Slashdot Mirror
Failing Grades For Most Anti-Spyware Tools
serbach writes "Steve Gibson posted this link to a superb test of about two dozen top Anti-Spyware programs: Eric L. Howes conducted the test over a two-week period in October. The results surprised me: only 3 ASW programs had a 'batting average' of better than .500 when it came to eradicating the broad range of spyware in the test. Freeware star Spybot Search & Destroy came in a distant 7th with an average of only .376. The top three? Giant Anti-Spyware, Spy Sweeper, and Ad-Aware. These test results are well worth your time."
Ars-technica also just did a review. Check it out.
o va l.ars
http://arstechnica.com/reviews/apps/spyware-rem
$_='while(read+STDIN,$_,2048){$a=29;$b=73;$c=142;
I dont use any, and have no problems. Never. And i fix other people's computers without them. When are people going to learn to be careful? I put firefox on a friends PC, along with adaware, and he still was screwed withtin 2 weeks. what is wrong with the general public???
You call it excessive, I call it ambitious.
I've been using a few different anti spyware tools in parallel because it seems as if there isn't a single tool that can reliable remove all spyware.
Free Firefox news reader.
The attitude to directed advertising programs or "spyware" on Slashdot. Especially when you step outside the parochial echochamber that is Slashdot discourse and speak to people who actually use these programs. On the whole, they are actually happy to get these novelties for "free", like the funny little desktop buddy, or the search bar, weather report or stopwatch.
I used to work for one of the companies that distributed a "spyware" program through download.com, and we had continual PR problems with being lumped in with the worst offenders of the spyware world. We didn't do drive by installations, or hide our intentions: we just traded our customers data for use of our program. What, exactly is wrong with that? Why is Slashdot pretending all of us are as bad as each other, as if in this, as with all fields, there isn't a spectrum of behaviour?? Even some linux users are bad, just look at the DDOS at sco.com. I'm sure noone here would condone that behaviour.
(Posted anonymously, not interested in karma bonus.)
Well Spybot may not do great, but it certainly does enough to clean up a persons PC so it works again without crashing every 5 minute.
My reccomendation is firefox or mozilla or even opera if you prefer it.
I do however note that if you take a clean system and then visit msn.com, then run spybot etc you will find that there are little evils that appear on your system.
It now appears that the best option is to wave goodbye to MS if you can. Pick a nice linux distro (eg Ubuntu or whatever suits you) or even MacOS X and feel that little bit safer.
...though I would have liked to see how the pre-emptive SpywareBlaster changed the results...
I've always found a combination of Ad-Aware and HijackThis do an excellent job of keeping all things spyware under control. Ad-Aware for more frequent scans, and the odd hit of HijackThis when things seem screwy. Admittedly, I don't know how much spyware I actually miss but it seems to keep XP happy for most part :)
you never know where your internet connected peecee might be sending it's bytes.
hmmm why is that activity LED blinkin?
Now I'm the grandest Tiger in the Jungle!
This isn't a standard issue MS bashing troll but you do have to question whether given the ease at which programs (which is what spyware is) can install themselves on someone elses computer with little or no user intervention , Windows is fit to be allowed on the internet. If all windows systems were taken offline then almost all viruses and the like would disappear almost immediately along with spambots and other unpleasent creations of the black hat fraternity. I'm not pretending this is feasible but you have to wonder what the net would be like if only relatively secure OS's were allowed to use it.
If you can limp yourself to download it, I've found Ad-Aware does an outstanding job in most cases. But you must have the new (free) version to do any good, The rate of evolution of these beasts are high, and they apparently came up with a new engine for Ad-Aware SE, that I've seen fund hundreds of objects that Ad-Aware 6, a moment before with current updates, had missed.
Makes most machines usable again, and quickly.
http://WeedTracks.com/ - 80,000 Weed files, Legal, Sharable Digital Distribution
> These test results are well worth your time.
Quite presumptuous of you to decide what my time is worth!
Anyway, since I use Linux and the only time I install software not via the package management, it's installed as a new generated user whose homedirectory is then killed with "userdel -r" - No, I never had a problem with spyware and probably won't in a long time to come. Ergo these tests are completely irrelevant to me.
I find the only way is to install FireFox with adblock.
Remove the IE shortcut, and rename the firefox link and check the icon it the stupid E.
And had Spy-Bot,Adware and SpywareBlaster running but you still get "users" installing crap,.. e.g. screensavers,and crap.
I been admin here only a few months but when I can the network was in shit. And 99% on the systems had at least 1 smileyface or such search bar installed and riddled with other crap.
Only do a update and full scan on a system when a user really complans about the speed of there PC for over a week or more.....
"NIPPLES!! I HAVE NO NIPPLES!!!" -Happy Noodle Boy
These test results are well worth your time.
No they are not. I already burned all Windows CDs in the fire. You wan't believe how much time I gained by doing this!
There you are, staring at me again.
top three anti spyware programs: 1. osX 2. Linux 3. commodore64
or else!
I use a mac and firefox. As far as I know, I haven't had any problems. Does anyone bother to make spyware for mac's? Does Java's sandboxing make it hard to write platform-independent spyware?
Reality is nothing but a collective hunch.
I've been an Ad-Aware user ever since I discovered spyware. SS&D was always over-zealous and broke too many legit applications for my liking.
That's what SpywareInfo's for.
http://www.spywareinfo.com
It's arguable that they're the biggest antispyware site out there, and if nothing else, they can get the CoolWebSearch strains that even Ad-Aware and Spybot can't get (real-yellow-pages, linklist, et cetera).
(Disclaimer: I'm a Trusted Advisor there.)
Striking fear in the authors of godawful fanfiction, I am here, appearing in darkness, Tuxedo Jack!
Spybot Search & Destroy is more preventive, as far as I know Ad-Aware doesn't do preventive measures like blocking (kill bit) of known bad ActiveX controls.
Really, I don't. Can some explain what exactly these "tools" do?
Perhaps I'm in a rare position and have been lucky to be immune from such troubles, but it seems to me that checking startup items, managing what's running on your system (exe's, services, etc.) is fairly routine stuff. And if there is a problem, deleting a file, making a simple regedit, etc. can't be that hard, right?
This just goes to show that anti-spyware (and as a extention that anti-virus) is wholy inadiquate to keep you safe.
Passive systems like virus scanners and anti-spyware are only effective at removing software AFTER it has infected computers.
You can scan downloaded software and e-mail, but that isn't going to do anything for you for stuff like worms or new threats that anti-virus firms are not aware of.
What is needed for security is a pro-active approach.
Auditing code, Compiling programs with stack protection, diversified software base, peer review of code, firewalls, better seperation of user and system and various other technics.
For a great example look at OpenBSD. If the technology sector as a whole adopted technics such as their's then virus, spyware, and worm threats would be nearly non-existant.
So as consumers of software we need to be aware of these things and only use software that employ these technics to keep us safe.
For example it would be cheaper to make cars like tin cans and no secure seats, no seat belts, no crush zones, no nothing... And that's what people are paying for in their software currently.
We need to only use software that does employ things that are the equivilent of seatbelts, airbags, and big hunks of metal to protect us.
"Unsafe at any speed" meets "Unsafe on any computer".
So the simple solution to this is to stop using Windows and start using Openbsd and secure versions of Linux and FreeBSD/NetBSD, etc.
of course most people are not that smart, but if you can you should. Security is a warm fuzzy.
...that I run FreeBSD, Linux and Solaris.
The least Microsoft could have done is create a non-admin user upon installation and force users to work as that, e.g. by changing word, excel etc. to refuse to open when used by an administrator and changing IE to refuse to work on anything but windowsupdate for administrators.
That would have been far more effective than SP2 and all the gazillion tools one seems to need today to be able to use XP reasonably.
It would also have cut down on a lot of Spam.
Yes, it would have been annoying, but safety-belts were annoying, too, when they first appeared.
Security is sometimes annoying, people should get over it, just like they got over Windows Product Activation.
Rainer
Windows 2000 - from the guys who brought us edlin
This is a very good solution :
http://www.freedownloads.nl/hitman_pro.htm
It's dutch and it runs Ad-aware, Spysweeper , Spybot S&D, Stinger, Spywareblaster , ect...automaticly....
use only Free software
"... twenty anti-spyware scanners were pitted against a collection of 15 adware and spyware programs that were installed with the latest version of Grokster ..."
15 pieces of trash with ONE program!
Me charging $60 an hour and HijackThis.
Seriously, I've yet to see spyware that booting into SafeMode and running HijackThis won't cure.
Sometimes I wish I was a plumber, then I'd know how to deal with other people's shit.
I use Spy Assissin. You download it from the ad-aware site, and have to pay for it. I think it's supposed to be better than adaware SE, which is the one tested (that's the free one).
Spy Assissin is cheap, and you get a 5 PC licence for it. Certainly sorted out a few nasty popup problems on my dads PC (though he probably didn't mind some of those lovely ladies popping up, but I'm sure my mother would have if it had gone on any longer).
Spy Assissin is updated regularly, and each time you run it it downloads it's updated (and reinstalled updated software, if required).
Pity it wasn't tested.
T.
Who won ??
I personally recommend Ad-Aware and S&D to my friends; it's been effective, methinks.
The most important thing is: if they must run Windows, a combination of those two kill the usual culprits.
is "think before install something" and "don't use insecure browsers". Never ever got a single pice of spyware with that. Nor did my parents or my girlfriend, who are not really what you would call "experienced users". And it don't even need performance hungry scanners.
The anti-spyware game is a real case of horses for courses - one tool will detect some spyware and miss others, while another will find all the bits the other missed, but miss off a couple it didn't. There really is no 'definitive' spyware removal tool and it's foolish to say there is. I advise people to run both Ad-Aware and Spybot with latest updates at least once a week to ensure almost all spyware is found and removed, as I've had too many instances of one of the two missing out five or six items on every sweep that the other one found straight away.
.dll that a program the user makes use of hooks into, the program may stop working, and who would get blamed? the anti-spyware vendor. Hey presto, Spybot looks like pure evil because they just killed off Joe User's cool new P2P app because keylog32.dll got wiped. This happened a lot when Kazaa was big - naive users getting told by techy types to run Spybot every now and then to clear spyware ended up bitching because it nuked the spyware that Kazaa checked for before starting up. They didn't seem to care about privacy when protecting it stopped them getting their MP3s and porn.
.exes, they will visit dodgy sites and they will do all manner of things because they believe they are safe. They don't understand that spyware blockers only work against known types of spyware, not all spyware in total. Naive users seem to think it's an agreement between spyware vendors and anti-spyware companies when it is, to all intents and purposes, an arms race which the anti-spyware groups will always in second place.
/. are now serving ads to the Microsoft 'Get the Facts' campaign? Is this Slashdot putting one over on Microsoft by taking the money they throw at them when they know no-one here will believe it, or have they reached a new low, actually showing not just Microsoft ads, but ones that feature blatant FUD against FOSS?
You could probably get even better performance by running more than those two, but I'm not going to harrass my clients to start running half a dozen programs just to remove spyware and it's a pretty rare thing to come across a piece of spyware, even a humble cookie, that both of those two miss. Anyway, my point is this; You can't just run Ad-Aware or Spybot and think you're protected. Until an anti-spyware tool has a 100% record against all known spyware, I won't consider them anything near a definitive tool, or a licence to behave recklessly on the net, something which too many naive people seem to do.
The problem with anti-spyware tools is three-fold;
a) They are made by private companies and individuals who's credentials and/or decency cannot be guaranteed. They could easily take kickbacks from spyware companies in exchange for 'excluding' their programs from the scan list. Sure, it might not be happening now, but what's to stop Lavasoft suddenly to start taking kickbacks to let the less insiduous spyware through? Unless you're on the inside of a company like that, you can never be sure. I'm sure Lavasoft aren't doing anything like that, as these results prove, I'm merely using them as an example - any anti-spyware app people trust is in an immensely powerful position on the user's computer, and any money-seeking company can theoretically be bought out.
c) When they remove a spyware
c) People do, as I mentioned above, use them as an excuse to behave recklessly on the internet - they will install random
Anyway, what was my point again? Oh yes, that these statistics are misleading for naive users. Ad-Aware and the others are now going to start shouting from the rooftops about how they're one of the top 3 anti-spyware apps on the market, and thousands of lusers will trust themselves to it implicitly solely because of that blurb, while the reality is Ad-Aware still misses stuff, and it is more than fallible. That 'lowly' Spybot has turned up half a dozen items Ad-Aware failed to find at least three times for me, but I wouldn't run that on it's own either - Everybodyb knows it's a good idea to get a second opinion, especially when it's free.
Also, does anybody else find it funny that
Dealing with lawyers would be a lot less tedious if they all looked like Casey Novak.
The reasons seem to be simple;
Yet, the test results show that the spyware detectors aren't in the arms race against spyware that I described above. Instead, many spyware revisions aren't detected at all. Either they don't know about the spyware revisions, the spyware is not being tested for, or the spyware is being ignored on purpose.
Right now, the bar that the spyware creators have to leap is very low. Both social engineering and direct injection onto systems make spreading these things fairly easy to do for the spyware maker. Tie that in with many spyware detectors not detecting completely, and not being used consistantly, and I don't see an end to this problem soon for most people.
What to do? I'll leave that to others for now. I have my own lists. It is a security issue so the systems should be considered to be on hostile networks and hostile users. I consider 2 hours to lock down a Windows XP system to be a reasonable minimum amount of time to spend on each system -- unless automation tools are used.
A firewall can not protect you from yourself. Turn off what you do not need. Do not use the firewall to do your work.
I finally managed to install SpyBot S&D on my Linux, and only now i found out that SpyBot is not so good after all. Oh, will I ever be safe from spyware ?!
I run a small IT consultancy, and nearly every internet connected PC we work on has a significant spyware infection on it. It's not only our job to remove it, but to prevent it coming back. The things that I've noticed after fixing a lot of problems:
This won't stop everything by any means, but it slows down reinfection. End users need to change habits - reading EULA, not just clicking OK, using passwords - but this isn't something you can do with a couple of hours work, so people aren't willing to do it. I have no solution to that problem.
Seriously guys, none of these spyware removers are even remotely perfect and they all suck time and CPU cycles. I disavow any knowledge of this guy, Mike Lin, but his itty-bitty FREEWARE program kicks butt.http://www.mlin.net/StartupMonitor.shtml It does one tiny little thing with almost zero overhead, it tells you what wants to insinuate itself into one of the several startup vectors of Windows. And gives you the option of not allowing it. Any spyware must have some part that runs at startup. This gives you a warning and a filename for googling to remove whatever you have contracted. Probably works for many worms, viruses, and trojans too.
A car is a generic end-user product as well. But if the engine catches on fire because the owner hasn't changed the oil in 12 months, despite the car manual prescribing a change every 5,000, documentation from the dealer saying the same, and red blinking light in the dashboard, no one blames the engineers. The exact same thing is true of sypware and viruses - it is a well known problem, the user's companies and ISPs tell them not to open the attachments, Windows XP even issues a warning prompt, but they do it anyway.
You can engineer many problems, but you can never engineer away human idiocy. There will always be some idiot who will find a way to kill themselves with a pair of dull safety scissors.
the article seems well done and deep but the presentation of the results is lackluster. they performed all those rounds of tests and analysis and the "conclusions" are
Spyware and adware can prove quite difficult to remove
No single anti-spyware scanner removes everything
etc. no kidding! why did they need to compare them to find out what is conventional wisdom for most people already. there is no quantifiable list of best-to-worst that i can find on the site, which is really the most valuable result of a study like this.
a waste of their time and ours.
Folks, you should check out this Sun Java Plugin Arbitrary Package Access Vulnerability
HOwever , these programs could do anything which is the worrying part. 99% of them may just be Gary Grocer trying to make some extra money
I think you're underplaying the seriousness of Gary Grocer's nefarious activities. After all, he's an internationally-wanted credit card fraudster who is also notorious for using zombified PCs to send spam.... that's how he makes his "extra money". (Note: There is a reward for the capture of him and his money-laundering associate, Freddy Firefighter).
"These people are scum, " says Florida's Head of Anti-Fraud Investigations, Calvin Criminal.
"Damn right, " adds his colleague, Alvin Arsonist.
"Slashdot - News and Chat Sites Deviant". (Click "homepage" link above for details).
While we should be grateful for the work done by the reviewer, I cannot but notice that the results are hard to find out.
I, for one, would like to see some conclusion or recommendation or rating (Anti-Spyware A - goog; Anti-Spyware B - shit; Anti-Spyware C - excellent).
I know the article focuses on falling efficiency, but still, it's a bit overwhelming to go over those huge tables.
link me
About half the time a user removes spyware from a PC that is running really sluggish, I've found that it the spyware removal utilities does NOT repair the winsock registry keys. Thus, you can't even get TCP/IP connectivity. You will know it's broken if you get an IP of 0.0.0.0 or will fail instantly to repair the LAN connection in XP and just get a 169.x.x.x address.
; en-us;811259
If you do plan on removing a heavly invested PC, be sure you know how to fix repair winsock.
If the customer is running XP with SP2, then you can run the "netsh winsock reset catalog" command (without quotes) to repair the connection and reset the winsock settings back to defaults. However, if the PC does not have SP2 installed, you will have to check out this link http://support.microsoft.com/default.aspx?scid=kb
For Win9x users, check out this link http://support.wadsnet.com/winsock/winsock98.asp
Life is not for the lazy.
I use Linux and I never hard spyware installed on my computer. Obviously, I also never had to install a anti-spyware program. If you are using a OS that allows spyware, then you are taking a risk. It is you choice do to so. But do not cry about your data loss. You took the risk. You did not use Linux.
Try it. Once. You can download a Live CD and try it even without installing it. If the 5 minutes this takes was a waste of time, then too bad. But if not, then you may just learn how to use a secure, modern OS that does not allow viruses for the rest of your life.
P.S: It's my birthday today. Actually. (as if anyone cares).
9/11: Never forget it was a false-flag operation
This stuff scares me. With each generation, these spyware writers become sneakier and more devious. As much as I have a handle on technology now, I imagine that there will be a time when I will have to ban myself from electronic transactions and do everything by hand and feet. One of these days they will get me... and that sucks.
I fear for my father who knows just enough of using the internet and installing applications to be dangerous. What's worse is that he often defaults to standard browsers that came with his ISP (e.g. Earthlink), who use IE.
Actually, a really good suggestion. I am learning stuff here. http://www.windowsecurity.com/articles/Securing_th e_Windows_2000_Registry.html
I'm surprised that they don't mention this piece of s**t. But since I haven't yet seen a program that can remove the latest version, I'm not surprised. This insidious piece of work actually installs a device driver which continuously monitors its files and prevents deletes etc.
Even starting in so-called 'safe mode' won't stop it. You have to boot with a CD and erase it manually.
The people who wrote it are 3721. something, and a link to it even appears on the default Chinese search page. In theory it just allows for Chinese name searches, but in reality does much more.
You have been warned - please don't visit the site.
"Moreover, users should learn to practice safe computing habits, which include avoiding web sites and programs of unknown or dubious provenance and carefully reading End User License Agreements and Privacy Policies."
Am I the only one who doubts that will come true any time soon, we all know how to click on a button as a reflex action, reading a lengthy EULA full of lawyerspeek... that's a headache.
I've said this before, but here goes again: what's "wrong" with non-nerds is that they're used to the Real-World "security model". The real world doesn't work like computers do.
In the real world, you don't have to have an absolutely-unbreakable titanium-plated vault door to your house, nor bullet proof windows. If anyone wanted to hack your front door down, it's worth a maximum 5 minutes with an axe.
Real world locks also aren't supposed to be unbreakable. Au contraire. By computer security standards, they're a catastrophe. Most allow 1-pin-at-a-time attacks, which in computer security is the worst anti-pattern. Locks with master keys allow easy escalation of privileges too.
It's all documented vulnerabilities (or exploits) and they've been known for ages, and never fixed.
But they work IRL anyway. Yes, any kid could lockpick your front door, or hack it down, or just throw a brick through the window to get in. But people still use locks, doors and windows.
Why? Because the IRL (In Real Life) you don't live in a lawless no-man's-land where any kiddie with a lockpick is l33t and free to pick your lock. IRL your real defense isn't the lock, but the law.
The lock or the door just markers. They just say "you're not supposed to be past this point uninvited, and if we find you inside, we'll throw your sorry ass in state jail."
(If you're a die-hard gun fanatic, feel free to replace by "if I find you in, you'll get a gut full of buckshot." Same idea: there'll be repercursions. The door just marks the point beyond which the thief is not supposed to go, not _the_ deterrent itself.)
And people instinctively expect the same kind of rights and protection to apply to the online world too. "This is my computer, you're not supposed to be on it. Your playzone ends at the ISP, and this side is my private property."
Unrealistic expectation? Maybe. But it exists nevertheless.
Unreasonable expectation? Not at all.
A polar bear is a cartesian bear after a coordinate transform.
This spyware tools only apply if you are on Windows. Even if you are, most of spyware (and the nasties kind) will not affect you as long as you stay away from IE and OE.
And I'm saying it running FF 1.0 on Fedora Core 2.
I think you mean free like in open source and not in free as beer. Since most software you download for free contains spyware like kazaa and grokster, those applications are free because they try to make money tru spyware.
Is "backweb" on win32 still considered "spyware" by those programs?
:)))
One of the inventors of anti spyware stuff called it "spyware" and forced my novice brother to delete it.
That "spyware" was installed by Siemens and FRISK, makers of F-Prot for gods sake! Its job was to download virus definitions for F-Prot Mobile which came with guys computer.
In 1 week I had to clean a damn new windows virus which was advanced and his half of documents were deleted by that virus.
I knew he was novice and wouldn't care about updates so I installed backweb on PURPOSE!
There, the company and customers which Ad-aware considered spyware
http://www.backweb.com/customers/
Note I am not against Lavasoft but I think the "paranoia" level of anti spyware is way TOO HIGH. E.g. deleting doubleclick.net cookies of IE which comes with P3P installed will get "bravo" from users but advanced ones will know it means NOTHING.
Ahhh yes, the power of Visual Basic. I like how professional the software is, it doesn't even say you need the Runtime libraries. Their website is mostly filled with "technical questions" about how to order the software.
Let's hope they address that.
Small potatoes make the steak look bigger.
go on... do it... you know you want to... :)
Donald 'Duck' Dunn: We had a band powerful enough to turn goat piss into gasoline.
You could simply buy an iBook and look at it as a peripheral for your cryo-cooled 1337-gamerboi PC.
You use the PC for playing "City of HalfEverDiabloCraft III" and for generating dubious overclocking benchmarks and storing your MP3's on your terrabyte RAID with the windowed 250gb SATA disks.
You use the Mac for web surfing, email and IM, to store critical documents you don't want eaten by Virii (making sure to back them up to CD-R every now and again) and generally Doing Usefull Stuff.
That way, your precious game time is uninterrupted by Microsoft's Keystone Kops approach to secuirty and monoculture attacks. Let's face it... you ain't never gonna be able to lock down your Windows box, no matter how much money and third party utilities you throw at the problem.
Alternatively, OpenBSD on any old laptop is another way to dodge the spyware bullet, if your Unix Fu is the stronger.
SoupIsGood Food
What good does a 90% detection rate do when programs can be remotely run via a web browser (or remote OS update program)? There is a design flaw here someplace which shouldn't require more bugware to compensate for.
Download=fine.
Download and automatically execute=very bad.
...is to be found on http://www.linuxiso.org/ - and, best of all, it's free! \o/
:%s/Open Source/Free Software/g
YTARY!
I was under the impression Ad-aware's scanlist oriented more towards tracking info and the like.
Personally I rarely use ad-aware by itself due to the amount of things it misses --possibly just the unique spyware demographic i've encountered, but I'm not sure I ever recall running ad aware AFTER spybot and finding more than a few cookies.
If you can't see the value in jet powered ants you should turn in your nerd card. - Dunbal (464142)
You'd think that the hosts of "Innovators of Wrestling" would yank it if it were downloading crap onto people's computers without their knowledge - in violation of the LAW!
But then again, I've seen how well most System AdminDUHstrators manage their sites; perhaps my surprise is simply the result of my moring coffee not kicking in yet.
And here is a question for the class to consider: Given the difficulty of removing spyware in a machine which is running the spyware, why has somebody not taken Knoppix, Wine, the NT filesystem wrapper code, and a virus cleaner, and created a boot disk that would
- mount the users disk using the NTFS in the kernel
- locate the native NTFS DLL, MD5 check it, and assuming it is not corrupt use it to mount the system R/W
- Use winelib to access the registry and clean it
- Run the filescan and purge to remove the infections
. That way, you would need to reboot twice (once to boot into the CD, once back into Windows).Granted, for me this question is of academic interest only - I don't run Windows anymore. But for those of us who have relatives still stuck in purgatory, this might be a better way to run.
www.eFax.com are spammers
I took a (not that hard) look at which are best as compliments to the top dog, GIANT AntiSpyware.
Turns out that SW Doctor seems to fill up the holes best, even better than AdAware and SpySweeper, although they come in better as standalone.
So, GIANT AntiSpyware with a liberal helping of SW Doctor and maybe an occational spray of AdAware seems to be the medicin to use.
Some anti-spyware tools have done a horrible job in my experience, incorrectly removing them sometimes leading to crashes occasionally (in fact, one that I've experienced was due to ad aware). A proper test should also test how correct the removal is and test the stability of potentially affected programs.
I'm wondering how they did quality analysis of the removal process.. Whats to say that some spyware removed here was only disabled or half removed?
Its also a matter of their distribution on the planet, of all the billions of worms out there for instance, just because a virus detector detects more then the other ones, they might be extremely rare.
I wouldn't rush off and choose any of these based on these figures, because the best ones could easily be the ones which incorrectly remove common spyware breaking stuff.
I think eric did a good job though. Maybe though he should update the results to include the distribution in the wild and quality of the removal
A lot of people here have made a mockery of the relevance of spyware removal tools, and even questioned whether spyware is a real issue at all. These people probably haven't tried to combat the latest strains of the CoolWebSearch infestation. Visiting a friend recently I noticed his laptop had gone totally Ga-ga, and I offered to help, thinking that a quick anti-virus scan accompanied by ad-aware cleansing, would get the unit back in shape. It didn't. I tried every automated and manual step-by-step procedure I could find on the net and nothing seemed to help. The premier anti-CoolWebSearch volunteer on the net seemed to have given up (as reported by the Register) I ended up deciding that it was less time consuming to save the few vital files that existed on the machine, and reinstall the operating system, rather than trying a meticulous process-creation-timestamp-analysis. The operating system I reinstalled was Win XP (not Linux). Why? Because my friend is a technically challenged moron and will never be capable of using anything but Windows for desktop computing.
Why not just 'not' log in as 'Administrator'? I mean, nobody logs in as Root in Mac or UNIX, but it's default to do so in Windows. In Mac, before installing anything major, it prompts for a password, even Updates. In UNIX you need to SUDO. When I set users up in Windows, they are all USERS. If they really are dangerous to the system, I put them in the GUEST group. Spyware and Viruses don't work without access. By default, Microsoft condones ruinware because of it's ambilivent user policy design.
Also, there are clearly some infections that no product can see...vendors, are you paying attention?
And finally, to the apologists for the spyware industry: ANY piece of software so contrived that
- [a] I don't get some in-my-face interaction like a EULA click-through to warn me I am installing it and
- [b] it has no clearly visible means of completely unistalling itself from my machine
is at the very least a detriment to the performance of my PC and at worst, because it operates in the shadows of my registry and START menu, gives me no easy way to be sure it is not informing others about choices and interests expressed on my PC that are nobody's business but mine. ANY such "convenience" or "novelty" is something I don't want and would never seek to have on my PC so take your sneaky crap and shove back up where it came from, all of it!SLASHDOT: news for people who can't concentrate on work or have no life at all and got tired of yelling back at the TV.
I am genuinely curious as to what motivates people to run software knowing that they are not allowed to look at the source code. Fair enough, you may not understand it yourself. But people are not islands, and you probably know someone who could understand it, if you really needed it understood. And more to the point, if they won't show you the source code, why not? What don't they want you to see?
The only way you can ever know for certain what a piece of software is doing, is by reading the source code. If the suppliers don't want you to read the source code, that suggests to me that they have a problem with you knowing what it does. Which further suggests that it's probably dodgy.
Je fume. Tu fumes. Nous fûmes!
ring ring, hello, tech support, may i help you?
yes, my computer is running slow and crashes a lot, i think it may be infected with a virus or spyware...
format C: and reinstall or use your OEM restore disk - this is a recording... format C: and reinstall or use your OEM restore disk - this is a recording... format C: and reinstall or use your OEM restore disk - this is a recording... format C: and reinstall or use your OEM restore disk - this is a recording...
this is about the only way to actually clean a windoze OS of any version #...
better yet, just abandon windoze and use Linux or BSD...
I think that the spyware industry is one of the most corrupt in the software biz right now.
Many of the tools in that review don't have uninstall procs and some that do like Aluria have 'problems' with the install.log that prohibit easy uninstallation.
Some spyware tools like Adware (not Adaware) are flat out spyware themselves.
And the remainder for the most part, are scanners that tell you something and then want you to spend $19.95 to remove them.
That's only slightly more ethical than Mafia protection scams.
Best case scenario any tool you use is missing about half of the spyware that may or maynot be on your machine. Your best bet is to use a few different tools like S+D and Adaware and to use real time blockers wherever possible.
Note: I have an XP Home machine at home where S+D teatimer has memory hole and it can't be run w/o consuming all the RAM.
Comment removed based on user account deletion
First off, I love linux, but in this case I think there's a better tool for the job. (The following is not really a shameless plug).
I use Bart's PE Builder. In a nutshell, it's a bootable cd with a Win32 network, disk (with native NTFS support) and GUI API load. The best thing is that it's built using actual Windows dll's and the like. Of course, you have to have a copy of XP or Server 2003 to built it, and it may not be strictly within Microsoft's licensing agreement to use their IP in this fashion, but that doesn't bother nor stop me.
Anyway, there's a native Ad-Aware plugin for BartPE, and I've hacked together a Spybot S&D plugin, as well. My usual proceedure is to boot the system with my cd, run AAW & S&D to clean up files on the hard drive. Then, I boot from the hard drive into safe mode with networking support, install the latest versions of AAW & S&D, and run them again. This cleans the registry as well (which unfortunately I haven't figured out how to do under BartPE... yet). This method has worked well in situations where the system is so infested I can't start from safe mode.
Part of the problem is that even with the proliferation of anti-spyware programs, often to completely eradicate these nasties, manually crawling for files and registry entries may be necessary. At least for the forseeable future I don't see this becoming a fully automated task.
This isn't just something encountered online though is it?
When it transfers itself to an EU citizen's PC and runs in the background collecting information it is acting within the EU. The EU could conceivably extradite the people responsible for this and try them as crimes have been comitted in the EU as surely as a cracker gaining illegal entry to an EU government computer from a terminal in the US has comitted a crime.
There's two utilities I use on a regular basis for winsock fixing:
1. LSP Fix. This program will let you see what dll's are embedded in your TCP/IP stack. Most of the time it will even detect stuff that's not supposed to be there, but you do have the option to override its judgement. Spybot S&D also has the ability to look into the stack, but you can't use it to remove offending modules, nor see their actual dll filenames.
2. Winsock XP Fix. This nifty little utility will basically reset all registry settings for the stack back to what they're supposed to be. This is usefull if some nasty has totally trashed the stack on its way out the door. It would also appear it works on earlier versions of Windows (certianly Win2k) but I've never tried it on anything but XP.
I used to joke that as long as people break their computers I'd have a job, but there are times when the spyware thing really drives me up a wall...
Unfortunetly I just switched my laptop back to windows from linux due to some software I must use (VMWare is too slow and WINE won't run it).
I am now faced worrying about spyware and viruses.
What I've done:
-Use Firefox for browsing.
-Set IE security to HIGH for the "Internet zone". Disabling ActiveX.
-Added Windows Update sites to the "Trusted Zone" so I can actually update".
-Installed Privoxy to help block junk when browsing sites.
-Installed SP2 so I have a firewall to protect against viruses that hit on the ever so lovely NETBIOS or RPC ports. No exceptions in the firewall.
All of my email is filtered by my Exchange server so I don't think I'll be needed anti-virus on my laptop. I almost never get or open attachments.
I'm hoping this will protect me. If anyone has anymore suggestions, please let me know. Also, I'm trying to figure out why Windows gets slow over time. It's like the installation rots. I'm trying to find out if you can prevent it.
Hope this helps,
Daniel
We use Adaware, Spybot, and Spysweeper. I also use pstools to kill anything in memory that comes back.
Some trojans/virus/spyware programs like to run two copies in memory. When you try to axe one, the other respawns the process.
Pstools will handle this. Pskill run from the command line with an ampersand (&) seperating the command lines will run a kill on two processes fast enough in most cases to kill them both before a respawn.
If it doesn't, start a pretty big file copy process to slow the system and rerun the pskill commands. This is usually enough to kill anything I have run across in memory.
ardustry
It didn't include the two most effective spyware removal tools, Webroot's SpySweeper, and Giant's program.
It chooses to test alluria, which now admits that not all spyware is spyware, since certain spyware paid them money.
They test S&D, which is fair, but they fail to mention that S&D can get less than 1/3 of the known spyware.
Then they only test a handful of software and have no basis for their comparisons.
Cripes. Why bother wasting the electrons for this review?
I've recently seen a rash of new spyware that registers a .dll or ten into the TCP/IP stack, or even in some cases a device driver. Those are truly the beasts. And, of course, the normal Windows startup routines don't necessarily apply, since Windows will include the dll's at launch, and once they're hooked into a process, they'll go about their nasty business as part of what may otherwise be considered a legitemite executable. The line between spyware and a virus/worms/trojans these days is so incredibly thin, it's hard to see anymore.
If it hasn't already become obvious I'm all in favor of dropping large objects on the scumbags that make this kind of stuff. Say, a super-large special order 1000 ton ACME anvil, to start?
I get a 1.000 batting average with my favorite anti-spyware prevention (not detection) tool:
Limited User.
And when not working as a Limited User, I turn off scripting and other stuff, and add "*.microsoft.com" to Trusted Sites so I can use Windows Update and Office Update.
Windows XP and Windows 2000 can catch 100% of all spyware all by themselves. If you let them. Spyware (or other software) doesn't install as a limited user.
Use Evolution instead of Outlook? Bewa
The forbes article in the parent also has a not too subtle message that associates computer geeks and terrorists. Are there any groklaw "terroists" out there that could use that for a "class action lible suit"[sic], if there is such a thing?
And did you exchange a walk on part in the war for a lead role in a cage? - Pink Floyd.
There's another class of evilness that doesn't involve startup and that's BHO's (or Browser Helper Objects), which come into play when IE is started and have full access to the computer.
I'm not sure what the secret to success is, but the secret to failure lies in trying to please everyone -Bill Cosby
Anything from M$ since 9x/ME has a built-in access rights system.
NO ONE needs to run as administrator, if they are not installing software.
Still today, lots of M$ users don't know that - what a waste!
-- From Denmark
It always pisses me off when somebody tries to do this because they never seem to do it right. That is to say, they never fully document the settings that they adjust on each software installation. News orgs are always coming up with statements that Mozilla or Spybot isn't that great, but that's always with out of the box settings. All I have to say is: "Hey, it's not the software's fault if you don't know how to use it!" Also, I felt that this statement was particularly telling: "The test results reported here constitute but a few tests with three collections of spyware and adware programs. The anti-spyware scanners tested here may perform differently with other collections of spyware and adware."
And the fact that it's lawyerspeak raises another issue: even if you do read it, are you going to understand fully what it is you're agreeing to?
I've been doing spyware removals for customer's at my job for over a year now. At first it was easy, just run Ad-Aware and you're done. Now some of the spyware programs are getting much more deceptive and can actually startup in safe mode making it nearly impossible to remove.
:)
At this point the first thing i do for a scan is use a USB adapter and connect the hard drive to my test station then clear all temp folders and run spysweeper and adaware to find any files. Then i reconnect the drive adn boot directly into safe mode and rerun both programs to clean out any registry entries. Finally i go through with hijackthis to repair any damage to the browser.
Ive tried out Giant spyware and it seems to work fairly well but the stupid tray app WILL NOT GO AWAY even after haing all of its startup options unchecked.
Also, the new version of Pest Patrol from eTrust keeps detecting a small text file in my 3 year old compressed video drivers as a keylogger
The reason I suggested using Linux rather than a Windows or DOS derivative was the idea that a virus written to infect Windows would be vastly less likely to be able to infect a Linux system.
That's also why the only file I suggested using from the victim was the NTFS DLL, and that only because of the legality of distributing the NTFS DLL.
Granted, in theory a system booting from CD would not fetch anything from the victim and would not be at risk, but you know what they say about theory and practice - in theory there is no difference between theory and practice, in practice there is.
www.eFax.com are spammers
Why on earth would you do this test on an Outdated OS? Does this really give us useful information if 90%+ of these problems are on Xp Pro and Home? I would think not. I would bet companies fix the spyware on xp then move onto other OS's or put them on the back burner. Chris
Things do not all update themselves.
Indeed especially in a corperate environment where you don't want windows auto updating with untested patches. If you have adaware/spybot & windows & you av & A.N.OtherApp updating itself you soon find your systems become unmaintainable or that user systems randomly break when things conflict.
There is no anti MS motive, I indeed worked as a windows sys-admin and at the time used linux on my system due to worms. I had a windows box to test patches on.
My point is this causes hastle to users & admin who do not need it.
I'm not surprised Spybot did badly.
These things go in cycles, kind of like the Darwinism that didn't work quickly enough on the germ plasm that somehow evolved into the amoral mockeries of humankind that write spyware/malware.
Adaware was widely used for a while, then I started noticing that it wasn't working so well.
Then Spybot is/was hugely popular and extremely effective, so I've started to notice that it too is missing stuff now (or is unable to remove what it finds).
Virus...er...spyware writers are working against these programs, and it's only natural that they are evolving their code to defeat at least the most successful/widely used anti-spyware programs out there.
You wouldn't expect the flu inoculation from 5 years ago to protect you this year, would you? Spyware - and it's counteragents - are the same.
-Styopa
I used to think that what Windows needed was an SU ability, so you'd run as a normal user, and enter the admin password when needed. I still think that's a good idea, but I've come to realise it won't do shit to stop spyware.
For those that don't know, Mac OS-X does just this. You run as a user, and it asks for root when something requires root to execute. Good idea, don't want to be running as root full time. So I'm hanging out in a recording studio, chattering with the engineer, who is also piddling around on his computer while we talk. He's doing something, a box popos up and asks for root and almost before I can see what it wants he whips off the root password and goes back to talking to me.
I asked him about this and he said well EVERYTHING requires it. Anytime you install any app, it needs root. It's just part of the install process.
Well I realised that would be the attitude most non-tech users would take. Installs need root. It's even correct in most cases. So the spyware that's piggybacking on whatever app they want gets root through the install, and then you are back to where you started. The extra verification step isn't any good since people just give it without checking.
I still think it's a good system for those of us that would be suspicious when some little app with no DLLs/libraries to install whines for root, but a normal user isn't going to know the difference. They'll give it root, and get spyware'd.
Not only do most users not want to take the time, they just lack the knowledge to tell if it mentions anything evil in there. They want their Kazza or whatever, and they'll just click buttons till it's installed. Hell, some programs don't even mandidate the installing of their spyware, they just rely on the fact that most people will just do the default install and pay no attention.
People do not want to understand how their system works, they just want it to work.
...It's a religious belief. Good explanation tho, I think I shall save it.
Blar.
And yes, in a corporate environment, it's not advisable to do that, which Microsoft thought of, funnily enough, and provided many ways to roll out TESTED updates to clients of your choice. Also, our corporate spyware detection has central references, as does our corporate antivirus and everything else that has periodic updates.
If you do things properly, Windows will cause you as many problems as linux. Like linux, if you don't know what you're doing, you can make a bad situation worse. Please bear in mind I'm not casting dispersions about your technical ability, but like you, just speaking from experience. God knows I've nuked some boxes in my time ;)
http://www.islamfortoday.com/attack.htm
On the Hijacking of Islam
If the terrorists that struck the USA last week were indeed Muslims, they have not only committed murder, which carries the death penalty, but have also committed a physical attack upon Islam by the damage they have done to its image.
By English convert to Islam, Ruqaiyyah Waris Maqsood.
The Islamic Rules of Warfare
Michael Young details how the attackers of the World Trade Center, if indeed they were Muslim, flagrantly violated the most basic Muslim conventions of war.
Recapturing Islam from the Terrorists
"Muslims cannot deny forever that doctrinal extremism can lead to political extremism. They must realise that it is traditional Islam, the only possible alternative to their position, which owns rich resources for the respectful acknowledgement of difference within itself, and with unbelievers."
by English convert to Islam, Abdal-Hakim Murad.
It's Time to Look in the Mirror
"The anger being vented at Muslims in the west is the anger that Muslims should have toward the murderers that crashed into those buildings. We should be the ones so incensed and sad. We should be the ones putting together military forces to hunt them down and find them, then dispense justice - Islamic justice - toward them. They attacked our religion - Allah's religion!"
by American Convert to Islam, Abdul-Lateef Abdullah.
Yusuf Islam on September 11
Britain's first government-funded Islamic school closed temporarily last week amid a wave of anti-Muslim feeling. Its chairman of governors, Yusuf Islam - formerly the pop star Cat Stevens - explains why his adopted religion is the home of tolerance and not of fanaticism.
September 18, 2001
American Muslim Leaders Condemn Terrorism, Defend Muslims' Civil Rights
By Susan Domowitz, Washington File Staff Writer 19 September 2001
Taliban have "hurt Islam and distorted the reputation of Muslims throughout the world".
Full text of the Saudi Arabian Government's statement on the breaking off of diplomatic relations with the Taleban
IslamForToday.com Tuesday, 25 September, 2001
External Links
Islam Hijacked
Rabbi Reuven Firestone, author of "Jihad: The Origin of Holy War in Islam" and Professor of Medieval Judaism and Islam at Hebrew Union College in Los Angeles, offers his insights into the events of September 11.
Mainstream Muslims Condemn the Attacks
Islamic Scholars Call September 11 Attacks a Distortion of Islam
By Laurie Goodstein, The News York Times, 30 September 2001
Muslim clerics say attacks in US are un-Islamic
Sheikh Mohammed Sayyed al-Tantawi of Al-Azhar, the highest institution in Sunni Islam, warned that those who attack innocent people will be punished by Allah.
Irish Times, September 14, 2001
We Need Spiritual Doctoring
Muslim American ER doctor Faiz Khan, M.D., on duty in New York on September 11, reflects on the incomprehensible suffering of that terrible day.
Islamic world deplores US losses
BBC News, 14 September, 2001
Mohammed Ali defends Islam on tour of New York devastation
Ananova, September 21, 2001
American Islamic scholar, Hamza Yusuf: Terrorists are mass murderers, not martyrs "It's politics, tragic politics. There's no Islamic justification for any of it."
The Mercury News (San Jose), September 15, 2001
Sheikh Yusuf Al-Qaradawi Condemns Attacks Against Civilians: Forbidden in Islam
Islam Online, September 13, 2001
UK Muslims disown 'lunatic fringe'
Members of Britain's Muslim mainstream majority yesterday rounded on the "tiny lunatic fringe" supporting the terrorist attacks on America.
By Richard Alleyne, Daily Telegraph (London) September 20, 2001
Ali's sorrow at terror attacks
Boxing legend Muhammad Ali has made a morale-boosting visit to rescue workers in the rubble of the World Trade Center.
BBC News, 21 September, 2001
Australian Islamic Council Condemns Attacks in US
So far, in 2004, 26% of all of the tech calls we've gone on for our clients and customers have been spyware removal.
While its simply amazing how many people claim to get "tricked" into installing this garbage I have to admit...being able to charge people and make money in this sluggish economy is fine with me.
If, due to people's inability/lack of know-how/tech department to update their machines or simply use firefox or any other non-ie browser is a good thing to my business.
So far we've had our clients buy more copies of adaware professional and hfnetcheckpro than we've sold copies of office 2k3.
Why do overlook and oversee mean opposite things?
Not everything does, but every piece of software that talks to the internet DOES get automatically patched, which is where the vulnerabilities come in.
That's BS as well. Windows allows you to set automatic updates so it will connect to the server, see if there are any updates available, but not actually update. Norton Antivirus connects to the server to check for updates, but does not update itself unless you tell it to. Adobe Acrobat Reader is one that unfortunately checkes every single time and reminds you there are updates available, but it does not download them until you tell it to. So no, ALL programs do not automatically update themselves.
-- If god wanted me to have a sig, he'd have given me a sense of humor.
What I do not understand is how can this be legal. To me this is no different than a trojan (the viral type not the condom.) Maybe it does not self-replicate and spread, but it still hijacked my friends computer. I thought that the malicious or destructive control of a computer without the users consent was illegal according to federal law. Why is it the the government will go after script kiddies, but does not go after the corporate goons who are no better? Oh, wait, I forgot. Script Kiddies do not make political contributions. I'm going to email my congressman.
Insert Generic Sig Here:
Slimeware er, spyware is the bane of my existance. I work for a large company and do not have final say about how the desktops are configured (I would do it differently), I support a special group and nearly all of my people have "admin rights" on their computers. I agree that these people need admin rights for some of the functions that they have to do but figure about 95% of the time they could run as a "super user" without any problems at all.
Very nearly 100% of the computers I touch are infested with slimeware. Running several commercial apps will clear most of the crap that is found but one or two apps seem to come back within a day or two (even if the user claims that they have not been on the internet). It has gotten to the point where I actually believe some of them!
I've found that what seems to be happening is that the slimeware distributors are playing a little versioning game. As soon as the major spyware removal tools are able to kill a specific version of slimeware, the slimeware authors make a new version that they then distribute.
It takes time between the release and the time that the spyware removers catch up and in the meantime, it is up to people like me to figure out how to clean up the mess. I am pretty hard-nosed and will spend a couple of hours searching the registry, booting from CD and deleting files and that kind of stuff to kill off the slimeware. Others who do similar jobs just re-image the machines. Soves the problem faster but I don't think the users are quite as happy. They have to reconfigure the machine to how they like it and there is always the risk of lost data.
I'd love to see these purveyors of filth in prison. Many of them serve up porn and put it on kids machines! They are guilty of a crime every time this happens. Why can't we do something?
Anyway, I don't blame the spyware removal people for these setbacks. They work hard to keep up but just can't.
Im my dreams, I dream of a single tool that sits on the desktop and checks for viruses, slimeware, spam, and other threats and inconveniences. I'd like the tool to be able to be programmed to block access to various applications and websites too. I'd like the same tool to have some sort of "safe recovery" feature that allows me to move back in time to a stable configuration that would not delete data.
These are just dreams but will someone somewhere please make my dream come true? Corporate IS departments everywhere would thank you with money from their budget!
Milton: It says 'crunchy frog' quite clearly.
Praline: Well, the superintendent thought it was an almond whirl. People won't expect there to be a frog in there. They're bound to think it's some form of mock frog.
Milton: (insulted) Mock frog? We use no artificial preservatives or additives of any kind!
Praline: Nevertheless, I must warn you that in future you should delete the words 'crunchy frog', and replace them with the legend 'crunchy raw unboned real dead frog', if you want to avoid prosecution.
Milton: What about our sales?
Praline: I'm not interested in your sales, I have to protect the general public. Now how about this one. (superintendent enters) It was number five, wasn't it? (superintendent nods) Number five, ram's bladder cup. (exit superintendent) What kind of confection is this?
Milton: We use choicest juicy chunks of fresh Cornish ram's bladder, emptied, steamed, flavoured with sesame seeds whipped into a fondue and garnished with lark's vomit.
Praline: Lark's vomit?
Milton: Correct.
Praline: Well it don't say nothing about that here.
Milton: Oh yes it does, on the bottom of the box, after monosodium glutamate.
Praline: Well I hardly think this is good enough. I think it would be more appropriate if the box bore a large red label : "WARNING:: Lark's Vomit".
Spyware, these days, is much harder to get rid of. A simple scan from a program isn't gonna do it. I've been doing ad-hoc tech support for my college dorm, and 95% of the cases I see are computers crippled because of spyware. There hasn't been one I couldn't fix yet.
Here's what I do:
-Install Ad-Aware SE (from a pen drive, since the spyware killed the internet)
-Update it
-Do a default scan
-Remove ANYTHING it finds
-Remove anything it puts in the quarantine
-Run MSCONFIG and, using your best judgement, uncheck anything from the services tab that doesn't look kosher
-Uninstall anything not kosher from Add/Remove Programs
-Reboot into safe mode
-Uninstall anything that didn't work before from Add/Remove Programs
-Open Explorer and delete anything from the Program Files directory that isn't kosher (this step will only work in safe mode because the programs in here won't be loaded into memory)
-Delete anything not kosher from the Start Menu's Startup folder
-Reboot into Normal mode
-Run Ad-Aware again just to be sure
-Install Firefox and hide IE icons
That should take care of the spyware (until the user decides to download more of it).
But there is more work to be done. Show the user what Firefox is and that they should use it from now on. Turn on Automatic Updates so they never have to visit the Windows Update site, the updates will download automatically. Inform them of the dangers of clicking popup messages to install software or whatnot. Though this is not a problem with firefox, explain they should read everything and install nothing that they didn't ask for.
Yes, this takes some time, sometimes upwards of 30 minutes, but if you did your job, you won't be visiting that person for a long time (at least for computer problems).
"I used to work for one of the companies that distributed a "spyware" program"
Moved on to a baby seal beating company? Or maybe an anal wart preserving company?
I mean, once you crawl down into the gutter, its hard to get out.
Interestingly, after you read enough of them, you begin to see the standard disclaimers and can scan very quickly through the EULAs. The stuff that's different usually pops out at you pretty quickly. I can scan the normal EULA (there are some pretty standard ones out there) within 1-2 minutes. It's worth the extra minute to scan now than to have to try to dig out the spyware later.
On the home desktop machine running XPSP2, as most are, updates are INSTALLED automatically. That's right - no user intervention.
In the corporate setting, it's very easy to not rely on the standard windows update to update clients - hotfixes and service packs are easily deployed over the network from a central server, again, without user intervention.
Acrobat reader is not a worry of mine - the only PDFs people read here are generated by ghostscript, and as with the service packs, etc., is very easy to update remotely using scripts. Our anti-virus isn't Norton, but Sophos, so that IS updated automatically.
I can see where you're confused, but I can assure you these problems you state don't exist any more.
That's because Spybot search and destroy is *very* harmful. Sure it gets rid of spyware but it has no respect for any other application on your system and will break it if it needs to remove the spyware. It is very sloppy. That's why it's rated #7. Spysweeper on the other hand has been working with major software vendors to be sure their shit does not break simple things like MS office.
And with my mac I have none of these concerns!
We have 250 local users and 500 remote employees and have not had a virus outbreak in over 3 years now.
Norton antivirus + a managed server which pushes virus definitions updates immediately upon arrival.
Shavlik patch management for pushing patches to individuals machines without setting up all that sms bullshit. Hit em every friday at 2 pm. Simple. We patch our 45 servers manually...
Spysweeper has been our spyware protection standard for almost a year now. We are still cleaning up some machines but no new ones are getting hit.
We run exchange 2003 server as well (oh my god) with Sybari Antigen and in 4 years have not had a single virus penetrate us. Not a single one!
The last outbreak we had was a customer who brought in randex after plugging in but now policy states their machines get checked first. Shrug, this end of the world and ultimate destruction attitude you claim is just a result of lazy or maybe lack of administration due to payroll $$$$. But it in no way is a result of Microsoft at all The same shit will happen if Linux ever becomes mainstream, which I feel will be even worse due to overconfident admins.
This is no suprise, this stuff is getting more and more difficult to remove. Programs like WinTools and TVMedia aren't totally removed by these programs, you have to browse the drive in explorer, in safe mode and delete the directory. Then you have to remove the service if you are using XP. These spyware companies are getting more complex in how the infest your system and it's all companies like lavasoft can do just to try keep up with these jerks.
There has been no spyware or adware on my machine since I started using firefox back at 0.7, period. Not a single item or article. Unless you count tracking cookies, but when was the last time a tracking cookie caused system instability? I still make love to my bonzai buddy daily though! ;)
- Better to speak your mind than to remain silent, or someone may speak for you.
If You really still use Limewire than that is Your fault (tm).
http://xnap.sourceforge.net/
With plugins for Gnutella, OpenNap, GiFT, Overnet and stuff. All in Java. With a nice little MacOSX installer.
For a company that's selling an anti-spyware tool, you'd think they could at the very least use a more secure way of tracking sessions than passing them in the URL.
/(<session token>)/filename.aspx. You're simply asking for trouble if you do.
I see that same thing done with way too many ASP.NET sites and it absolutely sickens me. It's as though no one knows that URL's that use the GET method are capable of being stored in cache even when you turn caching off via pragma:no-cache.
My suggestion is, never buy from a site with a URL that includes
On the home desktop machine running XPSP2, as most are, updates are INSTALLED automatically. That's right - no user intervention.
Re-read the parent post; he's arguing that all programs that connect to the web automatically update without giving the user a choice. I'm pointing out that Windows GIVES YOU THE OPTION. Yes, even in XP you can turn of Automatic Updates, as is recommended by most people. No serious professional leaves Windows Automatic Update enabled. Check your Security Panel under Control Panels.
In the corporate setting, it's very easy to not rely on the standard windows update to update clients - hotfixes and service packs are easily deployed over the network from a central server, again, without user intervention.
Again, that means that Automatic Updates are turned off on the client, and pushed out from from the Server. Yes, you can set it a client to automatically check a local server an automatically download from local server if there are updates, but no corporation does this; having 20,000 systems checking a local update server is a lot of useless traffic. So automatic udpate is disabled on all clients and updates pushed out from the server when needed.
Acrobat reader is not a worry of mine - the only PDFs people read here are generated by ghostscript, and as with the service packs, etc., is very easy to update remotely using scripts. Our anti-virus isn't Norton, but Sophos, so that IS updated automatically.
Again, reread the post. Yes, I know many programs can automatically update. Most programs are written so they will NOTIFY you that an update is available, and ask if you want it installed. Sophos automatically updates itself only because during initial configuration you clicked on an option to allow it to automatically connect, download, and install the updates. Most programs are written like that, they give you the option.
I can see where you're confused, but I can assure you these problems you state don't exist any more.
Re-read the parent post, it said programs that connect to the web *automatically* update, and I am saying that many programs give you the option .
-- If god wanted me to have a sig, he'd have given me a sense of humor.
Totally unbelievable that there are so many Windows lusers at Slashdot.
Then again, who ever said Slashdot visitors weren't a bunch of slimy cowards only pretending to have joined the open source camp?
Disgusting.
Recent versions of Ad-Aware always hang on me. They cannot run a complete scan at all. I've seen other reports on this, and I've tried most of the work-around suggested, but all to no effect. Or at most I'll get past one hang only to get hung up on another one just a few moments later.
Generally the hangs are in attempting a deep scan of the registry, or while scanning somewhere in my Windows directory.
I haven't been able to successfully run it since upgrading almost a year ago. I've upgraded since then to keep the latest version, but there has been no change in my ability to run it.
I'm running WinXP SP2 on a 2Ghz Pentium 4 processor with 512Meg of RAM and an 80Gig hard drive.
Anyone else having these problems or know of any sure-fire work-arounds?
- Spryguy
There are three kinds of people in this world: those that can count and those that can't
I use FutureSoft's i:scan because it gives me the ability to seek and destroy malware that no one else has a definition for... Also of note is the enterprise edition that allows you to create your own signatures so you don't have to wait on updates... Used together they are extremely effective... =)
I know what's on your hard dr
who has her brand spanking new $35 lexmark which requires funky ass control panels to start with the computer to operate properly. also when you start removing well known programs, you get more tech support calls "Where did my program(s) go???".
:) Also, to save yourself some headaches from the very annoying malware, do the above process in safe mode.
i have found the easiest way to clean out spyware from a computer that is not my own is to go through the Run keys in both hklm and hkcu and remove anything that looks suspect (novices will probably be better off removing everything). i.e. C:\windows\systray.exe does NOT need to start, nor does C:\windows\system32\asdfjlw12.exe. However, rundll nvDwcpll,start does need to exist (norton antivirus).
Next hit up the services mmc plugin (services.msc) and disable any services they do not need (including upnp discovery, server, workstation, and computer browser if its the only computer in the house). Once that is done, load up BHOdemon and turn off any benign BHOs for IE.
Finally install Firefox and all relevant plugins (flash, java, etc.) and change their desktop IE shortcut and default browser to Firefox (leave internet explorer in their programs menu incase they need to goto an IE-only website like windowsupdate).
This whole process takes me about 10 minutes tops (god bless usb flash drives) and either gets me free drinks or easy money and happy friends that don't come back to me for problems.
Again, this is only for computers that aren't your own. i advocate destroying your own computer in order to learn how spyware works (although virtual pc is a better place to break things
-dk
Pest Patrol belongs on this list, as in my experience it beats out Adaware and SpySweeper. It's not shareware but definitely worth the $40 I paid for it.
Its amazing how bad almost all of them are. I expected at least a handful to be getting 70-80% of spyware... But to be that horrible was totally unexpected. More amazingly, Giant Anti-Spyware was ONLY 3 WEEKS OLD when they reviewed it. I've been using it for a week, and it really does work well. It has significantly more features and a better UI than the two others I tried (ad-aware... weak with no features, and spybot... better but still ineffective)
Their SpyNet must really be effective to be able to beat ad-aware and Spysweeper by 50%!
Its a good thing sites like this are out there, otherwise who would have known that the software out there is that useless? Its shameful that bad software can still be profitable. I hope Giant gets recognized (monitarily) for it.
Here's what I do in these situations...
First, it requires a windows machine (NT,2K,XP) using the NTFS filesystem. FAT32 won't work because it don't do ACLs
1. Create a new local administrative account to work under (this is important read the whole thing here!)
2. Run Ad-Aware, Spybot S&D, and Hijack This, under this new admin account keep all the directories the spyware created, or make note of them so you can re-create them later.
3. Now, delete everything contained in these folders, then you start changing permissions on all these folders to deny Everyone access (including administrators), and take ownership of all these directories, when spyware trys to re-install itself it will fail. This method works real well when nuisance kids come back and try to re-install kaazaa, iMesh, etc. If you deny access to the kaazaa folder it won't come back unless they're smart enough to take ownership back and change permissions, or install it in a different directory.
4. This is the kicker: Install Firefox to replace IE, and Firebird to replace Outlook/Outlook Express. Run a search (F3) for iexplore.exe and msimn.exe and change permissions on them just like we did with the spyware folders.
5. This is my favorite: Now delete the IE icon and Outlook icons and change the Firefox and Firebird Icons to look just like IE and OE (MUHAHAHA).
6. Now login as Administrator and delete the user account we just created to do all this stuff.
If nuisance user must have IE to access a dumb banking website that's coded in shitty client side ASP or something like that; write a VB script, or batch file or whatever to use the runas command (similar to sudo in unix) to launch iexplore.exe under a less privileged account; point this back to the normal IE icon and it becomes seamless for the user.
You can take it even farther and deny write access to all the Run keys in the registry to keep crap from getting loaded in the System Tray. You can also deny write access to the Root of the Program Files folder, if you deny access to the whole folder including subdirectories and files it will break a number of applications that love to write metadata, temp files and such in the Program Files folder, like Microsoft Office 2000 (let's not even get started on how many Microsoft developers don't know where temp files and metadata belong). Of course if you do these things the user won't be able to install programs. If the user isn't running as an administrator they won't be able to write to the root of Program Files anyways, but they still can put stuff in their own Run key and the global Run key!
Sorry this is so hacked together, I'm in a hurry, want to go eat lunch NOW...
grep -iw skynet
http://shit.slashdot.org/article.pl?sid=04/11/23/0 331228
Since I wish to keep my contact to the MIS department (a.k.a "the obstacle") to the bare minimum, I only consider installing software on my work machine which is (a) free (gratis) and (b) has no "non commercial" clauses in its license.
Both Ad-Aware and Spybot S&D have workplace-friendly licenses.
Cars are not computers, yes. Computers are not cars, yes. You get a gold star.
But both computers and cars are complex multi-purpose devices. They are not commodity television sets or VCRs whose software only perform one basic function (watching a channel, recording a channel).
The more you can lock down and restrict the software on a device, the more secure and useable it can be. This is why crashes in phones and PDAs are so much less common than PCs.
The instant you give the user the ability to install whatever they want, all bets are off.
Flexability and Idiocy-proofness are inversely proportional for any complex system. There is no way around it, you can't have your cake and eat it too.
No I don't expect that Joe user should know how to swap out a DIMM. But I do expect that he should read the manual. I also expect him to read and heed warnings from his ISP about malware. If they can't do that then either
a) They can't complain when they get malware / virii
b) They shouldn't use a PC, since they won't take the time, they should use a locked down Internet Appliance.
You are being way too kind! A large portion of MS Windows' user mass have absolutely no chance keeping Windows clean on their own. If they use Windows on the Internet, that is. They will get screwed. Many of them won't know, or won't care. Those who do will often need help from others.
It's a pitty none of the tests have compared the false positive rates of the various spyware busters. It would be interesting to run all tested products on a PC with no spywares and compare the results. On my machine pest patrol (the online version) found 16 non-existing spywares. Testing for positives only encourages products that create false postives.
I'm starting to feel like a crank for mentioning that this is just a natural consequence of capitalism; the pursuit of ever-expanding profits by all legal means, when the corps own the government, is obviously going to lead to tragedy-of-the-commons problems like spam, spyware, pollution, etc.
Surely if the U.S. government can make pirating music and movies illegal the world over, then, if they wanted to, they could make spamming and spyware illegal as well. But, guess what? Pirating music is bad for business, so the gov't will push on it. Spamming and spyware is good for business, though citizen/comsumer-unfriendly, so the government "of the people" says "Suck it up! Don't be un-American by suggesting these businesses shouldn't have the right to shove advertising at you at all times."
Startup Monitor is nice. I only stopped autoloading it because every time my mom ran RealPlayer, it asked permission to allow TkBell to run at startup ;-)
Corollary to Moore's Law: The IQ of new computer owners is declining.
I came home for the holidays and got busy cleaning up the family computers like always. I happened to notice wintools there as well. Well after running adaware, stinger, trying to delete it, end task it, etc..... I just went into add remove programs in the control panel and there it was. Uninstalled as easy as could be. I always have to laugh when I forget to try the obvious and just go to the heavy handed stuff right away. But if you ever come across wintools again, keep it in mind.
You people have programs that install on your machine, collect data and send it back? .and no app makes a data call out without my approval. The default is set to No. It's hugely easy.
I can't tell you how strange this is to read.
I've been on Mac so many years, I genuinely take it for granted: my Powerbook belongs to me. As does the information stored within. All of it.
Mac OS X is fully networked . .
I post this not to be zealot-like, but with the idea that a free people should remain unco-opted. You don't have to put up with this shit at all.
Why is there discussion of market share and vulnerability to attack?
The number of hackers attacking an OS does signifies nothing, especially if the OS in question has a better security model.
Linux is not overrun with viruses, worms, trojans, etc. as is Windows because of a simple reason -- the foundation of Linux is more secure.
Windows is fundamentally flaw at it's core. Microsoft knows this and "patches" the obvious flaws but cannot fix the source of the flaws without re-writing the entire OS. Which will never happen.
This post encoded with ROT26. If you can read it, you've violated the DMCA. Handcuffs please, sergeant.
An added percaution is to look at the time/date stamp on the individual binaries, if any of them are newer than system installation time you have a better chance than not that it doesn't belong. Also, run cwshredder in report mode, it will tell you every IE toolbar/helper app/search assistant that is installed, many of them you can get rid of after inspecting the binaries.