Printable View
Anyone still using SpyBot S&D? I downloaded it from download.com to run on an infected machine... but when I started to update the definitions, I noticed that the def update was dated 2009. I am not sure if it really hasn't been updated since then... but that would make it painfully out of date. The immunization defs were pretty recent [at least 2011]... Anyone have any information on this? Should I consider it EOL?
Hi there westin, good to hear from you again, I hope all is well with you and yours. :)
SpyBot S&D is very much alive and kicking.............please go to the official site (there are other freebies to be had there ;) ) :
http://www.safer-networking.org/en/download/
I just looked, and you can download definitions for 9th November............2011 of course. They update at least once daily, although there might be more frequent "beta" updates?
I can't remember if you need to with Windows 7, but with Vista you certainly need to right click and run it as administrator if you want to update the immunization, otherwise it won't be authorised to do some bits of it.
Cheers :)
EDIT:
I have just downloaded and installed it on this Windows 8 Developers' Preview test box. I see what you mean, but I think that those are the base definitions that you get with your first update after installation. I ran the update routine again and it said that there were no newer updates. It looks like you get the original files with the cumulative updates included.
I have since updated it on an XP pro box that has been running it for some time with regular uppdates. I got:
Base Malware detections 2 November, Most Updated Definitions 9 November and Base Adware and Spyware Detections 19 0ctober....all 2011 of course :D
These would be the latest cumulative update installments.
Always helpful, nihil - Many thanks!
I still use it.
As already mentioned yes they are still releasing regular updated definition files.
on win7 you need to right click the spybot icon and select "Run as Administrator" otherwise it runs the app with restrictions.
also run it in safe mode with networking. I have found in the past i was able to always get better "cleaning" results when i run these sorts of applications via safemode, then once finished reboot into a normal user session.
Same thing with Windows 8, you must start it "As Administrator" even though you have logged in with an "administrator" account. ;)
I generally use filehippo.com as my preferred D/L site
and SpyBot S+D is still a goodie
but some of the bad guys are aware of it
and can hide from it, even disable it :(
I found the malwarebytes antimalware is a goodie :)
http://www.filehippo.com/download_ma..._anti_malware/
doesn't seem to have too much overhead, and as a new toy on the block, not all of the bad guys are aware of it, and therefore cannot hide from it
and if you are using SpyBot, don't forget to use the immunize option too
I have been using MBAM for a while. I love it. That is usually my first attack on an infected machine [after running ccleaner, of course]. I have also been using some of the bootable rescue CDs. I hadn't used spybot in a year or more, and the definitions date confused me. Nihil cleared that up though. On occasion I will also pull out Combofix if it is a particularly nasty infection. If that combination doesn't remove all of the junk, time for an OS reinstall. :)
I somehow disagree with you ... :) any infection can be cleaned unless data is stolen (in that case I would format). MBAM is decent but imo does give alot of FP's from what I have seen.Quote:
Originally Posted by westin
Everyday working in the antomalware space I am seeing that its not about what AV you are running on your machine / cor network, its how the network is structured , policies , etc etc. Spybot is also not bad.
Sorry - tangent /over :)
I am not saying that the infection cannot be cleaned. I am saying that at that point, it is less time consuming [generally speaking] to reload the OS than it is to be sure that the infection is gone.
I definitely agree with your second statement. I have some very strict policies in place on my network which prevent executable files from running out of temp folders, application whitelisting, no users run as admin, etc. I have not had one infection since I started implementing these [the machine that I mentioned in my original post belonged to a friend of a co-worker's]. This setup is a bit of a pain to get set up at first, but well worth it.
I am liking your policies (I have seen you mention them in a previouos post). Care to share your implementation or should I just google it?Quote:
Originally Posted by westin
They aren't too hard to implement. I use software restrictions policies on the computer part of the GPO to block exes from %temp% %tmp% etc. This can cause some problems with installations, but you can always remove the restriction, run the install, and then add the restriction back.
The exe whitelisting is a bit more tedious. It is easy for a user to bypass, but it seems to prevent several malware infections. I haven't seen any users bypassing it, but that obviously doesn't mean that they aren't. :) I use the 'Run only allowed Windows executables' on the user side of the GPO. You basically just build a list of allowed exe names.
Having users run without admin privs seems to be a key element in our stability. Sure, it means a bit more work for me, but it pays off in the long run.
I have found Spybot to be lacking in the past couple years. My preferred spyware program is MBAM and secondly SuperAntiSpyware. However, Spybot is good at finding PUPs and modified Windows security settings in the registry so I usually finish up with that.
Well I use MBAM and Spybot as they do tend to find different things. One additional comment is that MBAM is updated very, very frequently, whereas SpyBot isn't quite so often.
Another one I use is A-Squared, as once again it will find different things.
Mainly I am dictated to by customer requirements, which are usually "quick and cheap", so a reinstall is frequently the obvious answer.
I would agree that most things can be cleaned unless it is one that replaces executables with its own code. You would have to do a repair install anyway so no advantage in letting an AV delete the files for you.
If I find a rootkit or suspect that a trojan has actually run on the machine I would also reinstall as a matter of course.
I think that you need to look at how your anti-malware works as well?
I get calls from people that their AV has reported a virus (usually a trojan as it goes). What has actually happened is that the AV has detected something possibly nasty and has blocked access to it and issued an alert.
Sure, it's still there waiting to happen, but the AV won't let it run, unless you turn the AV off............. now if they have done that I ALLWAYS reinstall .............." haven't backed up your personal data? oh dear!" :lildevil:
Other AVs will quarantine suspicious stuff, but I never let an AV go ahead and delete without human intervention.
I take the view that once you have let it out of the bag then you don't know where it has gone, so a repair install is inadequate.
I believe that the most important feature of security software isn't the speed of scan or whatever they actually detect, it's what they detect at the perimeter and prevent from happening unless you OK it. At that stage in the game I really don't mind false positives.