Study: Anti-adware misses most malware

[Rodrigo Istalindir]

In theory, it shouldn't matter. In practice, you may end up with two programs fighting each other if they are both configured to do real-time scans.

Generally considered good practice, though, to run multiple products for hard drive scans, as some things slip through the cracks.

Better yet, don't run Internet Explorer, and 99% of these worries go away. A good quintuple defense of hardware firewall, software fireall/cookie blocker/etc, anti-spyware, anti-virus, and browser other than IE should keep you happy.

Kinda sad that we have to go to those lengths, though.

Even more sad is the MS has already bowed to pressure and removed one vendor from their spyware list when they complained.

 

[Andre]

Anyone know if it's bad practice to run two anti-spyware programs simlutaneously? For example, I run SpySubtract (in theory it is stopping spyware before it gets installed). Could I (and should I) also run the Microsoft one with "real-time protection"?

All I can say is I was doing that immediately after installing the programs I listed above, and I had to turn them off. Within 12 hours of installing, I had the following problems:

1. One fatal error that forced my system to shut down.
2. Three lockups when opening files in MS Word. Had to use Task Manager to shut down Word and try again.
3. Significant slow-downs in opening any application, including MS Word, MS Excel, and IE.

Once I shut down the real-time antispyware (about 4 hours ago), I haven't had repeats of these problems.

Given how valuable the real-time option is, I'll probably experiment with running just one by itself for a day or two, then the next one, and so on. I'll keep the one that causes the least disruption to my system. Right now, I'm kind of tired of the whole thing, so I'm not going to worry about it for a few days.

BTW - Running all these scans found over 40 files that Ad-Aware/Spybot didn't. After removing those files, I noticed that webpages are loading noticeably faster. Since I'm on dial-up, that's a pleasant surprise.

 

[EricNoah]

ok, good to know. I'll download the Microsoft one and just use it for cleanup and keep spysubtract running for preventative measure, plus do Ad-aware now and then.

Sadly, I can't get firefox to work on my computer. It might have something to do with my ad blocker, or my firewall, or some other setting, but haven't been able to figure it out.

Edit: just ran the Microsoft one, then my trusty Spysubtract, and then Ad-aware and came up with a total of one "bad" item, so overall I think my Spysubtract is probably doing a half-way decent job at screening incoming stuff.

 

[XCorvis]

Hot tip: The Microsoft anti-spyware running real-time protection is a bit of a memory/processor hog. You will probably see a performance hit if you run it. But it might be worth the trade off.

I deal with spyware for my job and I just came from a conference today. Here's what I do:
1. Spybot with Immunizations turned on. Run the updater about once a week and re-immunize.
2. Run Ad-aware SE occasionally. Always make sure you update it before you run it. Ad-aware and Spybot know about each other and play nice together.
3. If you're running XP, apply service pack 2.
4. In your web browser, use the advanced settings for cookies and disable 3rd party cookies completely. (You should NEVER need them enabled.) You can also crank up some of the security settings if you use IE.
5. Don't use IE. Use Firefox as your primary browser. Open IE only if firefox doesn't work on the page. Optionally, use Mozilla or Opera as your primary browser. It's about the same from a spyware perspective.

This should prevent you from getting the vast majority of adware, and if you don't have it you don't need to worry about getting rid of it...

 

[Wonko the Sane]

Ever since installing ProtoWall and the accompanying Blocklist Manager, Ad-aware and Spybot have been like the Maytag repairman: there's nothing for them to do.

It's a genuine pain to install, but well worth it.

Occasionally, a page won't load because all the crap is getting blocked, but I find that a small trade-off.

 

[Nifft]

Linux Rules!

"Use the Source, Luke!"

-- N

 

[Krieg]

"Use the Source, Luke!"

-- N

Yep so that once Linux gets up to 40% or so of market share all the script kiddies will start focusing on it too.

 

[LeifVignirsson]

Ever since installing ProtoWall and the accompanying Blocklist Manager, Ad-aware and Spybot have been like the Maytag repairman: there's nothing for them to do.

You almost made me spill my soda on that, Wonko. As an appliance parts manager, I can tell you that Maytag is the WORST appliance on the market and those repair guys are working on their appliances all the time to the tune of $500 to $1,000 for each repair (hence the reason why they have a class action lawsuit against them). Don't believe the hype

I will have to check out the other bot killers out there, though I don't think I want to do the real-time deal. Even though it might catch the things right then and there, I think I will be ok without it.

 

[Elephant]

Yep so that once Linux gets up to 40% or so of market share all the script kiddies will start focusing on it too.

Quite true. However, the list of all possible script exploits for Windows-based machines is longer by at least an order of magnitude than the list for Linux-based machines.

 

[Andre]

Looking for help identifying what is wrong and what I can do to fix it.

As I posted above, I had problems after installing some new anti-spyware programs. I’ve since uninstalled all three, leaving me with only Ad-Aware and Spybot. The problem that has developed in the last two days is this:

I log onto the internet. After anywhere from 2 minutes to 30+ minutes, I receive a warning that “Generic Host Process for Win32 Services has encountered a problem and needs to close.” Then I get a dialog box that warns “This system is shutting down…This shutdown was initiated by NT AUTHORITY/SYSTEM…Windows must now restart because the Remote Procedure Call (RPTC) service terminated unexpectedly.”

My system did not come with a Windows CD, so I can’t just reinstall the operating system (at least not without buying it at the store). I can still use system restore to go back to before I installed the anti-spyware, but my understanding is that all the spyware would also be restored. Any other ideas what I can do?