Failing Grades For Most Anti-Spyware Tools

serbach writes "Steve Gibson posted this link to a superb test of about two dozen top Anti-Spyware programs: Eric L. Howes conducted the test over a two-week period in October. The results surprised me: only 3 ASW programs had a 'batting average' of better than .500 when it came to eradicating the broad range of spyware in the test. Freeware star Spybot Search & Destroy came in a distant 7th with an average of only .376. The top three? Giant Anti-Spyware, Spy Sweeper, and Ad-Aware. These test results are well worth your time."

Ars Report

[cow_licker]

Ars-technica also just did a review. Check it out.

http://arstechnica.com/reviews/apps/spyware-remo va l.ars

Spyware

[cheezemonkhai]

Well Spybot may not do great, but it certainly does enough to clean up a persons PC so it works again without crashing every 5 minute.

My reccomendation is firefox or mozilla or even opera if you prefer it.

I do however note that if you take a clean system and then visit msn.com, then run spybot etc you will find that there are little evils that appear on your system.

It now appears that the best option is to wave goodbye to MS if you can. Pick a nice linux distro (eg Ubuntu or whatever suits you) or even MacOS X and feel that little bit safer.

Re:none here

[afd8856]

I've seen spyware targeted at firefox and java applets that would want me to install something I was not curious enough to see. Fortunately, I was always asked if I want to install (security mechanism in Java and Firefox). I think grandpa' will click ok on those boxes, without reading them first.

Re:Ars Report

[Anonymous Coward]

Clickety [arstechnica.com]

Ad-Aware Rules

[dreegle]

If you can limp yourself to download it, I've found Ad-Aware does an outstanding job in most cases. But you must have the new (free) version to do any good, The rate of evolution of these beasts are high, and they apparently came up with a new engine for Ad-Aware SE, that I've seen fund hundreds of objects that Ad-Aware 6, a moment before with current updates, had missed.

Makes most machines usable again, and quickly.

And if they fail...

[Tuxedo Jack]

That's what SpywareInfo's for.

http://www.spywareinfo.com [spywareinfo.com]

It's arguable that they're the biggest antispyware site out there, and if nothing else, they can get the CoolWebSearch strains that even Ad-Aware and Spybot can't get (real-yellow-pages, linklist, et cetera).

(Disclaimer: I'm a Trusted Advisor there.)

Re:none here

[gtkuhn]

I don't have spyware cuz I check processes for new things that pop up (XP Pro). I've had malware before and I reformat ASAP. Now, one nifty line of defense I use is a freeware program called Startup Monitor. http://www.mlin.net/StartupMonitor.shtml [mlin.net]

Re:none here

[gtkuhn]

Ah! Then try Security Taskmanager instead of that crappy windows taskmanager. Sorry, it's not free, but has a trial period. http://www.snapfiles.com/get/securitytask.html [snapfiles.com] Also, StartupManager (the free one that I can't recommend highly enough, see grandparent) catches stuff that tries to run at startup which is at least a valuable tipoff that something is wrong.

Spyware tips I've picked up

[cybergibbons]

I run a small IT consultancy, and nearly every internet connected PC we work on has a significant spyware infection on it. It's not only our job to remove it, but to prevent it coming back. The things that I've noticed after fixing a lot of problems:

• People don't know they have spyware on their computers. They are crawling along, at a stage I would call barely usable, and it doesn't bother them in the slightest. Or, better still, they find those new toolbars really useful...
• A combination of Spybot S&D and Adaware will clean up most problems. Hijackthis will then allow you to remove anything else. Some people say that Hijackthis is the only tool you need - but it can only remove very apparent problems, whereas the other tools will remove nearly all associated keys, files etc.
• To prevent re-infection, you need to lock down the machine whilst it remains usable. People really do not want to change, or put any effort in. You can try putting Firefox and Thunderbird on the PC, but most people will choose IE, or complain if you hide IE, so they don't have the option.
• Change the settings for the zones in IE to be more secure.
• Add a big list of bad sites to the restricted zone in IE. This includes some sites that have content, but it's generally porn, and as our users are business users, they won't call us back to give them access to a porn site.
• Add an even bigger list of ActiveX CLSIDs to not run.
• Stop the default action on windows scripting host files, scr files etc. from "run" to "edit". A lot of problems start with some user interaction, and this has cut down on quite a few (mainly non spyware) problems.
• A lot more small registry tweaks can be done... most of the above is done automatically by scripts we have writen. One of the problems we found was adding keys once to each HKCU hive - you don't want to overwrite them at each login, or the user changes will be forgotten, but none of the Run, RunOnce etc. keys do it per user.
• Add some buttons to the IE toolbar to put sites in the trusted or restricted zones, for when people have problems.
• Install Spyware Guard - this provides some active protection against spyware.

This won't stop everything by any means, but it slows down reinfection. End users need to change habits - reading EULA, not just clicking OK, using passwords - but this isn't something you can do with a couple of hours work, so people aren't willing to do it. I have no solution to that problem.

Re:Personal experience with anti spyware tools

[catwh0re]

In terms of spyware that runs on your system as a program, it's a good idea to write a list of the notorious Run directory in the windows registry, that way you can check your list to see if new spyware(and sometimes viruses) have been added. What you need to really do though is ensure that you don't end up deleting legitimate additions to this list, such as those added after installing applications.

An ounce of prevention worth a pound of cure

[gtkuhn]

Seriously guys, none of these spyware removers are even remotely perfect and they all suck time and CPU cycles. I disavow any knowledge of this guy, Mike Lin, but his itty-bitty FREEWARE program kicks butt.http://www.mlin.net/StartupMonitor.shtml [mlin.net] It does one tiny little thing with almost zero overhead, it tells you what wants to insinuate itself into one of the several startup vectors of Windows. And gives you the option of not allowing it. Any spyware must have some part that runs at startup. This gives you a warning and a filename for googling to remove whatever you have contracted. Probably works for many worms, viruses, and trojans too.

Re:Mac + Firefox = ok?

[random_culchie]

Yes it does. Since the applet only runs within the context of a given page makes it spyware unfriendly. Spyware generally sits in the backround gathering information on what you do. Since applets are limited to one page this eliminates spyware possiblities. An applet can only communicate with the server it originated from also. (Unless you click those grant permission things) This also makes it difficult send information to spyware hq. Generally applets have little if any information about the page they reside on.

Talking of Java....

[prandal]

Folks, you should check out this Sun Java Plugin Arbitrary Package Access Vulnerability [idefense.com]

Re:Spyware tips I've picked up

[cybergibbons]

I should ad (hoho) that one major advantage of Spybot S&D is that you can schedule it to run quietly in the background... this just isn't possible with any of the other free tools. The command that does it:

spybotsd /autoupdate /autocheck /autofix /autoclose /autoimmunize /taskbarhide

There are other tools that help massively with spyware. As a consultant, it's equally important to understand the ways and means spyware gets onto the system, so that you can prevent and cure effectively, and respond to new spyware before the automated tools do it or before it appears on the many forums.

• Sysinternals Utils are free and great. Process Explorer replaces the crippled useless tasklist in XP, and is quicker and easier to use than the command line utils. Filemon, Regmon, and Diskmon allow you to monitor files, registry keys, and disk access - you can see how, when, and why spyware is getting in.
• WhoLockMe - appears on the right click menu in explorer, and shows what is causing a file to be locked. Again, this can be done at the command line, but this makes life that little bit easier.
• Knoppix - for when it all goes very very wrong.... recover files, partition tables, reset passwords, even edit the registry

Comment removed

[account_deleted]

Comment removed based on user account deletion

I am intrigued by you ideas and wish to subscribe.

[gtkuhn]

Actually, a really good suggestion. I am learning stuff here. http://www.windowsecurity.com/articles/Securing_th e_Windows_2000_Registry.html [windowsecurity.com]

No mention of CnsMin?

[videodriverguy]

I'm surprised that they don't mention this piece of s**t. But since I haven't yet seen a program that can remove the latest version, I'm not surprised. This insidious piece of work actually installs a device driver which continuously monitors its files and prevents deletes etc.

Even starting in so-called 'safe mode' won't stop it. You have to boot with a CD and erase it manually.

The people who wrote it are 3721. something, and a link to it even appears on the default Chinese search page. In theory it just allows for Chinese name searches, but in reality does much more.

You have been warned - please don't visit the site.

Re:none here

[shufler]

The secret is to turn JavaScript OFF.

Re:It's interesting

[asadsalm]

>in theory, there isn't much of a difference
>in a loan shark and any sort of investment

Sorry about going off-topic, but - Not really.

INTEREST
--------
When you loan an amount on INTEREST, you always make a profit. The more money you have the more profit you can make. The rich get richer - faster.

Invest
------
When you invest that same amount in a business, you can loose that money. You cannot sit on your ass all day and hope to make money. You are doing actual work. Or you might be motivating people to work. If you dont, you loose your money.

So, in an INTEREST based economy, there is no production and people get fatter. In an investment based economy, people are working hard, and hence healthier. The INTEREST would certainly make that economy have more $$$money$$$ on fiscal records, but amount of money isn't everything, when health is being sacrificed.

Moral - You just gotta work hard for your money. If you don't its only bad for you.

Re:Mac + Firefox = ok?

[RedBear]

I'm not a programmer, but yes it is my understanding that sandboxing only applies to running a Java applet in a web browser or something similar.

Most Mac users aren't plagued by viruses, trojans or spyware simply because there isn't much of that stuff around for the Mac platform. This is for several reasons. One is that Macs still only represent about 5% of the computing world. Another is that Mac OS X has a better security structure and default security settings than the dominant OS. Another reason is that many Mac users are the type of people who simply don't put up with installing crap on their computer, and see no reason to install useless free junk. Mac users typically want to actually use the computer to get something done. It already looks pretty, why mess with that? ;)

If your physics professors are the only people using their computers, they must not be staying on legitimate physics and news websites. Something must be out of the ordinary for them to be contracting spyware. To get spyware you have to download some software, either manually or through a bug in the browser. Your typical website catering to educators isn't going to allow that sort of automatically installing code on their website. These professors of yours must be straying off the reservation at some point, or getting it through email attachments, or quite possibly a worm.

Firefox could possibly help them if you start with a clean system, but if they are actually going out and downloading FREE ANIMATED MOUSE CURSORS!!! they will need some re-education on how to keep their computer safe. Mac + Firefox would be a vast improvement, but unless they were restricted from installing any software (yes, this can be done) they will eventually get themselves in trouble. For general web browsing it is definitely a much more secure environment, but only if you know not to do something stupid. Java is certainly more secure when using Firefox on either platform, since you aren't using the buggy MSJava implementation.

Don't stop at replacing IE with Firefox. Outlook/Outlook Express is just as bad. Apple Mail is very nice on the Mac, but Thunderbird also works, and of course is cross-platform. And none of this is going to be very effective on Windows if you don't have a solid firewall to go along with it, and anti-virus software. On the Mac, turn on the built-in firewall to increase the already decent security.

Re:It's interesting

[Dr. Manhattan]

spyware usually is very hard to uninstall

Last Friday I went over to my cousin's house and cleaned her computer. (Can't quite get her to switch to Linux... yet.) Took all evening, and I finally had to boot into DOS and remove some files that way. One of them called "Wintools" had even set the 'hidden' and 'read-only' attributes, if I hadn't remembered 'attrib' I'd have had to wipe the thing and reinstall.

One of them had screwed up shutdown; it would freeze and she'd have to power-cycle, invoking a scandisk the next time. I don't know if it was intentional (to encourage the user keep the system running) or just crap programming, but either way the damn things could *not* be uninstalled without major surgery.

Here's what I do

[Akardam]

First off, I love linux, but in this case I think there's a better tool for the job. (The following is not really a shameless plug).

I use Bart's PE Builder [nu2.nu]. In a nutshell, it's a bootable cd with a Win32 network, disk (with native NTFS support) and GUI API load. The best thing is that it's built using actual Windows dll's and the like. Of course, you have to have a copy of XP or Server 2003 to built it, and it may not be strictly within Microsoft's licensing agreement to use their IP in this fashion, but that doesn't bother nor stop me.

Anyway, there's a native Ad-Aware plugin for BartPE, and I've hacked together a Spybot S&D plugin, as well. My usual proceedure is to boot the system with my cd, run AAW & S&D to clean up files on the hard drive. Then, I boot from the hard drive into safe mode with networking support, install the latest versions of AAW & S&D, and run them again. This cleans the registry as well (which unfortunately I haven't figured out how to do under BartPE... yet). This method has worked well in situations where the system is so infested I can't start from safe mode.

Part of the problem is that even with the proliferation of anti-spyware programs, often to completely eradicate these nasties, manually crawling for files and registry entries may be necessary. At least for the forseeable future I don't see this becoming a fully automated task.

Online encounters

[Nursie]

This isn't just something encountered online though is it?

When it transfers itself to an EU citizen's PC and runs in the background collecting information it is acting within the EU. The EU could conceivably extradite the people responsible for this and try them as crimes have been comitted in the EU as surely as a cracker gaining illegal entry to an EU government computer from a terminal in the US has comitted a crime.

A couple of utilities I've found usefull

[Akardam]

There's two utilities I use on a regular basis for winsock fixing:

1. LSP Fix [cexx.org]. This program will let you see what dll's are embedded in your TCP/IP stack. Most of the time it will even detect stuff that's not supposed to be there, but you do have the option to override its judgement. Spybot S&D also has the ability to look into the stack, but you can't use it to remove offending modules, nor see their actual dll filenames.

2. Winsock XP Fix [spychecker.com]. This nifty little utility will basically reset all registry settings for the stack back to what they're supposed to be. This is usefull if some nasty has totally trashed the stack on its way out the door. It would also appear it works on earlier versions of Windows (certianly Win2k) but I've never tried it on anything but XP.

I used to joke that as long as people break their computers I'd have a job, but there are times when the spyware thing really drives me up a wall...

Just my two cents...

[ardustry]

We use Adaware, Spybot, and Spysweeper. I also use pstools to kill anything in memory that comes back.

Some trojans/virus/spyware programs like to run two copies in memory. When you try to axe one, the other respawns the process.

Pstools will handle this. Pskill run from the command line with an ampersand (&) seperating the command lines will run a kill on two processes fast enough in most cases to kill them both before a respawn.
If it doesn't, start a pretty big file copy process to slow the system and rerun the pskill commands. This is usually enough to kill anything I have run across in memory.

Re:An ounce of prevention worth a pound of cure

[ppz003]

Spybot S&D will do this too. If you choose the advanced mode, and then Tools from the left side, you get a list of all processes that execute at system startup, with the option of disabling or removing them.

Browse through some of the other tools too. Some of them are pretty slick.

SINGLE BEST SOLUTION

[dioscaido]

Stop running your daily desktop account as Administrator. Most, if not all, of the spyware will fail when it attempts to infect your system. It's just general good practice anyway. No one runs KDE/Gnome as root, or log into their OSX machine as root. Neither should we.

• http://www.techproblemsolver.com/limited.html [techproblemsolver.com]
• http://www.dotnetdevs.com/articles/RunningAsNonAdm in.aspx [dotnetdevs.com]
• http://blogs.msdn.com/aaron_margosis/ [msdn.com]
• http://www.pluralsight.com/keith/book/html/howto_r unasnonadmin.html [pluralsight.com]
• http://support.microsoft.com/default.aspx?scid=kb; en-us;305780 [microsoft.com]

You need another ounce...

[mpath]

There's another class of evilness that doesn't involve startup and that's BHO's [spywareinfo.com] (or Browser Helper Objects), which come into play when IE is started and have full access to the computer.

Re:It's interesting

[Ilgaz]

It was a real funny chance myself getting infected in fact.

Its in just couple of Limewire 3.7.2 beta and 3.7.3 releases for mac. When they figured mac forums getting reports, they immediately pulled it from installation.

I am one (c) freak guy using all original dvds, cds, programs etc. Its really funny I got infected with spyware because of Limewire I mean...

I left a friend alone with my Mac G5, knowing my root pwd and I really didn't think he could be THAT GOOD on macs or forgot how easy macs are used :)

Guy installed limewire to get a rare mp3 he likes and boom, I had java asking permission to connect at morning (netbarrier running here)

What drove me nuts is, I am one of the FIRST guys figured TopMoxie on Win32 and alerted press (Wired etc) about it.

They figured mac users are aware of what that thing does and pulled it.

here is a forum posting for you, on a real popular mac website.
http://forums.macnn.com/showthread.php?s=&threadid =195695 [macnn.com]

About Top Moxie? Oh man, that thing was more evil than satan... Can't imagine how much money went to wrong hands instead of non spyware legit referrers of Amazon.com etc.

http://www.symantec.de/avcenter/venc/data/adware.t opmoxie.html [symantec.de]

Looks like Symantec analysed a recent version. That thing is written by very advanced java authors itself, read: Limesoft. It was first bundled with Limewire/Windows and OS integrated firewalls like Symantec firewall AUTOMATICALLY granted ALL rights to it since it was using SIGNED Microsoft JView to run. So, Jview, signed app, you get alert from firewall which RECOMMENDS to enable access since its signed microsoft system part.

Understand the trick? Since its SAME trick used on Limeshop/OS X

Oh it did one "cool" thing on windows...:) You know there are poor coders, freelance authors etc making money to run their sites via referring books,cds from amazon etc? It rendered such URLs (childs toy to get current url from IE) and REPLACED it with some limewire referrer.

Looks like they changed that attitude since Amazon and major, LEGIT referrers threatened a lawsuit against them.

We _must_ keep an eye on that Limeshop and TopMoxie, especially Java fans and developers. This is one cool(!) and evil way to unleash Java "run anywhere" potential. As its written in java, imagine 1 year later we speak about J2ME (java micro edition) spyware which is installed to Cell Phones, PDA's and Nokia, Ericcson give option to their customers to DISABLE Java via firmware.

Or lets say, you see people bragging about Linux,BSD is free of Spyware? It can easily change with that java sneaky thing.

Re:Terrible Review

[zaffir]

It says right in the story summary that they covered SpySweeper.

It is the one piece of software i've found that gets rid of everything i throw at it. On my client's machines, I used to run adaware and spybot, and then spysweeper if there were still popups. Now i just run spysweeper from safe mode once and it's all taken care of.

Re:It's interesting

[Ilgaz]

Oops, I noticed I got infected by a Limewire 4 (final) version, not just 3.7.2.

If you look at that macnn forum topic I referenced, you will see another "Adam" promising it was pulled from installation. Notice he and all guys speak about 3.7.x versions.

Now, its 4.x level and some of builds got Limeshop installed.

It can give a clue about their tactics. I am expecting a Limewire corp post in reply to my post REAL SOON btw.

Seems they dig web and sites like slashdot for words "limewire" and "spyware" and reply with non honest comments as stated above.

sorry replying to my own post, I had to inform any OS X users out there...

Re:It's interesting

[Hobophile]

When you loan an amount on INTEREST, you always make a profit. The more money you have the more profit you can make. The rich get richer - faster.

This line of reasoning is absolutely misleading. With any loan there is a significant possibility of default. Profit is not guaranteed, and the interest provides economic motivation for people with surplus cash (the "rich") to loan money to people who need it.

Furthermore, this completely ignores the benefits that the borrower obtains from loaned capital. The ability to leverage money not your own is incredibly powerful, though not without significant risk. You can borrow funds to invest in a business or real estate, and done properly you have a good chance of making yourself quite a bit more wealthy. In many cases your return will far outstrip that of your lender.

When you invest that same amount in a business, you can loose that money. You cannot sit on your ass all day and hope to make money.

By any measure, buying stock in a company is investing in its future growth potential. The average shareholder can do very little to guarantee this return except sit around all day. Further complicating this worldview is the notion of "investing" in the bond market, which essentially involves purchasing shares in interest-bearing loans.

Delve deep enough, and you get to the core concepts of capital, investment, and return on investment. What you are essentially suggesting is that one kind of ROI is "bad" (interest) while others are "good" (dividends earned through hard work). While this is an intriguing premise, there is no logical method of obtaining this conclusion.

It should be noted that much of the utility of wealth lies in its ability to let you choose to work hard only for the things you want to. There is no great benefit in suggesting that hard work itself is moral; people can and do work very hard for extremely selfish or malicious purposes.

Re:Spyware tips I've picked up

[FullCircle]

Since Captive NTFS was written to use the Windows DLL's to read and write NTFS partitions.

http://www.jankratochvil.net/project/captive/

Knoppix can find the needed DLL's and mount the drive as RW. It isn't 100% guaranteed safe, but when the system is already damaged it is definately worth a shot.

I've used it once to move data to a second drive for a customer and it worked flawlessly.

Out-of-control

[gone.fishing]

Slimeware er, spyware is the bane of my existance. I work for a large company and do not have final say about how the desktops are configured (I would do it differently), I support a special group and nearly all of my people have "admin rights" on their computers. I agree that these people need admin rights for some of the functions that they have to do but figure about 95% of the time they could run as a "super user" without any problems at all.

Very nearly 100% of the computers I touch are infested with slimeware. Running several commercial apps will clear most of the crap that is found but one or two apps seem to come back within a day or two (even if the user claims that they have not been on the internet). It has gotten to the point where I actually believe some of them!

I've found that what seems to be happening is that the slimeware distributors are playing a little versioning game. As soon as the major spyware removal tools are able to kill a specific version of slimeware, the slimeware authors make a new version that they then distribute.

It takes time between the release and the time that the spyware removers catch up and in the meantime, it is up to people like me to figure out how to clean up the mess. I am pretty hard-nosed and will spend a couple of hours searching the registry, booting from CD and deleting files and that kind of stuff to kill off the slimeware. Others who do similar jobs just re-image the machines. Soves the problem faster but I don't think the users are quite as happy. They have to reconfigure the machine to how they like it and there is always the risk of lost data.

I'd love to see these purveyors of filth in prison. Many of them serve up porn and put it on kids machines! They are guilty of a crime every time this happens. Why can't we do something?

Anyway, I don't blame the spyware removal people for these setbacks. They work hard to keep up but just can't.

Im my dreams, I dream of a single tool that sits on the desktop and checks for viruses, slimeware, spam, and other threats and inconveniences. I'd like the tool to be able to be programmed to block access to various applications and websites too. I'd like the same tool to have some sort of "safe recovery" feature that allows me to move back in time to a stable configuration that would not delete data.

These are just dreams but will someone somewhere please make my dream come true? Corporate IS departments everywhere would thank you with money from their budget!