• PC World
• » Software
• » Antivirus and Security

Anti-Spyware

Antivirus programs combat the traditional threats of viruses, worms, and Trojan horses but do little, if anything, about spyware installed by sneaky Web sites or suspicious employers, or via software downloads. Yet spyware is a growing scourge: ISP EarthLink says 40 percent of calls to its tech support are spyware-related.

We included a sampling of spyware in our antivirus zoo tests, with abysmal results. In our first round, only McAfee registered any at all, flagging one spyware component. Later, we downloaded an optional free spyware database from Kaspersky's Web site and were able to catch a handful of items with the antivirus scanner.

One reason for the tepid response from antivirus companies is a hesitancy to label spyware as malicious. While some pieces sneak onto your PC, many spyware programs are disclosed in the end-user license agreements of the freeware programs they ride in on. By accepting the agreement, you permit the installation of spyware that fetches targeted advertising or gathers marketing data.

Reading the fine print is the first step toward avoiding many types of spyware. But if the critters are already on your hard drive (and they likely are), your best defense is to run a program that scans your hard disk for known spyware files, folders, Registry entries, and tracking cookies, and then gives you the option to remove them. In addition, several anti-spyware utilities scan your PC's memory in real time to keep unwanted programs from installing and running in the first place.

Software firewalls, such as Zone Labs ZoneAlarm or Sygate Personal Firewall (both free), provide another line of defense against spyware by alerting you to and blocking programs on your PC that try to access the Internet. Several of the antivirus programs reviewed here include a firewall, something no well-connected PC should be without. See the April 2003 Internet Tips column ("Protect Your PC and Data With the Security Checklist") for advice on firewalls.

To Catch a Snoop, Sometimes

We tested four of the best anti-spyware scanners: Lavasoft Ad-aware Plus 6, PepiMK Software Spybot Search & Destroy 1.2, PestPatrol Software PestPatrol 4.2, and Webroot Software Spy Sweeper 1.5. For each, we installed the scanner and then introduced spyware. Our collection included two utilities, IMesh 3.1 and Hotbar 4, which contained profiling and ad-serving software and files (known as adware) such as Gator GAIN and CommonName. We also added an ActiveX control called Secret Admirer that caused our PC modem to call a 900 number associated with a porn Web site; and we installed five surveillance programs that run in stealth mode, recording keystrokes and grabbing screen shots. Finally, we moused around a Web site, OrbitExplorer.com, containing ActiveX controls that can automatically install spyware if browser security is turned down.

Each product rooted out a large proportion of the freeloaders, with Spybot Search & Destroy catching the most. But no program was perfect. After scanning and opting to remove detected spyware with one program, we found that running a second or third program almost always caught all or part of a spyware item that the first had missed. With each product, we also managed to find and remove additional spyware elements when we reran the scanner. That's because spyware has many hooks into the system that try to reinstall themselves after an attempted removal. So your anti-spyware motto should be: Scan, remove, reboot, repeat.

In addition to scanning best, Spybot Search & Destroy was the most competent at removing spyware without doing harm. In contrast, PestPatrol locked up and refused to run again after we instructed it to delete the spyware it had found.

Like antivirus utilities, the four anti-spyware programs also scan your PC's memory in real time to keep unwanted software from installing in the first place. However, we didn't see stellar performance from any of the programs. In most cases they noticed only a fraction of the spyware as we downloaded and installed it, but Ad-aware Plus performed better than the others. Memory-scanning is a brand-new feature in Spy Sweeper, which failed to find most programs we pitted it against; in Spybot Search & Destroy, it's limited to ActiveX controls and other code embedded in Web pages.

The four programs didn't differ greatly in features. You can set each to load and scan automatically at Windows start-up, and each can instantly notify you when spyware database updates are available. All four also back up files before deleting them (restoring a piece of spyware may be necessary to re-enable the free software it came with).

Two Are Better Than One

Anti-Spyware is still an infant class of software, but it's the best tool available right now. We recommend that instead of running any one program you combine our two favorites: Spybot Search & Destroy and Ad-aware. The former was the best at scanning disks in our tests, though its interface is a bit clumsy. The latter has a friendlier interface, and the $27 Plus version has the memory-resident scanner that did best in our tests. Spybot Search & Destroy warned us that Ad-aware might mistake its quarantined files for active spyware, but we didn't encounter this problem in our evaluation.

• See more like this:
• antivirus,
• anti-spyware,
• virus,
• spyware,
• malware,
• boomerang,
• f-secure,
• gecad,
• kaspersky,
• mcafee,
• viruscan,
• panda,
• symantec,
• norton,
• trend micro,
• pc-cillin,
• lavasoft,
• ad-aware,
• spybot search & destroy,
• pestpatrol,
• webroot,
• spy sweeper