Study: Tools Let Spyware Slip Through Cracks

[Chris]

With the threat of a sophisticated spyware attack looming, a renowned security researcher says the most popular detection and removal tools "fail miserably" at addressing the growing spyware/malware scourge.

Just days after hackers seized control of a banner ad server and used it to load malicious programs on vulnerable machines, researcher Eric Howes issued failing grades on all anti-spyware scanners he tested during a two-week stretch in October.

Howes, a graduate student at the University of Illinois at Urbana-Champaign, found that the best-performing anti-spyware scanner failed to detect about 25 percent of the "critical" files and registry entries installed by the malicious programs.

"One thing I found out for sure is that no single scanner removes everything," Howes said in an interview with eWEEK.com.

"I had an inkling before doing the test that the results would come back like this. But it still is disappointing to find that the tools, in many cases, are basically useless."

"The anti-spyware tools missed things that simply reinstalled what was deleted," Howes said, likening it to a cat-and-mouse game being won by the bad guys.

More | Here

Hmmmm nothing new that you need more than one scanner but the results were pathetic IMO.

[Zfactor]

AGH! I should have installed that copy of Pest Patrol onto my new computer instead of just going with Spybot and Ad-Aware

[grim_reefer]

i used

i) trendmicro virus scan

ii) spysbot s&d

iii) adaware se

on a computer i was servicing for someone, and it still had things on there which i couldnt get rid of - some were reinstalling themself after spybot s&d, but after adaware, they at least stopped reinstalling the active processes

however, registry keys were obviously still not fixed because IE was useless, the startpage would always change and it would always add the address befoire anything you try to type in! i was worried about it causing a problem by simply executing a bad code on the site it automatically enters in the IE address bar and start page - and just downloading the deleted viruses again and changing the reg keys that had been fixed

so i just deleted their links for IE and told them not to use it and use Mozilla Firefox which i installed

i guess it'll always just be a never-ending battle. you cant win, no matter what people WILL find away around the barriers, and find cracks in the bad programming code by a lot of companies

but i think they should be doing a better job at keeping up and on top of it

i like what one organization does (maybe Mozilla) in PAYING people, hackers, code writers, if they find security flaws in their broswer/products.. so those people that could be doing all the harm, can start doing something good - they gonna get paid for it and they dont get paid for messing up everyones computers so i imagine the system works quite well for keeping right on top of the problem

i never have a problem with mozilla firefox :D and i think it was mozilla

[andsome]

all very reassuring

[nellie2]

Please don't forget that a lot of these applications that we rely on are provided FREE for general use and they rely on donations to be able to keep going.

With the best will in the world it is difficult to stay on top of the malware threat because it is ever changing. Some exploits are very devious and hide dlls and add services and actively monitor the malware installation for changes, if it finds any changes then it will morph and re-install.

The anti-spyware programmers are doing an excellent job.... but they aren't superman!