Poor Defenders

1 2 3 4 5 6 Page 2
Page 2 of 6

Ineffective Tools

Illustration by Joe Zeff.
Illustration: Joe Zeff
To see for ourselves how well NoAdware and the others worked, we installed Windows XP on a clean hard drive, patched it, and then infected the system with six spyware applications chosen as a representative sample of the hundreds that exist. While our test is not comprehensive, the six programs include frequently used and widely available types of adware and spyware, including Browser Helper Objects and executable files.

The programs engage in a wide range of typical spyware behavior, such as changing a browser's home page, modifying Windows' Hosts file, downloading additional adware apps, and putting references to themselves into the Registry so that they'll launch when Windows does.

No spyware-removal utility is perfect; in our experience, even free tools we've found effective in previous tests, such as Spybot Search & Destroy, will fail to detect spyware that another good program might find. But we felt any spyware remover worth its salt should be able to detect and remove most of these common adware apps. After infecting the PC, we scanned it with one of the anti-spyware tools, starting the process over again for each one. As a control, we also ran the test using Spybot Search & Destroy.

Spyware programs put keys in the Windows Registry that are usually benign; they also install executable and DLL files, which are more dangerous. Ideally, anti-spyware software should remove both the keys and the files. But three products we tested removed browser cookies but no other files or Registry keys; one removed keys for two out of a possible six applications, but no files; and three removed files for some apps but left others untouched (see the chart).

SpyBlocs and PAL Spyware Remover not only failed to detect or remove any of our planted spyware, they identified legitimate parts of Windows or other applications as spyware and deleted them. SpyBlocs, for example, deleted a critical system folder where Windows stores its signed device drivers, which on some PCs might have resulted in an unrecoverable system crash. (The vendor says this was due to a bug that will be corrected in future versions.)

Even more remarkable, two other programs we tested installed spyware applications on our system. SpyAssault left a file called FavoriteMan, a browser hijacker listed in online spyware databases such as SpywareGuide.com. MyNetProtector installed a whopping 57 files, including 19 that attempted to make connections to the Internet--in some cases within seconds of installation. Among the programs it loaded were BargainBuddy, EZula, and PurityScan, all of which (according to SpywareGuide.com's database) display pop-up ads and change browser settings on PCs.

Our free control application, Spybot Search & Destroy, removed Registry keys for four applications, and executable and DLL files associated with five spyware apps.

We attempted to contact the companies that make the applications we tested, via multiple e-mail messages and telephone calls to the addresses and phone numbers listed in the Whois registration information for each company's domain name. At press time, only a few had replied.

1 2 3 4 5 6 Page 2
Page 2 of 6
  
Shop Tech Products at Amazon