Slashdot Mirror
Failing Grades For Most Anti-Spyware Tools
serbach writes "Steve Gibson posted this link to a superb test of about two dozen top Anti-Spyware programs: Eric L. Howes conducted the test over a two-week period in October. The results surprised me: only 3 ASW programs had a 'batting average' of better than .500 when it came to eradicating the broad range of spyware in the test. Freeware star Spybot Search & Destroy came in a distant 7th with an average of only .376. The top three? Giant Anti-Spyware, Spy Sweeper, and Ad-Aware. These test results are well worth your time."
The attitude to directed advertising programs or "spyware" on Slashdot. Especially when you step outside the parochial echochamber that is Slashdot discourse and speak to people who actually use these programs. On the whole, they are actually happy to get these novelties for "free", like the funny little desktop buddy, or the search bar, weather report or stopwatch.
I used to work for one of the companies that distributed a "spyware" program through download.com, and we had continual PR problems with being lumped in with the worst offenders of the spyware world. We didn't do drive by installations, or hide our intentions: we just traded our customers data for use of our program. What, exactly is wrong with that? Why is Slashdot pretending all of us are as bad as each other, as if in this, as with all fields, there isn't a spectrum of behaviour?? Even some linux users are bad, just look at the DDOS at sco.com. I'm sure noone here would condone that behaviour.
(Posted anonymously, not interested in karma bonus.)
...though I would have liked to see how the pre-emptive SpywareBlaster changed the results...
What's your secret? I have Ad-aware, Spybot, SpywareGuard, Spyware Blaster, Zone Alarm on my main PC. I use Firefox. I hardly ever (to be honest) visit pr0n sites. I hardly ever do any P2P stuff. And occassionaly, I DO still find the odd malware on my PC.
Never is a loooong time. Even Sean Connery learned Never to Say Never Again.
A lot of the spyware you get is just cookies from servedby.com or something that registers what sites you visit etc. You're not safer from them on Linux than you are on Windows.As long as you accept cookies, they'll be there.
I just use Firefox's cookie handling. I disable cookies and choose to allow only certain sites to set cookies (such as gmail, online banking etc).
This isn't a standard issue MS bashing troll but you do have to question whether given the ease at which programs (which is what spyware is) can install themselves on someone elses computer with little or no user intervention , Windows is fit to be allowed on the internet. If all windows systems were taken offline then almost all viruses and the like would disappear almost immediately along with spambots and other unpleasent creations of the black hat fraternity. I'm not pretending this is feasible but you have to wonder what the net would be like if only relatively secure OS's were allowed to use it.
This is a very good solution :
http://www.freedownloads.nl/hitman_pro.htm
It's dutch and it runs Ad-aware, Spysweeper , Spybot S&D, Stinger, Spywareblaster , ect...automaticly....
I can concur with the grandparent. I have a windows box running xp, and use firefox and thunderbird. It lives behind NAT from my linux box, and I never see any spyware/malware crap.
I just ran Ad-Aware for the first time in a while (it told me my definition file was 109 days old), and it prompted me to go download an upgrade. Ironicly, it launched IE for this (firefox is definately set as default). Once it finished updating and running a full scan, it found 4 whole 'bad' things, which in this case were IE tracking cookies (doubleclick.net, etc). 2 of those 4 had a creation date of today, meaning they were picked up in the process of downloading that adaware update...
Seems to be more and more firefox is leaning towards the 'Weve blocked this, click here to find out why' approach, would be nice if this was extended to all areas including dangerous java programs/etc.
There are PLENTY of things people can do in windows to protect themselves as much as they want. Suggesting moving to another operating system shows your real intentions here.
I apologise if this sounds pretty harsh, but I'm pissed off with the lack of professionalism or objectivity on this site.
Even better would be to turn Web Developers off Java Script ;)
Linux is not Windows
You'd think that the hosts of "Innovators of Wrestling" would yank it if it were downloading crap onto people's computers without their knowledge - in violation of the LAW!
But then again, I've seen how well most System AdminDUHstrators manage their sites; perhaps my surprise is simply the result of my moring coffee not kicking in yet.
And here is a question for the class to consider: Given the difficulty of removing spyware in a machine which is running the spyware, why has somebody not taken Knoppix, Wine, the NT filesystem wrapper code, and a virus cleaner, and created a boot disk that would
- mount the users disk using the NTFS in the kernel
- locate the native NTFS DLL, MD5 check it, and assuming it is not corrupt use it to mount the system R/W
- Use winelib to access the registry and clean it
- Run the filescan and purge to remove the infections
. That way, you would need to reboot twice (once to boot into the CD, once back into Windows).Granted, for me this question is of academic interest only - I don't run Windows anymore. But for those of us who have relatives still stuck in purgatory, this might be a better way to run.
www.eFax.com are spammers
I can install apps x, y, z and utilities p, q & r.
The apps update themselves without my intervention.
There's no crap to put up with. I don't update my software, my software updates itself. This is what I mean - you're not telling the truth here. You're saying Windows is at the state it was 5 years ago, when it clearly isn't. As for spyware, just install adaware, and it'll protect you perfectly. Heck, I still use IE, and my computer is still mine, running without any spyware at all, with no intervention from me whatsoever.
It clearly is MS bashing if you misrepresent the truth on such a massive scale. From your post, a newcomer to computers would assume it's impossible to run an MS windows box without having to manually update ever single thing on it. That it's insecure and will become compromised within minutes. It's pure FUD, and not in the least bit true.
I am genuinely curious as to what motivates people to run software knowing that they are not allowed to look at the source code. Fair enough, you may not understand it yourself. But people are not islands, and you probably know someone who could understand it, if you really needed it understood. And more to the point, if they won't show you the source code, why not? What don't they want you to see?
The only way you can ever know for certain what a piece of software is doing, is by reading the source code. If the suppliers don't want you to read the source code, that suggests to me that they have a problem with you knowing what it does. Which further suggests that it's probably dodgy.
Je fume. Tu fumes. Nous fûmes!
I've recently seen a rash of new spyware that registers a .dll or ten into the TCP/IP stack, or even in some cases a device driver. Those are truly the beasts. And, of course, the normal Windows startup routines don't necessarily apply, since Windows will include the dll's at launch, and once they're hooked into a process, they'll go about their nasty business as part of what may otherwise be considered a legitemite executable. The line between spyware and a virus/worms/trojans these days is so incredibly thin, it's hard to see anymore.
If it hasn't already become obvious I'm all in favor of dropping large objects on the scumbags that make this kind of stuff. Say, a super-large special order 1000 ton ACME anvil, to start?
Actually... I'll take it a step further. It's not mental blindness, it's willful ignorance. These are the people that will say they don't want to know anything about "that computer stuff". After painfully explaining to them what was wrong with the machine (damn you new.net, damn you to hell!), and explaining why it was causing problems (it's sending you to different places then you want to go, think of it as a malicious gas station attendant that reverses all directions for his own sick amusment), they'll wait until after you leave, and then re-install it.
These are also the same people who argued that Windows ME was the same as Windows 2K, because the Millenium was in 2000.
Nephilium
Slab: Jus' say "AarrghaarrghpleeassennononoUGH" -- Detritus' war on drugs Terry Pratchett, Feet of Clay
What I do not understand is how can this be legal. To me this is no different than a trojan (the viral type not the condom.) Maybe it does not self-replicate and spread, but it still hijacked my friends computer. I thought that the malicious or destructive control of a computer without the users consent was illegal according to federal law. Why is it the the government will go after script kiddies, but does not go after the corporate goons who are no better? Oh, wait, I forgot. Script Kiddies do not make political contributions. I'm going to email my congressman.
Insert Generic Sig Here:
Why are you spouting this FUD about microsoft?
My father and one of my brothers have windows machines. One is a locked down corporate XP pro SP1 laptop that is remotely administered by professionals. The other is a Windows ME home computer used for web surfing, e-mail, and video games.
About every other time I go to visit them, I walk them through spyware removal to make their machines run at a reasonable speed again. About once every three months, one of them calls me because their machine has become too bad to use and I talk them through it on the phone. They are both average, clueless users. If I could switch either of them to linux or the mac, I would in a heartbeat. My mother only calls for help with her imac when she forgets how to delete things in her webmail or she accidentally kicks the power cord out of the wall.
It is my professional opinion that anyone who does not actually need windows should switch, if they can afford to.
Computer science shows us that it's impossible to accurately detect a virus (some combination of undecideability and Rice's theorem, I'm thinking). Spyware is a "virus" in this sense, and since we can't detect viruses, we can't get rid of them. In theory, then, it's impossible to have a secure computer program (because even if it did, we couldn't detect that it had achieved such security).
Obviously there are heuristics that antivirus (and antispyware) programs use to "detect" viruses, but ultimately the virus-maker-versus-virus-detector problem is an arms race: virus-detectors try to keep up with virus-makers by discovered new heuristics to "detect" viruses, and virus-makers keep trying to outwit these new heuristics with ever-more-clever viruses.
In practice, a human being can detect the difference between a legitimate application and an unwanted application (hence the popups from firewalls and antivirus tools asking, "Do you want to allow this activity?"), but also in practice, many human beings do not exercise this ability. My grandmother, for example, sees those questions as a nuisance and simply clicks the left-most button no matter what the question asks.
Both in theory and in practice, this is an arms race and ultimately an impossibility.
And a close second, or perhaps tied at number one, is the negative attitude of a lot of knowledgeable types. They're very quick to assume the average user is "stupid" because he doesn't know how to format a floppy disk, for example. I actually heard a couple of techs laughing about this behind someone's back the other day. Well, those two guys probably had to use DOS to format disks back in the day, but when's the last time you went to the store and bought an unformatted disk? The current crop of "average" users has never had to deal with that, so why would you assume that when such a situation arises, they're just going to know what to do? And when all they encounter is derision and ridicule when they ask questions, how likely is it that they're going to continue to ask questions so that they can learn?
And then there's the nerd factor. A lot of people, particularly young women, are terrified that if they display any computer-centric knowledge beyond the bare minimum needed to get by from day to day, they'll be tagged as a Poindexter and ostracized. Sure, you can tell them that they shouldn't give a rip about what other people think, but never underestimate the power of peer pressure. I had an interesting conversation about this topic with someone from some educational institution a couple of years back, and she said that it was such a problem that it was causing many young people to think twice about taking computer-related courses -- and that was leading to a shortage of qualified IT staff. This may have changed a bit today, but not a lot, I'd wager.
Recent case in point: after dropping the phone on my desk for the umpteenth time while tucking it between my neck and shoulder, so that I could look up something on the PC while talking to someone, I asked my manager for a phone headset. He figured that would be a good idea, and asked the young (20-ish) woman on the other side of the office if she'd like one, too. Her reply: "Ohmigod, I'd look like a NERD!"
Some time ago, this same person was asked by another employee how to perform some sort of basic (to you and me) operation one one of the other PCs in the office. She gave him some instructions, and tagged them with "Gee, I hope you don't think I'm a NERD for knowing that."
I doubt she's a prime candidate for reading up on what spyware is, how to avoid it, and then finding, downloading and installing something like Ad-Aware -- much less telling anyone else how to do so. And I think she's representative of a lot of "average" users.
I just fixed a client's machine that was heavily infected with spyware. While I was finishing up protecting the machine, I decided to look at his Zone Alarm programs list (my clients rarely have firewalls installed, so it didn't occur to me to check earlier).
There were something like two or three dozen spyware entries in the programs list. 90% of them were 'allowed'. And they were all manually configured! That means that Zone Alarm popped up "awojethk.exe wants to access the internet" warnings, the person clicked the "Remember this setting" box, and clicked yes!
Argh!