Please help me Design a Spyware Test

Quote:

---

Methodology
Visit websites that are known to contain spyware. Then take system offline and scan for malware.

---

Your methodology is sound however your measurements are going to be skewed. Since we all know that spyware scum is always ahead of the scanners, a better way to check what you picked up is to use a system snapshot program. Pick any that you like. I did just such a test to show management what can happen with a single visit to a known spyware site. I picked up 20 spyware apps, 76 registry key additions/edits, 4 BHOs and a partridge in a pear tree. Another follow up test that I did was to see what programs would clean the infections. To my surprise the M$ beta spyware scanner did the best cleaning 62% of the crud. This is where your results would be skewed by 38% at best. Make sense?

NOTE: I never agreed to have any of this installed on my test host however after reading the site's TOS agreement, just by *visiting* I "agreed" to this insult.

Quote:

---

Originally posted here by thehorse13
Your methodology is sound however your measurements are going to be skewed. Since we all know that spyware scum is always ahead of the scanners

---

You're right. I did, however forget to mention that I used Ethereal to watch activity (or lack thereof) from the system as well as monitoring processes using tools such as ProcessExplorer, etc. That said it, even detecting the activity doesn't provide me with the location to look for the scumware (reg keys, dlls, etc). And I didn't test more than about 20 sites...just the usuall suspects that we found at work.

Quote:

---

NOTE: I never agreed to have any of this installed on my test host however after reading the site's TOS agreement, just by *visiting* I "agreed" to this insult.

---

LOL, dont ya just love this sh**?! I could not believe the multitude of exploits being used and the sh**load of popups/windows all over the place when I visited the one site...amazing.

Quote:

---

use a system snapshot program. Pick any that you like.

---

Could you point me to one or two that you favor, it's a great idea to try out?

Thanks for the tip hoss.

Quote:

---

That said it, even detecting the activity doesn't provide me with the location to look for the scumware (reg keys, dlls, etc). And I didn't test more than about 20 sites...just the usuall suspects that we found at work.

---

InstallWatchPro will do this for you. That's what I was saying when I mentioned a system snapshot. It will show you *everything* that changes on your system including reg keys, files, processes, etc, etc. This is the only way to accurately see what the spyware has done to your system.

Download it free from here:

http://www.epsilonsquared.com/installwatch.htm

:p

rico - thanks for the list! that's awesome and very helpful.

thehorse13 - what exactly does InstallWatchPro do? I'm not familiar with system snapshot software. Would you be able to give me some screen captures or a better explanation than what's on their website?

thanks!

Ok, so I don't wanna get banned for posting this, but I know for my own home testing spyass.com has some serious stuff! Careful on who you test this on. Just click on refresh a few times...and spyware will load.

thanks wildred - do you know what types of stuff it loads?

i'm scared to go visit it now, with your disclaimer.

wait - is it a porn site?

i can't visit porn sites, as i'm on company business.