MS AntiSpyware vs Ad-Aware vs. SpyBot

An anonymous reader writes "Flexbeta.net compares Microsoft's new spyware fighting tool, Windows AntiSpyware, to Ad-Aware and SpyBot S&D; the two leading spyware tools on the market today. The review sets up an infected PC using VMWare Workstation and scans the machine using all three tools to see which tool detects the most spyware. Though still in beta, Microsoft AntiSpyware does an amazing job at detecting spyware by finding twice as many infected files as Ad-Aware and nearly three times as SpyBot."

Comments

Wow, is this for real

[Cracell]

So wait a sec Microsoft's product is actual good?

Re:Wow, is this for real

[harrkev]

They have only owned it for a few weeks. Even Microsoft has limits on how fast they can screw stuff up.

Re:Wow, is this for real

[stfvon007]

What there gonna do is make it good so it becomes what 95% of users use, Then start mostly ignoreing it cause they have a monopoly, just like what happened to Internet Exploder. It will also be bundled with Windows XP SP3 and Longhorn.

Re:Wow, is this for real

[wankledot]

Of course it's good, they know where to find spyware and viruses because they're the ones that created them!!@# [/tinfoilhat]

Re:Wow, is this for real

[pilgrim23]

I tried it. I found this particular interesting: Box: Compaq P4 2ghz 256mb memory XP SP1 on a Corp. net (yes I know, but some of our in-house apps fail under SP2): Fairly clean already machine with Adaware and Spybot already loaded. I downloaded the Microsoft beta and ran it. Many minutes later it reported a passle of stuff. Like with Adaware and Spybot I said "Ok dump it all" turned off the All time protection feature, said no to all the "Do you want me to be intrusive and make all your decisions for you?" typical Microsoft crap (didn't matter, it loaded itself anyway), then, and this is the curious part: I ran Spybot. It ran in 2 seconds flat. Say What? So I downloaded a NEW spybot and installed it. It then did a normal several minutes run and found a few chunks I said go ahead and dump. Does the M$ product consider Spybot....spyware?

Re:Wow, is this for real

[Rasta Prefect]

I've noticed adaware often does this. It says there are 300 infections, but only 3 of them are program executables and only 1 is running. Many of them are cookies, so I suppose those could count individually, but seperate dlls for the 3 programs it found should not be counted as seperate infections.

Usually they do show what each file belongs to as well, so you can see roughly how many products they're removing. The number of files removed _is_ relavent however - many spyware programs tend to make multiple copies of themselves that'll happily restore each other when one is removed.

Re:Wow, is this for real

[Master of Transhuman]

Depends on your definition of "free software", doesn't it?

If someone writes a utility and gives it away, it rarely has spyware in it.

If a commercial or sports site "gives away" some lame "utility" to help you keep track of baseball scores, it usually has spyware in it.

This is not "free software".

I've NEVER seen spyware in GENUINE "freeware".

I frequent porn sites and I rarely even get spyware from THEM since they already know what you want and don't need to spy on you - and mainstream commercial advertisers don't advertise on them because it looks bad, so there is no motivation to put spyware on many porn sites. Of course, there are the lame sites that install overseas dialers and crap like that, but in general you get spyware from lame commercial sites selling crap.

Re:Wow, is this for real

[afabbro]

Did not do either of these things to me, on three different PCs.

Re:Wow, is this for real

[fm6]

You got modded up as funny. You deserve the upmod, but I think you make a serious point. Microsoft products don't always start out as total crap. Sometimes they buy a decent product from somebody, or invent something with a good basic design (their old Multiplan product was the first spreadsheet I didn't consider a total kludge), or invent some idea that could be really useful if it's implemented right. But then they throw their bureaucracy, their intense intracompany rivalies, their focus groups, their love of feature bloat, and (most of all) their compulsive tweaking at the product. Before you know it, you have some monstrosity that only runs on the latest hardware and that's a total pain to use.

That's why I'll always be sorry the Democrats didn't stay in power long enough to break Microsoft up. If Microsoft developers were forced to operate in a competitive environment where mistakes actually hurt them, we'd all be better off -- including the former Microsofters.

Re:Wow, is this for real

[imroy]

Maybe the MS product found the Spybot S&D definition file(s). Did you pay much attention to what the MS beta had found before telling it to delete them all?

Re:Wow, is this for real

[shaitand]

Don't confuse the issue, 95% of the users didn't use IE because it was good, they used it because it was good enough and bundled with the OS. You act as if the two things are seperate ;)

Netscape was always technically superior to IE.

Re:Wow, is this for real

[Zeinfeld]

Actually there is a huge problem with anti-spyware deleting anti-spyware. The problem is that the anti-spyware ends up looking very much like spyware as far as heuristic checks go. So for example it tries to resist being clobbered by the spyware, it scans the disk, it hooks into similar entry points.

The same problem happens with legislation. The Bono anti-spyware bill as currently drafted would make most of the anti-spyware programs illegal. its not intentional, its just bad drafting. The problem is that what is spyware is at some level a consent issue and so drafting is horribly difficult.

Re:Wow, is this for real

[DaFallus]

said no to all the "Do you want me to be intrusive and make all your decisions for you?" typical Microsoft crap (didn't matter, it loaded itself anyway)

Actually, in the original version of Giant's Antispyware, this is a default feature. The majority of Microsoft's beta version looks and acts almost exactly like Giant's latest version before they were bought out. I'd say that so far 99% of the code has been left untouched. However, Microsoft did remove the innoculate option from the Advanced Options menu.

Re:Wow, is this for real

[Nikker]

What I would like to know is, is the Microsoft version finding the same spyware in diffrent locations or finding diffrent types of spyware in the same locations? The reason I bring this up is for Microsoft to beat evreyone else by a factor of two just doesn't sound right. Not that it can't be done just that is was done.

The second case would be a factor of R&D which if confirmed that the detection does exist does prove a superior product.

Alternatively if the Microsoft product is finding more because they know exactly where the OS weaknesses are then that is an odd situation. Wouldn't that indicate that they know about these problems and instead of incorporating it into the OS they would charge you for them? That would also mean that those problems detected by the scanner will *not* be incorporated into the OS because it would come as a hotfix rather than in a def file.

I think this kind of software will do more to show the tigers true stripes then sell a new product. Maybe not today but eventually people will start to ask why.

2 more cents

Re:Wow, is this for real

[fm6]

What I would like to know is, is the Microsoft version finding the same spyware in diffrent locations or finding diffrent types of spyware in the same locations? The reason I bring this up is for Microsoft to beat evreyone else by a factor of two just doesn't sound right. Not that it can't be done just that is was done.

I'd already cleaned off the exisitng spyware using Ad-Aware and Spybot. So this was new stuff.

It shouldn't suprise anybody that Spybot and AdAware miss a lot of stuff. There's a lot of crap out there -- I've heard reports of people having thousands of infections. The big problem is keeping those databases up to date. Since Spybot is basically some guy's hobby, and Lavasoft has never put a lot of effort into maintaining AdAware (a product that was given to them by its original author, on the condition that they always provide a free version), naturally their databases have lagged. It was inevitable that somebody with deep pockets would invest the time and money to do a better job.

For fairness...

[Raindance]

To be fair, "infected files" is a rather ambiguous notation (perhaps "malicious packages" would be a better way to count things).

I would also feel better if the submitter hadn't been anonymous. Though it's probably not astroturfing.

RD

Re:For fairness...

[Jesus 2.0]

Except Lindsay Lohan.

Re:For fairness...

[Ark42]

Where those 4000+ files in the spybot/adaware quarantine directories?

Wait a minute...

[Anonymous Coward]

Wait.. aren't we supposed to hate Microsoft? I'm confused.

Funny...

[lga]

Does anyone else think it funny that the advert at the bottom of this review is for Smiley Central, a well known piece of computer-invading crap?

fair and blanced

[OffTheLip]

that's all we ask. Microsoft is the most suitable candidate to find spyware infecting their product. Hopefully this is step one, followed by OS changes eliminating/reducing the possibility. Dream over...

Why would this be a surprise?

[eno2001]

Microsoft knows what holes they have in the OS better than anyone else. They just don't bother to fix them in a timely fashion because it's not profitable The anti spyware isn't really a change in direction for them if you think about it. They are still applying a band-aid to the problems rather than a real fix.

Re:Why would this be a surprise?

[sql*kitten]

They just don't bother to fix them in a timely fashion because it's not profitable

They don't fix them because they meant them to be there.

Take the notorious problem with Outlook, that it will execute embedded VBscript in emails and send virii (or trojans or whatever) to the people in your address book. Well Outlook was designed to do that. If you have scriptable email, then you can use Exchange/Outlook as a platform to develop workflow applications. Doing it that way has nowadays been superseded by the web, of course. Now, MS were naive to think that no-one would ever exploit that feature maliciously, no-one's denying that. But they can't simply remove VBscript from Outlook because that would break the platform for people who did use it for application building.

Re:Why would this be a surprise?

[Flamesplash]

wow :)

On the counter point, *nix is like having 10 fingers but only knowing that 6 of them are there, and then only actually knowing how to use 3 of them.

I'm still waiting for the days of OSX but with windows.... cygwin will have to suffice for now.

Re:Why would this be a surprise?

[myowntrueself]

"Now, MS were naive to think that no-one would ever exploit that feature maliciously"

At least in the beginning they took measures to stop it; the original outlook couldn't even receive pop or imap email and hence the only incoming email was supposed to be from the corporate Exchange server.

It was only later, when the internet became popular, that, uh, by popular demand they produced add-on packs for exchange with which you could use pop, smtp and imap.

Then the email viruses began to take advantage...

I reckon that they should now go the other way around; produce a special add-on pack for the VB scripting and just leave it right out of the default install.

Re:Why would this be a surprise?

[marktaw.com]

That's a load of crap, Microsoft bought this product, not develop it in house. All products Microsoft buys are great products - Visio, NT, DOS, (the list goes on and on) but they end up ruining them in a few years.

Great!

[2MuchC0ffeeMan]

The Real-Time Protection agent is awesome. It automatically informs you of any changes being made to your current settings; such as if your IE homepage is trying to be changed. It also warns the user if any spyware is trying to be installed.
So it has to be running first. Just what i want my computer to do, run more stuff.

Also, I kinda know when our homepage is hijacked, and this is why i switched to firefox.

Missing Information

[sangreal66]

I only took a curory glance at the article before it was /.ed, but I did not see any attempt at analyzing how many of the additional items found by MSAS were false positives. This seems like pretty vital information.

Re:Missing Information

[TheRaven64]

Since they are running this in VMWare, and are hence able to save the state of the system, the best way to run this test would be to first run each product on the test image and tell it to remove everything it recognised. Then run each other product on the resulting image and discover what had been missed. Simply comparing the number each reports finding is hardly a good comparison.

Disclaimer: TFA was slashdotted by the time I tried to R' it.

Re:Missing Information

[jaylee7877]

good point. I ran the MS beta on my desktop. It detected a win32 port of gnu cat (cat.exe) as "Norwegian Porn Dialer". Don't recall seeing that option added...

MS = the Mob

[HeyBob!]

It's kind of like the Mob offering protection services to merchants. They're the problem in the first place!

This kind of protection should already be in Windows, or least, make the OS completely separate from the apps and the data.

You should be able to click on any process running and see complete details as to what it is, why it is running and access it's startup options.

Re:MS = the Mob

[Foolhardy]

Have you looked at Process Explorer? It's a task manager type progam that provides tons of extra information: for each process you can see its parent, the startup options, a list of every kernel handle it has open, every library it has loaded, a cpu and memory usage graph, a list of threads with stack and status for each, what services (if any) are running inside it (for the svchosts mainly), what sockets are open, environment variable information, image strings and more. Lots of other tools at sysinternals.com too.

The REAL Ultimate Windows Anti-Spyware Program

[BioCS.Nerd]

FireFox

An Ad-Aware/FireFox combination has served my parent's computer well for quite sometime. My father's business exclusively uses the above combination with great results.

Enough already.

[XorNand]

Ok, enough of the "MS should do better, they make the holes" comments. If you remember correctly, MS bought this code only a short while ago from Giant Company. About the only thing Redmond has done is repackage and rebranded it.

Just tried to install this MS AntiSpyware

[benzapp]

and apparently their detection of license keys has greatly improved... my key is invalid.

Anyone else have this problem using their obscure key of choice? SP2 installed fine a few months ago.

Re:Just tried to install this MS AntiSpyware

[Chemical]

You can download without having to validate your license. Just select, the "No, leave me the hell alone" option when downloading.

Finding more isn't necessarily good

[harlows_monkeys]

What we've seen where I work, with our antivirus/antispyware product is that if we miss something that AdAware of Spybot finds, then poeple say we are ineffective, and if we find something that they miss, people say we are generating false positives in order to frighten people into buying. (And then, when the thing we found that Spybot or AdAware missed actually causes problems, they say we put it there and start saying we pushing spyware).

A lot of people, especially on the popular antispyware forums, have simply decided that Spybot and AdAware are the best that there can possibly be, and anything that differs from them in bad.

Re:Finding more isn't necessarily good

[siliconjunkie]

It really depends on where you work. AdAware and Spybot S&D are two applications that work well and have a proven track record of being legitimate tools to combat spyware/adware/malware. Unfortunately, there are many more applications out there that are either (A) blatant rip-offs of these two legit programs, (B) Spyware disguised as anti-spyware or (C) BOTH.

This is not to say that there are not other legitimate programs out there, but sadly, if it's not on the short list of proven applications it should be scrutinized before it is endorsed.

Not a Microsoft Designed Product

[nurb432]

They just bought a company and rebranded..

Wait a few generations, then it will be a 'true' Microsoft Product..

Re:Not a Microsoft Designed Product

[isecore]

Amen to that.

Also, they bought Giant Antispyware, and christ on a crutch does that thing do a hell of a lot of false-positives.

I rennamed a textfile something like claria.exe and that thing started screaming immediately that bad people were trying to take over my life.

So seriously, I couldn't care less.

Re:Not a Microsoft Designed Product

[Jesus 2.0]

I rennamed a textfile something like claria.exe and that thing started screaming immediately that bad people were trying to take over my life.

Wow, how horrible. I can't imagine how annoying and dangerous that would be for me, given how often I rename text files to claria.exe.

Re:Not a Microsoft Designed Product

[jdhawke]

Also the default installs of TightVNC, RealVNC and winpcap are flagged as spyware. As if only crackers use these items for anything and no respectable user would.

Re:Not a Microsoft Designed Product

[displaced80]

Indeed. What's worrying isn't that perfectly innocent user behaviour triggers detection. Rather, that string (or even filename pattern-matching) is a dumb way to detect.

Spyware makers will start (if they haven't already) randomizing the filenames, registry keys, etc. Then your anti-spyware software's gotta start doing what it should've in the first place -- something smart.

Re:Not a Microsoft Designed Product

[ameoba]

OTOH, I learned the hard way not to trust file names. A routing cleaning of core dumps on our fileserver at school managed to destroy the work of half of the VLSI class. Who would've thought that students would be designing CPU cores and just call the output file "core"...

I'm going to bite and try this out

[drgath159]

I liked how it politely asked if I wanted to validate Windows
"Before obtaining the requested download, please take a moment to validate your genuine Microsoft Windows installation. Validation assures that you are running an authentic and fully-licensed copy of Windows. Validating now will enable faster access to genuine Windows downloads upon future visits to the Download Center. Please see the Why Validate? page to learn more about the Windows Genuine Advantage program and why validation is recommended."
Obviously clicked no.

Re:No more spying, please!

[Lindsay Lohan]

Also, I neglected to mention in my previous post...

One factor behind MS AntiSpyware's successful may be the use of quadratic probing in a secondary clustering to traverse file patterns, which are stored in an acylic graph.

Fleischer and Trippen elaborate further on this technique in a Java implementation, which of course Microsoft did not employ. The rationale, however, is the same.

Re:Twice as much

[Rob Carr]

After a vicious round with spyware, I switched to Firefox and regularly running AdAware and Spybot. Still, I ran the MS program to see what would happen.

Adaware and Spybot report a lot of cookies. MS's program didn't. On the other hand, the AntiSpyware program found stuff the other two didn't. Total "hits" weren't 2-3x, but I've decided to keep AntiSpyware in addition to the other two programs.

Re:Twice as much

[Zocalo]

I'm guessing that the only thing that would account for this kind of discrepency is how registry keys are counted. Whether you count each individual registry key, registry branch, or just piece of spyware on a case-by-case basis will make a huge difference. Also, spyware typically installs copies of its registry settings in several places, and on a system with multiple logins there is even more room for abuse.

Based on my experiences there's not much to choose from between Spybot and Ad-Aware, and I haven't really worked out where the MS/Giant program fits yet. Some programs that are missed by Ad-Aware get picked up by Spybot and vica-versa, so I'd expect there to be a few new things to be found by the MS effort. What worries me most is that discrepency between Spybot and Ad-Aware; I've never seen that kind of gap between the two in either direction. I suspect that inadvertantly or intentionally the selection of spyware installed on the testbed virtual PC may have been slightly biased.

This isn't really MS antispyware

[mutilated_cattle]

MS just bought giant AS and rebranded their product as Microsoft. As far as I can tell there's very little change to the program itself beyond the branding.

Giant has always been among the top antispyware products, as evidenced by Failing Grades for most anti-spyware tools so this "MS should know their own security holes better than anyone" stuff isn't strictly relevant. I think MS should foucus more on fixing the secuity problems in IE that are responsible for 90%+ of spyware infections rather than sticking plaster over the holes by buying up anti-spyware solutions. Is this even going to be free when it's released?

Personally I prefer webroot spysweeper anyway, Giant has always generated too many false positives for me.

I, for one...

[Big Nothing]

I, for one, welcome our new anti-spyware overlords.

Seriously.

Yes, it would be better if all the security holes in M$ SW were fixed but guess what: they're not gonna be fixed tomorrow. A good anti-spyware tool is sorely needed. I've cleaned a large number of home and office computers using a number of anti-spyware tools and frankly none of the cut it. At best, some of them suck a little bit less than the rest. I find that at least 3 separate tools are needed to find, clean and keep clean a normal luser's puter. If M$ can come up with a tool that is efficient, free and automagically upgradeable I'd sure as hell cheer.

Too many hits

[tehshen]

There is a problem with the database that is preventing the site from working.
An email has been sent to the administrator notifying them of the problem. Please try again later.

They're letting us slashdot their mail server too?

It is good!

[Further82]

It even detected and removed Firefox and my Linux partition. Ad-aware missed those.

Hold up!

[NeoSkink]

Wait wait wait! Microsoft is going to charge for their program?

Maybe I haven't been following the story very closely, but that seems like a stupid move. "Our operating system and browser allow this stuff in the first place, now pay us to remove it."

Keeping that in mind, I'll stick with the FREE AA and SB.

Re:and Linsux is really Unix, so?

[l3v1]

step MS has taken in order to help the common user avert infection by malicious developers
conspiracy to degrade MS software

Good heavens :) Medicine has evolved pretty much in the last couple of hundred years you know, so you can easily get pills for your delusions :)

Well, the ignorance part is harder to cure, 'cause it's more up to you then doctors.

It caught itself trying to make changes

[srNeu]

I just ran it and got a message:

The Internet Explorer URL for your Search Assistant is attempting to be changed from http://www.google.com/ie to http://ie.search.msn.com/{SUB_RFC1766}/srchasst/sr chcust.htm.

So this is how they are going to promote their new search engine.

A small silver lining to all this spyware

[Free_Trial_Thinking]

Ok, I know spyware/adware/viri are a blight on our wonderful internet but here's what I find fascinating about them:

Computers are becoming analogous to small ecosystems. In my mind I often compare the idea to leaving a loaf of bread in my back yard to connecting a fresh windows XP install to a cable modem, maybe surfing a few shady websites and letting it sit for a few months.

In my backyard all kinds of organisms will appear to utilize the bread's resources, birds, insects, bacteria, mold, and who knows what else. And also on this hypothetical computer again all kinds of organisms will be drawn to use up all of the computer's resources (processing/bandwidth) including spyware, adware, virii, worms, etc. I just find it really fascinating how a natural phenomenom like this is finding its way into a manmade system like the internet.

My prediction along these lines is that we're going to see some amazing instances of AI coming from these 'weeds' of the internet (spyware,virii, spam, etc) since they're most 'organic stuff' in the internet system.

Discuss, discuss. (I hope I could express this idea well enough, the analogy seems so clear to me.)

Re:But MS Anti Spyware doesn't detect itself.

[afd8856]

When downloading, they want me to check if the windows I'm using is legit. Wouldn't you call this spying on my affairs?

(I already know about the link to the direct download)

Re:The whore on the corner is selling condoms

[HiyaPower]

I think you have a problem that you should deal with. I have dealt with my M$ problem. I just do not use their crud. No crud, no spyware, no problem.

Spyware

[JohnyDog]

Both Ad-aware and Spybot are popular and estabilished, which means that newer spyware/adware knows them, knows how to hide, avoid them or even completely disable them, even if they're frequently updated. So it isn't surprising that MS AntiSpyware performs better now, but that doesn't tell anything about how it will perform in few months from now.

The advanced tools are worth the d/l alone

[British]

The MS utility fonud some Dutch porn dialer that was on my system since 2003. AdAware never found it.

But what wowed me were the useful utilities in the "advanced tools". I was finally able to disable a few annoying system tray icons(totally forgetting how to do it in Win2k). I still can't get the Nvidia driver utilities off, but MS is not to blame in that case.

The tracks eraser functionality goes way beyond a simple "url cleaner". You can clear the document history, etc for TONS of apps. I'm wondering when the anti-MS zealots will be yelling that it will be a useful tool for child pornographers(heh).

The GUI is a bit shoddy. I wish I could keep the heiarchial list of stuff when I'm inspecing the startup apps, etc, and there's no + to collapse/expand. Either way, I love the advanced utilities alone, and could probably clean out TONS of spyware, etc if I run this on my dad's PC.

Inconsistent results?

[MunchMunch]

Can someone explain how this could be?

The first Ad-Aware scan revealed 1309 infected objects and a second scan immediately after a reboot resulted in 291 more infected objects reported. After removal of those objects, we ran Microsoft AntiSpyware Beta. AntiSpyware's scan revealed a whopping 1,877 infected files left over by the Ad-Aware not to mention the nearly 3,000 registry locations infected. One of the files which Ad-Aware failed to detect was WinTools which is suspected to be a Trojan with a maximum threat level.

It was time to pin Microsoft AntiSpyware against SpyBot S&D by first scanning with SpyBot then checking to see how many files SpyBot had left behind. SpyBot's initial scan resulted in 358 "problems" detected. After running SpyBot a second time to make sure it did not report any other "problems", we ran Microsoft AntiSpyware. AntiSpyware was able to detect 659 infected files on the machine with 2.223 registry keys infected.

So, to begin, Ad-Aware found 1,600 infected elements total. AntiSpyware found 4,877 more. Total: 6,477

SpyBot finds 358. AntiSpyware finds 2,882 more. Total: 3,240

Can anyone explain this? Even if the programs are giving false positives on spyware (and, considering that even having malicious spyware installed, 6,000+ detected compromised elements makes false positives almost a promise rather than a hunch), why would AntiSpyware inconsistently return false positives depending on what program scanned the PC first? Doesn't make any sense at all.

Re:Inconsistent results?

[Feztaa]

First, it's because you read "1" as "4" (reread your own post, you even quoted it properly). Second, it's because Adaware and spybot count the infections differently (and find different ones), thus the ones found by MSAS afterwards vary.

Basically, it's apples and oranges.

Hey, wait a second

[CrankyFool]

Running this on my parents' PC, I find that it has, in fact, found spyware that neither adaware nor spybot has found.

Only problem is that it's TightVNC. I can understand that -- I mean, someone could use that to access your computer! The weird thing is, it didn't flag Remote Assistance as spyware. Totally missed it.

I think I'll submit a bug.

Priceless

[lxs]

This is the first alert I got after running it:

Microsoft AntiSpyware has detected that the Window's Messenger Service is currently running. The messenger service is sometimes used in corporate networks to send information from the administrator to its users. However, this service has been a wide source for pop-up message spam, and for most users not on a corporate network should be turned off and disabled.

They even detect their own crap!

Weird Page to Link To?

[milletre]

Is it me, or is the link to the Microsoft Anti-Spyware fishy? I got all sorts of security warnings from Firefox, and it comes up as an https:// page.

But if I go there from the Microsoft home page proper, it's a non-secure URL.

wtf?

Re:Twice as much

[karmaflux]

With that much crap cloggin up your resources, spyware doesn't have a chance! It'll never find processor time! Clever ruse.

I concur, MS's AntiSpyware program works well

[phaetonic]

I have to give credit to Microsoft purchasing the company who made this AntiSpyware program. Yesterday I went to a client site and their server got infected (surfing on a naughty site I'm sure) and AdAware and Spybot removed a few but the machine was still hosed. I was unable to double click on any icon on the desktop - I would get a GPF. I went in safe mode with networking, downloaded the MS AntiSpyware tool, went in regular mode to install it (LUCKILY that worked, not sure why), went back in safe mode to run the tool, and it wiped out over 20 different spyware signatures and over 100 files, much more than either of the other tools. After a few hours, the machine was running perfectly with the icons allowing to be double-clicked on.

False positives..

[wfberg]

Among the things MS Anti-Spyware found on my system (which is actually well-maintained, so perhaps not the best test-bed) none was a real hit, they were all false positives.

It even managed to warn against registry settings put in place by SpyBot to ensure a malicious site runs in internet explorer's restricted zone!

Also, it reported with glee that TightVNC is a dangerous hacking tool. I happen to use it to help out people, exactly the kind of people who are likely to remove it if AntiSpyware complains about it (e.g. my mom).

Then a load of DLLs that are actually dummy DLLs shipped with the "lite" version of a (once upon a time) popular ad/spyware ridden app - again, it's detecting its competition!

And then there are the residual files/empty directories/registry settings that adaware/spybot didn't remove some months ago when I tried an app that came with ad/spyware. No active components at all.

Another thing I don't like about it is that it's user interface doesn't scale properly when you've adjusted your DPI settings.

Also, its on-access scanner (for want of a better word) comes with an enormous performance hit, and is mostly concerned with Internet Explorer hacks. Those are a minor concern for me since I use firefox, and besides, Microsoft should fix IE, not ship cycle/ramhungy monitoring applications for it (though that's hardly GIANT's fault).

In other words, I'm underwhelmed.

Re:False positives..

[cookiepus]

Also, it reported with glee that TightVNC is a dangerous hacking tool. I happen to use it to help out people, exactly the kind of people who are likely to remove it if AntiSpyware complains about it (e.g. my mom).

It reported RealVNC as "Commercial Remote Control Product" with a danger meter of 50%. Since I know I run RealVNC, I said "always ignore this". It won't show up in the hits again. But I would imagine there are people out there who have VNC installed on their systems by someone who spies on them (untrusting boyfriend perhaps?) so why shouldn't those people be warned? If they have VNC for a good reason (like you and I do) they can easily exclude it from future hits.

I also got a complaint about some eDonkey registry keys. I am not sure I ever ran eDonkey, perhaps it's because eMule registers itself to handle eDonkey links. I also said to ignore this always, so it won't show up again.

I see both of these as valuable features. There are people out there who may not know they have VNC installed, and there are people out there who may not know eDonkey has adware (or whatever the problem is) - those people should be warned of this. We can easily ignore the information and make it not appear in the future.

Also, its on-access scanner (for want of a better word) comes with an enormous performance hit, and is mostly concerned with Internet Explorer hacks. Those are a minor concern for me since I use firefox

So turn off the real-time checks.

Re:False positives..

[Warskull]

I got a similar result here, it turned up all false positives. I heard a lot of people claim Giant Anti-Spyware is the best, but from what I can tell Spybot search and destroy is still by far the best with a bit of back-up from lavasoft's ad-aware. So what this means is people are fine just running spybot and ad-aware. This microsoft rebranding of Giant looks to be the super paranoid version of anti-spyware. Not only does it mark spyware, but it also marks programs that install spyware, and marks programs similar to those that install spyware. I think any peer to peer application they know about is included as spyware. While this could be good for the lay user, it seems anyone with a remote knowledge of computers is better off using other programs. One big thing this has that others don't is the descriptions (pretty good) of the spyware. Maybe some uninformed people running this will read some of those descriptions and hopefully become more aware of why they don't want spyware.

Single Data Point...

[raehl]

I just ran it on my system and got 0 infected files; so it's probably not jus padding itself for the sake of padding itself. (I don't install lots of crap, so I'm not surprised it didn't find anything.)

Interesting.

[Aggrazel]

It detected my "TightVNC" installation as possible spyware, but didn't say anything about the Windows Terminal Services service running ....

Microsoft AntiSpyware forces you to install IE 6

[Brett Glass]

I just attempted to install Microsoft AntiSpyware on a machine from which Internet Exploder had been mostly removed via the utility Win98 Lite. It refused to install, insisting upon the presence of Internet Exploder 6. The machine in question uses Mozilla, with which we're quite happy. It appears that Microsoft is tying yet another product to the use of Internet Exploder 6, probably in violation of the recent DoJ Consent Decree. Will the Bush Justice Department do anything?

Microsoft is contributing to their demise

[Bruha]

Linux will succeed becuase you have many groups contributing to computing some free some not so free but it creates a economy around it of sorts.

Microsoft however cant stand for some reason to be the OS that great things are built on like Linux can and is being today. They try to take their OS and adapt and squeeze out what they consider competition. Then they take the products that other companies make to run on Windows such a Ad-Aware, Norton Antivirus, Lotus Notes and a myriad of other programs out there and try to build them into Windows. Netscape employeed people who designed, maintained, and supported their browser. Microsoft rolled out IE and tied it into their OS sparking a controversy that eventually landed it in court. Yes the consumer has suffered but what about those Netscape employees? Did Microsoft give them jobs making IE better and supporting it? Hardly those guys were muscled out of the marketplace. Now I'm sure they got jobs elsewhere but what and where are they doing things.

This can go for any number of companies that are threatened becuase Microsoft refuses to make windows as good and secure as it can be they only want to add the next cool feature into their OS.

Symantec, Mcaffee, Real, and many other companies employ many good people with ideas and not just the engineers and software hackers, there are secretaries, janitors, and guards that also are employeed and probably buy Windows. Once they lose their jobs becuase Microsoft muscled their company out of business then they probably wont be buying as many computer products anymore.

Thus Microsoft sits there and kills their own bottom lines.

Of course were all eventually damned in that robots and smart computers will replace our jobs. Just look at those poor bastards that are being replaced in the Toyota autoplants here soon. This will spread to all auto makers across the world and it will not stop there. Productivity increases due to these robots will put strain initally on supply lines becusae those humans cant keep up and then one company will pick up the slack by having robots do that portion of the work and other companies will have to do so to keep up.

From there it's basically a self feeding reaction that eventually will nullify every job we have or can move to in the next 50-100 years.

Oh and governments would step up to help you?

System File Checker

[runamok1]

It used to be pretty easy to get rid of spyware.

0. Get all Windows updates, patches, etc.
1. Get both programs (Spybot and Adaware)
2. Update both via downloading the newest signature files.
3. Reboot in safe mode. (press F8, etc.)
4. Run both programs.
5. Optionally open msconfig (not available in Win2K) and/or regedit and check to see what is still running and track down each item at http://www.pacs-portal.co.uk/startup_index.htm or similar.
6. Reboot.
7. Optionally take a look to see if any items you removed in step 5 recreate themselves.
8. Optionally install firefox, etc.

Heh heh. Re-reading this makes it seem not so easy, but everything is easy when you know how.

I have noticed newer spyware variations doing two VERY BAD THINGS.
1. Preventing adaware, spybot, norton, etc. from working. Via the hosts file or otherwise.
2. Modifying system files so that they can not be removed. I turned one friend's computer (running XP) into a paperweight. Because the program was manipulating winlogon.exe. Adaware removed it and the computer would logout every time you tried to logon. I had to extract the file from an XP boot disk.

OK. So the point of this post was that since Microsoft knows their files the best, one would assume they could check file checksums and file dates, etc. and prevent these sorts of shenanigans.

They have had a program called System File Checker sfc.exe since the windows 98 days. I always thought an adaware program combined with this would be nice.

Although I have never figured out how these spyware programs can circumvent "system file protection" when it is a royal pain for US to do so.

Even better

[PortWineBoy]

I got an ad saying my computer may be infected with spyware...but then it switched to some girl in panties so all was okay.

It's trivial to generate false positives...

[John3]

How about attaching your claria.exe text file to all your outgoing emails, sending your emails out with a subject of "I'm not selling Viagra , Cialis, or Rolex Watches!!!!" and see what kind of false positives you get from anti-spam and anti-virus filters. It's not a precise science, so I'd expect false positives when you make a concious attempt to fool the program.

That's not to say they can't make it more accurate, but they may be trading off accuracy for speed (filename match rather than file signature). If I was designing it I wouldn't be real concerned with trying to correctly deal with bored users trying to fool our program by renaming their important documents to "claria.exe".

Re:Twice as much

[damiam]

Some of what it detects are definitely false positives. On my machine, it claimed to find registry traces of eDonkey and Grokster, which it says contain adware. But the keys it found were put there by Shareaza, a non-spyware open-source client.

Unnecessary app, fix the autostart instead!

[tomas.bjornerback]

Another useless application...

If Windows were to ASK the user during startup what services and programs to autostart (except for the well known and checksummed original, MS, services), most of the spyware wouldn't even start!

Some will say that users will answer "yes, start that too" to all programs, but that's mostly depending on the GUI used for the asking process:

* Perhaps all processes/services should by default not start automatically

* Each have a (short) warning text.

* Only one place for all autostarts! Not HKLM, HKCU, Startup, ...

* Figure out more stuff here yerselves... I don't work at MS and I don't want to invent stuff for them for free! :)

Since most users believe that they need to buy a new computer because the old one is slow, but it's due to spyware (are Intel/MS supporting the spyware creators to increase sales?), which clings to the OS like a spider in all of it's autostart places...

Re:Twice as much

[ZeroExistenZ]

I second that.

Serv-U FTP Server is appearantly a "Trojan FTP", default action is to "quarantine" in MS's view.

Aimed at the masses

[Durzel]

To be fair to Microsoft, their software picked up things on my PC which I knew were "dubious", but I knew were safe (e.g. Kazaa Lite as opposed to Kazaa, etc).

It's obvious that this software is aimed towards the uninformed masses in the same way SP2. I'd wager that most non-techie people barely know what spyware is, let alone how to find spyware-free "lite" versions of software, assuming they exist.

Also, the real time agent kicks serious ass. I'm amazed that people have even tried to criticise that (simply because its MS) by saying "oh great, yet another TSR program to run in the background, way to go M$!". When I installed the latest Sun JVM it informed me that a Browser Helper Object was installed and that it was "safe". A nice touch.

In other news, how come there hasn't been a front page story on these serious flaws in Mozilla and Firefox ? Double standards? I'm all for bashing MS when appropriate but lauding every single IE flaw with a seperate story and ignoring something like this doesn't exactly paint the site as unbiased.

spybot/adaware combo still works better for me...

[mikenb]

I'm cleaning up a clients laptop, and decided to use the new microsoft spyware beta. I ran it first:

5 infected files
1 threat (real vnc)

Then I ran spybot after running the microsoft program:

12 files found
including valueclick
advertising.com
avenue a, inc
double click
DSO exploit
fastclick
mediaplex

and finally I ran adaware:

25 critical objects found

All of these programs had the signatures updated. Spybot and adaware collectively caught 37 more files than the microsoft beta did...

But it is still in beta I guess.

Warning: Real-Time option reenables itself

[PatientZero]

I tested it out too on my home machine, and the only thing it found was the Download Manager for Gamespot (based on Kontiki). Thank you Mozilla. :)

In any case, I uncheked the "install real time protection agents" option during installation, but after running the scan I ran through the options to see what other features it had. Surprise, RTP was enabled. Oh the irony of MS AntiSpyware behaving in the same shady fashion as Spyware apps. ;)

So if you do install it but don't want the RTP agents, make sure you hit up the options before quitting.

Behaviour confirmed.

[khasim]

I just downloaded it and ran it and it did the same thing to me. Just about everything was re-enabled after I specifically un-checked it during the install.

It also made my PC run slower than before.

It found VNC as "spyware", but it set the "remove/ignore" option to "ignore" so that wasn't so bad.

Other than that, it didn't find anything. But I run FireFox with adblock and both spybot and ad-aware so I wasn't expecting anything to show up.

I've uninstalled Microsoft's anti-spyware and it left the directory and log files on my PC without giving me any uninstall warnings.

Re:Behaviour confirmed.

[Vancorps]

VNC is commonly used as a trojan so that behavior makes sense.

The rest is typical with microsoft.

I would be curious of an anti-spyware app could be written to run on a network, since profiles are stored on a central server and that server is never used to browse the Internet it would be the perfect environment to clean spyware from all the profiles out there.

It would also be nice if you could script the app so for instance, your organization uses Alexa or Viewpoint you could enable it to prevent apps from breaking while disabling or removing all other spyware.

Umm... don't think so...

[borg1238]

Sorry, didn't do this to me either. Homepage on IE is still google, and the hosts file appears to have been left alone.

So all I have to to is make an unsubstantiated post about a M$ program doing evil things to my machine and I get modded up? Oh yeah... this is Slashdot.

Re:Twice as much

[CritterNYC]

Some of what it detects are definitely false positives. On my machine, it claimed to find registry traces of eDonkey and Grokster, which it says contain adware. But the keys it found were put there by Shareaza, a non-spyware open-source client.

Yeah, it wanted to kill off pieces of eMule, Shareaza and Unreal Tournament 2004 on my box.

arghhh

[TCP Pimp]

Yeah works great, I ran it on a client's PC and it uninstalled Windows. :)

Re: keep the politics out, please....

[fm6]

... but when you go on the political rant by saying "you'll always be sorry the Democrats didn't stay in power long enough to break Microsoft up" - you lose me.

I think you need to have more than a passing reference to a particular political party before it counts as a "political rant". And it's not as if I'm a big fan of the Demos anyway. But that's a secondary issue. Let me refresh your memory: back in 2000, MS was defending itself in antitrust court, and doing a really poor job of it. At one point they actually got caught fabricating evidence. Then the Demos left office, and a new pro-business AG simply dropped the case.

Whether you think the anti-trust case was a good idea or a bad one, you have to concede that Microsoft might well have been broken up by now if Al Gore had won the election. Pointing out that fact doesn't make me a partisan.

Why can't people get it through their heads that Microsoft's problems are part of the natural course of free-market economics? They didn't start out a huge business, placing their OS on everyone's computer. They *earned* that position through superior marketing and business deals.

Again, your memory needs refreshing. MS's dominance of the OS market is pretty much an accident. That actually got into the business against their own will. They wanted to sell development tools for the new IBM PC, but that meant that IBM had to adopt an OS those tools would run on. Which is why they steered IBM to CP/M. When that fell through, they hurriedly licensed a CP/M clone from Seattle Computer Products, which became the basis for MS-DOS.

MS-DOS is one of the biggest abortions since the rise of modern technologies (find me a single OS expert who will give it high marks). Yet its very flaws created such a high level of lockin with the PC platform itself -- which was also pretty flawed. Since compatibility soon became the name of the game, clone computers had to reproduce all of IBMs mistakes. And since their biggest mistake was choosing MS-DOS, computer makers ended up paying a tithe to Bill for every box they sold.

But even if you were correct, and Bill achieved his success by technical brilliance and plain good business -- so what? He got his reward when he became the richest dude on the planet. He did not earn the right to destroy the very marketplace that made him rich. Microsoft's role in the current marketplace is bad for all of us -- including Microsoft. Calling me ideological names isn't going to change that.

VNC is evil!!!!111

[Venner]

Some of what it detects are definitely false positives. On my machine, it claimed to find registry traces of eDonkey and Grokster, which it says contain adware. But the keys it found were put there by Shareaza, a non-spyware open-source client.

Yep. Same here. It decided that VNC was obviously an attempt to remotely hijack my computer.

It also felt the need to alter my hosts file for me. It didn't like the fact that I had "ads.msn.com" pointing to 127.0.0.1 (as well as over 100 other ad domains; the only one it cared about was MSN!)

No surprise, really

[MigLar2000]

It's no surprise that Microsoft is better at detecting spyware, most of it is their fault.

Re:VX2 Kicks Anti-SpyWare Ass :(

[detlev409]

I've had some success with the new updates for adaware. I've had rather underwhelming results from the VX2 plugin, but a fully updated adaware installed has removed VX2 on a number of machines in the last few days. I can't specify what strain of VX2 was had in all cases, though, so take it for what it's worth.

Alternative Software

[Archon-X]

I stopped using SpyBot & Adaware a long time ago.
They're most admirable projects, however, neither are comprehensive.
Often times, you have to run both to try to remove something, and there is still spyware installed.
Neither offers a preemptive system either (filtering web, watching the registry etc)

The *most* comprehensive program I have found is webroot SpySweeper.

It is incredibly thorough, has staff dedicated to finding new spyware strains, the ability to report suspicious files, the works.

OOBE

[Ancient_Hacker]

lesse, just a few notes of my first look at it:

• Apparently they're not interested in bringing pirates into the MS fold, it only runs on "authorized" installations. Hmmm..
• It asks me if I want it to run at 2 AM, I click "no", then later it reports it's set to run at 2AM. Hmmm....
• I click on Manage 2AM runs, and I see no option to turn them off. If you deselect all runs, it complains that you havent selected any runs. Hmmm...
• Screen is a dog's breakfast:
• non standard panel borders that trail off, looking like a bad screen update.
• The app name appears several times, in different fonts and sizes. One instance is clickable, and takes you to an unexpected summary page. The next text isnt.
• There's a cacophony of active items. There's menus. There's clickable text. There's a separate area on the top right with BOTH icon-like things and clickable text.
• If you click on the things in the upper right, it immediatel;y and irrevokably cancels the current scan. Nice. Not only does it do something unexpected, it doesnt even ask if you want to do it, and you can't back out or continue. Sweet.
• Like many of these thingies, it feels it has to put up the name of every file it is scanning, and update the file totals. And run a dumb little static animation that really makes no sense, as it isnt moving files at all. This is not only useless and misleading information, it slows down the scanning process, especially with older video cards.
• It did find one registry key, but AFAICS it doesnt bother explaining what it is and what the ramifications are. And the button to remove it is inadequately labeled "Continue", which requires some extra text by it explaining what it really does.

I wouldnt call this a Beta, I've seen better preliminary prototype mock-ups.

Subscription fee?!

[Beetle B.]

"Ad-Aware and SpyBot offer great performance for free, yet when Microsoft debuts its AntiSpyware application, it will require a subscription fee."

A subscription fee?! First, they produce an OS that's just open to all manner of spyware one can imagine, then they actually charge to have it removed?!

Wow! I need to get into this business!

False Positives...

[douglask]

Just FYI, MS Anti Spyware does report false positives. It believes that TightVNC is spyware. Hmm.. I guess it competes with the MS remote assitance tool. :-) It kinda makes you wonder how it finds "finding twice as many infected files", eh?