[Donna]

How many antispyware do we need to detect and remove spyware?

Last month, we published a simple test on how real time protection by antispyware should work to prevent installation of known spyware / adware on your system. Today, we will show another test of how some antispyware's detection and removal process work.

Also, if you are visiting security forums like this one, you may notice a question “Do I need another antispyware program in addition to the one I’m using?”. If not, you may wonder yourself if 1 or 2 antispyware is enough to detect/remove spyware / adware. Check out the following test to find out whether 1 or 2 antispyware is enough.

For this test, we used 8 Claria’s software:

• Gator eWallet
  
• WebSecureAlert
  
• DashBar
  
• DateManager
  
• WeatherScope
  
• PrecisionTime
  
• GotSmiley
  
• ScreenScenes (Beach Islands)

The above are detected as spyware / adware by many antispyware applications. Even some antivirus programs detect some of the above as a threat.

4 antispyware programs were use to detect/remove the above threats:

• CounterSpy
  
• Windows AntiSpyware Beta 1
  
• Ad-aware SE Personal
  
• Spybot Search & Destroy

The above image shows the 4 AntiSpyware products are installed in a clean system which we will use to detect and clean the system after installation of 8 Claria products.

Next image are the installers of Claria software:



The image below shows 8 Claria software products are now installed and the “About” windows of the said Claria software:





Please note that CounterSpy and Windows AntiSpyware were shutdown & the real time protection of antivirus was disabled to be able to install the Claria software without any interruption.

Scanning and Detection

What does one expect after the antiSpyware program finishes scanning? A user who installs Claria’s software will see an additional component called GAIN Publishing  (see http://www.gainpubli...p/gainfaq.html) .  This means we are expecting the antiSpyware programs to detect at least 9 threats (8 Claria software products mentioned above and the component GAIN Publishing).





The above is the scan result of CounterSpy v1.0.29 with definitions 200.  It found 8 threats: Claria.DateManager, Claria.Adware, Claria.GAIN, Claria.PrecisionTime, Claria.WeatherScope, Claria.WebSecureAlert, Claria.DashBar and Gator.  It failed to detect 2 threats: ScreenScenes and GotSmiley.





The above are the scan results of Windows AntiSpyware v1.0.614 with 5733 definitions.  It found 9 threats: Claria.GAIN, Claria.GAIN.Trickler, Claria.PrecisionTime, Claria.WeatherScope, Claria.WebSecureAlert, Claria.DashBar, Claria.DateManager, Claria.ScreenScenes and Claria.GotSmiley.

It did not fail to detect all Claria’s software. 

Note: Claria.GAIN.Trickler is also known Gator.
See:
http://doxdesk.com/parasite/Gator.html
http://www.liutilities.com/products/wintas...brary/trickler/
http://www.processli...files/trickler/
http://www.bleepingcomputer.com/startups/T...r.exe-7513.html



The above is the scan result of Spybot Search & Destroy v1.4 with the July 8th definitions.  It found 6 threats: WebSecureAlert, GAIN.DashBar, GAIN.Gator, GAIN, Date Manager and PrecisionTime.  It failed to detect 3 threats: GotSmiley, ScreenScenes and WeatherScope. 

Note:  Spybot S&D found only the shortcut for WebSecureAlert (the .lnk file)

Removal / Cleaning

Counterspy is the first antiSpyware program that we used to hopefully clean the system:



http://dozleng.com/i...ovalusingcs.jpg

http://dozleng.com/i...alprocesscs.jpg

http://dozleng.com/i...aningdonecs.jpg

After it finished cleaning the system, the system was rebooted.  The system shows that CounterSpy successfully removed Claria’s Dashbar, Gator, WebSecureAlert, WeatherScope, DateManager and PrecisionTime.  However, CounterSpy failed to detect/remove GotSmiley and ScreenScenes (Beach Islands):

http://dozleng.com/i...ctsleftbycs.jpg

As we can see on the above image, there are 2 other Claria software products left by CounterSpy - the GotSmiley and ScreenScenes which was visible in the list of Programs.  The GotSmiley icon was also visible in the system tray.  GotSmiley and ScreenScenes (Beach Islands) would still run:

http://dozleng.com/i...ungotsmiley.jpg

http://dozleng.com/i...creenscenes.jpg

So we scanned once again using CounterSpy to allow it to find GotSmiley and ScreenScenes.  The scan result:

http://dozleng.com/i...ncompletecs.jpg

http://dozleng.com/i...ansummarycs.jpg

CounterSpy again found threats by Claria.DashBar, Gator and Claria but failed to detect GotSmiley and ScreenScenes again.  We allowed CounterSpy to remove the 3 items it detected.

http://dozleng.com/i...moveusingcs.jpg

http://dozleng.com/i...aningdonecs.jpg

After the removal of the 3 threats by CounterSpy, the system was rebooted again to allow another scan using CounterSpy:

http://dozleng.com/i...ncompletecs.jpg

CounterSpy found the same 3 threats again.  We allowed it to again remove the 3 threats.

http://dozleng.com/i...anremovalcs.jpg

http://dozleng.com/i...rdremovalcs.jpg

Since CounterSpy failed to detect and remove the 2 Claria software products(GotSmiley and ScreenScenes) after 3 consecutive scans and removal process (with system reboot in between), we now used Windows AntiSpyware to scan the system and allowed it to clean whatever it would detect:

http://dozleng.com/i...scanprocess.jpg

http://dozleng.com/i...ompletemsas.jpg

http://dozleng.com/i...summarymsas.jpg

Windows AntiSpyware detected Claria software: GotSmiley and ScreenScenes that CounterSpy failed to detect and some other Claria software.  We allowed Windows AntiSpyware to remove the 4 threats it found:

http://dozleng.com/i...removalmsas.jpg

http://dozleng.com/i...processmsas.jpg

http://dozleng.com/i...processmsas.jpg

http://dozleng.com/i...erebootmsas.jpg

http://dozleng.com/i...processmsas.jpg

After the removal process by Windows AntiSpyware, the system was rebooted.  The system shows ScreenScenes was not listed anymore but GotSmiley was still listed though the GotSmiley icon in the system tray was gone:

http://dozleng.com/i...msasremoval.jpg

We tried to run the GotSmiley program but Windows could not locate it which means Windows AntiSpyware succeed in removing the Claria software – GotSmiley and ScreenScenes but left the harmless GotSmiley shortcuts.

http://dozleng.com/i...msasremoval.jpg

http://dozleng.com/i...msasremoval.jpg

We scanned again using Windows AntiSpyware to find out if it would find any other threats.  Scan results were:

http://dozleng.com/i...2ndscanmsas.jpg

Windows AntiSpyware reported 0 items.

We will then tried again to scan the system using CounterSpy:

http://dozleng.com/i...bycs0threat.jpg

Finally, CounterSpy found 0 items too which meant Windows AntiSpyware was successful in detecting and removing the spyware / adware that CounterSpy failed to detect and remove earlier.

We ran Spybot Search & Destroy and Ad-ware SE antiSpyware scanners:

http://dozleng.com/i...dlogentries.jpg

Spybot Search & Destroy found log files which we allowed it to remove:

http://dozleng.com/i...riorremoval.jpg

http://dozleng.com/i.../z_ssdfixed.jpg

Next, Ad-aware found 1 critical tracking cookie:

http://dozleng.com/i...etest/z_aaw.jpg

http://dozleng.com/i...test/z_aaw2.jpg

http://dozleng.com/i...test/z_aaw3.jpg

Last but not the least, we ran the Symantec’s GAIN Adware removal tool to find out whether the system was spyware / adware clean:

http://dozleng.com/i...ntecgainrem.jpg

http://dozleng.com/i...antecfound0.jpg

Findings

• The above test clearly shows that a user needs to use more than 1 antiSpyware to hopefully clean a system!
  
• The recommended action by CounterSpy to "Quarantine" was great. However, it failed to detect all Claria’s software and kept finding the same 3 threats and failed to remove them each time the removal process was done.
  
• The recommended action by Windows AntiSpyware was "Ignore" (an issue that Microsoft explained by publishing an answer to customers). Hopefully the Microsoft AntiSpyware Beta team will consider changing it to remove or quarantine in the future. Even though the recommended action was "Ignore", the Windows AntiSpyware did detect all known threats in this test system and removed them properly.

Testing environment

• System: Microsoft Windows XP Pro with Service Pack 2 installed in Microsoft Virtual PC 2004 with Service Pack 1
  
• Software:
  - Claria’s software which installed GAIN Publishing software as a component for it’s products: Gator eWallet, DashBar, WeatherScope, PrecisionTime, DateManager, ScreenScenes, GotSmiley and WebSecureAlert
  - AntiSpyware: CounterSpy by Sunbelt Software (on a 15 days trial), Microsoft's Windows AntiSpyware Beta 1, Safer-Networking’s Spybot Search & Destroy, Ad-aware SE Personal by Lavasoft
  
• Utility/Tool:
  - Adware.GAIN Removal tool by Symantec. The version of the tool was 1.0.5 and did have a digital signature timestamp equivalent to 07/05/2005 04:20 PM
  - Screen Capture utility: SnagIt by TechSmith

FYI, all detection/cleaning log files were saved (not truncated) for records and reference. If you require to view the log files, please request by responding here or send us a private message or email.

Disclaimer: The above products or company that were used on this test do not represent the author or this site dozleng.com. For questions or comments, please post them here. No PM or email will be entertained on the above test other than scan log files request. Do not use the above test as your basis in purchasing or using a product. The antispyware programs may act differently (depending on what type of spyware / adware bundled application is installed). Kindly view our Disclaimer on Product Reviews and Research

[Haroldo]

Please note that this, and other similar reports, can be found in our CoU Research Projects page. The link for this page can be found atop every page of our web site.

Great job, Donna!

[alexeck]

I admit to being completely baffled as to why we didn't detect GotSmiley. I am having the team research this and hopefully this will be resolved very soon.

Alex Eckelberry
President, Sunbelt Software

[Pluto]

First of all many thanks to Donna for having performed such an instructive test.

It seems obvious that the hostile reflex initiated by Microsoft's management in its AntiSpyware software of Claria products must take into consideration that Microsoft did not remove Claria software from its list, but only shifted the critique from critical to moderate.

It is obvious that Microsoft AntiSpyware did recognize all Claria software installed in the test, which confirms if needed the general positive attitude towards Microft's heritage of the Giant software.

Remains we stay confronted to our very own reaction as to the meaning of moderate in terms of risk. Shall we only take into consideration critical risks? I think, otherwise argued by strict necessity or obvious (very obvious!) zero-risk, a risk remains a risk and is worth being acknowledged as so: remove!

Finally, multiple anti-spyware programs do appear being necessary. The idea is not that one program should be better than another, but that they all have their strong and weak points, and that combining them enhances the chance of a wider risk coverage. Of course, the point is also to combine without excess and within complemantarity. COU here as elsewhere delivers that amount of information required to do good, better without too much.

I am, again, impressed by this test. Thank uou very much.

This post has been edited by Pluto: 12 July 2005 - 08:04 PM

[philow]

alexeck, on Jul 12 2005, 01:36 PM, said:

I admit to being completely baffled as to why we didn't detect GotSmiley.  I am having the team research this and hopefully this will be resolved very soon.

Alex Eckelberry
President, Sunbelt Software
<{POST_SNAPBACK}>

Our research team has determined that CounterSpy definition version 200 does in fact catch GotSmiley and ScreenScenes. It looks as if we are having some intermittent problems with our updates. If anyone else has these results, you can do the following:

Note: If you have a registration key you will need it handy after you follow these instructions.

1. Close CounterSpy

2. Right-mouse click the CounterSpy in the lower right hand corner Select ‘Shutdown CounterSpy’

3. Navigate to the C:/Program Files/Sunbelt Software/CounterSpy Client folder

4. Delete the files:
gcThreatAuditScanData.gcd
gcThreatAuditThreatData.gcd
gcuserdata.gcd

5. Open CounterSpy and choose File-Check for updates...

This will download the latest definition files and you should be good to go.

Donna, Great tests and you definitely got our attention

Thanks,
Phil Owens
Product Manager
Sunbelt Software

This post has been edited by philow: 12 July 2005 - 08:36 PM

[Donna]

alexeck, on Jul 12 2005, 10:36 AM, said:

I admit to being completely baffled as to why we didn't detect GotSmiley.  I am having the team research this and hopefully this will be resolved very soon.

Alex Eckelberry
President, Sunbelt Software
<{POST_SNAPBACK}>

Thanks Alex for the attention on the above simple "run".

BTW, welcome to CoU

[Donna]

philow, on Jul 12 2005, 12:21 PM, said:

Our research team has determined that CounterSpy definition version 200 does in fact catch GotSmiley and ScreenScenes. It looks as if we are having some intermittent problems with our updates. If anyone else has these results, you can do the following:

Note: If you have a registration key you will need it handy after you follow these instructions.

1. Close CounterSpy

2. Right-mouse click the CounterSpy in the lower right hand corner Select ‘Shutdown CounterSpy’

3. Navigate to the C:/Program Files/Sunbelt Software/CounterSpy Client folder

4. Delete the files:
gcThreatAuditScanData.gcd
gcThreatAuditThreatData.gcd
gcuserdata.gcd

5. Open CounterSpy and choose File-Check for updates...

This will download the latest definition files and you should be good to go.

Donna, Great tests and you definitely got our attention

Thanks,
Phil Owens
Product Manager
Sunbelt Software
<{POST_SNAPBACK}>

Welcome to CoU Phil and thanks for providing the work-around for CounterSpy customers. I'll use that work-around then run another test with CS antispyware. Will post the result in this discussion.

[Donna]

Pluto, on Jul 12 2005, 11:53 AM, said:

First of all many thanks to Donna for having performed such an instructive test.

It seems obvious that the hostile reflex initiated by Microsoft's management in its AntiSpyware software of Claria products must take into consideration that Microsoft did not remove Claria software from its list, but only shifted the critique from critical to moderate.

It is obvious that Microsoft AntiSpyware did recognize all Claria software installed in the test, which confirms if needed the general positive attitude towards Microft's heritage of the Giant software.

Remains we stay confronted to our very own reaction as to the meaning of moderate in terms of risk. Shall we only take into consideration critical risks? I think, otherwise argued by strict necessity or obvious (very obvious!) zero-risk, a risk remains a risk and is worth being acknowledged as so: remove!

It alarmed us when Microsoft AntiSpyware downgraded the threat level for Claria because some beginners might continue using the spyware / adware bundled applications. However and as I mentioned in another discussion, what important is the detection. Removal process play a big part too.

Quote

Finally, multiple anti-spyware programs do appear being necessary. The idea is not that one program should be better than another, but that they all have their strong and weak points, and that combining them enhances the chance of a wider risk coverage. Of course, the point is also to combine without excess and within complemantarity. COU here as elsewhere delivers that amount of information required to do good, better without too much.

I am, again, impressed by this test. Thank uou very much.
<{POST_SNAPBACK}>

That is very true. With the # of malware facing us, more tools is necessary to avoid re-generation. Harmful items may be removed by one or two tools (depending how nasty a spyware is. Nastier requires more specialized tools). Using additional tool to verify that all traces are gone is a good method. I have to agree too that all application has its own weakness. Support team play a big role in patching whatever reported weakness of an application.

Thank you Pluto for the nice comments and for viewing the above test

[Haroldo]

We are very pleased to see the prompt attention that this test received with the management of Sunbelt Software.

Obviously, the intent of this post was to neither embarass any program nor to prove superiority of one versus another. Had another threat been used (rather than Claria) of if it were conducted at another point in time (to allow for a different set of definitions), the results might have been different.

Clearly, the intent was to show the need for multiple protection tools. Other research has been conducted along similar lines (please see Windows Secrets Newsletter, half way down Giant AntiSpyware catches 63%, tests say). This test shown here, however, was conducted and produced allowing the reader a clear and easy to follow illustration of the difficulty and frustration associated with malware removal.

Far too many (novice and intermediate) users feel comfortable saying

Quote

I use Norton Antivirus and Spybot Search and Destroy.

...and feel that they are fully protected.

One of the goals of Calendar of Updates is to share the information and knowledge concerning online security. The next time someone states that they are protected with one or two tools, please refer them to this post to help them understand that they might be underestimating the threat!

Thank you again, Donna, for an excellent illustration. In addition, we appreciate Sunbelt Software for quickly addressing the issues surrounding their product. We welcome you as new members to our site and anticipate any input that you can offer to help us further our mission!

[sml156]

Great work as allways Donna

I use 3 out of the 4 programs you tested and noticed that you did not show a scan of Ad-aware SE Personal before removeing all the threats, only till the end when it found a cookie did you show useing it

Also I would of been iterested to see what would of happened if you had your computer online ( your taskbar showed no network connection )

[Donna]

sml156, on Jul 13 2005, 09:40 AM, said:

Great work as allways Donna

I use 3 out of the 4 programs you tested and noticed that you did not show a scan of Ad-aware SE Personal before removeing all the threats, only till the end when it found a cookie did you show useing it

I didn't use Ad-aware SE Personal to detect for spyware on this test but I'll show it in the next test.

The next test is to allow MS Windows AntiSpyware as the first "cleaner" before using the other 3 antispyware - CounterSpy, MSAS and Spybot S&D.

After that we will use Ad-aware SE Personal as the first "cleaner" before using MSAS, CounterSpy and Spybot S&D.

Last but not the the least is to use Spybot S&D as first cleaner before using the 3 antispyware.

I might load Webroot SpySweeper, Spyware Doctor too and maybe other antispyware program and run them as first spyware removers.

I will test other antispyware (if requested) as long as it is available to try from their website.

Quote

Also I would of been iterested to see what would of happened if you had your computer online ( your taskbar showed no network connection )
<{POST_SNAPBACK}>

We usually recommend to users to disconnect the internet connection prior allowing any antispyware tools to remove spyware. This is because some spyware / adware application can damage the connections (e.g. LSP).

Thanks for your comments

[Donna]

Hi all,

The Part 2 of "How many antispyware do we need to detect and remove spyware?" can be found in http://www.dozleng.c...dates/topic5722

Spy Sweeper and Spyware Doctor were added in the test.

A summary page is available in http://www.dozleng.c...x.php?pg=claria

Regards,

Donna