Antispyware Shootout 343
An anonymous reader writes "ZDNet has published a review of 8 antispyware products from Computer Associates, Lavasoft, McAfee, Microsoft, PC Tools, Symantec, Trend Micro and Webroot. Check out the Editor's Choice. Interesting winner ...." I've used quite a number of these scanners on and on & off basis, and I think the reality is that you if you are truly to clean a machine out, you're going to need to use like three - five of these. Each of them captures a certain area, but none are the One Ring or anything.
Enough power (Score:5, Insightful)
Maybe some major fix in the operating system (as well as in the users' brain) could help a little bit.
Oh my god another LOTR joke (Score:1, Insightful)
Why is this necessary? (Score:3, Insightful)
It is NOT normal to have to do this.
How can you trust an infected machine? (Score:4, Insightful)
I would not trust any machine which is infected once, because there can be countless ways to hide an application once a hacker got in.
Re:Prevention or cure? (Score:4, Insightful)
Re:Free solutions (Score:5, Insightful)
Re:Why is this necessary? (Score:2, Insightful)
If you go to install some filesharing app, and you don't do some extremely thorough inspection of the installation procedure, you can get some spyware installed on your machine during the process no matter what the operating system is.
This isn't a Windows specific issue.
Re:How can you trust an infected machine? (Score:1, Insightful)
It's probably because people don't want to go through the whole "reinstall everything and then beg Micro$oft to reactivate them" crap. This whole spyware/virus debacle just shows how hostile M$ is toward its users. First, they refuse to fundamentally fix their OS to prevent the viruses and spyware in the first place. Then, after years of criticism, they finally hack together a bandaid in the form of the condescending MS Antivirus (TM) and MS Defender(TM). After the user has tried everything they can to fix their infected OS, they go to reinstall and what happens? They have to call Micro$oft to beg them to reactivate their piece-of-shit operating system. Goddamn I don't know why you Windows users continue to allow yourselves to get raped. Just use Linux already!
We've beaten viruses but not spyware? (Score:2, Insightful)
Re:Prevention or cure? (Score:3, Insightful)
First, installing and maintaining a Linux box is much easier than Windows. Try Ubuntu, for example, complete install with latest patches in less than an hour versus the 6+ hour install last time I had to reinstall Windows due to spyware corruption (Windows install, SP installs, patch updates, application installation - MS Office plus patches... don't forget to install and configure firewall and anti-virus).
Second, Linux was designed from the ground up as a multi-user system which means that the security to prevent viruses and spyware is built into the architecture, not patched on top of an insecure architecture like Windows. The fact that Linux users aren't plagued by viruses and spyware is because they are secure by default.
Immunity of Linux/Mac NOT due to low marketshare. (Score:5, Insightful)
Hogwash. In Linux or Mac, you can accomplish all daily tasks as a user with limited privileges. This is often impossible in Windows. In Linux, you can easily choose to install software only from trusted sources (e.g. your distro's package repositories.) It comes with all needed apps. This is not true in Windows.
Need more proof? See this [theregister.co.uk] from the Register.
It's completely ignorant to say that Linux and Mac would be just as bad if they had more marketshare.
Re:Oh my god another LOTR joke (Score:2, Insightful)
Tolkien's ghost has passed beyond the Circles of the World. All that's in his grave are some bones.
Such is the fate of Mortal Men; their fea are not naturally bound to the Earth like those of the Eldar. Exceptions have been observed only in strange and extreme cases usually involving corrupt magic, such as the Nazgul, the Barrow-wights and the Army of the Dead.
Let's Put the Blame Where it Belongs (Score:3, Insightful)
I see that in a lot of the responses the knee jerk "blame Microsoft" response has come into play. If you buy a house without a lock on the front door and a thief comes in and steals something, he gets arrested. There may be a lot of eye-rolling at your stupidity for not installing a lock after you bought the house, but the fact remains that you didn't break the law, the thief did. In the case of spyware, it is the company that planted the spyware that should get the blame.
Re:Enough power (Score:3, Insightful)
I post this comment because I've been finding that, more and more, people complain to me of slower and slower systems. Well, the biggest problem is that people I've helped out are subscribing to up to five anti-virus programs at a time. You get great tips when you can take a PC's boot time from over five minutes down below a minute thirty. People are so afraid of getting spyware and virusus that they don't mind running their computers as if they were 286 boxes.
I kid you not, some of these PCs have taken over eight minutes just from power on to system idle process. Opening MSConfig takes over two minutes in some cases. All those anti-virus programs and these guys' PCs are still so full of spy/malware and other crap that it takes twenty minutes just to boot, kill off some processes, edit the boot file, and turn it off.
My honest opinion? Install one anti-virus, a different firewall, and a spyware watcher like SpyBot (as long as they play nice). Next, if you really are that desperate for free programs, movies, porn, then get a seperate box for the P2P software and browsing free movie sites or whatever (unless that's the only reason you own one, you sorry soul, you). That's your firewall. Any internet stuff outside of casual browsing, or updates/patching is done on the POS PC and if you need something on your good computer (work or gaming PC), then burn it to disk for the transfer. Don't even share your files. It's a lot easier to catch malware that way.
Re:Why is this necessary? (Score:3, Insightful)
Can you please explain how this is so? Linux has been around much longer than XP / 2k / 98, all of which are extremely vulnerable to Spyware / Malware / Viruses. Why has Linux, which has been available since 1991, along with all of the source code that makes it work, not had one spyware program written for it? I'm not trying to claim there has never been a virus or worm written for Linux, or *nixes in general. The difference is that developers of any POSIX-compliant OS or distro will have things patched much quicker than MS, with updates going out to multiple software repositories across the internet, updating any compatible distro of Linux (whether by deb, RPM, or ports/portage) quickly. Linux users tend to keep their OS up to date with the latest packages and security fixes. Windows has "Windows Update" which is a lame attempt to replicate the success of OSS package management systems. Many MS users tend to turn this feature off, but the sad thing is even if they leave it on, MS is still typically much slower to release a fix for problems with their OS. Spyware has been around for how many years now? They still haven't fixed it? Funny, I've been running Linux since 2000, never had one peice of Spyware infect my computer. Or a virus for that matter. All this using software that has the source code available for public viewing. Shouldn't this make it more insecure? Hmm, guess not.
Re:Why is this necessary? (Score:4, Insightful)
Re:Immunity of Linux/Mac NOT due to low marketshar (Score:3, Insightful)
Re:Why is this necessary? (Score:2, Insightful)
If I were trying to write something insidious, I would target one of these platforms because no-one expects it, and the detection and removal tools are not as advanced because they are a lower-profile target.
Re:What is spyware ? (Score:5, Insightful)
It doesn't matter if you are running as admin or as the user, because for spyware the only thing that matters is your user behavior. Therefore if you install it as the user, it will still be able to show ads, replace your mozilla start page, do popups, etc. The only difference is that it will be per-user rather than machine-wide. For most people that wouldn't matter as they are a single user on that machine and the difference between having it be user-process or admin-process really isn't large. As it has been previously pointed out - the only thing that matters on a personal workstation is the user's data and you don't have to be an admin to have access to that. The only good thing could be the fact that removing it could be just a tad simpler, assuming that the software doesn't try to exploit some type of local-root exploits.
The only reason Linux does not have that problem at this time is that there isn't a market for the spyware industry in the Linux world. The current Linux users are less likely to download those type of programs and more likely to ensure that the programs only do what they are supposed to. As soon as there is a noticeble increase in the average usage of Linux, the spyware will start to develop their expertise in that area as well.
Re:Immunity of Linux/Mac NOT due to low marketshar (Score:4, Insightful)
Based off of how bad our clueless grad students get their Linux systems owned, I remain totally unconvinced alternate platforms offer any more inherant security. When it comes to protecting a user from themselves, there's not much you can do other than take away their administrative rights completely.
Comment removed (Score:3, Insightful)
Re:Prevention or cure? (Score:3, Insightful)
How about learning to operate a computer first? Most of these users with spyware problem stem from being computer illiterate.
I disagree for the most part. Users should not have to be computer experts to use them. There should be no link in an e-mail message or web site that will install spyware without any more user intervention. Software should be properly restricted by default, from access to your files, the internet, and the core OS. When I'm listening to the radio and I hear an ad for a new station on 143.6 AM, I don't have any fear of navigating the dial to that station, because just listening to a given station is unlikely to cause my radio to start reporting my listening habits and adding extra ads from that point on. Computers should be the same.
Take my brother for example he installs anything he wants on his computer and dosen't care because as soon as I come home to visit my mother guess who is going to format and reinstall the OS again and make everything beter again and this cycle goes on and on.
While what he is doing is ill informed (or he is just uncaring) he should be able to install anything he wants without worrying about it doing malicious things, unless he specifically allows it. Other OS's have sandboxes and good application level ACLs, although none are really up to snuff. Of course other OS's don't have a malware problem, so there is little need as yet. Your blithe acceptance of the problem, is part of the problem. If there were two major OS's competing in the space, based upon the quality of the solutions, the malware problem would 99% mitigated in a matter of months. The problem is not solved because MS does not care to solve it.
Re:Were they reviewing Spybot or not? (Score:3, Insightful)
Why does it have to be magical? (Score:3, Insightful)
There is a certain myopia among technically-minded individuals that makes it seem that only a technical solution can solve a technical problem. This is not necessarily the case. Moving to a Unix-type system is the electronic equivalent of moving from a blighted inner-city ghetto to an upperclass suburban neighborhood. There's no technical reason why it should be any safer or cleaner--but it is. You might think that this is a "head in the sand" approach. But as far as I'm concerned, it's taking advantage of reality.
Re:Why is this necessary? (Score:3, Insightful)
There's no magic - just good defaults.
Windows: most users run as administrator. Lots of software breaks if you don't.
OSX: root is disabled by default. Apps may request sudo rights of a user, to which a user has to enter his password and may review the (somewhat archanly named) right being asked for.
Linux: root is enabled by defauly. Installers insist you create a non-root user during installation and warn you to use it. All sofware expects to be built/run/compiled as non-root and root only used for installation. Gnome and KDE provide secure password GUI's.
Windows: Several 'net ports open by default
OSX: none
Linux: varies
Windows: Software does not need to be marked executable to run.
OSX: Software must be marked executable to run.
Linux: Software must be marked executable to run.
Windows: software updates can be turned on to be checked automatically. SP2 defaults this.
OSX: automatic updates are the default (forever)
Linux: user needs to turn on yum (et.al)
Windows: Poor GUI design teaches users to keep clicking OK when confused.
OSX: GUI design guidelines teach users how to use security consistently, if followed.
Linux: Commands provide no feedback on success.
Windows will eventually get these right.
Re:Most telling part of the article... (Score:2, Insightful)
Check for yourself... and it is impossible to get rid of, IE recreates it everytime it is started...br...and I've checked this on a fresh installed W2K, before connecting to the Internet and with Ad-Aware installed from CD (and nothing else installed).