Spyware Stoppers Still Improving

We tested new versions of three anti-spyware apps and like them, but an old favorite stands out.

Mary Landesman
From the August 2005 issue of PC World magazine
Posted Wednesday, June 22, 2005
Spyware and adware continue to evolve--as does the software expressly designed to thwart these pests. I looked at new installments of three anti-spyware applications: a prerelease version of Sunbelt Software's CounterSpy 1.5, plus shipping versions of Webroot's Spy Sweeper 4 and FBM Software's ZeroSpyware 2005.

Previous versions of both CounterSpy and Spy Sweeper performed well in our April "Spyware Stoppers" roundup, giving me reason to believe that their latest iterations would do equally well in this round of tests. Both apps contain new capabilities, and of these, CounterSpy's DNR (Do Not Resuscitate) technology sounded particularly interesting. According to Sunbelt, DNR improves the chances of killing off resuscitators--parts of spyware applications that prevent their deletion.



My expectations were ably met. Spy Sweeper 4 demonstrated significant improvements, removing 88 percent of our target components (up from 81 percent in April). And the CounterSpy 1.5 beta removed even more of the adware and spyware in our tests than the program had in the April review, raising its overall effectiveness to 95 percent, improving by a whopping 10 percentage points from before.



CounterSpy's 1.5 update reflects changes Sunbelt has made under the hood, and the tool no longer uses the same engine as Microsoft's AntiSpyware product. Later on, the company plans to launch version 2, which will include a revamped interface.

ZeroSpyware 2005 performed impressively, too: It removed 86 percent of the target components and distinguished itself further by removing 96 percent of all nasty in-memory processes in our tests. By comparison, Spy Sweeper removed 85 percent of the target in-memory processes, and CounterSpy also removed 96 percent.



In addition to scanning for spyware that's already on a computer, each of the three products I tested provides real-time monitors designed to prevent spyware and adware from gaining a foothold in the first place. ZeroSpyware set itself apart here, successfully blocking all but one attempt to penetrate my system. Unfortunately, ZeroSpyware and the other two programs all permitted Web sites to be automatically added to my Trusted Sites zone.

 
  Advertisement 
 
 

 
CounterSpy and Spy Sweeper also allowed other potentially harmful behavior. CounterSpy let the ISTbar toolbar slip past its defenses; ISTbar then added itself to the Windows Registry and ran as an active process. Spy Sweeper allowed ISTbar as well, and also permitted the SideFind BHO--which can retrieve and install additional files--to integrate into my browser. In both instances CounterSpy and Spy Sweeper later detected and removed the apps during their next scheduled scan.

Though ZeroSpyware performed the best at preventing infections with its real-time monitor, I found that the positioning of the alerts within the application's interface actually thwarted my efforts to update and run a scan.

In contrast, CounterSpy launches alerts in the bottom-right corner of the screen, so they don't compete with the program interface and other open windows. Spy Sweeper blends both approaches. For known spyware threatening to infect, Spy Sweeper launches its main program window and overlaps it with an alert. Otherwise, it launches the alert in the bottom-right of the screen.


Usability Headaches
ZeroSpyware impressed me with its performance, but I was less taken with the utility's usability. For example, the update menu was difficult to find (it's hidden within the 'General Settings' menu), and some of ZeroSpyware's program options launched in a separate window that was often inaccessible, since a portion of the window remained outside of my viewing area.

One trick for disabling processes that resuscitate adware and spyware is to boot the PC into Safe Mode. Unfortunately CounterSpy's interface was too large at the lower screen resolution of Safe Mode, which made reaching the scan button nearly impossible. Both Spy Sweeper and ZeroSpyware performed well in Safe Mode, and Spy Sweeper has a special diagnostic version just for this purpose.

Any of the three programs I tested is very capable of protecting your system. Though ZeroSpyware excelled at preventing infection, its intrusive alerts might make it less than ideal for a heavily infected PC. Spy Sweeper, with its more integrated alerts, could be a better choice. Both ZeroSpyware and Spy Sweeper are priced at $30, which includes one year of free updates and free online support.

While both Spy Sweeper and ZeroSpyware put in a good showing, CounterSpy continues to impress me the most. Its new engine and improved technology offered up the best removal rates in my tests. Add to that its unobtrusive alerts and its $20 price (including one year of updates and online tech support), and CounterSpy is a clear winner.


CounterSpy 1.5

Sunbelt Software
Beta software, not rated
Robust detection and easy-to-use protection at an affordable price make it stand out from the crowd.
Price when reviewed: $20
Current prices (if available) 




Spy Sweeper 4

Webroot Software

With integrated alerting, Spy Sweeper is a solid choice; but it still can't best CounterSpy.
Price when reviewed: $30
Current prices (if available) 




ZeroSpyware 2005

FBM Software

Intrusive alerts and a less-than-friendly interface offset this app's excellent protection.
Price when reviewed: $30
Current prices (if available) 

if you want to acquire a software antispyware or you already possess one and you want to know if it is safe you can read the following information that pcworld recave in which there is comparative of the best antispyware. there are some that some that are not so good in my opinion but they turned out to be the best and others that I thought were the best and they turned out to.
info:
sorry for my bad english 

It’s true. Microsoft Antispyware detects Claria’s adware still but the recommended action is set to Ignore. I first learned of this at Calendar of Updates in a post by Donna Buenaventura, another Microsoft Security MVP. I downloaded some Claria software and ran Microsoft Antispyware myself with the same results.



This news is making the rounds of anti-spyware sites and forums already and people are NOT happy.

http://www.dslreports.com/forum/remark,13793423

Some of the remarks include:


1. This is sad news. I don’t think MS will back off. I suggest everyone using MSAS strongly consider getting rid of it and using CounterSpy instead. It is very reasonably priced and PCWorld August 2005 edition says the new beta engine is their product of choice for antispyware applications.


2. But you have Microsoft, a trusted entity, telling it’s users that Claria/Gator is not a threat. Most of those users are uninformed and will allow it to stay on their machines because MS says it’s ok. All because MS is in a potential business deal with a known malware company.


3. Microsoft, this is just bad!

Another disappointed MVP. We’re into fighting spyware, not joining it

Bad move :thumbsdown:



4. I bet the public will lose their trust in Microsoft Antispyware before it even comes out of beta


5. I agree, and I am also very disappointed with Microsoft for doing such a thing. The whole situation is just another Hotbar as far as I’m concerned.

The purpose of an antispyware application is to root out deceptive software, but when it the program itself starts to behave in a deceptive manner it becomes a part of the problem.

This whole business of antispyware software giving free passes to “favored/feared” spyware is getting ridiculous. Microsoft, snap out of it!


Sunbeltblog reports:


A brief check of our database updates from Microsoft shows that Claria adware has been set to a default action of “Ignore” since at least early June (Claria continues to be listed in our database with a default action of “Quarantine”).

You might recall that Microsoft acquired its antispyware application from GIANT, who had a close business relationship with Sunbelt Software. As part of the deal, Sunbelt continues to receive definitions from Microsoft until June 2007. Sunbelt, however, has its own research team and adds its own definitions to the database in addition to what they get from Microsoft.

In the current Spyware Weekly newsletter, Mike Healan of SpywareInfo.com comments:


I can’t imagine what they are thinking at Microsoft. I would be hard pressed to think of a better way for Microsoft to alienate their users. I certainly hope that the opposition from within Microsoft prevails and that this deal dies on the negotiating table.

Ben Edelman has updated his write up to include the news of the changed detections.


This is exactly the kind of conflict of interest I worried about three paragraphs above—but I didn’t anticipate how quickly this problem would come into effect!

Wayne Porter, blogging at ReveNews calls it Conflict of Interest 102 His site at SpywareGuide.com reports, interestingly enough, that Gator (Claria) is currently the top detection. See the site for full the top 10 list.


1 Gator 6.55%
2 MySearch 5.53%
3 CoolWebSearch 4.38%
4 180 Search Assistant 4.02%

Ed Bott wrote yesterday:


What is Microsoft thinking? This deal would be a P.R. disaster. The only way it makes sense is if Microsoft buys the company, fires everyone involved with it, has their buildings exorcised, and rewrites every line of code in their product.

He wrote about it again, describing the Claria product lines, and hopes the deal will “fall apart”.

Hellooooo Microsoft! Are you listening???? Your public has spoken.

Full disclosure: I received the Microsoft MVP security award in April of this year and have also been performing part time consulting for Sunbelt Software, makers of CounterSpy, since April 2005.