|
Surf in peace
Hidden disasters lurk on the Web in the form of malicious downloads that can be adware, spyware or both. We have tested 7 tools that have a free download to help keep this under control
Wednesday, February 22, 2006
Every user who spends a considerable amount of time online,
surfing and downloading is susceptible to receive malware on their computers.
This is aside from regular viruses and worms. One big menace is what is called
'adware'. Adware can be in many forms on your computer. They can be
essential parts of otherwise perfectly useful software (like with Real Player)
or they can form piggy-backed add-ons to software you don't really need, like
screensavers. We have not declared a winner in this shootout.
Adware or Spyware?
Actually at the moment, there's a blur in the line between what can be
classified as 'adware' and what as 'spyware', since adware essentially
spyware too, since it needs to log and track personal information like what you
do and where you go on the Internet in order to be able to serve appropriate
advertisements. Purely spyware components however may have absolutely no
visibility aside from the fact that your computer causes a lot more network
traffic than needed or becomes so very slow nothing is usable anymore. In this
shootout, we decided to walk on the fence and evaluate products that helped you
control both adware and spyware on your PC.
 A number of commonly available antivirus software has the
capability to detect and remove spyware/adware. There are also software that are
specifically made (even by antivirus vendors) for this purpose. In this
shootout, we are comparing such dedicated anti-adware products against one
another. Before we go on to the actual product reviews and see how they fared,
let us explain how we did this comparative.
Test bed
To refrain from using time consuming procedures that involved installing
fresh copies of the OS and reloading it with spyware, we decided to take an
easier route (with one disadvantage explained later) using virtualization.
First, we installed a copy of Win XP SP2 in a Virtual PC instance and updated it
with the latest patches and disabled automatic updates. Then, we loaded it with
the spyware from our secret test collection. Then we shutdown this virtual
machine and made a replica of its hard disk (VHD) file. Each anti-adware product
was installed on a separate copy of the VHD file and put through its paces. This
way, we also got to go back and recheck something when needed without having to
keep a large number of hard disks or systems frozen. In the interest of
fairness, these systems had no antivirus or firewall (except the default Windows
Firewall) installed.
Deciding factors
One thing we couldn't really measure was the anti-adware product's raw
performance requirements since this is not very easy to do in a virtual
environment. However, we did tabulate the figures and compared them against one
another. This included factors like memory consumption, CPU cycles during a scan
with our test collection of spyware agents.
We also looked at the UI of the product and checked its
usability. We rated this on intuitiveness and the amount of help the product
provided. Most spyware will impair your ability to properly use the Net.
Therefore, we gave a lower score to products that had online help instead of
on-disk. We also looked for ability to schedule a scan, customize scans to
certain areas, how the interface proceeded after it found malware, ability to
rollback changes and finally if it allowed you to pick what agents to remove.
Types of spyware
Although most of us don't realize it, quite a lot of stuff we end up
installing on our PCs today has the potential to be or are actually spyware.
Some examples are:
Unlike what quite a lot of users believe, Flash movies
although in binary form and cookies cannot be 'spyware'. This is because a
Flash movie (on an Internet Webpage) can only operate on files on the Website
from which it is being served and not on your hard disk-it can operate on
local files only when you're running it off your hard disk or a CDROM.
Cookies are not spyware
Cookies are plain text files. You can drag-drop this into a Notepad window
and view its content. Some cookies may appear to contain binary-like strings but
this is just encrypted text.
Cookies cannot do anything by themselves-they are simply
sent back and forth between your browser and the particular Web site when and if
you visit that website.
So, if you have a cookie from pcquest.com
but never
actually go there, that cookie can do you no harm. The only reason why cookies
figure in spyware discussions is because it forms the store for the personal
information spyware transmits. So, when you delete a cookie, you erase that
information and protect yourself.
Lavasoft Ad Aware SE Personal Edition
 We reviewed version 1.06r1, with def update SE1R87. Ad Aware has a nice and
clean interface that is intuitive to use. Built-in help is provided for all its
features. A small minus is that it does not have scheduled scans. It can scan
the NTFS alternate data streams for malware that hijack that space. The program
loads the computer averagely during a scan, utilizing 35% CPU resources and
roughly 22 MB RAM.
It detected 195 objects in a smart scan and 208 of them in
full scan. These figures are combined totals of registry, file and other entries
of objects found. After a scan, Ad Aware will display a list of detected malware
agents. These can be cookies, executables or attempts to hijack the Web browser.
Before it will delete selected spyware, Ad Aware
automatically backs the relevant files and settings into quarantine. There is a
Quarantine Manager to manage such items.
Ewido Anti-Malware 3.5
 This was a 14-day trial copy of the tool, updated with def package 1668. The
interface is clean and clutter-free, offering lots of options. Scan options
include checking just the RAM and registry besides the usual full, fast and
custom options. What is missing were built-in help and the absence of scheduled
scannig.
There is a very useful 'Analysis' screen in the
interface where it shows you the different startup and active processes as well
as network connections that have been opened, along with what's using them.
Network analysis is similar to NETSTAT command
plus you can terminate connections. The process analysis screens go deeper,
letting see how it started (particular registry key or folder it auto-launched
from).
CPU load is 86% and RAM 19 MB while scanning. Like Ad
Aware, we got only consolidated figures-170 for fast scan and 326 for a full
scan. Both scans are equally fast.
Microsoft AntiSpyware Beta 1
 MS AntiSpyware gives you only two options to scan-intelligent (quick mode)
and full. It has good integrated help and scheduled scanning. The UI is simple
and straight-forward and quite intuitive to even people used to other tools.
What we did not like was its insistence to abort a scan when you clicked on some
option. We used build 9.0.333.0 with def update 5797.
Performance was not all that impressive: it loaded the CPU by 60% and
used 28 MB of memory. It also took the maximum time to scan, even in quick mode
(10 mins 27 secs) and even more (17 mins) in full scan mode. In all, it detected
13 bad products (both full and quick), the figures did change for the memory and
registry counts in both scans. The number went up from 1,050 registry
corruptions detected in intelligent scan to 1,123 in full mode.
MS AntiSpyware can create restore points and has agents for
guarding IE, system settings and blocks application.
PC Tools Spyware Doctor
This product is looks impressive with its neat screen which still manages to
offer so many options. Some options are hidden away and you might want to go
feature-exploring a bit. There is no scheduler and help is limited to a quick
start guide. Scan options include quick, full and custom scan. But, the scan
operation starts as soon as you select the scan link on the navigation pane,
without first letting you choose the scan type. So, you need to stop that scan,
click a button and then select the scan type. This is very irritating. Our copy
was version 3.5 of the product, which was a trial version needing you to
register the copy before it will clean. We updated the definitions to 3.03910.
It takes a lot longer than Ad Aware to scan at around 5 mins in both quick and
full scan modes, it does show up a lot of detected malware. Its totals were at
1,396 in quick and 1,478 in full scan.
Spybot Search & Destroy
Version 1.4 of the product has so many options and features. Each screen
features descriptions right there, as well as a built-in help file to guide you
around. This is an ambitious program aiming to give you everything under one
roof and ends up stuffing it to capacity. No wonder then that it needs 85% of
your processor and nearly 28 MB of memory to run.
Spybot has two scan methods: 'Check for problems' and
'Immunize'. The first one has just a progress bar that runs from end to end
and a button lets you fix what it found wrong.
The 'problems' are the spyware on your system. The Immunize option
lets you scan the system for 'possible things' it can protect you against
(8556 for us). 'Secure Shredder' files, tweaker for IE, registry
checker, system startup manager, uninstaller are some features it has. You need
to 'update' as well as restart the program before you start scanning.
Spyware Blaster
 This is an anti-spyware tool that has no visible options for scanning. This
is a little confusing. There are also no buttons to start a scan! It
automatically protects your browser and system against spyware, functioning much
like one of those Internet firewall products. There are no features for
scheduling either. Help is built-in. We have used version 3.5.1 of the product,
updated with the Jan 10th definition file.
You can create snapshots of important browser settings. It
lets you manage IE settings such as homepage, various IE specific pages (like
about:blank, search URL), the hosts file, the title bar of the browser, ActiveX
and Flash content. This is one of the few tools around that considers Flash
content as spyware capable and lets the user block it. You can also add ActiveX
objects to its ban list using their “CLSID” if you know what these values
are.
There were options on various screens to enable features in
Firefox, which was not part of our test.
Webroot Spysweeper
This anti-spyware tool from Webroot is an interesting tool. We have tested
its 4.5.7 (build 642) def updated to v604. Spysweeper detected 22 items in all,
with a total item score of 1,826. This makes it the tool with the maximum number
of detections in this shootout. It is very light weight at run time, using a
mere 8% processor and 14 MB memory resources. There is a scheduled scan feature,
but this is cleverly offloaded onto Windows Scheduled Tasks. This version
requires an active subscription for removal of detected items.
It disables the Windows Messenger service (not the IM). It
can protect IE, startup objects, hosts file, add-ons, ActiveX and NTFS alternate
data streams. Scans can be paused and resumed at will, but options get disabled
during a scan or update. A context-menu can be added to Explorer to launch scans
of specific folders or drives (option disabled until you subscribe).
Trend Micro AntiSpyware
We are not really considering this product in this shootout for one
reason-the product is not available in India. We have tested the US version of
the product in this review. Using around 77% CPU and 17 MB memory, it scans
cookies, memory, registry, URL and file areas for spyware. The tool has a
specific disliking to CoolWebSearch for which there are special options to scan.
It further has a 'CWShredder' component that removes the CWS elements if
found. You'll need to go around searching for the update button, which is well
hidden inside the 'About' tab! This anti-spyware has black and white list
feature for applications. It features built-in documentation and options to scan
in quick, full or custom modes. We updated the version 3.11 build 30123 of the
product with the version 2.78 definition file. In quick scan, it detected 350
total elements and 966 elements in full scan.
Page(s) 1
|
Print
Comment
Email
Digg
Del.icio.us
Reddit
Twitter
