Spybot's Poor Reputation

[PepiMK]

@Tattenbach: actually, open source is a wide field. When I started this, license part II.a. fullfilled my universities wants of OS. It's not open to anyone though, simply because then the bad guys would be ever quicker to counteract and we would have to countercounteract even quicker and ...
We're planing on something that'll allow some opening, while avoiding the above problem though...

@jonathanbean: bitman has already given a very good explanation. What I've also seen often is magazines complaining about Spybot not detecting "inactive spyware", which means they've got some spyware files, put them onto their harddisk somewhere, and expect Spybot to find them. The "problem" with that is that Spybot may ignore those while on-demand scanning and will find them only on-access. Which isn't a problem outside of test labs though, since there, those files will be found where they're installed.

An example: Malware ABC installs file XYZ.exe ALWAYS to C:\Windows\ (if it should decide on a different location, the files must be changed to reflect that rule, so all our other criteria, mostly file contents checksums, wouldn't fit either, so whether we use the path or not, new version needs new rules... but using the path as one criteria is faster to detect).
In the test lab, the file may be in C:\MyTestSamples\ (what those labs call "inactive spyware tests" or similar), where we don't look for it. You're still protected, because if you add C:\MyTestSamples\ to the download directories setting, it'll be found during on-demand as well, and if you or anyone else tries to start it, the on-access part will detect and block it. But in a test lab, it fails, and I've seen that that often inflicts the final rating a lot.

PCWorld: indeed asked us about advertising in relation to recent reviews. Not that I would actually say that influenced anything.

And about commercial applications... I wonder if those magazines tested email support... we get so many answers from people who're astonished that their emails were answered within hours, in a time that wasn't matched by any commercial vendor they've mailed so far. We've actually got quite a proud support team there who can't stand any questions left in the inbox and do a great job in really fast replies.

[jonathanbean]

about the service Spybot provides. I was blunt with the subject title because that is exactly how the PC magazine have stated it recently -- by "reputation" I did not mean it was MY opinion but the language used in PC mags is really harsh.

Sorry if I sounded "snitty!" This is a very useful forum.

[jonathanbean]

"Education is great, but unfortunately nearly useless for the masses. I salute those here and all throughout the web who attempt the insurmountable task of educating everyone, but I also understand that it won't happen, at least in our lifetimes."

Very true! I teach a course on the history of business and technology and there are a lot of companies with great technology (geek factor) that failed to understand how humans will use their technology.

Here is a positive recommendation, and it may be in Beta 1.5:

I am shocked that hundreds of thousands of students are given Spybot, install it but don't install Teatimer, just the scanner. Occassionally they scan for spyware. Yikes! Shouldn't Spybot have a exclamation point or screen telling users that Teatimer is HIGHLY RECOMMENDED!

Example: I told my secretary about spyware because she was getting all these pop-ups, etc. Then I scanned her computer and found keyloggers, trojans, all sorts of stuff. she freaked and put Spybot on but not teatimer. I found this out (months later) and scanned with another program and found lots of spyware.

[Tattenbach]

@Tattenbach: actually, open source is a wide field. When I started this, license part II.a. fullfilled my universities wants of OS. It's not open to anyone though, simply because then the bad guys would be ever quicker to counteract and we would have to countercounteract even quicker and ...
We're planing on something that'll allow some opening, while avoiding the above problem though....

Patrick, when I talked about open source I referred to a comment previously made by Jonathan.
I did not mean to suggest to have SpyBot open source nor was this a comment attacking the program and its nature.

MfG

[md usa spybot fan]

An interesting point was raised about ratings and advertising.

In September 2006 Consumer Reports rated antispyware programs. Consumer Reports is published by Consumer Union of U.S., Inc. which is a nonprofit organization that not only does not accept advertising but also bans the use of their ratings for commercial purposes:

Violations of CU's No Commercial Use policy Our Ratings and reports may not be used in advertising. No other commercial use, including any use on the Internet, is permitted without our express written permission.

The ratings were based on Blocking, Features and Ease of use with indications for features Protects browser, Protects start-up, Describes spyware and Also in suite of use as follows:

Overall score combines blocking, features, and ease of use. Blocking shows how completely the product detected a number of different spyware behaviors and blocked or removed the initiator. Features includes auto update and real-time protection. Ease of use indicates how intuitive the interface is and how easy it is to perform common functions. Protects browser means spyware is prevented from changing your home page and redirecting Web searches. Protects start-up shows which products detect and stop spyware from starting automatically at boot-up. Describes spyware provides extra guidance to help decide whether to remove a detected item. Also in suite means similar software is available in the mfr.'s security suite. Price is for the retail, boxed version; downloads are usually available.All except Trend Micro (4) let you set computer scans for a specific time. All let you selectively restore programs removed as spyware.

Spybot Search and Destroy 1.4 was rate sixth out of twelve antispyware products. It was rated very good in all three rating categories (Blocking, Features and Ease of use) and had the following features checked: Protects browser, Protects start-up, Describes spyware. The only rating feature not checked was Also in suite.

It was also one of three "Quick picks" with the following statement:

For a free complement to your main antispyware:
6 Spybot (download)
This is very good at detecting spyware behavior and is easy to use. For a free program, it's a rich offering, with the ability to schedule hard-drive scans and to quarantine suspected spyware. It also includes a file shredder.

I would also like to add that the Consumers Reports article disagreed with the following statement by rating Windows Defender dead last:

Windows Defender has even been rated better.

[jonathanbean]

As I recall, CU got a lot of flak for its testing with dummy spyware (i.e., not the real thing). That's been flying around the Internet.

The more I look and research, the more you have convinced me to come back to Spybot and give up my expensive commercial software.

One point: I have had several antispyware programs on one computer (Trendmicro, WD, Ewido) but Antivir Premium always catches the spyware first with its heuristics. They SAY that their free version is the same as their Premium so I might go free with them too (with a small donation, of course!). I've watched the av-comparatives charts over the years, they constantly change but I am surprised by Antivir's ability at grabbing spyware and quarantining ASAP.

As for viruses, I haven't run into one in years! What's up with that?

[Tattenbach]

As for viruses, I haven't run into one in years! What's up with that?

Perhaps you have been cautious enough.

Jonathan:

I am not selling the idea to give up commercial software.

Regarding anti-malware, I have a license for Ad-Aware Pro (which is not really that much superior to the free version), I have a paid version of the antivirus program AVG (that includes the ex-ewido anti-spyware module) and many other great free programs like SpyBot, Hijackthis, Sysinternals tools, etc, etc, etc………

I believe that every one of them has their own particular strengths and so I use them. Like many have said, there is not a single solution for all the problems that may affect a Windows PC, so in the bag of solutions you should carry backup utilities like Acronis TI or Norton Ghost (among many others) or live-boot CDs like Knoppix, DSL, Bart PE, etc..

But, once more, education, IMHO, is the most important tool... Unfortunately, as BITMAN stated, the common user is not really interested in that, so all these tools and programs are really like RPG’s in the hands of someone drunk, blind, deaf and additionally tied-up and unconscious, fighting an entire army.

[Tattenbach]

BTW, in the posts to be found through the URL listed below there are good examples of what I meant by "drunk, blind, etc "

[jonathanbean]

I'm much more cautious than most of the people at my university. It amazes me how unprotected people are -- old virus detectors that are never updated, no firewall, no antispyware ("I thought the antivirus program took care of that!"), etc., etc.

I've noticed a real decrease in spyware since switching to Firefox. Now if I go on the wild side of the Internet and foolishly download "naughty" files, I should expect some consequences. LOL

On the virus issue, some magazine or web writer wrote about this "no virus in forever" issue, and I thought, "yeah, I haven't had one in ages." Perhaps the server/IT people are getting better?

Spyware, though, remains a huge problem. But the biggest problem is most people think viruses and spyware are the same thing.

BTW, I set my secretary's computer up properly now. One question I have about the four levels of Spybot protection -- I have three checked "on," but the Sticky on "Hosts" sounded above me. I'm concerned that changing the machine's ip address will screw up my dsl router address for my home computer. True?? The DSL IP issue is one that caused several calls to India (Verizon DSL) and once I got it right, I didn't want to mess with it again!

How important is the host protection?

[jonathanbean]

FYI: I read up and HOSTs file protection won't work with my LAN ISP in effect (DSL). That info. was from mvchosts site.

Oh, well.