Installed and ran Microsoft Anti-Spyware (MSA) tonight. It found a few things, so--without removing or quarantining anything--I ran AdAware (AA) and SpyBot (SB) to see how they compare.

MSA found old registry keys for WhenU.SaveNow, StartNow Hyper Bar, and Bear Share.

AA and SB found nothing. But then these are just registry keys without any actual files. I assume SB and AA must have got these in the past.

MSA did do a good thing when it raised an alert that the Dameware remote control utility I had installed was a high alert item unless it had been installed by the network admin. Since I am the network admin, I appreciated that it pointed out a "RAT" (guess that means remote access tool), even if that RAT was legitimate. This would go a ways to stop uncontrolled use of things like PCAnywhere.

Final Analysis: Good descriptions of problems, and free. But then SpyBot and AdAware were both recommended by Consumer Reports and they are also free.

I would not use it as a primary tool, but anyone who has fixed infected systems knows that it takes several tools in combination. Doctors use drugs in combination, right? So you need a couple AV programs (NOT Symantec or McAfee which all virus writers plan on), several anti-spyware programs, hijackthis for manual removal (and windows safe mode and regedit), and several years experience in IT.

I am not sure who to thank for spyware, but it's been good for my business. Pretty sad, actually.



[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/289/30154#30154