Anti-Spyware Products Don't Live Up to Promises

John Wells writes "In the December, 2004 issue of PC World, the author of an article titled Poor Defenders concludes that most commercial anti-spyware software is ineffective. In tests using a fresh install of XP and 6 typical spyware infections the commercial software failed to stack up against freeware competitor Spybot Search and Destroy. Four out of seven commercial products failed to remove any of the infections. One product even installed 57 spyware files itself! Conclusion: Use freeware products like Spybot and Lavasoft's Ad-Aware SE Personal."

Comments

not too comprehensive

[ack154]

So where does this guy get his "paid" spyware removal applications? Clicking on popups? Oh... wait...

many of these utilities use aggressive marketing tactics in pop-up ads, spam, and keyword ads appearing alongside Google search results

Though I suppose this is how they sucker a lot of people and some people expect results if they pay for a utility, I would probably do at least a LITTLE research before paying for any app like that. The thing is, I would hardly consider this "most commercial anti-spyware software." So as far as this "test," he might as well do an article about Virtual Bouncer and how it removed his parasites for him.

Why didn't he test something like Spy Sweeper or Giant AntiSpyware? Those are paid ones that I would probably recommend if someone did want to pay for a program. At least that way, people would see that not ALL commerical products are crap - it does almost sound like that.

But really, Spybot isn't even cutting it anymore, IMO. AdAware is still doing well, but I've actually been more impressed with the other two I mentioned above - worth a look if you haven't checked them out - both have free trials that you would have no problems doing a removal with.

Re:not too comprehensive

[Cat_Byte]

But really, Spybot isn't even cutting it anymore, IMO. AdAware is still doing well

I find running both of these and using the yahoo spyware blocker is pretty effective. The yahoo thing doesn't catch all of them but I notice the # found by spybot and ad-aware went down quite a bit after installing it. FYI, if anyone hasn't upgraded to 1.05 of ad-aware I recommend doing so. I found about 30 more spyware programs on my Mom's computer after the upgrade after scanning with the most up to date definitions on 1.03.

Re:not too comprehensive

[Elwood P Dowd]

I'm curious about Symantec AntiVirus 9. Supposedly it finds spyware & adware too.

Re:not too comprehensive

[over_exposed]

So where does this guy get his "paid" spyware removal applications? Clicking on popups? Oh... wait...

And when I click on the link to his story, I get "Firefox prevented this site from opening a popup window. Click here for options..."

Coincidence? I think not...

Re:not too comprehensive

[Cat_Byte]

I work on lots of peoples computers guys. It isn't just mine. I install stuff from the internet just like others have on here but nobody would dare admit it. Sure I have the yahoo messenger, gmail notifier, folding@home, weatherbug, etc on mine. It isn't that uncommon guys. Get off the high horse. The spyware tools are what I put on other peoples computers when I work on them in my spare time. I also have to use IE at work to be like the customers we have when I troubleshoot our program. I'm tech support. Sheesh. I swear the people on here with their high horses and arrogant assumptions. Do I have to post my whole damn life story to keep people from filling in the blanks with ?

Re:not too comprehensive

[Mastoid]

Supposedly, yes. I was excited to read that when our site got an upgrade with our site license.

However, it's limited to finding certain malware installations on a full system scan, if you enable that option. It's off by default.

It does not prevent installation of malware in the first place, nor does it use its resident memory scanner to detect infections of anything other than viruses.

I haven't been too impressed with its abilities when manually scanning, either. It's an excellent virus scanner, so that's what I use it for. I keep systems clean with a combination of Ad-Aware, Spybot, and proper user permissions.

Re:not too comprehensive

[pbranes]

Everyone is forgetting one of the most important methods of combating spyware - install windows critical updates. Many many many spyware installs get on systems by browser holes. If people would just update their systems, they would be protected against a huge infection vector. Obviously, that doesn't keep spyware off of your system if you have installed kazaa or some other stupid app like that, but it does protect you against drive-by installs.

The other great, untapped tool is BartPE. This is a bootable windows xp cd. You can have ad-aware, clamwin, mcafee, and f-prot all load up from a bootable cd where they can download internet updates, and scan a hard drive. You don't know how many times I have "cleaned" people's computers with ad-aware & spybot while booted into their windows os, but some spyware has built in functions to hide itself, so spyware keeps reappearing. Using bartpe solves that problem, you boot off of it first, get the really nasty spyware, trojans, and viruses out of the way, then you boot into windows and run ad-aware and spybot again to get whatever was left behind (usually registry entries).

Re:not too comprehensive

[mjm1231]

We're running the corporate edition here. It does find spyware and adware. Doesn't do anything about it, but it does tell you it's there. The biggest drawback is that it also scans the system restore folder, and reports a machine as infected if it finds spyware there. (It does the same annoying thing with viruses.. if a virus is in quarantine, SAV detects it and reports the machine as infected.)

It's up to the users to do the research.

[garcia]

Nathan Shafer, answering our e-mail message to Spyware Stormer, challenged our test methodology. Shafer wrote that Spyware Stormer detects "over 20,000 variants of spyware and adware," and that its performance with the six applications we chose was therefore "hardly representative in any way."

They are absolutely correct here although there are only four programs you should ever install for combating spyware: Adaware, SpyBot S&D, SpywareBlaster, and a good software firewall package (preferably one that tells you when something is trying to connect out to the Internet like ZoneAlarm). You need to keep these programs updated on a regular basis and you need to make sure that they run regularly. Unfortunately only SpyBot S&D runs w/o user intervention if you set it up to do so.

SpyBot, while being a great program, isn't updated nearly as often as AdAware and doesn't find all those pesky cookies that AdAware does. SpywareBlaster is good for keeping those pesky cookies from getting onto your machine in the first place.

We were unable to reach NoAdware, but the Better Business Bureau of Upstate New York reported that it had received 22 complaints about the company, which is not a member of the BBB, by early October. Network Dynamics has a clean record as a member of Southern California's BBB. The BBB's complaint database contained no record of complaints for the remainder of the companies whose products we tested.

The BBB has fallen into worthlessness in recent years (I don't know about years passed). They have little to no pull and sometimes they even go so far as to ignore complaints against their companies. I would ignore any comments in regards to BBB related businesses.

Basically you need to research what you are installing on your machine. That means using google, word of mouth, and your own deep digging before you put any "cleaning" program on your machine. You also need to do some research into making sure that you are using what you can to combat Spyware.

Sadly, most people out there don't know, care, or care to know. That's why they end up w/it in the first place. If people DID care about what they were installing on their computer AND took the time to do a quick google search they would find out exactly what they need to know.

It has gotten to the point where I seriously believe that MSFT is doing this on purpose in order to show the public why they NEED to use "protected computing".

Re:It's up to the users to do the research.

[which way is up]

This is a dangerous trend. Given the majority of these ad/spyware companies don't care what their products do to the "users" computer, they can leave security holes unnoticed and allow exploits without the user even knowing there is a flaw in their computer. Windows updates can only do so much, and with companies releasing software that intends to help the user, but instead can hurt them. All the while the user is unaware. This makes me sick. Let's support the companies that work off of donations and have open source programs. This is the only way to prevent this from spreading to all of the favorite anit-ad/spyware programs.

Re:It's up to the users to do the research.

[Lumpy]

you really need to go further.

looking for free AV or firewall software I encounterd that MOST has spyware bundled with it. the ONLY apps I feel safe installing are Open Source where I can look to see if there is spyware included.

Freeware software has become the biggest carrier of spyware. many "media players" and other apps have a crapload of spyware in them and I am running into people with claria installed that dont even use the internet but recieved a nice CD with a copy of PC magazine that had some nice free apps on it.

personally, I am making a killing at $50.00 a pop to relatives and friends. i tell them to let others know that I'll do the same to their computer for $100.00 and I'll give them $20.00 for each person they send me.

I now clean about 20 computers a week, all set up in a row in the basement with a 2 day turnaround for them and they have to sign a waiver/disclaimer and pay in cash.

christmas is going to be a great one this year.

so in a way, I really have the spyware makers and microsoft's IE team to thank for the plentiful bounty I have this year.

Re:It's up to the users to do the research.

[hackstraw]

They are absolutely correct here although there are only four programs you should ever install for combating spyware: Adaware, SpyBot S&D, SpywareBlaster, and a good software firewall package (preferably one that tells you when something is trying to connect out to the Internet like ZoneAlarm).

Thanks for the tip. If I ever get spyware or adware on my Mac, Linux, or Slowaris boxen I'll install these and see if it helps.

Sadly, most people out there don't know, care, or care to know.

And why should they?

Although I'm more technically and mechanically inclined than most people, do you know what I know or care to know about my car?

I put gas in it when the trip odometer gets around 300 miles (gas gauge is broken).

I get someone to put new oil and stuff in it when its been about 3,000 miles or about 3 or 4 months. When I'm there I may get some other fluids or belts or hoses changed if I can't remember when the last time I've done it or it looks bad enough to change.

My car is 14 years old. Its broken down twice in the past 5 years that I have owned it. It broke down due to a broken water pump and a broken universal joint on the drive shaft (neither were diagnosable by physical inspection). I'm guessing these anecdotal data points are much less than what is expected of an average person to surf the web and read some email.

I know and spend much less time with things like my telephone, my television, my stereos, my dishwasher, my garbage disposal, my microwave, well every other electro-mechanical gizmo that "makes my life easier and better".

I'm sorry, but statements by us technogeekdweebies like Sadly, most people out there don't know, care, or care to know. only applies to computers. Actually, a large subset of the computer population that run something besides a Mac, Linux, or Solaris on their computer.

I hate to be l33t or whatever, but a statement like Sadly, most people out there don't know, care, or care to know. falls into that category, and that is following advice that there are 3 specific 3rd party programs required to keep your computer running (after careful research) and a 3rd party firewall product that is much beyond anyone's wants or needs for surfing the web and reading email. Oh, and I hear that people "need" or "should" also have a virus program on their computer also (after careful research, and constant updates).

I get reminded daily about how fundamentally stupid people are when they talk about their "computer problems". If I had those problems, I would throw the computer in the trash. End of problem.

Sometimes I think about creating a startup company that rebrands and sets up Windows correctly and sell it at a premium to people. Something akin to what Saleen does to Ford Mustangs. I would bet that people would pay well beyond Mac prices for a "PC" that runs almost as good as a Mac.

Re:It's up to the users to do the research.

[pbranes]

At the support center that I work at, we do pretty much the exact same thing - 90% of our calls are related to spyware. One thing you didn't mention above that you may want to consider is Bart PE. It is a bootable windows xp cd that can run ad-aware, clamwin, mcafee, and f-prot. It can also connect to the internet and download updates for each of these apps. You can then tell these apps to scan & disinfect the person's hard drive. We have found that if we run bartpe right away on any computer we get in, we can save ourselves tons of time because it knocks out all the nasty spyware, trojans, and viruses right from the start.

I Prefer hijackThis

[Bimo_Dude]

hijackThis seems to find all the stuff that others leave behind, and it's free (as in beer). Almost everybody I know uses it too.

Re:I Prefer hijackThis

[garcia]

Yeah, it's free, and it's great for people that have a "Clue". It's not so good for people that don't have any idea of what they are doing with a computer.

Most people don't have a Clue and they don't want to. That's why they are infected with Spyware in the first place. I would NEVER recommend hijackThis to anyone except someone I was KNEW was very good with computers and what they should and should not see running.

While it is difficult to get Spyware when you can't start your computer correctly it is also annoying ;)

Re:I Prefer hijackThis

[UWC]

My main problem with HijackThis is that it finds all potential instances of browser hijacking, benign or not. I've run it before, and a majority of what it found were things that did not need to be removed. It's good that it's so thorough, but it's definitely not friendly for those that need it most. However, I've seen forums in which you can post your results and other members will advise you on which entries are harmful and should be removed.

Re:I Prefer hijackThis

[Davak]

Please don't recommend this so broadly. Experts should use hijack this to fix systems that can't be fixed any other way. Hijack This alone will miss files that are currently not being executed. Using Hijack This alone without other antispyware software is silly.

Just because it's not running, I am sure you don't want some coolwebsearch files just sitting silently on your system.

Here's my recent techrx post regarding this same subject: http://www.tech-recipes.com/windows_spyware_tips75 8.html

or the easiest solution

[hsmith]

install firefox
???
profit

really if you are still using IE you are bringing it on yourself, i loved IE, but it has become garbage

Re:or the easiest solution

[LiquidCoooled]

Most of the time, installing Firefox won't actually remove the problem.
Sure, it will prevent further mistakes (or at least limit them) but it won't get rid of half of the crap that gets onto a machine.

Its the same thinking when people say "install service pack 2 to clean it up". Those machines are the ones which have the most problems, and for once, MS isn't really to blame for it.

They will only do well if starting from a clean slate, so before upgrading someone to Firefox, or any other secure upgrades, make sure you remove the problem first.

Re:or the easiest solution

[michrech]

Actually, MS *IS* to blame for it? How do you think the browser security failures got into the system in the first place?

Yes, software mistkes will happen (Perfect example: Microsoft). But the least they can do is repair the holes and release updates.

Sure, many won't install the updates on a regular basis, but every customer of mine will. Same will go for many other techs. With the security holes closed/closing, there would be less spyware (as we know it today).

I'm not taking blame from users. As long as they continue to not understand that there is *never* such thing as a free lunch, this crap will happen to them...

Re:or the easiest solution

[pbranes]

I work in a computer support center where people drop off their computers for us to fix. The biggest problem we have isn't spyware installed via IE, it is spyware installed via kazaa, morpheus, etc. It's these companies bundling spyware with their apps that is the major problem - not just people installing spyware via activex. So, unfortunately, installing firefox is a good idea, but it still leaves a large attack vector for spyware to get in.

Re:or the easiest solution

[pauloslash]

Stop surfing w/ admin rights. Using firefox doesn't hurt either.

By doing both, SpyBot nor AdAware will ever find anything to remove. Only thing i go out of my way to remove occasionally are cookies.

Where's the program

[four2five]

That convinces your little sister she doesn't need a barbie IE brower theme or a cursor that looks like a puppy dog. Hold that, I want a program that turns the cursor into a weapon of some fashion that I may use to smite that damend purple monkey on my computer. That's worth my website traffic being shipped of to who knows where in itself.

Yahoo's spyware tool is the best

[Electric Eye]

Folks, I'm telling you, I've used Yahoo's new Spyware program that sits in the Yahoo toolbar and the thing works BETTER than AdAware. I'm serious. I had to fix my parents' and my inlaws' PCs, both with XP2. I've used AdAware and a few other freebies on both, but they still ran slow. So, for the hell of it, I used the new Yahoo thingy and it found TONS of stuff the others did not, including a trojan spam application. I have yet to see anyone talk about this app (even Ars Technica's latest Spyware article neglected to talk about it).

Re:Yahoo's spyware tool is the best

[kesuki]

Parent is not troll... Cookies ARE spyware and yahoo!'s toolbar uses cookies to tack and collect Personally identifiable information on users et-al. Yahoo!s Spyware tool does allow yahoo!'s tracking cookies to remain intact... while removing other companies... making yahoo!'s tracking cookies more valuable...
I'm sure yahoo!'s Removal tool works to remove eveyone elses spyware(or as much of it as yahoo! is aware of), but it by design allows yahoo to continue to track your web usage.

she got a refund?

[underpar]

NoAdware "removed some stuff, but it also deleted something on the hard drive so the computer couldn't reboot," Smith says. After reinstalling Windows, Smith sent multiple messages to NoAdware requesting a refund, which she received four months after her initial request.

They actually gave her money back. That's good right? Sure they took four months, but they did it. She should shut up and stop complaining. They could have just blamed her for it since she really couldn't have proven anything.

manda

Hmm...

[which way is up]

I use Adaware SE and SpyBot which I run manually once a week, each. I have Webroot's Spy Sweepter which stays in memory and provides a good level of "live" detection. Between the three programs it has been a long time since I've had a adware/spyware program on my desktop. However, it has only been through the use of all three that I have gotten to this point. I haven't found a program that will accomplish this by itself, either free or for fee. PC Magazine ran a comparison of spyware removal programs recently and came to about the same conclusion. They did rate AdAware SE as the best program, though.

Free anti-virus alternatives?

[mabu]

I'm curious if there are comparable-quality Freeware/Shareware anti-virus products available? I don't mind paying for a product, but don't like having the product cease to function unless more money is extorted out of me in perpetuity. I'm sick and tired of Symantec shaking me down for subscription updates, and subsequent versions of their products becoming more bloated and inefficient.

Re:Free anti-virus alternatives?

[say__10]

AVG Anti-Virus, we use it at my work (an ISP) and reccomend it to all of our customers. Check it out at www.grisoft.com

Re:Free anti-virus alternatives?

[AndroidCat]

Grisoft's AVG Anti-Virus. Make sure you get AVG 7.0 because support for 6 will end with 2004. No complaints, but I only run it now-and-then because the idea is to stop them before they get installed.

Re:Free anti-virus alternatives?

[Wordsmith]

try clam a/v, or if you're on windows, clamwin a/v. the interface isn't great, but it does the job.

why?

[Chuck Bucket]

I still can't fathom WHY Microsoft doesn't have something like this builtin to XP. My mom bought a Dell and a neighbor has had to clean the thing 3 times in the past 6 months! I'm embarassed now that I didn't push her towards a Apple now, but I only run Mac and Linux at home, and had no idea how bad the spyware issue is for Windows.

Really, this is an OS problem, and MS should provide a solution, you shouldn't have to reply on 3rd party providers to fix a shortcoming of the OS!

BCB

Re:why?

[jd142]

Because MS wants people to be able to install software easily and quickly. It enhances the Windows usability experience to be able to quickly and easily install any piece of software.

Plus, Microsoft likes to sell ads on its sites. I doubt you'll ever see anything like the Firefox ad blocker or the AdBlocker extension for IE.

I was very surprised they blocked pop ups. Probably got to the point where pop ups from spyware infected computers were making people think twice about windows as an os.

Re:why?

[0racle]

I think that it might have something to do with the phrase 'anti-competitive lawsuit.'

No spyware is not an OS problem, I have Windows machines, I use IE, I do not have a spyware problem. My girlfriend runs Windows, she uses IE, she does not have a spyware problem, and while I may be catagorized as more cluefull then the average user, she is the average user excepting for one thing, she actually learned how to use her computer. Do you consider a person refusing to clean their duct work, or take their car in for a tune up a problem with the house or the car? No its the users fault, and its the same with spyware. How long have people been told, don't click on everything you see? Don't open that mail? Hell its even on the news now. This is a problem with people activly refusing to learn. Spyware writers do not target Windows, they target IDIOTS. There are spyware apps that target Mozilla that do things they shouldn't, so why are there not more? The target is idiots, thats why, you will see more and more targeting Mozilla as more and more of the target audience are convinced to use it.

Re:why?

[TheAwfulTruth]

Then it'll be Microsoft that determines what software is "Spyware" and what is not?!?

This is NOT an OS problem at all. Spyware is (as far as the OS is concerned) a legitimately installed and running program.

There is nothing in Linux or OSX that will prevent spyware on those OSes either. It's an ignorant user that installs Gator and the syware it comes with (or any of dozens of other spyware carrying programs)

That being said, XP SP2 does help in this regard. There is an additional warning when you try to install or run programs that you have downloaded from the web, and the firewall will block outgoing connections from unknown programs (Till you tell it to do otherwise). So that helps some, but of course the ignorant user that bypasses all that will still have a "problem" that they cannot understand.

The only way to truly prevent the problem of spyware is to prevent users from installing software at all, on ANY OS. (Er, but then my Toshiba laptop came preinstalled with spyware, so not even then...)

Re:why?

[Swamii]

Probably got to the point where pop ups from spyware infected computers were making people think twice about windows as an os

Haha. As if people actually knew was an OS was...

The real reason MS hasn't created a spyware blocker? Because peanut galleries like Slashdot would go up in arms about how MS is trying to "take over another market", cry about unfair competition, whine about too much bloat, etc. I mean, just look at how Slashdotters whined and cried like a bunch of 4 year olds this morning when Microsoft announced they were entering the blog publishing realm. When you're Microsoft, it's damned if you do, damned if you don't.

Re:why?

[jafac]

Spyware exists for Mac OS X.
So why don't any Spyware removers exist?

Re:why?

[RatBastard]

It's an ignorant user that installs Gator and the syware it comes with

While true, it is hardly their fault when so many programs out there come bundled with spyware. I've run across many free utilities and applications that are filled to the rim with spyware and I'm very careful about what gets put on my Windows box. I can't see how the average "it's just a tool" users out there can keep on top of all this.

But there are also programs that auto-install themselves without the user's knowledge, just by landing on an otherwise legit looking web page. That is an OS level problem and there is no excuse in the world for it. XP SP2 fixes many instances of this, but not all and not everyone has XP. There are still a huge number of 98, ME and 2000 users out there and SP2 won't help them a bit.

The "ease of use over all other considerations" model has left Windows vulnerable to these infestations. It saddens me that people are unwilling to hold Microsoft to task for their short sightedness and utter lack of concern for their users security. While there are no built in systems to stop spyware from getting installed by a user under Linux or OS X, OS X, at least, requires a user to provide the administrator password for any application that is trying to install system level software. And none of the Linux/OS X (and non-IE browsers on Windows) auto install software from a website.

Re:why?

[Natchswing]

> Really, this is an OS problem, and MS should provide a solution, you shouldn't have to reply on 3rd party providers to fix a shortcoming of the OS!

Alright, I'll bite. What short-comings would the Linux OS have without third party applications? You could almost argue that everything in your distro, besides the kernel, is a third party application.

Now, saying that the OS shouldn't rely on third party applications to patch holes - that I'd agree with.

Re:why?

[Mongoose Disciple]

On top of things already mentioned in some good replies to this post...

You have to remember that the spyware climate looked pretty different back when WinXP was first being designed/written. It's reasonable that the designers wouldn't have anticipated it becoming as much of an issue as it has and wouldn't have prioritized it very highly.

That said, I have a Windows machine at work and another at home, and outside of cookies that AdAware cleans up, neither has ever had spyware or a virus. You'll never be able to write software that makes it impossible for malicious people to exploit uneducated or naive computer users. That doesn't mean that the effort shouldn't be made, but realize it's a losing battle. There will always be some way to trick novice users to allow something bad to happen to their machine.

Re:why?

[starm_]

I think there is a bigger issue behind all of this. People really are starting to trust free and open source software more than commercial software. It is no surprise as private companies act as your enemy as soon as you buy something from them. They try to extort money from you by pushing upgrades because of vulnerabilities and compatibility. They make you subject to small print, EULAs with mysterious and suspicious content, advertisement that is manipulative, misleading and dishonest while giving you poor quality support for their products. They push expensive insurance on everything you buy.

Just they other day I had to throw out a perfectly good scanner because the company that made it (agfa) stopped making new drivers for it and it won't work under XP.

Before the advent of opensource/free software consumers had no alternatives so they had to deal with unethical deceitful entities. But now open source has proven to be much more competitive on the ethical and honesty front. If private companies want to keep their market share they are going to have to earn their trust. They will have to stop trying the fsck everyone in the behind all the time by pulling charlatan licensing tricks on you or people will slowly move away from them.

Re:why?

[omicronish]

I still can't fathom WHY Microsoft doesn't have something like this builtin to XP.

Really, this is an OS problem, and MS should provide a solution, you shouldn't have to reply on 3rd party providers to fix a shortcoming of the OS!

The ultimate solution would be to make Windows more secure by default. Yes, you can make it difficult for spyware to enter, but only if you make modifications (run as regular user, keep patched regularly, use Firefox, if using IE modify a crapload of settings to make it as secure as it can be, etc.). Regular users don't know how to do these things, and it'd be really nice if a couple of those things were done automatically. Actually, it'd be more than nice; it's imperative that they be done for the sake of security.

The solution isn't to bundle a spyware remover with Windows. The solution is to eliminate the security flaws that allow spyware to enter in the first place. And I'm not talking about buffer overflows and such, but fundamental security blunders such as the introduction of ActiveX. The former are a nuisance that are difficult to avoid (just look at all the flaws in IE, Firefox, etc.), but the latter is simply inexcusable since they're purposely designed. Microsoft didn't accidentally create ActiveX; they planned and implemented it without realizing the security implications.

If anyone's ever looked at IE's security model, even if it's theoretically safe it's confusing as hell for people even like me. The concepts of zones and many different unclear settings that affect security turns securing IE into a trial-and-error process. When people suggest rewriting IE there's usually an implication of rewriting stuff to fix buffer overflows and other annoying bugs. I suggest rewriting IE to eliminate the confusing security model and ActiveX, which in turn would likely eliminate many potential bugs that arise from confusion.

Same goes for anti-virus

[CrazyJim1]

Anti-virus tools are designed to take out older viruses. When a new virus comes out to market, the Anti-virus tools could take years or never defeat it.

The fact that its called ANTI-VIRUS makes gullible people think its a cure all, when its unlikely worth the time to install, let alone the money spent on it

A couple tips for removing spyware from windows.

[category_five]

A couple tips for removing spyware from windows. Run both ad-aware and spybot - search and destroy. after you run them you might still have some spyware. If this happens turn off system restore (at your own risk)and then reboot into safe-mode and run the checkers again. This can remove some of the hangers on. Also a great utility is www.doxdesk.com. It shows you how to manually unregister DLL files and also does a web based check for some common spyware.

Consider the alternative.

[sulli]

It was either this or more "What I Did With My iPod" stories.

Hmm...

[conebrid]

You must be using Internet Explorer with your security settings set to allow ActiveX controls to use the Pest Scan

Doesn't look like I'm going to be able to scan my system without using IE with ActiveX enabled. I think I'll pass.

Fundamental Difference

[ObsessiveMathsFreak]

The fundamental difference between freeware and proprietry anti-malware software is that the freeware are doing it for the love of the game, or in this case their hatred for spyware in all its daemonic forms.

Commerical anti-spyware vendors on the other hand are in in for the $$$ and that means they are susseptable to temptation, i.e allow malwarez who give them money to get through, use malwarez tactics to get money and do things other than what it says on the tin while users aren't looking.(read, kazaa)

I suppose commerical vendors are just more idealogically close to the spammers, who are also in it for the money.
In any case, if you need an 'infrastructural' type software program, your nearly always better off going FOSS anyway. That's my 2c.

Re:Fundamental Difference

[sjonke]

That can be true, but what is to say that a freeware spyware removal tool developer wouldn't take payments from spyware producers? Indeed it would seem even greater incentive to do so seeing how all their development efforts add up to nada in terms of income otherwise.

Re:Don't install "anti spyware" advertised in popu

[sonicattack]

Don't buy any services or products advertised in popups, or other "annoying" media.

Duh!

Re:How many

[QuaZar666]

Damn you. One can lose their sanity in that song. for the love of slashdot never post that song again.

For all others who have not clicked on the link, I recommend to not click it, unless of course you enjoy Banana Phone.

- Qua

Spyware Stormer

[LittleLebowskiUrbanA]

is not a company you want to do business with regardless. I note that they responded to the article. So how about this question, Spyware Stormer? I challenge you to answer me here in this public forum and will once again email this to every address I can find for your company.

Why is your company using Windows Messenger Service to effectively spam/invade user's privacy with unwanted popups advertising your product?

Article Redundant

[isorox]

In tests using a fresh install of XP and 6 typical spyware infections

So, a fresh install of XP then

Open Source Solution Needed

[DigitalRaptor]

The open source community really needs to rally behind this, I think.

I'd love to see a project that uses community involvment to flag projects and websites as "phishing" or "spyware" related.

It could be integrated into open source projects such as Firefox and Thunderbird so you could be assured that after a few people in the community confirmed that a particular URL or even IP was "phishing" or "spyware" related, it would be disabled in the browser or email client without a blood sample and double confirmation.

I, for one, am sick of helping other people clean their computers of spyware. Many of them become so bogged down they are unusable.

Spybot: Destroy UI Designers

[Blakey Rat]

Too bad Spybot: Search and Destroy has one of the worst UIs I've seen in a Windows program in a LONG time. It frequently will do tasks without giving you any status report. It will often get dialog boxes stuck behind the main window where you can't see them to even know a dialog box is open. The custom controls are about the ugliest thing I've seen in software, and the entire program gives a "made by a junior high student in Visual Basic" vibe.

How about a little bit of professionalism in software development! I know it's freeware and you're not making money, but how about at least taking enough pride in your work to make it usable and not hideously ugly? I hate to say it, but I can't talk management into using Spybot: Search and Destroy as a standard because it looks so unprofessional.

Don't blast MS for Mom's self-inflicted wounds.

[McNally]

I still can't fathom WHY Microsoft doesn't have something like this builtin to XP. My mom bought a Dell and a neighbor has had to clean the thing 3 times in the past 6 months! I'm embarassed now that I didn't push her towards a Apple now, but I only run Mac and Linux at home, and had no idea how bad the spyware issue is for Windows.

Really, this is an OS problem, and MS should provide a solution, you shouldn't have to rely on 3rd party providers to fix a shortcoming of the OS!

No disrespect intended towards your mother, but it's at least as much a user education issue as it is an operating system issue (and actually I feel I'm understating the user responsibility considerably with that statement.)

There are some systemic problems with Windows, particularly the Windows/IE combination, that allow spyware to flourish -- the lack of a way for a common user to get a good idea what's running on their system besides MS-installed OS files, for example, or the multitude of places that auto-starting spyware can hide its startup away from the user's notice. But in the end the people who have spyware problems are almost universally the people who clicked on a link from an unknown source that promised them something cool (or more often than not, something astonishingly lame by more educated users' standards..) If your momand other users like her could be trained not to click on "Click here to install our FREE animated weather-forecasting dancing baby!" when she doesn't know anything about the source of the offer, 90% of the problem would go away overnight.

Re:No shit

[oexeo]

I didn't post this. A friend thinks it's funny to destroy my karma, when I leave my account logged into /.

Re:A minor quibble

[merdaccia]

The advantage of paying for AdAware is to get AdWatch, a live detection program which blocks registry modification, browser hijacks, etc. as they happen. It is very customisable and can react autonomously or can prompt for action. No burning desire, just a good product. (No affiliation)

As to this douche installing programs advertised by popups, what does he expect? If your advertising strategy is popups, you're selling crap. If your purchasing strategy is popups, you're buying it.

Open Source?

[Anonymous Coward]

If I am not mistaken (I use a Mac, so my contact with sypware is largely in removing it from other folks' computers) even the good free programs (adaware, spybot, etc) are closed source. As soon as the makers stop updating them, they become useless, as they can't remove newer spyware.

I've often wondered if it'd be feasible to start an open source spyware zapper project - the scanner wouldn't be too tough to write I don't think, and you could get the community to keep submitting updated definitions for newly found spyware via some sort of wiki-esq mechanism.

Could this work? And if so, could we also make our own anti-virus program while we're at it?

Re:I can't run Ad-Aware

[bpfinn]

Ad-Aware runs on a BartPE Boot CD. I've heard Spybot also runs on BartPE, but I don't think there are handy instructions for adding it to the image.

donate to a good cause...

[martin_b1sh0p]

I also recommend SpyBot...but I would like to point out that if you use and really like the product you should donate in order to keep the product free. Even if it's $1 or $5. Yes it's true that at that point the product is no longer free, but just think of the great product you got for only $1 or $5.

Rogue Spyware Cleaners

[Alien54]

As seen on this page, which lists hundreds of bogus products

"Rogue/Suspect" means that these products are of unknown, questionable, or dubious value as anti-spyware protection.

Some of the products listed on this page simply do not provide proven, reliable anti-spyware protection. Others may use unfair, deceptive, high pressure sales tactics and false positives to scare up sales from gullible, confused users. A very few of these products are either associated with known distributors of spyware/adware or have been known to install spyware/adware themselves. Users are advised to rely on anti-spyware applications with deserved reputations for trustworthy performance.

useful link to bookmark

Ain't it the truth...

[wcitechnologies]

I run a small computer company in my town of about 50,000. Constantly I am getting people in here who are complaining about their computer slowing down, displaying popups, or not working at all. Then they'll go on about how they bought some program from Staples thats supposed to remove spyware. But, you'll never guess what the problem ALWAYS is: Spyware! As a technician, the first thing that I ALWAYS do is uninstall commercial Anti-Spyware. This article summs it up: install Spybot S&D and Ad-Aware (as well as Hijackthis). They remove 99% of the products I deal with. There are always a few out there that NO anti-spyware programs can remove, and I'll have to do some manual digging through the registry, but thats to be expected. Speaking of freeware, just for kicks, uninstall your expensive Norton Antivirus and go get AVG Antivirus.

spyware tips

[J3r3miah]

besides the usual .. use firefox..

the other night my laptop got a spyware infestation and this was the most serious one i had come across..
adaware and spybot couldn't detect anything.. yet i kept getting IE popups.. I booted to safe mode but guess what.. an IE popup while adaware is running (network was not available) in safe mode!
so i back to windows normal mode, pull up sysinternal's processEx to see which process starts the IE process.. and i was surprised to find that the IE popups were from winlogon.exe! later i found out that the sypware had also modified my winsock files..

anyway.. to the tips.. sometimes you have two processes that monitor each other, so when you kill one, the other process respawns the proccess you just killed. unless you are lightining fast with taskmgr... you can kill both at the same with taskkill /pid [proccess1] /pid [proccess2] /f
if you find a .dll and can't delete it because some proccess is using it.. or want to know which process is using it.. try "tasklist /m [dll_filename]"
the "[" "]" don't mean optional parameters.. i couldn't use the less/greater signs

the sypware that i got installed was hosted at rackspace.. so i called up rackspace (@3am CST).. bitched about it and they contacted their spyware client.. you would expect then to stop hosting the spyware.. instead rackspace sent me a link for a utility to download (utility provided by the spyware client).. which removed whatever i had but installed more spyware!!
In the end, i renamed iexplore.exe and put a copy of cmd.exe as iexplore.exe ... so every now and then i get cmd.exe windows.. until adaware releases a fix for what i have :)

Contact info for spyware author...

[teknickle]

Could we please all help our 'friend' in promoting his selling of spyware dll usage?

The domain name is:
LOCALNRD.COM

The address is this:
Thinking Media LP
275 Madison Avenue
New York, NY 10016

Or please give a call to show your support for spyware and your desire to do business with them.
1(866)839-6164

Thanks for helping the cause!!!!

But sometimes things don't co-exist well

[kaladorn]

You're right about running multiple software levels in your defence against adware, spyware, malware and viruses.

At the same time, these programs don't always coexist well together. I had to laugh (wince) when my Panda anti-virus program decided that Spybot was a potential threat and quarantined it. (I was using Panda mostly for the firewall, because I don't trust the built in XP firewall capabilities). Sometimes these apps just are unknowing about one another, and seeing something out of place, they want to do something about it. Now, of course, the experienced computer user can make some intelligent decisions. But a newbie or your elderly mother might well be challenged to make such decisions and would likely just run things in automatic quarantine mode.

Now, I can still use Spybot, I'm just not sure all of its parts behave as they once did. It still seems to do the job, I just don't know if it is doing as good of job as before.

Couple of interesting blog entries on this too...

[The1Genius]

'Sophos' has some good blog postings over at ITToolbox on the emerging market of "Digital Snake Oil" in the antivirus/antispyware product sector...

http://blogs.ittoolbox.com/eai/implementation/arch ives/001997.asp

http://blogs.ittoolbox.com/eai/implementation/arch ives/002284.asp

Re:Adaware Rocks

[Re-Pawn]

Not always - I had the real pleasure of cleaning my inlaws computer a monthy ago. They have a 16 yr old in the house + broadband and un-updated windows box - The machine was pretty much dead - I had to pull the ethernet connection to even get it running. I had a copy of ad-aware with me - first pass netted 642 critical items. Cleaned those - was able to get online - then updated ad-aware defs and cleaned another 152 critical items (in addition they had their browser cache set at 40 gigs and it was about half-full).

Can't imagine how this passed the house

[krgallagher]

From the article:

" Securely Protect Yourself Against Cyber Trespass (SPY ACT) (H.R. 2929): ... Among other things, it also outlaws taking over a PC for the purpose of sending unsolicited information to others (setting up a zombie PC); changing a browser's home page or otherwise loading pages other than those the user intended to request;"

Seems to me that would outlaw pop-up advertisements completely. There is no way this is going to become law.