Spybot seems to be stuck in progress.
Note: Very long text. Try to carefully read everything if possible.
Spybot 2.x doesn't seem to be so successful like 1.x was. The main problems are actual detection and performance. Not every malware is detected and application itself feels quite slow for me.
Comparing Spybot with MalwareBytes Anti-Malware, the difference is pretty much obvious as MBAM seems to be more successful at detection and it's pretty much optimized and yet they offer in addition Anti-Exploit protection.
However, Spybot seems to be stuck in progress. Even its community is no longer so social like it was back in 2005-2007.
Let me explain as far as I can:
Detection.
As far I've understood the OpenSBI mechanism, Spybot detects stuff through specific paths. If I define rule to detect file in %SYSDIR% for example, it will be detected only if it's in that folder. However, if I move exactly the same file in any other folder, it will remain undetected even with defined file properties in rule (I mean the additional checks like filesize and md5 hash). The same thing would happen if I use file scan. It will scan file, but it will be detected only if it's in %SYSDIR% for example. File scanner should detect malware no matter in which folder it's located.
This might be seriously outdated as malware these days uses various names and various paths to become stealth.
System scanner should start scanning each file instead. However, registry scan should stay as it is for now as it's pretty much just data over there, nothing else.
Another problem with detections are outdated ones. As far I've checked the database through Ignore list, "Zango" is still there. That thing is way too old. Instead of putting over 80 detection databases, you could at least move all outdated detections up to year 2006 as outdated detection database as Spybot cannot be used on Windows XP SP2 or older if I'm not wrong (according to compatibility page, XP SP0 is supported, but insanely insecure and outdated). I'm considering year 2006 as dead-end because there's barely anyone who still has malware from that year. Eitherway, it shouldn't scan for anything made before 2006 as XP SP3 is not even supported by Microsoft itself.
(Note: Noticed KnightHop. Still can't beat it.)
Cookies.
Too much of paranoia for no use. They are not such a threat, though they might be compromising privacy, but malware is doing worse stuff than cookies itself. For disabling Third-party cookies notification, just to note: Google seems to require third-party cookies for YouTube / Google+ account as I can't see any notifications unless I enable third party cookies. Separate cookie detections from system scan and put it to Cookie management module. If possible, implement it as browser extension for cookie management.
Usage tracks.
Separate it from system scan and put it as usage track cleaning module. People might treat it as a threat if it's in system scan and it's pretty much easier to clean it up individually.
Cleaning.
I'm not quite sure why is there individual cleaner module as there is no need for it when everything should be done through scanner module in foreground. Cleaning module should be preformed in background without any GUI, any response should be replied back to scanner module instead.
Immunization.
For sure thing, there are still many dead websites listed in that database, and there should be a better way for immunization. Adding over 200k entries might slow down browser for no good use these days. Well, passive immunization should be gone and it should be replaced with something else, like with extension or add-on (you were planning to do something about it on Chrome as far as I remember) and use online check is website legit or not or try to dynamically immunize entries by keeping at least 1000 recent malicious websites blocked. When they get offline, remove them from list and refresh immunization by removing old and adding new entries.
Statistics.
It's fine in general, but you should add and option to send scan statistics of detection products to see which product is being detected most of the time and with that you should be able to define which product is outdated and it should be moved to old detection database.
Updates.
They should be real-time updates which append on existing detection database without depending on license.
Donations.
Not sure if this is needed as you're selling licenses.
Download Directories.
I'm not quite sure is this even working, should be deprecated as I haven't managed to find a way to detect something from Download folders.
StartUp Tools.
Still running slow, took about 2-3 min to open main window. Selecting process takes some time to load due to loading details. Maybe it should be easier to put details on new window and wait until it loads or do some threading and load details in background while showing progress bar when it all loads, with addition to choose to cancel it. Some paths in Advanced Startup don't give any details as "file not found". Some files with no specified folder path are found, some are not and some don't give any details even if there's defined file path. Editing in Scheduled Tasks doesn't do anything.
System Repair.
Definitely not worth for Home or Professional license because it only tries to remove paths that don't exist. This scanner is very outdated and it should be replaced with broken path / temp files cleaner module to get rid of temporary files and broken paths in shortcuts and registry startup entries.
Secure Shredder.
You've said that Spybot shreds detected files if I'm not wrong. With OpenSBI, it's pretty much just adding wanted files to OpenSBI rule, detect and destroy them (including purging from quarantine). Should be offered for free, like in 1.x.
Phone scanner.
I guess you should develop Android/iOS app that checks for all privacy issues or A.K.A. yet another privacy checker tool like there's millions of them on Play Store. Maybe app scanner would work, but there are many of those still and you would have to re-analyze every single APK on store which would take forever to check. No idea how to improve this part yet.
Boot CD Creator.
I guess it should be used to create a Bootable USB, too. It's more popular these days. This module should be in professional license eitherway.
Scripting.
No idea, never tried it. Keep it in paid.
Repair Enviroment.
This should be available for free IMO because it's Emergency enviroment where you should be safe from any malware activity. Not sure if possible, but you could put in professional license a remote-control malware removal if needed, but I'm not sure how effective it could be.
Live Protection.
Quite different than TeaTimer for sure. Free version should offer startup entry and homepage/search engine monitoring.
(Simplified: Free HIPS protection, Paid Malware protection)
Resources.
My Spybot folder size is near 290 MB, without update folder it's 240 MB. MBAM folder is at 40 MB. Spybot seems to have many duplicate resources and probably some obsolete stuff, too.
Instead of putting same resource images in every excutable and library, just make resource image library where you should get all images and probably some other stuff that don't need to be duplicated all time to save some space. If file is missing, simply put blank as it's not essential.
Services.
Scanner service is running and taking resources for no reason even in free version while Spybot is not running. There should be some memory management for that service if Spybot is not running.
OpenSBI.
Still good idea, but still not well known. (I can't even pick "Save" option in menu for some reason). Scripting is fine, but detection rules might not be reliable for malware detection. They are fine for detecting other software, though (as long as that software is installed in default path...).
GUI.
Interface needs a complete clean up.
I guess that scrolling animation was a bad suggestion from me after all. Damnit. GUI needs to be more simplified and lightweight without all those noticable refreshes and flashing while scrolling or browsing. Every module should have identical design, but StartUp tools, Statistics, Settings and OpenSBI Editor don't match default design.
Anti-Virus.
One-day updates are coming from anti-virus protection. It should be in paid version, but real-time updates should apply for any version, even free one.
Awards on your website.
Put actual link on awards to award pages, as otherwise these awards don't seem legit.
Paid vs Free.
Paid license should have things that shouldn't be essential for malware removal, like temporary file cleaning, boot CD creator, scripting, notifications and scheduling, but it should have things useful for business purposes (though, I don't know which).
Last words.
I know that you can't do most of these stuff as it would require complete re-writing of software (in Delphi if I'm not wrong) and some of these things are probably impossible at the moment, but if possible, make malware detection, removal and performance as priority. It needs to be cleaned up so that Spybot itself doesn't become bloatware.
In addition, yet another complete re-design should happen, but that shouldn't be a priority yet as Spybot isn't optimized yet.
I've probably forgot to add few more notes. I'll bump if I need to add some serious notes.
I can't say that I hate Spybot, it's just that I don't know where to begin and I might not be able to give well explained solutions. It's a nice tool, but I kinda want it to return its own old glory. I've tried to translate it to Croatian for long time with long delays due to college stuff (and not having/getting any job/work experience).
I'm doing some programming in Java (aiming at Android development) at the moment and I wish I could try to improve Spybot at some point, but that would be too big step for me as I probably don't have complete experience for security software development (and it's Delphi).
Thanks for reading if you managed to read all of this. Reply would be nice to see is there anything that could happen.
