New Anti-Spyware Tests[Eric L. Howes]

New Anti-Spyware Tests
Hi All:

Over the past 2 days I've performed yet another round of tests with 20 anti-spyware scanners, this time using a new collection of spyware and adware picked up from my favorite "test" site, "Innovators of Wrestling" (iowrestling.com). As before, I identified a core set of "critical" detections and monitored how throughly each anti-spyware scanner removed the "critical" detections. You can find a list of those detections on the Guide page here:

spywarewarrior.com/asw-test-guide.htm#..

The results of this new round of tests can be found on these two pages:

spywarewarrior.com/asw-test-results-3...
spywarewarrior.com/asw-test-results-4...

As I requested before, please have a look at the Guide page before proceeding to the results pages. The Guide page has been revised to account for these new tests. As always, the "Disclaimers" section on the Guide page is "must read":

spywarewarrior.com/asw-test-guide.htm#..

One aspect of these latest tests worth noting: the collection of spyware and adware used for this round of tests included some especially nasty software that proved difficult, if not next to impossible to remove for the anti-spyware scanners. In particular, the key processes for the following adware/spyware was not killable at all:

IBIS Toolbar/Websearch
IBIS Toolbar/WinTools

The executables were simply too well protected in memory. Even the DiamondCS process tools APM and APT could not remove those processes and modules from memory.

The standard procedure that anti-spyware scanners use in this situation is to remove the files on reboot by configuring the scanners to run through the HKLM\...\RunOnce key. Not a single anti-spyware scanner succeeded in doing that, however, because one of the above processes -- or perhaps it was the VX2 3dsdpi.dll module that was attached to the Winlogon process, a core Windows system process -- blocked changes to the RunOnce key. Still worse, the files mentioned above could not even be removed in Safe Mode.

This all is a potentially huge problem. The only way I succeeded in removing those files was to boot to a command line using SysInternals' ERD Commander 2000. A bootable CD could be used to achieve the same result.

Finally, before anyone asks, let me indicate right now that I am not going to put together a table summarizing the combined results of both rounds of tests. Were I to do so, that table would immediately be taken as a definitive ranking of the products tested, and that kind of ranking is simply not warranted solely on the basis of these two rounds of tests. Moreover, I know that once that table appeared, people would link only to the table, and the rest of the critical information and context regarding these tests would get lost in the rush to judgment.

In any case, questions, comments, and suggestions are always welcome.

Best,

Eric L. Howes

 

Cheers to you Eric !!!

 

There is a new Freeware AnitSpyware program in BETA

Was wondering how it compares and if any have tried it out.

http://mt.smolyan.info/sw.php

Bruce

 

Those Eric Howes tests have been doing the rounds of the various Forums for a few weeks now - they have done wonders for the sale of Giant AS, but really they make for very depressing reading. Even if you have a combination of several of the leading scanners, you are still unable to fix a fairly substantial proportion of ITW spyware. And if you just rely on Spybot S&D - Ugh!!!

 

That is sobering. I'm glad to know that I'm not the only one who can't get rid of IBIS Toolbar. I tried everything with a client's computer and had been researching this. I've never seen anything like it. Thanks Eric for another round of tests.
Gerard

 

Hi everyone,

I'm searching for some enlightenment on the issue of IBIS Toolbar:

1) Does KAV 4.5. or PG 3.0 block its installation?
2) Is it possible to block it in Firefox, without turning off javascript completely?
3) Are their any other prevention measures available/necessary when using Firefox?

As always, thanks much for your help in answering these questions for me.

Rich