Slashdot Mirror


Anti-Spyware Products Don't Live Up to Promises

John Wells writes "In the December, 2004 issue of PC World, the author of an article titled Poor Defenders concludes that most commercial anti-spyware software is ineffective. In tests using a fresh install of XP and 6 typical spyware infections the commercial software failed to stack up against freeware competitor Spybot Search and Destroy. Four out of seven commercial products failed to remove any of the infections. One product even installed 57 spyware files itself! Conclusion: Use freeware products like Spybot and Lavasoft's Ad-Aware SE Personal."

36 of 400 comments (clear)

  1. not too comprehensive by ack154 · · Score: 5, Informative

    So where does this guy get his "paid" spyware removal applications? Clicking on popups? Oh... wait...

    many of these utilities use aggressive marketing tactics in pop-up ads, spam, and keyword ads appearing alongside Google search results

    Though I suppose this is how they sucker a lot of people and some people expect results if they pay for a utility, I would probably do at least a LITTLE research before paying for any app like that. The thing is, I would hardly consider this "most commercial anti-spyware software." So as far as this "test," he might as well do an article about Virtual Bouncer and how it removed his parasites for him.

    Why didn't he test something like Spy Sweeper or Giant AntiSpyware? Those are paid ones that I would probably recommend if someone did want to pay for a program. At least that way, people would see that not ALL commerical products are crap - it does almost sound like that.

    But really, Spybot isn't even cutting it anymore, IMO. AdAware is still doing well, but I've actually been more impressed with the other two I mentioned above - worth a look if you haven't checked them out - both have free trials that you would have no problems doing a removal with.

    1. Re:not too comprehensive by Cat_Byte · · Score: 4, Insightful
      But really, Spybot isn't even cutting it anymore, IMO. AdAware is still doing well

      I find running both of these and using the yahoo spyware blocker is pretty effective. The yahoo thing doesn't catch all of them but I notice the # found by spybot and ad-aware went down quite a bit after installing it. FYI, if anyone hasn't upgraded to 1.05 of ad-aware I recommend doing so. I found about 30 more spyware programs on my Mom's computer after the upgrade after scanning with the most up to date definitions on 1.03.

      --
      Two roads diverged in a wood, and I - I took the one the bus load of girls just went down.
    2. Re:not too comprehensive by Elwood+P+Dowd · · Score: 3, Interesting

      I'm curious about Symantec AntiVirus 9. Supposedly it finds spyware & adware too.

      --

      There are no trails. There are no trees out here.
    3. Re:not too comprehensive by over_exposed · · Score: 3, Informative

      So where does this guy get his "paid" spyware removal applications? Clicking on popups? Oh... wait...

      And when I click on the link to his story, I get "Firefox prevented this site from opening a popup window. Click here for options..."

      Coincidence? I think not...

      --
      "The object of war is not to die for your country, but to make the other bastard die for his." - Patton
    4. Re:not too comprehensive by Cat_Byte · · Score: 3, Interesting

      I work on lots of peoples computers guys. It isn't just mine. I install stuff from the internet just like others have on here but nobody would dare admit it. Sure I have the yahoo messenger, gmail notifier, folding@home, weatherbug, etc on mine. It isn't that uncommon guys. Get off the high horse. The spyware tools are what I put on other peoples computers when I work on them in my spare time. I also have to use IE at work to be like the customers we have when I troubleshoot our program. I'm tech support. Sheesh. I swear the people on here with their high horses and arrogant assumptions. Do I have to post my whole damn life story to keep people from filling in the blanks with ?

      --
      Two roads diverged in a wood, and I - I took the one the bus load of girls just went down.
    5. Re:not too comprehensive by pbranes · · Score: 3, Informative
      Everyone is forgetting one of the most important methods of combating spyware - install windows critical updates. Many many many spyware installs get on systems by browser holes. If people would just update their systems, they would be protected against a huge infection vector. Obviously, that doesn't keep spyware off of your system if you have installed kazaa or some other stupid app like that, but it does protect you against drive-by installs.

      The other great, untapped tool is BartPE. This is a bootable windows xp cd. You can have ad-aware, clamwin, mcafee, and f-prot all load up from a bootable cd where they can download internet updates, and scan a hard drive. You don't know how many times I have "cleaned" people's computers with ad-aware & spybot while booted into their windows os, but some spyware has built in functions to hide itself, so spyware keeps reappearing. Using bartpe solves that problem, you boot off of it first, get the really nasty spyware, trojans, and viruses out of the way, then you boot into windows and run ad-aware and spybot again to get whatever was left behind (usually registry entries).

    6. Re:not too comprehensive by mjm1231 · · Score: 3, Informative

      We're running the corporate edition here. It does find spyware and adware. Doesn't do anything about it, but it does tell you it's there. The biggest drawback is that it also scans the system restore folder, and reports a machine as infected if it finds spyware there. (It does the same annoying thing with viruses.. if a virus is in quarantine, SAV detects it and reports the machine as infected.)

      --
      Ideology: A tool used primarily to avoid the bother of thinking.
  2. It's up to the users to do the research. by garcia · · Score: 5, Informative

    Nathan Shafer, answering our e-mail message to Spyware Stormer, challenged our test methodology. Shafer wrote that Spyware Stormer detects "over 20,000 variants of spyware and adware," and that its performance with the six applications we chose was therefore "hardly representative in any way."

    They are absolutely correct here although there are only four programs you should ever install for combating spyware: Adaware, SpyBot S&D, SpywareBlaster, and a good software firewall package (preferably one that tells you when something is trying to connect out to the Internet like ZoneAlarm). You need to keep these programs updated on a regular basis and you need to make sure that they run regularly. Unfortunately only SpyBot S&D runs w/o user intervention if you set it up to do so.

    SpyBot, while being a great program, isn't updated nearly as often as AdAware and doesn't find all those pesky cookies that AdAware does. SpywareBlaster is good for keeping those pesky cookies from getting onto your machine in the first place.

    We were unable to reach NoAdware, but the Better Business Bureau of Upstate New York reported that it had received 22 complaints about the company, which is not a member of the BBB, by early October. Network Dynamics has a clean record as a member of Southern California's BBB. The BBB's complaint database contained no record of complaints for the remainder of the companies whose products we tested.

    The BBB has fallen into worthlessness in recent years (I don't know about years passed). They have little to no pull and sometimes they even go so far as to ignore complaints against their companies. I would ignore any comments in regards to BBB related businesses.

    Basically you need to research what you are installing on your machine. That means using google, word of mouth, and your own deep digging before you put any "cleaning" program on your machine. You also need to do some research into making sure that you are using what you can to combat Spyware.

    Sadly, most people out there don't know, care, or care to know. That's why they end up w/it in the first place. If people DID care about what they were installing on their computer AND took the time to do a quick google search they would find out exactly what they need to know.

    It has gotten to the point where I seriously believe that MSFT is doing this on purpose in order to show the public why they NEED to use "protected computing".

    1. Re:It's up to the users to do the research. by which+way+is+up · · Score: 4, Insightful

      This is a dangerous trend. Given the majority of these ad/spyware companies don't care what their products do to the "users" computer, they can leave security holes unnoticed and allow exploits without the user even knowing there is a flaw in their computer. Windows updates can only do so much, and with companies releasing software that intends to help the user, but instead can hurt them. All the while the user is unaware. This makes me sick. Let's support the companies that work off of donations and have open source programs. This is the only way to prevent this from spreading to all of the favorite anit-ad/spyware programs.

    2. Re:It's up to the users to do the research. by Lumpy · · Score: 4, Interesting

      you really need to go further.

      looking for free AV or firewall software I encounterd that MOST has spyware bundled with it. the ONLY apps I feel safe installing are Open Source where I can look to see if there is spyware included.

      Freeware software has become the biggest carrier of spyware. many "media players" and other apps have a crapload of spyware in them and I am running into people with claria installed that dont even use the internet but recieved a nice CD with a copy of PC magazine that had some nice free apps on it.

      personally, I am making a killing at $50.00 a pop to relatives and friends. i tell them to let others know that I'll do the same to their computer for $100.00 and I'll give them $20.00 for each person they send me.

      I now clean about 20 computers a week, all set up in a row in the basement with a 2 day turnaround for them and they have to sign a waiver/disclaimer and pay in cash.

      christmas is going to be a great one this year.

      so in a way, I really have the spyware makers and microsoft's IE team to thank for the plentiful bounty I have this year.

      --
      Do not look at laser with remaining good eye.
    3. Re:It's up to the users to do the research. by pbranes · · Score: 3, Insightful

      At the support center that I work at, we do pretty much the exact same thing - 90% of our calls are related to spyware. One thing you didn't mention above that you may want to consider is Bart PE. It is a bootable windows xp cd that can run ad-aware, clamwin, mcafee, and f-prot. It can also connect to the internet and download updates for each of these apps. You can then tell these apps to scan & disinfect the person's hard drive. We have found that if we run bartpe right away on any computer we get in, we can save ourselves tons of time because it knocks out all the nasty spyware, trojans, and viruses right from the start.

  3. I Prefer hijackThis by Bimo_Dude · · Score: 4, Informative

    hijackThis seems to find all the stuff that others leave behind, and it's free (as in beer). Almost everybody I know uses it too.

    --
    "Teleporting Rodents with D-Cell Battery Displacement" theory -- IgnoramusMaximus (692000)
    1. Re:I Prefer hijackThis by garcia · · Score: 3, Insightful

      Yeah, it's free, and it's great for people that have a "Clue". It's not so good for people that don't have any idea of what they are doing with a computer.

      Most people don't have a Clue and they don't want to. That's why they are infected with Spyware in the first place. I would NEVER recommend hijackThis to anyone except someone I was KNEW was very good with computers and what they should and should not see running.

      While it is difficult to get Spyware when you can't start your computer correctly it is also annoying ;)

    2. Re:I Prefer hijackThis by Davak · · Score: 5, Informative

      Please don't recommend this so broadly. Experts should use hijack this to fix systems that can't be fixed any other way. Hijack This alone will miss files that are currently not being executed. Using Hijack This alone without other antispyware software is silly.

      Just because it's not running, I am sure you don't want some coolwebsearch files just sitting silently on your system.

      Here's my recent techrx post regarding this same subject: http://www.tech-recipes.com/windows_spyware_tips75 8.html

  4. or the easiest solution by hsmith · · Score: 4, Informative

    install firefox
    ???
    profit

    really if you are still using IE you are bringing it on yourself, i loved IE, but it has become garbage

    1. Re:or the easiest solution by LiquidCoooled · · Score: 3, Informative

      Most of the time, installing Firefox won't actually remove the problem.
      Sure, it will prevent further mistakes (or at least limit them) but it won't get rid of half of the crap that gets onto a machine.

      Its the same thinking when people say "install service pack 2 to clean it up". Those machines are the ones which have the most problems, and for once, MS isn't really to blame for it.

      They will only do well if starting from a clean slate, so before upgrading someone to Firefox, or any other secure upgrades, make sure you remove the problem first.

      --
      liqbase :: faster than paper
  5. Where's the program by four2five · · Score: 4, Funny

    That convinces your little sister she doesn't need a barbie IE brower theme or a cursor that looks like a puppy dog. Hold that, I want a program that turns the cursor into a weapon of some fashion that I may use to smite that damend purple monkey on my computer. That's worth my website traffic being shipped of to who knows where in itself.

    --
    -or so you'd think
  6. Yahoo's spyware tool is the best by Electric+Eye · · Score: 3, Informative

    Folks, I'm telling you, I've used Yahoo's new Spyware program that sits in the Yahoo toolbar and the thing works BETTER than AdAware. I'm serious. I had to fix my parents' and my inlaws' PCs, both with XP2. I've used AdAware and a few other freebies on both, but they still ran slow. So, for the hell of it, I used the new Yahoo thingy and it found TONS of stuff the others did not, including a trojan spam application. I have yet to see anyone talk about this app (even Ars Technica's latest Spyware article neglected to talk about it).

  7. she got a refund? by underpar · · Score: 3, Informative

    NoAdware "removed some stuff, but it also deleted something on the hard drive so the computer couldn't reboot," Smith says. After reinstalling Windows, Smith sent multiple messages to NoAdware requesting a refund, which she received four months after her initial request.

    They actually gave her money back. That's good right? Sure they took four months, but they did it. She should shut up and stop complaining. They could have just blamed her for it since she really couldn't have proven anything.

    manda

  8. Free anti-virus alternatives? by mabu · · Score: 4, Interesting

    I'm curious if there are comparable-quality Freeware/Shareware anti-virus products available? I don't mind paying for a product, but don't like having the product cease to function unless more money is extorted out of me in perpetuity. I'm sick and tired of Symantec shaking me down for subscription updates, and subsequent versions of their products becoming more bloated and inefficient.

    1. Re:Free anti-virus alternatives? by AndroidCat · · Score: 5, Informative

      Grisoft's AVG Anti-Virus. Make sure you get AVG 7.0 because support for 6 will end with 2004. No complaints, but I only run it now-and-then because the idea is to stop them before they get installed.

      --
      One line blog. I hear that they're called Twitters now.
    2. Re:Free anti-virus alternatives? by Wordsmith · · Score: 4, Informative

      try clam a/v, or if you're on windows, clamwin a/v. the interface isn't great, but it does the job.

  9. A couple tips for removing spyware from windows. by category_five · · Score: 3, Informative

    A couple tips for removing spyware from windows. Run both ad-aware and spybot - search and destroy. after you run them you might still have some spyware. If this happens turn off system restore (at your own risk)and then reboot into safe-mode and run the checkers again. This can remove some of the hangers on. Also a great utility is www.doxdesk.com. It shows you how to manually unregister DLL files and also does a web based check for some common spyware.

  10. Consider the alternative. by sulli · · Score: 3, Funny

    It was either this or more "What I Did With My iPod" stories.

    --

    sulli
    RTFJ.
  11. Fundamental Difference by ObsessiveMathsFreak · · Score: 4, Insightful

    The fundamental difference between freeware and proprietry anti-malware software is that the freeware are doing it for the love of the game, or in this case their hatred for spyware in all its daemonic forms.

    Commerical anti-spyware vendors on the other hand are in in for the $$$ and that means they are susseptable to temptation, i.e allow malwarez who give them money to get through, use malwarez tactics to get money and do things other than what it says on the tin while users aren't looking.(read, kazaa)

    I suppose commerical vendors are just more idealogically close to the spammers, who are also in it for the money.
    In any case, if you need an 'infrastructural' type software program, your nearly always better off going FOSS anyway. That's my 2c.

    --
    May the Maths Be with you!
  12. Re:How many by QuaZar666 · · Score: 3, Funny

    Damn you. One can lose their sanity in that song. for the love of slashdot never post that song again.

    For all others who have not clicked on the link, I recommend to not click it, unless of course you enjoy Banana Phone.

    - Qua

  13. Article Redundant by isorox · · Score: 3, Funny

    In tests using a fresh install of XP and 6 typical spyware infections

    So, a fresh install of XP then

  14. Open Source Solution Needed by DigitalRaptor · · Score: 4, Interesting

    The open source community really needs to rally behind this, I think.

    I'd love to see a project that uses community involvment to flag projects and websites as "phishing" or "spyware" related.

    It could be integrated into open source projects such as Firefox and Thunderbird so you could be assured that after a few people in the community confirmed that a particular URL or even IP was "phishing" or "spyware" related, it would be disabled in the browser or email client without a blood sample and double confirmation.

    I, for one, am sick of helping other people clean their computers of spyware. Many of them become so bogged down they are unusable.

    --
    Lose Weight and Feel Great with Isagenix
  15. Re:why? by 0racle · · Score: 3, Insightful

    I think that it might have something to do with the phrase 'anti-competitive lawsuit.'

    No spyware is not an OS problem, I have Windows machines, I use IE, I do not have a spyware problem. My girlfriend runs Windows, she uses IE, she does not have a spyware problem, and while I may be catagorized as more cluefull then the average user, she is the average user excepting for one thing, she actually learned how to use her computer. Do you consider a person refusing to clean their duct work, or take their car in for a tune up a problem with the house or the car? No its the users fault, and its the same with spyware. How long have people been told, don't click on everything you see? Don't open that mail? Hell its even on the news now. This is a problem with people activly refusing to learn. Spyware writers do not target Windows, they target IDIOTS. There are spyware apps that target Mozilla that do things they shouldn't, so why are there not more? The target is idiots, thats why, you will see more and more targeting Mozilla as more and more of the target audience are convinced to use it.

    --
    "I use a Mac because I'm just better than you are."
  16. Don't blast MS for Mom's self-inflicted wounds. by McNally · · Score: 4, Insightful
    I still can't fathom WHY Microsoft doesn't have something like this builtin to XP. My mom bought a Dell and a neighbor has had to clean the thing 3 times in the past 6 months! I'm embarassed now that I didn't push her towards a Apple now, but I only run Mac and Linux at home, and had no idea how bad the spyware issue is for Windows.

    Really, this is an OS problem, and MS should provide a solution, you shouldn't have to rely on 3rd party providers to fix a shortcoming of the OS!
    No disrespect intended towards your mother, but it's at least as much a user education issue as it is an operating system issue (and actually I feel I'm understating the user responsibility considerably with that statement.)

    There are some systemic problems with Windows, particularly the Windows/IE combination, that allow spyware to flourish -- the lack of a way for a common user to get a good idea what's running on their system besides MS-installed OS files, for example, or the multitude of places that auto-starting spyware can hide its startup away from the user's notice. But in the end the people who have spyware problems are almost universally the people who clicked on a link from an unknown source that promised them something cool (or more often than not, something astonishingly lame by more educated users' standards..) If your momand other users like her could be trained not to click on "Click here to install our FREE animated weather-forecasting dancing baby!" when she doesn't know anything about the source of the offer, 90% of the problem would go away overnight.
  17. Re:why? by Swamii · · Score: 3, Insightful

    Probably got to the point where pop ups from spyware infected computers were making people think twice about windows as an os

    Haha. As if people actually knew was an OS was...

    The real reason MS hasn't created a spyware blocker? Because peanut galleries like Slashdot would go up in arms about how MS is trying to "take over another market", cry about unfair competition, whine about too much bloat, etc. I mean, just look at how Slashdotters whined and cried like a bunch of 4 year olds this morning when Microsoft announced they were entering the blog publishing realm. When you're Microsoft, it's damned if you do, damned if you don't.

    --
    Tech, life, family, faith: Give me a visit
  18. Open Source? by Anonymous Coward · · Score: 3, Interesting

    If I am not mistaken (I use a Mac, so my contact with sypware is largely in removing it from other folks' computers) even the good free programs (adaware, spybot, etc) are closed source. As soon as the makers stop updating them, they become useless, as they can't remove newer spyware.

    I've often wondered if it'd be feasible to start an open source spyware zapper project - the scanner wouldn't be too tough to write I don't think, and you could get the community to keep submitting updated definitions for newly found spyware via some sort of wiki-esq mechanism.

    Could this work? And if so, could we also make our own anti-virus program while we're at it?

  19. Re:why? by jafac · · Score: 3, Interesting

    Spyware exists for Mac OS X.
    So why don't any Spyware removers exist?

    --

    These are my friends, See how they glisten. See this one shine, how he smiles in the light.
  20. Rogue Spyware Cleaners by Alien54 · · Score: 3, Interesting
    As seen on this page, which lists hundreds of bogus products

    "Rogue/Suspect" means that these products are of unknown, questionable, or dubious value as anti-spyware protection.

    Some of the products listed on this page simply do not provide proven, reliable anti-spyware protection. Others may use unfair, deceptive, high pressure sales tactics and false positives to scare up sales from gullible, confused users. A very few of these products are either associated with known distributors of spyware/adware or have been known to install spyware/adware themselves. Users are advised to rely on anti-spyware applications with deserved reputations for trustworthy performance.

    useful link to bookmark

    --
    "It is a greater offense to steal men's labor, than their clothes"
  21. spyware tips by J3r3miah · · Score: 3, Informative

    besides the usual .. use firefox..

    the other night my laptop got a spyware infestation and this was the most serious one i had come across..
    adaware and spybot couldn't detect anything.. yet i kept getting IE popups.. I booted to safe mode but guess what.. an IE popup while adaware is running (network was not available) in safe mode!
    so i back to windows normal mode, pull up sysinternal's processEx to see which process starts the IE process.. and i was surprised to find that the IE popups were from winlogon.exe! later i found out that the sypware had also modified my winsock files..

    anyway.. to the tips.. sometimes you have two processes that monitor each other, so when you kill one, the other process respawns the proccess you just killed. unless you are lightining fast with taskmgr... you can kill both at the same with taskkill /pid [proccess1] /pid [proccess2] /f
    if you find a .dll and can't delete it because some proccess is using it.. or want to know which process is using it.. try "tasklist /m [dll_filename]"
    the "[" "]" don't mean optional parameters.. i couldn't use the less/greater signs

    the sypware that i got installed was hosted at rackspace.. so i called up rackspace (@3am CST).. bitched about it and they contacted their spyware client.. you would expect then to stop hosting the spyware.. instead rackspace sent me a link for a utility to download (utility provided by the spyware client).. which removed whatever i had but installed more spyware!!
    In the end, i renamed iexplore.exe and put a copy of cmd.exe as iexplore.exe ... so every now and then i get cmd.exe windows.. until adaware releases a fix for what i have :)

    --
    God is real unless declared as int
  22. Contact info for spyware author... by teknickle · · Score: 5, Funny

    Could we please all help our 'friend' in promoting his selling of spyware dll usage?

    The domain name is:
    LOCALNRD.COM

    The address is this:
    Thinking Media LP
    275 Madison Avenue
    New York, NY 10016

    Or please give a call to show your support for spyware and your desire to do business with them.
    1(866)839-6164

    Thanks for helping the cause!!!!