://WeedTracks.com/ - 80,000 Weed files, Legal, Sharable Digital Distribution
> These test results are well worth your time.
Quite presumptuous of you to decide what my time is worth!
Anyway, since I use Linux and the only time I install software not via the package management, it's installed as a new generated user whose homedirectory is then killed with "userdel -r" - No, I never had a problem with spyware and probably won't in a long time to come. Ergo these tests are completely irrelevant to me.
I find the only way is to install FireFox with adblock.
Remove the IE shortcut, and rename the firefox link and check the icon it the stupid E.
And had Spy-Bot,Adware and SpywareBlaster running but you still get "users" installing crap,.. e.g. screensavers,and crap.
I been admin here only a few months but when I can the network was in shit. And 99% on the systems had at least 1 smileyface or such search bar installed and riddled with other crap.
Only do a update and full scan on a system when a user really complans about the speed of there PC for over a week or more.....
"NIPPLES!! I HAVE NO NIPPLES!!!" -Happy Noodle Boy
These test results are well worth your time.
No they are not. I already burned all Windows CDs in the fire. You wan't believe how much time I gained by doing this!
There you are, staring at me again.
I dont use any, and have no problems.
That's kind of the point. If spyware broke your computer immediately, you'd know it's there and would be able to remove it.
If you've never checked for spyware, it might be on your system.
You can declare that you know you don't have a disease because you were never tested for it.
LK
"Hi. This is my friend, Jack Shit, and you don't know him." - Lord Kano
top three anti spyware programs: 1. osX 2. Linux 3. commodore64
or else!
What's wrong with the general public is they don't give a damn about computer security. Nor should they have to -- a computer is supposed to be a generic consumer product, usable by anyone.
Unfortunately that's a long way from the truth. But I think you should blame the engineers and computer scientists, not the end users.
too right, and well, *I* don't ever go to p@rn sites or anything like that, oh no, but I suspect that a fair percentage of the posters here do, and any number of sites that *all* have ways of trying to get spyware onto your system. To the poster, *other* people *use* the internet, the "none here" poster clearly only views sites from a list of regulated safe sites. I might randomly trawl 500 sites a day looking for *something* or *nothing*, but in doing that I might hit on some interesting information that may lead me somewhere else. I'm not a monk, using the internet isn't a case of "Radioactive Material, approach with Caution", don't give us that Holier-Than-Thou cr@p about "when will people learn" (which pretty much equals, "nya nya, I'm better/smarter than you dum shmucks"). Fact : spyware is around, maybe not on large reputable sites, but when you trawl the internet, searching or messing around or *enjoying* the internet, then you will come across it ... obviouly not if you are the poster of this thread, who is Perfect, and may in fact be the Second Coming I suspect, but for other lesser *normal* mortals, it's there, so simple safe precautions make sense ... put suntan lotion before you go for a walk in Death Valley huh ... and use anti-virus / anti-spyware before you go on the internet ... simple sensible precaution ??
I use a mac and firefox. As far as I know, I haven't had any problems. Does anyone bother to make spyware for mac's? Does Java's sandboxing make it hard to write platform-independent spyware?
Reality is nothing but a collective hunch.
I've been an Ad-Aware user ever since I discovered spyware. SS&D was always over-zealous and broke too many legit applications for my liking.
That's what SpywareInfo's for.
http://www.spywareinfo.com
It's arguable that they're the biggest antispyware site out there, and if nothing else, they can get the CoolWebSearch strains that even Ad-Aware and Spybot can't get (real-yellow-pages, linklist, et cetera).
(Disclaimer: I'm a Trusted Advisor there.)
Striking fear in the authors of godawful fanfiction, I am here, appearing in darkness, Tuxedo Jack!
Spybot Search & Destroy is more preventive, as far as I know Ad-Aware doesn't do preventive measures like blocking (kill bit) of known bad ActiveX controls.
Really, I don't. Can some explain what exactly these "tools" do?
Perhaps I'm in a rare position and have been lucky to be immune from such troubles, but it seems to me that checking startup items, managing what's running on your system (exe's, services, etc.) is fairly routine stuff. And if there is a problem, deleting a file, making a simple regedit, etc. can't be that hard, right?
What's your secret?
He has no secrets. I am currently logging in to his machine, if you call Windws 98 a machine. he can either pay me for real spy removal tools or I email his files to his mother.
Love,
Mr. Hacker
did you set firefox to be his default browser ?
otherwise clicking on links in email opens IE
installing is not enough
There are also products that use the HTML Active X control (such as EditPlus and WinAmp I think) thus by-passing your hard work.
There are places where the networks are not touching,and there are places where they are-Boeing's Lori Gunter
I don't have spyware cuz I check processes for new things that pop up (XP Pro). I've had malware before and I reformat ASAP. Now, one nifty line of defense I use is a freeware program called Startup Monitor. http://www.mlin.net/StartupMonitor.shtml
...that I run FreeBSD, Linux and Solaris.
The least Microsoft could have done is create a non-admin user upon installation and force users to work as that, e.g. by changing word, excel etc. to refuse to open when used by an administrator and changing IE to refuse to work on anything but windowsupdate for administrators.
That would have been far more effective than SP2 and all the gazillion tools one seems to need today to be able to use XP reasonably.
It would also have cut down on a lot of Spam.
Yes, it would have been annoying, but safety-belts were annoying, too, when they first appeared.
Security is sometimes annoying, people should get over it, just like they got over Windows Product Activation.
Rainer
Windows 2000 - from the guys who brought us edlin
I don't have spyware cuz I check processes for new things that pop up (XP Pro).
What about programs that appropriate the names of legitimate windows processes? Or ones that take advantage of the shortcomings in the font used in the task manager to look like a legitimate process?
LK
"Hi. This is my friend, Jack Shit, and you don't know him." - Lord Kano
you're definately on to something. another damaging policy happens here, at my university. all students live behind a draconian firewall their first year that lets nothing through. then when they leave they're dumber about security than when they started. isps and schools need to put more emphasis on the user to handle their own security. we don't let broken/dangerous cars on our roads. isps and schools shouldn't allow them on their networks.
This is a very good solution :
http://www.freedownloads.nl/hitman_pro.htm
It's dutch and it runs Ad-aware, Spysweeper , Spybot S&D, Stinger, Spywareblaster , ect...automaticly....
use only Free software
A decent browser, good av software and a patched os will protect you from most things but the reality is that most people will click on the okay button of the "Can I please install malware on your computer" dialogue box! Users are exposed to so many dialogue boxes during the day for puerile reasons, they become conditioned to mindlessly clicking on things to get to their destination. So that when one pops up for a decent reason, they click on the damn thing anyway. Non-techies out there have no idea of cyber-hygiene, which in todays environment is the equivalent of not using a condom while you bang crack ho's while mainlining H from a shared needle (almost)!
"... twenty anti-spyware scanners were pitted against a collection of 15 adware and spyware programs that were installed with the latest version of Grokster ..."
15 pieces of trash with ONE program!
Me charging $60 an hour and HijackThis.
Seriously, I've yet to see spyware that booting into SafeMode and running HijackThis won't cure.
Sometimes I wish I was a plumber, then I'd know how to deal with other people's shit.
I use Spy Assissin. You download it from the ad-aware site, and have to pay for it. I think it's supposed to be better than adaware SE, which is the one tested (that's the free one).
Spy Assissin is cheap, and you get a 5 PC licence for it. Certainly sorted out a few nasty popup problems on my dads PC (though he probably didn't mind some of those lovely ladies popping up, but I'm sure my mother would have if it had gone on any longer).
Spy Assissin is updated regularly, and each time you run it it downloads it's updated (and reinstalled updated software, if required).
Pity it wasn't tested.
T.
scanners do not prevent the problems. They do only detect them. Note that some of them also detect cookies. cookies do not affect your system stabilyty but they can be used to track your surfing behaviour.
So the question is then: what spyware do you have and how did you get it.
Note also the diclaimer in the linked article. Some spyware is not detected because of the policy. spyware can be dived in category's spyware that is visibly installed (you know what you get when you install kazaa). To the search related (alexa what's related installed in internet explorer) to the hidden installs of activex applications/dailers.
I am mainly interested in spyware that (can) disrupt system stabily (hidden proxy's, resource hogging, improperly uninstall when related free application is deinstalled)
Ah! Then try Security Taskmanager instead of that crappy windows taskmanager. Sorry, it's not free, but has a trial period. http://www.snapfiles.com/get/securitytask.html Also, StartupManager (the free one that I can't recommend highly enough, see grandparent) catches stuff that tries to run at startup which is at least a valuable tipoff that something is wrong.
I personally recommend Ad-Aware and S&D to my friends; it's been effective, methinks.
The most important thing is: if they must run Windows, a combination of those two kill the usual culprits.
is "think before install something" and "don't use insecure browsers". Never ever got a single pice of spyware with that. Nor did my parents or my girlfriend, who are not really what you would call "experienced users". And it don't even need performance hungry scanners.
The anti-spyware game is a real case of horses for courses - one tool will detect some spyware and miss others, while another will find all the bits the other missed, but miss off a couple it didn't. There really is no 'definitive' spyware removal tool and it's foolish to say there is. I advise people to run both Ad-Aware and Spybot with latest updates at least once a week to ensure almost all spyware is found and removed, as I've had too many instances of one of the two missing out five or six items on every sweep that the other one found straight away.
.dll that a program the user makes use of hooks into, the program may stop working, and who would get blamed? the anti-spyware vendor. Hey presto, Spybot looks like pure evil because they just killed off Joe User's cool new P2P app because keylog32.dll got wiped. This happened a lot when Kazaa was big - naive users getting told by techy types to run Spybot every now and then to clear spyware ended up bitching because it nuked the spyware that Kazaa checked for before starting up. They didn't seem to care about privacy when protecting it stopped them getting their MP3s and porn.
.exes, they will visit dodgy sites and they will do all manner of things because they believe they are safe. They don't understand that spyware blockers only work against known types of spyware, not all spyware in total. Naive users seem to think it's an agreement between spyware vendors and anti-spyware companies when it is, to all intents and purposes, an arms race which the anti-spyware groups will always in second place.
/. are now serving ads to the Microsoft 'Get the Facts' campaign? Is this Slashdot putting one over on Microsoft by taking the money they throw at them when they know no-one here will believe it, or have they reached a new low, actually showing not just Microsoft ads, but ones that feature blatant FUD against FOSS?
You could probably get even better performance by running more than those two, but I'm not going to harrass my clients to start running half a dozen programs just to remove spyware and it's a pretty rare thing to come across a piece of spyware, even a humble cookie, that both of those two miss. Anyway, my point is this; You can't just run Ad-Aware or Spybot and think you're protected. Until an anti-spyware tool has a 100% record against all known spyware, I won't consider them anything near a definitive tool, or a licence to behave recklessly on the net, something which too many naive people seem to do.
The problem with anti-spyware tools is three-fold;
a) They are made by private companies and individuals who's credentials and/or decency cannot be guaranteed. They could easily take kickbacks from spyware companies in exchange for 'excluding' their programs from the scan list. Sure, it might not be happening now, but what's to stop Lavasoft suddenly to start taking kickbacks to let the less insiduous spyware through? Unless you're on the inside of a company like that, you can never be sure. I'm sure Lavasoft aren't doing anything like that, as these results prove, I'm merely using them as an example - any anti-spyware app people trust is in an immensely powerful position on the user's computer, and any money-seeking company can theoretically be bought out.
c) When they remove a spyware
c) People do, as I mentioned above, use them as an excuse to behave recklessly on the internet - they will install random
Anyway, what was my point again? Oh yes, that these statistics are misleading for naive users. Ad-Aware and the others are now going to start shouting from the rooftops about how they're one of the top 3 anti-spyware apps on the market, and thousands of lusers will trust themselves to it implicitly solely because of that blurb, while the reality is Ad-Aware still misses stuff, and it is more than fallible. That 'lowly' Spybot has turned up half a dozen items Ad-Aware failed to find at least three times for me, but I wouldn't run that on it's own either - Everybodyb knows it's a good idea to get a second opinion, especially when it's free.
Also, does anybody else find it funny that
Dealing with lawyers would be a lot less tedious if they all looked like Casey Novak.
Run some you might me supprised, my company firewall regularley blocks known spyware in websites like hotmail. Just because a site isn't seedy doesn't meen it won't contain spyware, hell i even found some that got installed by ubisoft when i used to play IL2-Sturmovik. Last ubisoft game i ever bought. I wouldn't be complacent if i were you.
Saying Apple is better than MS is like saying Botulism is better than rabies.
The reasons seem to be simple;
Yet, the test results show that the spyware detectors aren't in the arms race against spyware that I described above. Instead, many spyware revisions aren't detected at all. Either they don't know about the spyware revisions, the spyware is not being tested for, or the spyware is being ignored on purpose.
Right now, the bar that the spyware creators have to leap is very low. Both social engineering and direct injection onto systems make spreading these things fairly easy to do for the spyware maker. Tie that in with many spyware detectors not detecting completely, and not being used consistantly, and I don't see an end to this problem soon for most people.
What to do? I'll leave that to others for now. I have my own lists. It is a security issue so the systems should be considered to be on hostile networks and hostile users. I consider 2 hours to lock down a Windows XP system to be a reasonable minimum amount of time to spend on each system -- unless automation tools are used.
A firewall can not protect you from yourself. Turn off what you do not need. Do not use the firewall to do your work.
I finally managed to install SpyBot S&D on my Linux, and only now i found out that SpyBot is not so good after all. Oh, will I ever be safe from spyware ?!
User stupidity is still the number one security problem.
I run a small IT consultancy, and nearly every internet connected PC we work on has a significant spyware infection on it. It's not only our job to remove it, but to prevent it coming back. The things that I've noticed after fixing a lot of problems:
This won't stop everything by any means, but it slows down reinfection. End users need to change habits - reading EULA, not just clicking OK, using passwords - but this isn't something you can do with a couple of hours work, so people aren't willing to do it. I have no solution to that problem.
Seriously guys, none of these spyware removers are even remotely perfect and they all suck time and CPU cycles. I disavow any knowledge of this guy, Mike Lin, but his itty-bitty FREEWARE program kicks butt.http://www.mlin.net/StartupMonitor.shtml It does one tiny little thing with almost zero overhead, it tells you what wants to insinuate itself into one of the several startup vectors of Windows. And gives you the option of not allowing it. Any spyware must have some part that runs at startup. This gives you a warning and a filename for googling to remove whatever you have contracted. Probably works for many worms, viruses, and trojans too.
Er... you have that backwards. I said that it's not actually like that. But the marketing departments claim it is, and it would all work better if it was. So it should be.
It's impossible to make everyone in the world an expert on computers, so you might as well give up complaining about it. It's also impossible to prevent people who aren't experts from using computers.
It's not impossible to make computers secure. It's a very hard problem, I admit -- it's much easier if you can rely on the users to know what's going on. But it's solvable, and that's what the industry needs to be working towards.
A car is a generic end-user product as well. But if the engine catches on fire because the owner hasn't changed the oil in 12 months, despite the car manual prescribing a change every 5,000, documentation from the dealer saying the same, and red blinking light in the dashboard, no one blames the engineers. The exact same thing is true of sypware and viruses - it is a well known problem, the user's companies and ISPs tell them not to open the attachments, Windows XP even issues a warning prompt, but they do it anyway.
You can engineer many problems, but you can never engineer away human idiocy. There will always be some idiot who will find a way to kill themselves with a pair of dull safety scissors.
the article seems well done and deep but the presentation of the results is lackluster. they performed all those rounds of tests and analysis and the "conclusions" are
Spyware and adware can prove quite difficult to remove
No single anti-spyware scanner removes everything
etc. no kidding! why did they need to compare them to find out what is conventional wisdom for most people already. there is no quantifiable list of best-to-worst that i can find on the site, which is really the most valuable result of a study like this.
a waste of their time and ours.
Folks, you should check out this Sun Java Plugin Arbitrary Package Access Vulnerability
HOwever , these programs could do anything which is the worrying part. 99% of them may just be Gary Grocer trying to make some extra money
I think you're underplaying the seriousness of Gary Grocer's nefarious activities. After all, he's an internationally-wanted credit card fraudster who is also notorious for using zombified PCs to send spam.... that's how he makes his "extra money". (Note: There is a reward for the capture of him and his money-laundering associate, Freddy Firefighter).
"These people are scum, " says Florida's Head of Anti-Fraud Investigations, Calvin Criminal.
"Damn right, " adds his colleague, Alvin Arsonist.
"Slashdot - News and Chat Sites Deviant". (Click "homepage" link above for details).
I dont use any, and have no problems. Never. And i fix other people's computers without them.
Same here, I call it the ol Format/Reinstall process.
Life is not for the lazy.
Perhaps, but it's not Levi's fault if I go out with my trouser zipper undone. People need to be educated about computers requiring security, much in the same way I was educated last week on the functions of a zipper.
sig free since 1993
Until engineers and computer scientists can make computers idiot proof, I don't see why we should consider computers a 'generic consumer product'. You need a license to drive a car, since the car is by no stretch of the imagination idiot proof. If you try driving a car in traffic without any sort of training you'll most likely end up hurting yourself and others.
Similarily, using a computer with a broadband connection to the Internet without at least some idea of how to make the computer secure (i.e. antivirus software/firewall) will most likely result in a computer infected with trojans and spyware, causing problems for the owner. What's worse, his computer will probably infect other computers as well.
Sometimes the concept of an "Internet license" similar to the driver's license actually seems like a good idea. A driver's license doesn't stop car accidents from happening, but a least you're keeping some of the worst morons off the road.
I can concur with the grandparent. I have a windows box running xp, and use firefox and thunderbird. It lives behind NAT from my linux box, and I never see any spyware/malware crap.
I just ran Ad-Aware for the first time in a while (it told me my definition file was 109 days old), and it prompted me to go download an upgrade. Ironicly, it launched IE for this (firefox is definately set as default). Once it finished updating and running a full scan, it found 4 whole 'bad' things, which in this case were IE tracking cookies (doubleclick.net, etc). 2 of those 4 had a creation date of today, meaning they were picked up in the process of downloading that adaware update...
Personally I find that only granting read permission on the Run & RunOnce registry keys prevents a lot of problems, as if doesn't seem that any malware I've come across is smart enough to reset the permissions.
While we should be grateful for the work done by the reviewer, I cannot but notice that the results are hard to find out.
I, for one, would like to see some conclusion or recommendation or rating (Anti-Spyware A - goog; Anti-Spyware B - shit; Anti-Spyware C - excellent).
I know the article focuses on falling efficiency, but still, it's a bit overwhelming to go over those huge tables.
About half the time a user removes spyware from a PC that is running really sluggish, I've found that it the spyware removal utilities does NOT repair the winsock registry keys. Thus, you can't even get TCP/IP connectivity. You will know it's broken if you get an IP of 0.0.0.0 or will fail instantly to repair the LAN connection in XP and just get a 169.x.x.x address.
; en-us;811259
If you do plan on removing a heavly invested PC, be sure you know how to fix repair winsock.
If the customer is running XP with SP2, then you can run the "netsh winsock reset catalog" command (without quotes) to repair the connection and reset the winsock settings back to defaults. However, if the PC does not have SP2 installed, you will have to check out this link http://support.microsoft.com/default.aspx?scid=kb
For Win9x users, check out this link http://support.wadsnet.com/winsock/winsock98.asp
Life is not for the lazy.
Seems to be more and more firefox is leaning towards the 'Weve blocked this, click here to find out why' approach, would be nice if this was extended to all areas including dangerous java programs/etc.
This stuff scares me. With each generation, these spyware writers become sneakier and more devious. As much as I have a handle on technology now, I imagine that there will be a time when I will have to ban myself from electronic transactions and do everything by hand and feet. One of these days they will get me... and that sucks.
I fear for my father who knows just enough of using the internet and installing applications to be dangerous. What's worse is that he often defaults to standard browsers that came with his ISP (e.g. Earthlink), who use IE.
what sort of job does that do on cookies?
Spyware doesn't just include a .exe on startup.
Saying Apple is better than MS is like saying Botulism is better than rabies.
Actually, a really good suggestion. I am learning stuff here. http://www.windowsecurity.com/articles/Securing_th e_Windows_2000_Registry.html
I'm surprised that they don't mention this piece of s**t. But since I haven't yet seen a program that can remove the latest version, I'm not surprised. This insidious piece of work actually installs a device driver which continuously monitors its files and prevents deletes etc.
Even starting in so-called 'safe mode' won't stop it. You have to boot with a CD and erase it manually.
The people who wrote it are 3721. something, and a link to it even appears on the default Chinese search page. In theory it just allows for Chinese name searches, but in reality does much more.
You have been warned - please don't visit the site.
The general public is composed of people who literally can't tell the difference between Adobe Photoshop and Adobe Acrobat Reader, or Mozilla Firefox and Mozilla Thunderbird. This is no hyperbole, I know many people with this problem and I'm sure you've met some yourself. They'll call and say, "I'm having a problem with my Adobe." Or ask you repeatedly which application you're in right now when you're both looking at the screen, even though the applications present completely different interfaces. The person usually will have been using the applications in question for months or years, and still can't tell them apart without thinking about it really hard.
Is it simple ignorance? No, that could be easily corrected. Is it sheer stupidity? No, these people are otherwise of average intelligence or better. It's some kind of weird mental blindness that comes over people whenever they are faced with a computer screen. It's conditional stupidity, and it's one of the main problems with the general public. Most of them will never learn to be careful until you hook up a car battery to their earlobes that gives them a physical notice whenever they do something stupid. Otherwise they just don't seem to be equipped mentally to grasp the concepts involved in using a computer responsibly. The software industry hasn't exactly been helping matters, but they have a monumental task ahead of them. I think computers are just too abstract for a lot of homo sapiens sapiens to deal with.
The secret is to turn JavaScript OFF.
"Moreover, users should learn to practice safe computing habits, which include avoiding web sites and programs of unknown or dubious provenance and carefully reading End User License Agreements and Privacy Policies."
Am I the only one who doubts that will come true any time soon, we all know how to click on a button as a reflex action, reading a lengthy EULA full of lawyerspeek... that's a headache.
Also, sysinternals.com has a pretty decent process explorer.p .shtml
http://www.sysinternals.com/ntw2k/freeware/procex
My email addy? should be easy enough.
You fix their computers without them? Isn't that illegal?
I've said this before, but here goes again: what's "wrong" with non-nerds is that they're used to the Real-World "security model". The real world doesn't work like computers do.
In the real world, you don't have to have an absolutely-unbreakable titanium-plated vault door to your house, nor bullet proof windows. If anyone wanted to hack your front door down, it's worth a maximum 5 minutes with an axe.
Real world locks also aren't supposed to be unbreakable. Au contraire. By computer security standards, they're a catastrophe. Most allow 1-pin-at-a-time attacks, which in computer security is the worst anti-pattern. Locks with master keys allow easy escalation of privileges too.
It's all documented vulnerabilities (or exploits) and they've been known for ages, and never fixed.
But they work IRL anyway. Yes, any kid could lockpick your front door, or hack it down, or just throw a brick through the window to get in. But people still use locks, doors and windows.
Why? Because the IRL (In Real Life) you don't live in a lawless no-man's-land where any kiddie with a lockpick is l33t and free to pick your lock. IRL your real defense isn't the lock, but the law.
The lock or the door just markers. They just say "you're not supposed to be past this point uninvited, and if we find you inside, we'll throw your sorry ass in state jail."
(If you're a die-hard gun fanatic, feel free to replace by "if I find you in, you'll get a gut full of buckshot." Same idea: there'll be repercursions. The door just marks the point beyond which the thief is not supposed to go, not _the_ deterrent itself.)
And people instinctively expect the same kind of rights and protection to apply to the online world too. "This is my computer, you're not supposed to be on it. Your playzone ends at the ISP, and this side is my private property."
Unrealistic expectation? Maybe. But it exists nevertheless.
Unreasonable expectation? Not at all.
A polar bear is a cartesian bear after a coordinate transform.
For cookies I use Firefox and disable 'em. Exceptions for Slashdot, of course.
Compare what you said with buying/operating let's say a car. It drives and everything, but people still like to lock their car, and use airbags, all to improve security (for themselves and the car). Why not do the same with a computer? The fact that it only became a (big) issue recently shouldn't matter much.
:)
Btw, brave comment to post
This spyware tools only apply if you are on Windows. Even if you are, most of spyware (and the nasties kind) will not affect you as long as you stay away from IE and OE.
And I'm saying it running FF 1.0 on Fedora Core 2.
What's wrong with the general public is they don't give a damn about computer security. Nor should they have to -- a computer is supposed to be a generic consumer product, usable by anyone.
That would work if a computer had about the same features and abilities of a toaster.
Unfortunately, a computer is mixture of hardware and computer software that can do office tasks, multimedia, file sharing, communications, and gaming. The feature set is easy to upgrade and expand through software installations.
In addition, due to most computers being connected to the rest of the world, the cost benefits of spyware/viruses (creating spamming relays is big money) and the fact that trying to infect an individual computer is effectively free, the problem is apparent.
Any product with a ton of features and abilities requires user training. Its possible to easily design a car that doesn't require knowledge to drive -- as long as everyone will only go to the mall or the grocery store. But people use their autos for many destinations, over many different roads, and thus we require people to learn how to use cars.
A computer is no different.
Want to write documents? A typewriter works. Some of the electric ones were quite nice. Want to send text messages? SMS over mobile phones. Want to send documents? Fedex. Games? A console. Music? A radio.
Want to do all of the above, and more, with the ability to extend the features and easily upgrade for less cost? Okay. But it will require some training.
If you disconnect yourself from the internet, and lose that feature set, you will probably be secure. Even disconnected, not knowing what you are doing will have consequences. If you are lucky, the only consequence will be wasting your own time. If you are unlucky, you will be frustrated by fighting with the computer all the time to do what you want, how you want it.
Do you want to connect to the net? Congratulations, now you are exposed to the worst people in the world. Would you be cautious walking down a street in Romania with your credit cards in your wallet? Why aren't you cautious while you are online, making purchases, connected to the same network as a Romanian hacker?
I'm sorry, but we can't not create an idiot-proof box. We can't even make a box that requires zero knowledge to run. Our best bet is education.
I support your view, that the general public shouldn't need to know anything but the most basic security procedures. Using the computer to surf the net is often compared to driving a car. I had to learn more than a year how to drive to get a driving licence. Using a computer is a lot more complex than driving a car and knowing when to hand it to someone to maintain it. With computers, users are exposed to so much stuff to learn that they are happy when the computer does somewhat what they need to have. People are burdend enough to get their machine doing what they need. They don't want to learn yet another thing, just because the machine can't seem to protect itself.
The general public has been trained to click dialogs away without reading them because most time they either they don't know what it means or they don't know how they could remedy/react to the problem. So they click them away hoping the computer still somehow does what they expect them to do.
Expecting that every user with internet-access becomes an expert in computer security expert is never going to happen. People should know how to surf securly, but as it is right now, there is to much to read and to learn. For anyone who doesn't like to learn the in and outs of a computer (i.E. most users) its a frustrating, time consuming and seemingly endless task.
There is still much to do, to make surfing the web as securly and as easy as possible.
I use IE (set security & privacy to high), and The Proxomitron. I've never *EVER* had an adware/spyware infection. And it blocks out ads as well.
Never had problems with spyware or anything.
:-)
Well, there was this "Pammela Anderson STrip Poker" game in 95 or so.. that turned out to be a hard-drive formatter in disguise.. but appart from that, nothing.
Safe browser habits I suppose..
..trouser zipper undone..
If the zipper were made the way MS makes their software, the zipper would come apart on its own at the most embarrassing moment.
All theory is gray
"Ironicly, it launched IE for this..."
Wrong, AA does not open a browser to update def files--it has its own interface for this. So this would also not explain your two tracking cookies today--perhaps you picked them up on fudgepackers.com?
I think you mean free like in open source and not in free as beer. Since most software you download for free contains spyware like kazaa and grokster, those applications are free because they try to make money tru spyware.
Is "backweb" on win32 still considered "spyware" by those programs?
:)))
One of the inventors of anti spyware stuff called it "spyware" and forced my novice brother to delete it.
That "spyware" was installed by Siemens and FRISK, makers of F-Prot for gods sake! Its job was to download virus definitions for F-Prot Mobile which came with guys computer.
In 1 week I had to clean a damn new windows virus which was advanced and his half of documents were deleted by that virus.
I knew he was novice and wouldn't care about updates so I installed backweb on PURPOSE!
There, the company and customers which Ad-aware considered spyware
http://www.backweb.com/customers/
Note I am not against Lavasoft but I think the "paranoia" level of anti spyware is way TOO HIGH. E.g. deleting doubleclick.net cookies of IE which comes with P3P installed will get "bravo" from users but advanced ones will know it means NOTHING.
Even better would be to turn Web Developers off Java Script ;)
Linux is not Windows
Ahhh yes, the power of Visual Basic. I like how professional the software is, it doesn't even say you need the Runtime libraries. Their website is mostly filled with "technical questions" about how to order the software.
Let's hope they address that.
Small potatoes make the steak look bigger.
go on... do it... you know you want to... :)
Donald 'Duck' Dunn: We had a band powerful enough to turn goat piss into gasoline.
You could simply buy an iBook and look at it as a peripheral for your cryo-cooled 1337-gamerboi PC.
You use the PC for playing "City of HalfEverDiabloCraft III" and for generating dubious overclocking benchmarks and storing your MP3's on your terrabyte RAID with the windowed 250gb SATA disks.
You use the Mac for web surfing, email and IM, to store critical documents you don't want eaten by Virii (making sure to back them up to CD-R every now and again) and generally Doing Usefull Stuff.
That way, your precious game time is uninterrupted by Microsoft's Keystone Kops approach to secuirty and monoculture attacks. Let's face it... you ain't never gonna be able to lock down your Windows box, no matter how much money and third party utilities you throw at the problem.
Alternatively, OpenBSD on any old laptop is another way to dodge the spyware bullet, if your Unix Fu is the stronger.
SoupIsGood Food
What good does a 90% detection rate do when programs can be remotely run via a web browser (or remote OS update program)? There is a design flaw here someplace which shouldn't require more bugware to compensate for.
Download=fine.
Download and automatically execute=very bad.
It IS impossible to make anything (not just computers) 100% secure. Sure, you could kill all humans worldwide so nobody could think of new exploits but as long as there are users that want to use the network/host in another way than it was intended it is not possible to get 100% security.
Linux is not Windows
...is to be found on http://www.linuxiso.org/ - and, best of all, it's free! \o/
:%s/Open Source/Free Software/g
YTARY!
I was under the impression Ad-aware's scanlist oriented more towards tracking info and the like.
Personally I rarely use ad-aware by itself due to the amount of things it misses --possibly just the unique spyware demographic i've encountered, but I'm not sure I ever recall running ad aware AFTER spybot and finding more than a few cookies.
If you can't see the value in jet powered ants you should turn in your nerd card. - Dunbal (464142)
The most important advantage of a license would be the possibility to revoke them for users proving to be complete idiots even after a reasonable number of warnings which would spare the rest of us the spam-zombies created by this stupidity.
Linux is not Windows
You'd think that the hosts of "Innovators of Wrestling" would yank it if it were downloading crap onto people's computers without their knowledge - in violation of the LAW!
But then again, I've seen how well most System AdminDUHstrators manage their sites; perhaps my surprise is simply the result of my moring coffee not kicking in yet.
And here is a question for the class to consider: Given the difficulty of removing spyware in a machine which is running the spyware, why has somebody not taken Knoppix, Wine, the NT filesystem wrapper code, and a virus cleaner, and created a boot disk that would
- mount the users disk using the NTFS in the kernel
- locate the native NTFS DLL, MD5 check it, and assuming it is not corrupt use it to mount the system R/W
- Use winelib to access the registry and clean it
- Run the filescan and purge to remove the infections
. That way, you would need to reboot twice (once to boot into the CD, once back into Windows).Granted, for me this question is of academic interest only - I don't run Windows anymore. But for those of us who have relatives still stuck in purgatory, this might be a better way to run.
www.eFax.com are spammers
I dont use any, and have no problems.
I use Spybot and Adaware in combo. I also use AVG anitvirus. I'm not sure why, just for peace of mind I guess, because they have never, ever turned up anything on my own box, and I've been running the same install of original Windows 98 on a cable connection for four years now, much of that time without a NAT/firewall box (although I'm only in Windows about 10 hours a week).
A little informed caution really does go a long way.
When I fix other people's computers I use them because it does "jump start" the process of cleanup making things go a hair faster and smoother. I like faster and smoother. They're tools, like using a circular saw for long rough cuts, as opposed to a hand saw. Of course you'll still use hand saws for the fine finish work. Plus if I can get the people themselves to run them once in awhile I don't have to fix their computers quite so often, and I prefer to be paid for preventitive medicine, rather than emergency meatball surgery. The hard part is getting them to run them on a regular basis, and some of them just will click on every mailing list attachment that comes down the pike.
When are people going to learn to be careful?
Let us observe the behavior of people while they are engaged in a legitimate matter of life and death, shall we? Say, while driving?
I think the answer to your question, for most of them, is 'never'.
what is wrong with the general public???
Oh sweet Jesus, you want me to try to answer that in the space of a forum post? Yeah, right Bob. Blow me.
Ok, ok, I'll give you the Reader's Digest condensed version:
They really are functional morons.
KFG
Wrong, grandparent meant it launched IE to download a new version of Ad-Aware which is the case.
Well, I tried this Lunix thing you mentioned.
After spending about an hour configuring the windowing system to work, I was able to get started. Why is it so sluggish?
Couldn't get The Sims to run. Or MSN for that matter. I tried quake, but the performance was kindof lacklustre, and I had no control over the resolution. But I don't use my PC just for games.
Shame I couldn't use it for Photoshop either. And it didn't seem to support my scanner.
My point is that Linux is not an option for a lot of people. Sure, I could probably find an MSN client, but a lot of applications don't have an alternative. Gimp is nowhere near a replacement for photoshop; This is why Adobe is still charging a lot of money for it. Hardware support is not perfect, especially for more specialised hardware.
I took a (not that hard) look at which are best as compliments to the top dog, GIANT AntiSpyware.
Turns out that SW Doctor seems to fill up the holes best, even better than AdAware and SpySweeper, although they come in better as standalone.
So, GIANT AntiSpyware with a liberal helping of SW Doctor and maybe an occational spray of AdAware seems to be the medicin to use.
Some anti-spyware tools have done a horrible job in my experience, incorrectly removing them sometimes leading to crashes occasionally (in fact, one that I've experienced was due to ad aware). A proper test should also test how correct the removal is and test the stability of potentially affected programs.
I'm wondering how they did quality analysis of the removal process.. Whats to say that some spyware removed here was only disabled or half removed?
Its also a matter of their distribution on the planet, of all the billions of worms out there for instance, just because a virus detector detects more then the other ones, they might be extremely rare.
I wouldn't rush off and choose any of these based on these figures, because the best ones could easily be the ones which incorrectly remove common spyware breaking stuff.
I think eric did a good job though. Maybe though he should update the results to include the distribution in the wild and quality of the removal
A lot of people here have made a mockery of the relevance of spyware removal tools, and even questioned whether spyware is a real issue at all. These people probably haven't tried to combat the latest strains of the CoolWebSearch infestation. Visiting a friend recently I noticed his laptop had gone totally Ga-ga, and I offered to help, thinking that a quick anti-virus scan accompanied by ad-aware cleansing, would get the unit back in shape. It didn't. I tried every automated and manual step-by-step procedure I could find on the net and nothing seemed to help. The premier anti-CoolWebSearch volunteer on the net seemed to have given up (as reported by the Register) I ended up deciding that it was less time consuming to save the few vital files that existed on the machine, and reinstall the operating system, rather than trying a meticulous process-creation-timestamp-analysis. The operating system I reinstalled was Win XP (not Linux). Why? Because my friend is a technically challenged moron and will never be capable of using anything but Windows for desktop computing.
Why not just 'not' log in as 'Administrator'? I mean, nobody logs in as Root in Mac or UNIX, but it's default to do so in Windows. In Mac, before installing anything major, it prompts for a password, even Updates. In UNIX you need to SUDO. When I set users up in Windows, they are all USERS. If they really are dangerous to the system, I put them in the GUEST group. Spyware and Viruses don't work without access. By default, Microsoft condones ruinware because of it's ambilivent user policy design.
Also, there are clearly some infections that no product can see...vendors, are you paying attention?
And finally, to the apologists for the spyware industry: ANY piece of software so contrived that
- [a] I don't get some in-my-face interaction like a EULA click-through to warn me I am installing it and
- [b] it has no clearly visible means of completely unistalling itself from my machine
is at the very least a detriment to the performance of my PC and at worst, because it operates in the shadows of my registry and START menu, gives me no easy way to be sure it is not informing others about choices and interests expressed on my PC that are nobody's business but mine. ANY such "convenience" or "novelty" is something I don't want and would never seek to have on my PC so take your sneaky crap and shove back up where it came from, all of it!SLASHDOT: news for people who can't concentrate on work or have no life at all and got tired of yelling back at the TV.
I am genuinely curious as to what motivates people to run software knowing that they are not allowed to look at the source code. Fair enough, you may not understand it yourself. But people are not islands, and you probably know someone who could understand it, if you really needed it understood. And more to the point, if they won't show you the source code, why not? What don't they want you to see?
The only way you can ever know for certain what a piece of software is doing, is by reading the source code. If the suppliers don't want you to read the source code, that suggests to me that they have a problem with you knowing what it does. Which further suggests that it's probably dodgy.
Je fume. Tu fumes. Nous fûmes!
ring ring, hello, tech support, may i help you?
yes, my computer is running slow and crashes a lot, i think it may be infected with a virus or spyware...
format C: and reinstall or use your OEM restore disk - this is a recording... format C: and reinstall or use your OEM restore disk - this is a recording... format C: and reinstall or use your OEM restore disk - this is a recording... format C: and reinstall or use your OEM restore disk - this is a recording...
this is about the only way to actually clean a windoze OS of any version #...
better yet, just abandon windoze and use Linux or BSD...
I think that the spyware industry is one of the most corrupt in the software biz right now.
Many of the tools in that review don't have uninstall procs and some that do like Aluria have 'problems' with the install.log that prohibit easy uninstallation.
Some spyware tools like Adware (not Adaware) are flat out spyware themselves.
And the remainder for the most part, are scanners that tell you something and then want you to spend $19.95 to remove them.
That's only slightly more ethical than Mafia protection scams.
Best case scenario any tool you use is missing about half of the spyware that may or maynot be on your machine. Your best bet is to use a few different tools like S+D and Adaware and to use real time blockers wherever possible.
Note: I have an XP Home machine at home where S+D teatimer has memory hole and it can't be run w/o consuming all the RAM.
Comment removed based on user account deletion
First off, I love linux, but in this case I think there's a better tool for the job. (The following is not really a shameless plug).
I use Bart's PE Builder. In a nutshell, it's a bootable cd with a Win32 network, disk (with native NTFS support) and GUI API load. The best thing is that it's built using actual Windows dll's and the like. Of course, you have to have a copy of XP or Server 2003 to built it, and it may not be strictly within Microsoft's licensing agreement to use their IP in this fashion, but that doesn't bother nor stop me.
Anyway, there's a native Ad-Aware plugin for BartPE, and I've hacked together a Spybot S&D plugin, as well. My usual proceedure is to boot the system with my cd, run AAW & S&D to clean up files on the hard drive. Then, I boot from the hard drive into safe mode with networking support, install the latest versions of AAW & S&D, and run them again. This cleans the registry as well (which unfortunately I haven't figured out how to do under BartPE... yet). This method has worked well in situations where the system is so infested I can't start from safe mode.
Part of the problem is that even with the proliferation of anti-spyware programs, often to completely eradicate these nasties, manually crawling for files and registry entries may be necessary. At least for the forseeable future I don't see this becoming a fully automated task.
This isn't just something encountered online though is it?
When it transfers itself to an EU citizen's PC and runs in the background collecting information it is acting within the EU. The EU could conceivably extradite the people responsible for this and try them as crimes have been comitted in the EU as surely as a cracker gaining illegal entry to an EU government computer from a terminal in the US has comitted a crime.
There's two utilities I use on a regular basis for winsock fixing:
1. LSP Fix. This program will let you see what dll's are embedded in your TCP/IP stack. Most of the time it will even detect stuff that's not supposed to be there, but you do have the option to override its judgement. Spybot S&D also has the ability to look into the stack, but you can't use it to remove offending modules, nor see their actual dll filenames.
2. Winsock XP Fix. This nifty little utility will basically reset all registry settings for the stack back to what they're supposed to be. This is usefull if some nasty has totally trashed the stack on its way out the door. It would also appear it works on earlier versions of Windows (certianly Win2k) but I've never tried it on anything but XP.
I used to joke that as long as people break their computers I'd have a job, but there are times when the spyware thing really drives me up a wall...
Unfortunetly I just switched my laptop back to windows from linux due to some software I must use (VMWare is too slow and WINE won't run it).
I am now faced worrying about spyware and viruses.
What I've done:
-Use Firefox for browsing.
-Set IE security to HIGH for the "Internet zone". Disabling ActiveX.
-Added Windows Update sites to the "Trusted Zone" so I can actually update".
-Installed Privoxy to help block junk when browsing sites.
-Installed SP2 so I have a firewall to protect against viruses that hit on the ever so lovely NETBIOS or RPC ports. No exceptions in the firewall.
All of my email is filtered by my Exchange server so I don't think I'll be needed anti-virus on my laptop. I almost never get or open attachments.
I'm hoping this will protect me. If anyone has anymore suggestions, please let me know. Also, I'm trying to figure out why Windows gets slow over time. It's like the installation rots. I'm trying to find out if you can prevent it.
Hope this helps,
Daniel
We use Adaware, Spybot, and Spysweeper. I also use pstools to kill anything in memory that comes back.
Some trojans/virus/spyware programs like to run two copies in memory. When you try to axe one, the other respawns the process.
Pstools will handle this. Pskill run from the command line with an ampersand (&) seperating the command lines will run a kill on two processes fast enough in most cases to kill them both before a respawn.
If it doesn't, start a pretty big file copy process to slow the system and rerun the pskill commands. This is usually enough to kill anything I have run across in memory.
ardustry
It didn't include the two most effective spyware removal tools, Webroot's SpySweeper, and Giant's program.
It chooses to test alluria, which now admits that not all spyware is spyware, since certain spyware paid them money.
They test S&D, which is fair, but they fail to mention that S&D can get less than 1/3 of the known spyware.
Then they only test a handful of software and have no basis for their comparisons.
Cripes. Why bother wasting the electrons for this review?
Ya, I should've made that more clear, but that was indeed the case.
I've recently seen a rash of new spyware that registers a .dll or ten into the TCP/IP stack, or even in some cases a device driver. Those are truly the beasts. And, of course, the normal Windows startup routines don't necessarily apply, since Windows will include the dll's at launch, and once they're hooked into a process, they'll go about their nasty business as part of what may otherwise be considered a legitemite executable. The line between spyware and a virus/worms/trojans these days is so incredibly thin, it's hard to see anymore.
If it hasn't already become obvious I'm all in favor of dropping large objects on the scumbags that make this kind of stuff. Say, a super-large special order 1000 ton ACME anvil, to start?
I get a 1.000 batting average with my favorite anti-spyware prevention (not detection) tool:
Limited User.
And when not working as a Limited User, I turn off scripting and other stuff, and add "*.microsoft.com" to Trusted Sites so I can use Windows Update and Office Update.
Windows XP and Windows 2000 can catch 100% of all spyware all by themselves. If you let them. Spyware (or other software) doesn't install as a limited user.
Use Evolution instead of Outlook? Bewa
The forbes article in the parent also has a not too subtle message that associates computer geeks and terrorists. Are there any groklaw "terroists" out there that could use that for a "class action lible suit"[sic], if there is such a thing?
And did you exchange a walk on part in the war for a lead role in a cage? - Pink Floyd.
There's another class of evilness that doesn't involve startup and that's BHO's (or Browser Helper Objects), which come into play when IE is started and have full access to the computer.
I'm not sure what the secret to success is, but the secret to failure lies in trying to please everyone -Bill Cosby
Anything from M$ since 9x/ME has a built-in access rights system.
NO ONE needs to run as administrator, if they are not installing software.
Still today, lots of M$ users don't know that - what a waste!
-- From Denmark
That's just plain not true.
Impossible in practice is not the same as impossible in theory. It just means we haven't got the right practices available to us yet. And, yes, you're right. It's currently impossible. That doesn't make it the end user's problem. It makes it a research problem. (Or maybe a 'trying to do too much when all people want is web and email' problem).
Also, there's a big difference between 'technically not 100% secure' and 'gets pwned by every piece of spyware or adware on the Internet'. Again, moving away from the second option is a hard problem. But it's up to the software providers to solve it, not the end users.
There needs to be some basic knowledge, yes. Currently the level of knowledge required to use a computer safely is excruciatingly high. It needs to be a lot lower before users can reasonably be expected to meet it.
If, for example, all the user had to remember was "don't type in the root password unless you're installing from a CD", that would be fair enough.
Currently you have to know about viruses, and how you might be infected; firewalls and related networking knowledge; adware and spyware, and how you might be infected with those; the various means of checking for exploits and cleaning them; the various means of keeping software up-to-date... and so on. Turning a Windows box into a secure Windows box is a good half hour's work for someone who knows what they're doing.
There's absolutely no way an average user can be expected to deal with all that.
Quite. Unfortunately my "solution", "make the software secure", isn't especially immediate or practical. Sadly the idea of a widely-adopted "Internet license" seems even less likely to succeed.
About the only thing I can see potentially working is if ISPs took a proactive approach: providing training, checking for security holes, and disconnecting insecure computers.
Sadly I suspect the economic factors just don't work out... there's no incentive for an ISP to abuse its customers to that extent. The bandwidth sucked up by malware is a business expense which they can easily swallow.
Actually... I'll take it a step further. It's not mental blindness, it's willful ignorance. These are the people that will say they don't want to know anything about "that computer stuff". After painfully explaining to them what was wrong with the machine (damn you new.net, damn you to hell!), and explaining why it was causing problems (it's sending you to different places then you want to go, think of it as a malicious gas station attendant that reverses all directions for his own sick amusment), they'll wait until after you leave, and then re-install it.
These are also the same people who argued that Windows ME was the same as Windows 2K, because the Millenium was in 2000.
Nephilium
Slab: Jus' say "AarrghaarrghpleeassennononoUGH" -- Detritus' war on drugs Terry Pratchett, Feet of Clay
It always pisses me off when somebody tries to do this because they never seem to do it right. That is to say, they never fully document the settings that they adjust on each software installation. News orgs are always coming up with statements that Mozilla or Spybot isn't that great, but that's always with out of the box settings. All I have to say is: "Hey, it's not the software's fault if you don't know how to use it!" Also, I felt that this statement was particularly telling: "The test results reported here constitute but a few tests with three collections of spyware and adware programs. The anti-spyware scanners tested here may perform differently with other collections of spyware and adware."
And the fact that it's lawyerspeak raises another issue: even if you do read it, are you going to understand fully what it is you're agreeing to?
You're making good points right up until that last paragraph.
User education will never happen -- you might as well accept it. It's almost impossible to come up with circumstances under which the general population learns enough about computers to use today's machines safely. To most people, computers are confusing, annoying, useful most of the time, and of little to no importance.
Sure, it would be nice if users were educated. But it's a pipe dream. Therefore it's the technology that must change. It's a hard problem, but it's by no means unsolvable.
Most people don't need their computers to do much. The proportion of people who actually use their computer as a computer, rather than a browser-emailer-wordprocessor, is tiny. They're the majority of the market, and they should really be provided for.
I've been doing spyware removals for customer's at my job for over a year now. At first it was easy, just run Ad-Aware and you're done. Now some of the spyware programs are getting much more deceptive and can actually startup in safe mode making it nearly impossible to remove.
:)
At this point the first thing i do for a scan is use a USB adapter and connect the hard drive to my test station then clear all temp folders and run spysweeper and adaware to find any files. Then i reconnect the drive adn boot directly into safe mode and rerun both programs to clean out any registry entries. Finally i go through with hijackthis to repair any damage to the browser.
Ive tried out Giant spyware and it seems to work fairly well but the stupid tray app WILL NOT GO AWAY even after haing all of its startup options unchecked.
Also, the new version of Pest Patrol from eTrust keeps detecting a small text file in my 3 year old compressed video drivers as a keylogger
The reason I suggested using Linux rather than a Windows or DOS derivative was the idea that a virus written to infect Windows would be vastly less likely to be able to infect a Linux system.
That's also why the only file I suggested using from the victim was the NTFS DLL, and that only because of the legality of distributing the NTFS DLL.
Granted, in theory a system booting from CD would not fetch anything from the victim and would not be at risk, but you know what they say about theory and practice - in theory there is no difference between theory and practice, in practice there is.
www.eFax.com are spammers
Why on earth would you do this test on an Outdated OS? Does this really give us useful information if 90%+ of these problems are on Xp Pro and Home? I would think not. I would bet companies fix the spyware on xp then move onto other OS's or put them on the back burner. Chris
Things do not all update themselves.
Indeed especially in a corperate environment where you don't want windows auto updating with untested patches. If you have adaware/spybot & windows & you av & A.N.OtherApp updating itself you soon find your systems become unmaintainable or that user systems randomly break when things conflict.
There is no anti MS motive, I indeed worked as a windows sys-admin and at the time used linux on my system due to worms. I had a windows box to test patches on.
My point is this causes hastle to users & admin who do not need it.
I'm not surprised Spybot did badly.
These things go in cycles, kind of like the Darwinism that didn't work quickly enough on the germ plasm that somehow evolved into the amoral mockeries of humankind that write spyware/malware.
Adaware was widely used for a while, then I started noticing that it wasn't working so well.
Then Spybot is/was hugely popular and extremely effective, so I've started to notice that it too is missing stuff now (or is unable to remove what it finds).
Virus...er...spyware writers are working against these programs, and it's only natural that they are evolving their code to defeat at least the most successful/widely used anti-spyware programs out there.
You wouldn't expect the flu inoculation from 5 years ago to protect you this year, would you? Spyware - and it's counteragents - are the same.
-Styopa
The two don't compare. When was the last time that you heard of someone either being killed or killing someone else because they didn't know enough about how to use a computer?
Actually, driving is a lot simpler - the rules are finite and don't change very often, traffic controls are standardized and the only real threat are idiots who insist on driving too fast, talking on cell phones (or eating, drinking, fixing their hair, etc.) or thinking that they can mix alcohol and driving. Oh yeah, and teenagers.
I used to think that what Windows needed was an SU ability, so you'd run as a normal user, and enter the admin password when needed. I still think that's a good idea, but I've come to realise it won't do shit to stop spyware.
For those that don't know, Mac OS-X does just this. You run as a user, and it asks for root when something requires root to execute. Good idea, don't want to be running as root full time. So I'm hanging out in a recording studio, chattering with the engineer, who is also piddling around on his computer while we talk. He's doing something, a box popos up and asks for root and almost before I can see what it wants he whips off the root password and goes back to talking to me.
I asked him about this and he said well EVERYTHING requires it. Anytime you install any app, it needs root. It's just part of the install process.
Well I realised that would be the attitude most non-tech users would take. Installs need root. It's even correct in most cases. So the spyware that's piggybacking on whatever app they want gets root through the install, and then you are back to where you started. The extra verification step isn't any good since people just give it without checking.
I still think it's a good system for those of us that would be suspicious when some little app with no DLLs/libraries to install whines for root, but a normal user isn't going to know the difference. They'll give it root, and get spyware'd.
Not only do most users not want to take the time, they just lack the knowledge to tell if it mentions anything evil in there. They want their Kazza or whatever, and they'll just click buttons till it's installed. Hell, some programs don't even mandidate the installing of their spyware, they just rely on the fact that most people will just do the default install and pay no attention.
People do not want to understand how their system works, they just want it to work.
Yeah, but people on the road are going somewhere. People on the internet, aren't.
...It's a religious belief. Good explanation tho, I think I shall save it.
Blar.
And yes, in a corporate environment, it's not advisable to do that, which Microsoft thought of, funnily enough, and provided many ways to roll out TESTED updates to clients of your choice. Also, our corporate spyware detection has central references, as does our corporate antivirus and everything else that has periodic updates.
If you do things properly, Windows will cause you as many problems as linux. Like linux, if you don't know what you're doing, you can make a bad situation worse. Please bear in mind I'm not casting dispersions about your technical ability, but like you, just speaking from experience. God knows I've nuked some boxes in my time ;)
Er... you might want to try reading that again.
Last I checked 'A is a lot more complex than B' and 'B is a lot simpler than A' mean the same thing.
So far, in 2004, 26% of all of the tech calls we've gone on for our clients and customers have been spyware removal.
While its simply amazing how many people claim to get "tricked" into installing this garbage I have to admit...being able to charge people and make money in this sluggish economy is fine with me.
If, due to people's inability/lack of know-how/tech department to update their machines or simply use firefox or any other non-ie browser is a good thing to my business.
So far we've had our clients buy more copies of adaware professional and hfnetcheckpro than we've sold copies of office 2k3.
Why do overlook and oversee mean opposite things?
Not everything does, but every piece of software that talks to the internet DOES get automatically patched, which is where the vulnerabilities come in.
That's BS as well. Windows allows you to set automatic updates so it will connect to the server, see if there are any updates available, but not actually update. Norton Antivirus connects to the server to check for updates, but does not update itself unless you tell it to. Adobe Acrobat Reader is one that unfortunately checkes every single time and reminds you there are updates available, but it does not download them until you tell it to. So no, ALL programs do not automatically update themselves.
-- If god wanted me to have a sig, he'd have given me a sense of humor.
What I do not understand is how can this be legal. To me this is no different than a trojan (the viral type not the condom.) Maybe it does not self-replicate and spread, but it still hijacked my friends computer. I thought that the malicious or destructive control of a computer without the users consent was illegal according to federal law. Why is it the the government will go after script kiddies, but does not go after the corporate goons who are no better? Oh, wait, I forgot. Script Kiddies do not make political contributions. I'm going to email my congressman.
Insert Generic Sig Here:
Slimeware er, spyware is the bane of my existance. I work for a large company and do not have final say about how the desktops are configured (I would do it differently), I support a special group and nearly all of my people have "admin rights" on their computers. I agree that these people need admin rights for some of the functions that they have to do but figure about 95% of the time they could run as a "super user" without any problems at all.
Very nearly 100% of the computers I touch are infested with slimeware. Running several commercial apps will clear most of the crap that is found but one or two apps seem to come back within a day or two (even if the user claims that they have not been on the internet). It has gotten to the point where I actually believe some of them!
I've found that what seems to be happening is that the slimeware distributors are playing a little versioning game. As soon as the major spyware removal tools are able to kill a specific version of slimeware, the slimeware authors make a new version that they then distribute.
It takes time between the release and the time that the spyware removers catch up and in the meantime, it is up to people like me to figure out how to clean up the mess. I am pretty hard-nosed and will spend a couple of hours searching the registry, booting from CD and deleting files and that kind of stuff to kill off the slimeware. Others who do similar jobs just re-image the machines. Soves the problem faster but I don't think the users are quite as happy. They have to reconfigure the machine to how they like it and there is always the risk of lost data.
I'd love to see these purveyors of filth in prison. Many of them serve up porn and put it on kids machines! They are guilty of a crime every time this happens. Why can't we do something?
Anyway, I don't blame the spyware removal people for these setbacks. They work hard to keep up but just can't.
Im my dreams, I dream of a single tool that sits on the desktop and checks for viruses, slimeware, spam, and other threats and inconveniences. I'd like the tool to be able to be programmed to block access to various applications and websites too. I'd like the same tool to have some sort of "safe recovery" feature that allows me to move back in time to a stable configuration that would not delete data.
These are just dreams but will someone somewhere please make my dream come true? Corporate IS departments everywhere would thank you with money from their budget!
Milton: It says 'crunchy frog' quite clearly.
Praline: Well, the superintendent thought it was an almond whirl. People won't expect there to be a frog in there. They're bound to think it's some form of mock frog.
Milton: (insulted) Mock frog? We use no artificial preservatives or additives of any kind!
Praline: Nevertheless, I must warn you that in future you should delete the words 'crunchy frog', and replace them with the legend 'crunchy raw unboned real dead frog', if you want to avoid prosecution.
Milton: What about our sales?
Praline: I'm not interested in your sales, I have to protect the general public. Now how about this one. (superintendent enters) It was number five, wasn't it? (superintendent nods) Number five, ram's bladder cup. (exit superintendent) What kind of confection is this?
Milton: We use choicest juicy chunks of fresh Cornish ram's bladder, emptied, steamed, flavoured with sesame seeds whipped into a fondue and garnished with lark's vomit.
Praline: Lark's vomit?
Milton: Correct.
Praline: Well it don't say nothing about that here.
Milton: Oh yes it does, on the bottom of the box, after monosodium glutamate.
Praline: Well I hardly think this is good enough. I think it would be more appropriate if the box bore a large red label : "WARNING:: Lark's Vomit".
Spyware, these days, is much harder to get rid of. A simple scan from a program isn't gonna do it. I've been doing ad-hoc tech support for my college dorm, and 95% of the cases I see are computers crippled because of spyware. There hasn't been one I couldn't fix yet.
Here's what I do:
-Install Ad-Aware SE (from a pen drive, since the spyware killed the internet)
-Update it
-Do a default scan
-Remove ANYTHING it finds
-Remove anything it puts in the quarantine
-Run MSCONFIG and, using your best judgement, uncheck anything from the services tab that doesn't look kosher
-Uninstall anything not kosher from Add/Remove Programs
-Reboot into safe mode
-Uninstall anything that didn't work before from Add/Remove Programs
-Open Explorer and delete anything from the Program Files directory that isn't kosher (this step will only work in safe mode because the programs in here won't be loaded into memory)
-Delete anything not kosher from the Start Menu's Startup folder
-Reboot into Normal mode
-Run Ad-Aware again just to be sure
-Install Firefox and hide IE icons
That should take care of the spyware (until the user decides to download more of it).
But there is more work to be done. Show the user what Firefox is and that they should use it from now on. Turn on Automatic Updates so they never have to visit the Windows Update site, the updates will download automatically. Inform them of the dangers of clicking popup messages to install software or whatnot. Though this is not a problem with firefox, explain they should read everything and install nothing that they didn't ask for.
Yes, this takes some time, sometimes upwards of 30 minutes, but if you did your job, you won't be visiting that person for a long time (at least for computer problems).
"I used to work for one of the companies that distributed a "spyware" program"
Moved on to a baby seal beating company? Or maybe an anal wart preserving company?
I mean, once you crawl down into the gutter, its hard to get out.
Interestingly, after you read enough of them, you begin to see the standard disclaimers and can scan very quickly through the EULAs. The stuff that's different usually pops out at you pretty quickly. I can scan the normal EULA (there are some pretty standard ones out there) within 1-2 minutes. It's worth the extra minute to scan now than to have to try to dig out the spyware later.
On the home desktop machine running XPSP2, as most are, updates are INSTALLED automatically. That's right - no user intervention.
In the corporate setting, it's very easy to not rely on the standard windows update to update clients - hotfixes and service packs are easily deployed over the network from a central server, again, without user intervention.
Acrobat reader is not a worry of mine - the only PDFs people read here are generated by ghostscript, and as with the service packs, etc., is very easy to update remotely using scripts. Our anti-virus isn't Norton, but Sophos, so that IS updated automatically.
I can see where you're confused, but I can assure you these problems you state don't exist any more.
Computer science shows us that it's impossible to accurately detect a virus (some combination of undecideability and Rice's theorem, I'm thinking). Spyware is a "virus" in this sense, and since we can't detect viruses, we can't get rid of them. In theory, then, it's impossible to have a secure computer program (because even if it did, we couldn't detect that it had achieved such security).
Obviously there are heuristics that antivirus (and antispyware) programs use to "detect" viruses, but ultimately the virus-maker-versus-virus-detector problem is an arms race: virus-detectors try to keep up with virus-makers by discovered new heuristics to "detect" viruses, and virus-makers keep trying to outwit these new heuristics with ever-more-clever viruses.
In practice, a human being can detect the difference between a legitimate application and an unwanted application (hence the popups from firewalls and antivirus tools asking, "Do you want to allow this activity?"), but also in practice, many human beings do not exercise this ability. My grandmother, for example, sees those questions as a nuisance and simply clicks the left-most button no matter what the question asks.
Both in theory and in practice, this is an arms race and ultimately an impossibility.
Yes, using a computer is more complex than driving a car. The point that I tried unsuccessfully to make was that comparing the two tasks isn't appropriate or informative. Yes, maintaing a computer is "more complex" in that there are more individual tasks that have to be done more often (patching, virus updates, dropping it on the ground from a significant height when it fails again, etc.) and maintaing a car is "less complex" in that the only thing that a driver can really do themselves is add fuel when necessary, but it misses the point. The reason that cars are as easy to use as they are today is that there is over a hundred years development involved in desiging a car for a human to use easily and safely. Granted that computers have been around for a lot less time, but can one really say that computers now are better and easier to use for the people that use them than the systems that preceeded them? In what other discipline would we tolerate this?
And rather than fix it, we blame the user.
That's because Spybot search and destroy is *very* harmful. Sure it gets rid of spyware but it has no respect for any other application on your system and will break it if it needs to remove the spyware. It is very sloppy. That's why it's rated #7. Spysweeper on the other hand has been working with major software vendors to be sure their shit does not break simple things like MS office.
I think you're right. I wonder if that might be a good reason to have operating systems, by default, ship with everything locked down pretty well, allowing for basic applications. For people who know enough to understand that they can do more than word-processing, care enough to do it, and know enough to access that extra functionality, you'll be enabled to bypass certain security measures. So, as a principle, the security is such that you need to know what you're doing in order to do something insecure.
The problem with this is, the same people who only use their computer for e-mail will get upset if you take away their weatherbug and their favorite virus-infected screensaver or spyware infected cursor-set. It's the people who don't understand computers who refuse to believe that there's a connection between giving complete system-wide freedom to people who know nothing about computers and the types of computer problems they experience. Until this is resolved, the operating system that sacrifices security in order to pander to users will remain dominant.
And with my mac I have none of these concerns!
And a close second, or perhaps tied at number one, is the negative attitude of a lot of knowledgeable types. They're very quick to assume the average user is "stupid" because he doesn't know how to format a floppy disk, for example. I actually heard a couple of techs laughing about this behind someone's back the other day. Well, those two guys probably had to use DOS to format disks back in the day, but when's the last time you went to the store and bought an unformatted disk? The current crop of "average" users has never had to deal with that, so why would you assume that when such a situation arises, they're just going to know what to do? And when all they encounter is derision and ridicule when they ask questions, how likely is it that they're going to continue to ask questions so that they can learn?
And then there's the nerd factor. A lot of people, particularly young women, are terrified that if they display any computer-centric knowledge beyond the bare minimum needed to get by from day to day, they'll be tagged as a Poindexter and ostracized. Sure, you can tell them that they shouldn't give a rip about what other people think, but never underestimate the power of peer pressure. I had an interesting conversation about this topic with someone from some educational institution a couple of years back, and she said that it was such a problem that it was causing many young people to think twice about taking computer-related courses -- and that was leading to a shortage of qualified IT staff. This may have changed a bit today, but not a lot, I'd wager.
Recent case in point: after dropping the phone on my desk for the umpteenth time while tucking it between my neck and shoulder, so that I could look up something on the PC while talking to someone, I asked my manager for a phone headset. He figured that would be a good idea, and asked the young (20-ish) woman on the other side of the office if she'd like one, too. Her reply: "Ohmigod, I'd look like a NERD!"
Some time ago, this same person was asked by another employee how to perform some sort of basic (to you and me) operation one one of the other PCs in the office. She gave him some instructions, and tagged them with "Gee, I hope you don't think I'm a NERD for knowing that."
I doubt she's a prime candidate for reading up on what spyware is, how to avoid it, and then finding, downloading and installing something like Ad-Aware -- much less telling anyone else how to do so. And I think she's representative of a lot of "average" users.
We have 250 local users and 500 remote employees and have not had a virus outbreak in over 3 years now.
Norton antivirus + a managed server which pushes virus definitions updates immediately upon arrival.
Shavlik patch management for pushing patches to individuals machines without setting up all that sms bullshit. Hit em every friday at 2 pm. Simple. We patch our 45 servers manually...
Spysweeper has been our spyware protection standard for almost a year now. We are still cleaning up some machines but no new ones are getting hit.
We run exchange 2003 server as well (oh my god) with Sybari Antigen and in 4 years have not had a single virus penetrate us. Not a single one!
The last outbreak we had was a customer who brought in randex after plugging in but now policy states their machines get checked first. Shrug, this end of the world and ultimate destruction attitude you claim is just a result of lazy or maybe lack of administration due to payroll $$$$. But it in no way is a result of Microsoft at all The same shit will happen if Linux ever becomes mainstream, which I feel will be even worse due to overconfident admins.
This is no suprise, this stuff is getting more and more difficult to remove. Programs like WinTools and TVMedia aren't totally removed by these programs, you have to browse the drive in explorer, in safe mode and delete the directory. Then you have to remove the service if you are using XP. These spyware companies are getting more complex in how the infest your system and it's all companies like lavasoft can do just to try keep up with these jerks.
There has been no spyware or adware on my machine since I started using firefox back at 0.7, period. Not a single item or article. Unless you count tracking cookies, but when was the last time a tracking cookie caused system instability? I still make love to my bonzai buddy daily though! ;)
- Better to speak your mind than to remain silent, or someone may speak for you.
Well, first of all, they don't have to do anything to use the airbags, they're there by default.
/. crowd it isn't so bad. We're interested in this stuff so we're in-the-know about it. Most people (our parents, siblings, friends, etc.) simply aren't.
As for the locks, it's not really that simple. It's like being on your own to locate and/or purchase locks for your car after the initial car purchase. Every 4th street corner has some guy peddling locks, and there's no governing entity stating which locks work and which locks don't.
From there, you not only have to decide which lock or locks to use, but you have to figure out how to install them, as well as maintain them. How often have you had to do maintenance to the locks on your car?
For you and I and the bulk of the
My Tech Posts on Twitter
exactly. also, if i always have 22 proccesses running, that's a pretty darn good clue, too.
You call it excessive, I call it ambitious.
If You really still use Limewire than that is Your fault (tm).
http://xnap.sourceforge.net/
With plugins for Gnutella, OpenNap, GiFT, Overnet and stuff. All in Java. With a nice little MacOSX installer.
I must say that since I updated to XP SP2 I have had no spyware on my machine. I built out the machine and installed SP2 in about august. Since then I've done normal browsing on the box and so has my wife and I just checked with ad-aware last night and the only "spyware" was tracking cookies and I don't really count those. Now that active X controls can't (as easily anyway) install in stealth mode (and in fact are auto canceled so my wife can't even figure out how to install them when she wants which is good) I don't see them on my machine.
"You can now flame me, I am full of love,"
If it is possible for a well educated and intelligent human to look at a piece of software and determine that it is or is not benign, then it will ultimately be possible for a software program to do the same.
In my opinion, the use of "hueristics" to detect malware is a complete red-herring that has taken over the anti-malware community, because it is comparatively easy and easily marketable. In reality, we shouldn't care that xyz.exe is on the computer, or that some registry value is set. As long as we keep trying to build hueristics or library lists to detect xyz.exe with semi-frequent scans the arms race continues. What we should be doing is constant real-time monitoring of the actions of all running programs. The first time a program tries to do something that could be malicious, run the action against a set of deterministic rules and decide if it really is a danger or not. If the rules still can't decide it, give the user an informative dialog box with the option to allow or disallow, and keep that decision for future reference with respect to that program and that action.
I keep a copy of the last free version of Tiny Personal Firewall on my USB thumbdrive just to install on friend's and family's computers that I end up fixing. I install it, reboot and start IE. I show them the popup asking allow/disallow and click allow, then tell them that unless they are in the process of installing a new program that they know needs to get to the internet, just click disallow every time the box pops up. In five years, and over 20 people using it, I've only had 3 calls where I had to walk someone through unblocking an application that they had disallowed, and every single one of the users is in love with it.
The only time there is a problem is when you have malicious programs that also provide functionality that the users wants. Trying to get my family away from Gator and incredimail has been a long battle.
"Unheard of means only it's undreamed of yet,
Impossible means not yet done." ~~ Julia Ecklar
For a company that's selling an anti-spyware tool, you'd think they could at the very least use a more secure way of tracking sessions than passing them in the URL.
/(<session token>)/filename.aspx. You're simply asking for trouble if you do.
I see that same thing done with way too many ASP.NET sites and it absolutely sickens me. It's as though no one knows that URL's that use the GET method are capable of being stored in cache even when you turn caching off via pragma:no-cache.
My suggestion is, never buy from a site with a URL that includes
On the home desktop machine running XPSP2, as most are, updates are INSTALLED automatically. That's right - no user intervention.
Re-read the parent post; he's arguing that all programs that connect to the web automatically update without giving the user a choice. I'm pointing out that Windows GIVES YOU THE OPTION. Yes, even in XP you can turn of Automatic Updates, as is recommended by most people. No serious professional leaves Windows Automatic Update enabled. Check your Security Panel under Control Panels.
In the corporate setting, it's very easy to not rely on the standard windows update to update clients - hotfixes and service packs are easily deployed over the network from a central server, again, without user intervention.
Again, that means that Automatic Updates are turned off on the client, and pushed out from from the Server. Yes, you can set it a client to automatically check a local server an automatically download from local server if there are updates, but no corporation does this; having 20,000 systems checking a local update server is a lot of useless traffic. So automatic udpate is disabled on all clients and updates pushed out from the server when needed.
Acrobat reader is not a worry of mine - the only PDFs people read here are generated by ghostscript, and as with the service packs, etc., is very easy to update remotely using scripts. Our anti-virus isn't Norton, but Sophos, so that IS updated automatically.
Again, reread the post. Yes, I know many programs can automatically update. Most programs are written so they will NOTIFY you that an update is available, and ask if you want it installed. Sophos automatically updates itself only because during initial configuration you clicked on an option to allow it to automatically connect, download, and install the updates. Most programs are written like that, they give you the option.
I can see where you're confused, but I can assure you these problems you state don't exist any more.
Re-read the parent post, it said programs that connect to the web *automatically* update, and I am saying that many programs give you the option .
-- If god wanted me to have a sig, he'd have given me a sense of humor.
Totally unbelievable that there are so many Windows lusers at Slashdot.
Then again, who ever said Slashdot visitors weren't a bunch of slimy cowards only pretending to have joined the open source camp?
Disgusting.
Recent versions of Ad-Aware always hang on me. They cannot run a complete scan at all. I've seen other reports on this, and I've tried most of the work-around suggested, but all to no effect. Or at most I'll get past one hang only to get hung up on another one just a few moments later.
Generally the hangs are in attempting a deep scan of the registry, or while scanning somewhere in my Windows directory.
I haven't been able to successfully run it since upgrading almost a year ago. I've upgraded since then to keep the latest version, but there has been no change in my ability to run it.
I'm running WinXP SP2 on a 2Ghz Pentium 4 processor with 512Meg of RAM and an 80Gig hard drive.
Anyone else having these problems or know of any sure-fire work-arounds?
- Spryguy
There are three kinds of people in this world: those that can count and those that can't
I use FutureSoft's i:scan because it gives me the ability to seek and destroy malware that no one else has a definition for... Also of note is the enterprise edition that allows you to create your own signatures so you don't have to wait on updates... Used together they are extremely effective... =)
I know what's on your hard dr
No, it is not an appliance to you or probably most of the /. readers. But, we are a very small minority of users. Most people do think of computers as a 'generic consumer product' or appliance, and there is absolutely nothing wrong with this. The computer makes the ideal platform to ease the common person's life, just as any other appliance. Your attitude is typical elitist snobbery.
"Who are in control, they are not in control of anything - they don't even control themselves!" - Glen Beck
Suppose companies started putting up fake road signs everywhere -- fake street names, fake stop signs, fake construction detour signs -- and suddenly every driver had to be "trained" to get to their destination without being distracted by all this, or making any wrong turns. That's the kind of situation we have with computers. Even though laws exist, enforcement is lax.
The metaphor doesn't go much further, of course (you can't program a car to recognize fake road signs :P). My point is just that you can't blame the end-users for everything, because they are being lied to, and education as a solution will only go so far.
I am the man with no sig!
who has her brand spanking new $35 lexmark which requires funky ass control panels to start with the computer to operate properly. also when you start removing well known programs, you get more tech support calls "Where did my program(s) go???".
:) Also, to save yourself some headaches from the very annoying malware, do the above process in safe mode.
i have found the easiest way to clean out spyware from a computer that is not my own is to go through the Run keys in both hklm and hkcu and remove anything that looks suspect (novices will probably be better off removing everything). i.e. C:\windows\systray.exe does NOT need to start, nor does C:\windows\system32\asdfjlw12.exe. However, rundll nvDwcpll,start does need to exist (norton antivirus).
Next hit up the services mmc plugin (services.msc) and disable any services they do not need (including upnp discovery, server, workstation, and computer browser if its the only computer in the house). Once that is done, load up BHOdemon and turn off any benign BHOs for IE.
Finally install Firefox and all relevant plugins (flash, java, etc.) and change their desktop IE shortcut and default browser to Firefox (leave internet explorer in their programs menu incase they need to goto an IE-only website like windowsupdate).
This whole process takes me about 10 minutes tops (god bless usb flash drives) and either gets me free drinks or easy money and happy friends that don't come back to me for problems.
Again, this is only for computers that aren't your own. i advocate destroying your own computer in order to learn how spyware works (although virtual pc is a better place to break things
-dk
It's something of a scary thought that programmers are in the minority, and so it makes perfect sense that computers not be programmable...
But then I guess they wouldn't be computers :-)
Anyway, yes, it's a hard problem to solve. Hopefully more and more software will become commoditised, so it'll become easy to provide a standard set of programs that everyone wants...
Indeed.
Pest Patrol belongs on this list, as in my experience it beats out Adaware and SpySweeper. It's not shareware but definitely worth the $40 I paid for it.
Well, that depends on your definition of 'virus'. For example, say a virus is a program which could potentially damage a user's documents.
This could be prevented completely by permanently linking every file to the application which created it. Only that application is allowed to access the file.
As an even simpler example, just check all programs against a whitelist and if they're not found, don't execute them.
As a simpler and easier to implement example, have an 'executable' bit and don't let anything set that bit after you're done installing the OS.
Not that I'm saying any of the above are good ideas. But the problem is far from unsolvable. In fact, if the computer is only needed for a limited range of tasks, it's a pretty easy problem to solve. (In theory, if not quite in practice...)
How do you think the people who know what to do found out what to do? We don't think that "average users" are stupid because they don't know how to do things, we think they're stupid because they don't have the intelligence to learn things that they don't know themselves.
I just fixed a client's machine that was heavily infected with spyware. While I was finishing up protecting the machine, I decided to look at his Zone Alarm programs list (my clients rarely have firewalls installed, so it didn't occur to me to check earlier).
There were something like two or three dozen spyware entries in the programs list. 90% of them were 'allowed'. And they were all manually configured! That means that Zone Alarm popped up "awojethk.exe wants to access the internet" warnings, the person clicked the "Remember this setting" box, and clicked yes!
Argh!
Its amazing how bad almost all of them are. I expected at least a handful to be getting 70-80% of spyware... But to be that horrible was totally unexpected. More amazingly, Giant Anti-Spyware was ONLY 3 WEEKS OLD when they reviewed it. I've been using it for a week, and it really does work well. It has significantly more features and a better UI than the two others I tried (ad-aware... weak with no features, and spybot... better but still ineffective)
Their SpyNet must really be effective to be able to beat ad-aware and Spysweeper by 50%!
Its a good thing sites like this are out there, otherwise who would have known that the software out there is that useless? Its shameful that bad software can still be profitable. I hope Giant gets recognized (monitarily) for it.
Here's what I do in these situations...
First, it requires a windows machine (NT,2K,XP) using the NTFS filesystem. FAT32 won't work because it don't do ACLs
1. Create a new local administrative account to work under (this is important read the whole thing here!)
2. Run Ad-Aware, Spybot S&D, and Hijack This, under this new admin account keep all the directories the spyware created, or make note of them so you can re-create them later.
3. Now, delete everything contained in these folders, then you start changing permissions on all these folders to deny Everyone access (including administrators), and take ownership of all these directories, when spyware trys to re-install itself it will fail. This method works real well when nuisance kids come back and try to re-install kaazaa, iMesh, etc. If you deny access to the kaazaa folder it won't come back unless they're smart enough to take ownership back and change permissions, or install it in a different directory.
4. This is the kicker: Install Firefox to replace IE, and Firebird to replace Outlook/Outlook Express. Run a search (F3) for iexplore.exe and msimn.exe and change permissions on them just like we did with the spyware folders.
5. This is my favorite: Now delete the IE icon and Outlook icons and change the Firefox and Firebird Icons to look just like IE and OE (MUHAHAHA).
6. Now login as Administrator and delete the user account we just created to do all this stuff.
If nuisance user must have IE to access a dumb banking website that's coded in shitty client side ASP or something like that; write a VB script, or batch file or whatever to use the runas command (similar to sudo in unix) to launch iexplore.exe under a less privileged account; point this back to the normal IE icon and it becomes seamless for the user.
You can take it even farther and deny write access to all the Run keys in the registry to keep crap from getting loaded in the System Tray. You can also deny write access to the Root of the Program Files folder, if you deny access to the whole folder including subdirectories and files it will break a number of applications that love to write metadata, temp files and such in the Program Files folder, like Microsoft Office 2000 (let's not even get started on how many Microsoft developers don't know where temp files and metadata belong). Of course if you do these things the user won't be able to install programs. If the user isn't running as an administrator they won't be able to write to the root of Program Files anyways, but they still can put stuff in their own Run key and the global Run key!
Sorry this is so hacked together, I'm in a hurry, want to go eat lunch NOW...
grep -iw skynet
http://shit.slashdot.org/article.pl?sid=04/11/23/0 331228
Since I wish to keep my contact to the MIS department (a.k.a "the obstacle") to the bare minimum, I only consider installing software on my work machine which is (a) free (gratis) and (b) has no "non commercial" clauses in its license.
Both Ad-Aware and Spybot S&D have workplace-friendly licenses.
Cars are not computers, yes. Computers are not cars, yes. You get a gold star.
But both computers and cars are complex multi-purpose devices. They are not commodity television sets or VCRs whose software only perform one basic function (watching a channel, recording a channel).
The more you can lock down and restrict the software on a device, the more secure and useable it can be. This is why crashes in phones and PDAs are so much less common than PCs.
The instant you give the user the ability to install whatever they want, all bets are off.
Flexability and Idiocy-proofness are inversely proportional for any complex system. There is no way around it, you can't have your cake and eat it too.
No I don't expect that Joe user should know how to swap out a DIMM. But I do expect that he should read the manual. I also expect him to read and heed warnings from his ISP about malware. If they can't do that then either
a) They can't complain when they get malware / virii
b) They shouldn't use a PC, since they won't take the time, they should use a locked down Internet Appliance.
You are being way too kind! A large portion of MS Windows' user mass have absolutely no chance keeping Windows clean on their own. If they use Windows on the Internet, that is. They will get screwed. Many of them won't know, or won't care. Those who do will often need help from others.
It's a pitty none of the tests have compared the false positive rates of the various spyware busters. It would be interesting to run all tested products on a PC with no spywares and compare the results. On my machine pest patrol (the online version) found 16 non-existing spywares. Testing for positives only encourages products that create false postives.
I'm starting to feel like a crank for mentioning that this is just a natural consequence of capitalism; the pursuit of ever-expanding profits by all legal means, when the corps own the government, is obviously going to lead to tragedy-of-the-commons problems like spam, spyware, pollution, etc.
Surely if the U.S. government can make pirating music and movies illegal the world over, then, if they wanted to, they could make spamming and spyware illegal as well. But, guess what? Pirating music is bad for business, so the gov't will push on it. Spamming and spyware is good for business, though citizen/comsumer-unfriendly, so the government "of the people" says "Suck it up! Don't be un-American by suggesting these businesses shouldn't have the right to shove advertising at you at all times."
Startup Monitor is nice. I only stopped autoloading it because every time my mom ran RealPlayer, it asked permission to allow TkBell to run at startup ;-)
Corollary to Moore's Law: The IQ of new computer owners is declining.
I rooted your mom's box.
Writers imply. Readers infer.
I came home for the holidays and got busy cleaning up the family computers like always. I happened to notice wintools there as well. Well after running adaware, stinger, trying to delete it, end task it, etc..... I just went into add remove programs in the control panel and there it was. Uninstalled as easy as could be. I always have to laugh when I forget to try the obvious and just go to the heavy handed stuff right away. But if you ever come across wintools again, keep it in mind.
You people have programs that install on your machine, collect data and send it back? .and no app makes a data call out without my approval. The default is set to No. It's hugely easy.
I can't tell you how strange this is to read.
I've been on Mac so many years, I genuinely take it for granted: my Powerbook belongs to me. As does the information stored within. All of it.
Mac OS X is fully networked . .
I post this not to be zealot-like, but with the idea that a free people should remain unco-opted. You don't have to put up with this shit at all.
I rooted your box while you were rooting his mom's box. Nice wallpaper.
Why is there discussion of market share and vulnerability to attack?
The number of hackers attacking an OS does signifies nothing, especially if the OS in question has a better security model.
Linux is not overrun with viruses, worms, trojans, etc. as is Windows because of a simple reason -- the foundation of Linux is more secure.
Windows is fundamentally flaw at it's core. Microsoft knows this and "patches" the obvious flaws but cannot fix the source of the flaws without re-writing the entire OS. Which will never happen.
This post encoded with ROT26. If you can read it, you've violated the DMCA. Handcuffs please, sergeant.
An added percaution is to look at the time/date stamp on the individual binaries, if any of them are newer than system installation time you have a better chance than not that it doesn't belong. Also, run cwshredder in report mode, it will tell you every IE toolbar/helper app/search assistant that is installed, many of them you can get rid of after inspecting the binaries.