Identifying the Enemy
Today in the all out fight with spyware, adware,
malware and viruses we as consumers have a
plethora of options when it comes to software
programs for removing these pesky bugs.
I keep my eyes open for new software and utilities
to remove known issues and even go as far as
infecting test systems to run trials of new programs.
First let’s talk about the computer we used, so that you know what we are working
Dell Demission 8200
Windows XP Home sp2 all updates and IE7
Integrated sound & video
We did not install any other software at the time of the infestation.
Please note that all programs were updated to the latest version.
When testing each program we did not remove the infections, as we
wanted to see what program would detect the most spyware.
I want to take some time to talk about what an infected computer looks like, what
programs I installed to infect the computer, and what program that I chose to use to
From working on so many computers I have
found the following to be the most common
type of spyware, adware and malware. Using
this knowledge, I found and downloaded the
most infectious programs:
Limewire Registry Power Cleaner
Kazaa Weather Bug.com
So what does an infected
computer look like?
Locked Desktop Images
Internet Explorer Tool Bars
Fake Blue Screens
SUPERAntiSpyware (What the company claims)
SUPERAntiSpyware is a powerful anti-spyware solution designed to be the first
line of defense and/or to compliment your existing security solution.
SUPERAntiSpyware will detect and remove the toughest of spyware infections
such as Gromozon, Zlob, SmitFraud, Vundo, WinFixer, SpywareQuake,
VirusBurst and well over 100,000 other harmful
SUPERAntiSpyware detects and removes Adware, Spyware, Malware, Trojans,
Parasites, Dialers, Rootkits, Worms, Browser HiJackers and Keyloggers.
SUPERAntiSpyware features many unique technologies such as our First Chance
Prevention system that detects and removes threats before your system starts in
order to block infections from infecting and re-infecting your system during the
startup and shut down sequences.
For more information please go to www.SUPERAntiSpyware.com
Adaware 2007 (What the company claims)
Ad-Aware is no ordinary anti-spyware, it is the original anti-spyware product,
offered to consumers worldwide to protect their personal and home computers
from malware attacks. And today, with over a quarter of a billion downloads,
computer users put their trust in Ad-Aware more than any other anti-spyware
For more information please go to www.adaware.com
SpyBot Search and Destroy (What the company claims)
Spybot - Search & Destroy detects and removes spyware, a relatively new kind
of threat not yet covered by common anti-virus applications. Spyware silently
tracks your surfing behavior to create a marketing profile for you that is
transmitted without your knowledge to the compilers and sold to advertising
companies. If you see new toolbars in your Internet Explorer that you haven't
intentionally installed, if your browser crashes inexplicably, or if your home
page has been "hijacked" (or changed without your knowledge), your computer
is most probably infected with spyware. Even if you don't see the symptoms,
your computer may be infected, because more and more spyware is emerging.
Spybot-S&D is free, so there's no harm giving it a try to see if something has
invaded your computer.
For more information please go to www.spybot.com
Counterspy (What the company claims)
-Heavy-duty Anti-Spyware protection, but light on CPU and Memory.
-Kernel-level Active Protection™ guards you 24/7.
-Hybrid design combines VIPRE Anti-Malware technology with our award - winning
spyware detection and removal.
-Deep-rooted malware is exterminated at boot time, before Windows loads.
-Small, regular definition updates greatly reduce update downloading time.
-Over 2,000,000 threat definitions!
-Vista compatible: Integrates seamlessly with the Vista Windows Security Center.
For more information please go to www.sunbelt-software.com
A-Squared (What the company claims)
Security must not be a privilege. Under this motto, Emsi Software provides
the Malware scanner a-squared Free completely free of charge for private
use. But it is not a very limited version, it is a full tool to clean your computer
from Malware. Not only Spywares, as detected by classic Anti-Spyware
programs, but also especially Trojans, Backdoors, Worms, Dialers,
Keyloggers and a lot of other destructive pests, which makes it dangerous to
surf the web.
For more information please go to www.emsisoft.com
The latest version of avast! antivirus kernel features outstanding detection
abilities, together with high performance. You can expect 100% detection
of In-the-Wild viruses (viruses already spreading between users) and
excellent detection of Trojan horses.
For more information please go to www.avast.com
So we have our test computer that is widely infected and we have chosen
our programs to test. Now it’s time to do the testing.
However, before we go to the results let me say a few things about removing
infections from your computer.
Firstly, as far as I can see there will never be just one program that will
remove 100% of all infections.
So you will need to use multiple programs to do the job. It is not unheard of
to use 10-15 programs to clean up a computer taking, in some cases, 4+
hours to do so.
In most cases you can’t use the everyday programs that I have tested to
remove some of the more severe programs that can infect your computer. I
will go over some tools that can help you in removing those programs later
ASquared Found 1175
Super Antispyware Found 700
Adaware 2007 found 323
SpyBot Serch and Destroy found 252
Counterspy found 2995
What I thought about each program
Why did I use this program?
This program does find some of the hard ones, but it does not usually remove all of
them; however, knowing the computer is infected with a specific piece of spyware
can sometimes be half the battle. From that point on you can use other utilities to
remove those threats. So this program is good at removing some threats, but is better
at identifying them.
Why did I use this program?
Adaware is the most commonly used program and it’s a must for any tool kit for
programs to rid a computer of infestation. I like the old version better than the 2007,
updates are slow and you can tell that they are trying to sell you the upgrade.
I wish the program was more proactive about identifying threats that are not always not
considered adware, such as webshots and weatherbug, both which are known in the
industry as being adware and install related programs such as mysearch toolbar.
SpyBot Serch and Destroy
Why did I use this program?
Like Adaware I’m not a huge fan of their latest program release; slow and not very
accurate when it came time to detecting some of the less severe types of infestation.
However, if you are looking for an easy way to see if you have smitfraud then this is
not a bad way to use this program. I also have issues with the tea timer that is set in
the new program to run as default when running the installation; making it not the
most user-friendly program. (New Update today Feb 13th - a new release came out
and fixed the update time, so that the program acts as it use to) It’s still a good tool to
use, but don’t make it the only one you use.
Why did I use this program?
Smart, fast and reliable for the down and dirty jobs, this program is one of my
favorites. It can identify and remove some of the hardest pieces of infestations that I
have seen. You can see in the numbers that this program holds its own when it
comes to removing rogue programs. Again don’t make it your only tool, because you
will find yourself still infected.
Why did I use this program?
Another one of my top picks for removing known and some not so known
adware/spyware/malware. Fast scanning offers deep scans and, as you
can see in the numbers, has the ability to identify more than the others in
its field; however, it’s slow to update.
Keep in mind that some programs do not see each registry entry as a separate
infection; it looks at the name and sees that as one.
However, Counterspy and A-Squared did a better job identifying far more than
SpyBot and Adaware when comparing name and registry entry data.
The infections that each program found were not always the same, and had I used
just one program, I would not have cured the computer. In our test computer case I
had to use all the programs plus other utilities to completely clean the computer.
Proving the point that, it takes more than one program to do the job.
So what about those other utilities that I keep referring to? Well first let’s talk about
the risk involved in using these utilities before we delve into what they are and what
You must take extreme caution when using these programs. Some of these
programs expose Windows core elements allowing you to edit change and even
delete. If you are unsure of what you are doing then exit the program and do more
research, or take the computer to a repair shop. I know of one that is around…
This tool removes SurfSideKick, QooLogic, Look2Me or any combination of that
Also nicely picks out Vundo infections.
One of the better things it does is pick files recently created, which can give clues to
other infections. You can use it to unhook any dll in the system32 folder. You can use it
to delete as many as 8 files using its command line functions.
Also it deletes a bunch of files related to the infections above automatically and is
updated fairly regularly.
SmitFraudFix is a tool that S!Ri created to remove rogue anti-spyware applications
that utilize Trojans to issue fake taskbar security alerts or that change your
background in order to scare you into purchasing the full commercial version of their
These infections are difficult to remove and are usually bundled with so much other
malware, that traditional antispyware or antivirus programs have difficulty completely
cleaning these infections. Due to this fact, a specialized tool was created in order to
help a user clean their system of these infections.
VundoFix is a cleaning tool made by Atribune. Its purpose is to remove Vundo
infections from computers and it scans based on registry searching with an additional
As stated above, and as the name implies, VundoFix's purpose is to remove Vundo from
infected computers. VundoFix has a relatively powerful method of brute scanning the
registry, as well as scanning for files that upload Vundo onto one’s computer. It also has
an attached "blacklist", and all the files in it are scanned. It also relies on a method of
examining the binary strings inside suspicious files to determine how the file behaves.
Because Vundo has random file names, it is not possible for VundoFix to have a 100%
detection rate. Often, the infected files must be removed using VundoFix's "Add more
files" option (they cannot be removed manually in any way).
HijackThis lists the contents of key areas of the Registry and hard drive--areas that are
used by both legitimate programmers and hijackers. The program is continually updated
to detect and remove new hijacks. It does not target specific programs and URLs, only
the methods used by hijackers to force you onto their sites.
As a result, false positives are imminent, and unless you're sure about what you're
doing, you should always consult with knowledgeable folks before deleting anything.
RogueRemover is a tool that can remove various rogue antispyware, antivirus and hard
drive cleaning utilities. Rogue applications are applications that, rather than remove
spyware, provide false positives, distribute malware or spyware, advertise, or provide
RegSeeker is a perfect companion for your Windows registry.
RegSeeker includes a powerful registry cleaner and can display various information like
your start-up entries, several histories (even index.dat files), installed applications and
much more. With RegSeeker you can search for any item inside your registry,
export/delete the results, open them in the registry. RegSeeker also includes a tweaks
panel to optimize your OS. Now RegSeeker includes a file tool to search for duplicate
files, bad shortcuts and more.
After 4 hours and many programs our test computer is
back to its good old self. As you can see, it takes time and
sometimes a lot of work to get the bugs off an infected
And as programs and people advance this will be an
ongoing battle, but with tools and knowledge this is a
battle that we can win!