Printable View
What sort of features would you want to see in a spyware/adware removal program so that we wouldn't have to download 4-5 different tools to remove spyware?
What features would you want to see for a corporate world environment?
Look forward to your replies :)
:) Would be good if a few of these companies got together and joined to produce a complete suite packaged with all of the features of 5 or so all rolled into one. They could share the profits and we could enjoy the ease of removing this junk.....Don't know if there would be a conflict between the different software.
I think that with the profits that microsoft makes, gates should develope this kind of software and distribute it free with all windows o/s. And make it available to all current users,surely this could be done.
I just use spysweeper and it does the job. I used to use adaware and Spybot one after the other to be sure but I dropped both after I got spysweeper. On top of that I switch from crappy IE (on my winblows box) to firefox and I haven't seen hardly any real spyware at all.
Yeah, basically the same with me Korp. After I started using FireFox I don't even remember getting any spyware. Currently I use adaware but if I had to "combine" any two spyware application's it would be adaware and hijackthis.
I would have a central, (opensource?) database for the definitions, that all products can download from, and then the software vendors can focus on speed and accuracy + heuristics. This can apply to AV as well. And HJT works good too.
With Adware/spyware like virus/trojans prevention is always better than the cure.
Fiirst advce to the user.. ..ie user education.
a tools that blocks the crap at the door (the job that the AV's are missing-even ones with adware tools)
for removal nothing beat the combination
HJT
CWS
Spybot
Adaware
The Cleaner
The bigest problem with most of these tools is they have to be installed.. and they have "Issues" when installed in safe mode. Many new Malware will run while the machine is in safemode.
An intelligent tool that will run from a "Live CD" is currently my pick.. one that knows that the C:\ drive is the users active drive.. and identify the OS, clean the registry, remove the crap.. with out having to boot the users OS..
BTW.. On difficult jobs I will install the Clients hdd into a test Rig for scanning.. Is there a tool where I can ediit the registry of the Win OS on that drive as well?
Cheers
[edit] YES A Live CD, that has AV and Anti-Adware/Spybot prog that will look to either a Memstick or FDD for the definitions.. then you only need to burn one disk every few months rather than every time a new virus comes out.. yes I know that you can just update online useing the live cd's browser.. but that is not always possable [/edit]
Und3ertak3r-
I completely forgot about this bootable idea... I've been meaning to post it somewhere.
http://clamav.sourceforge.net <-- an opensource AV
I've always wondered how hard it would be to combine a AV like clamAV with a distribution like knoppix.... and also find a way to use the adaware reference files with a knoppix port somehow...
It would beat safe mode, ya know?
Wow... I had never thought of the live cd thing but that is without a doubt the best idea I have heard... That would rock the socks off of safe mode.
if you look into PE builder there are versions of virus scan that will run on a live version of windows... i also know that the apps that i use (command line mcaffe) also exist for linux, so in theory it shouldn't be hard at all -- the only problem you run into is that you cannot always remove everything from the registry -- i have yet to find a tool that will natively open the registry and remove the crap
bartPE gives you the option in its iso wizard to include any software you need in the iso it creates. it comes with the option to include stinger but what you add is up to you. BTW bartPE is an XP type os that runs compleatly from a CD (for those who dont know) and it'll run programs without using the system files of an infected box. the networking needs some work but its truley great to clean a mach thats so infected with virus/trojans/spyware that it cant boot or takes an hour before its usable or moveing needed files off before an fdisk if its unsavable.
http://www.nu2.nu/pebuilder/index.php?p=1
as far as features in an adware program....reg protection is number one in my book.
I don't understand the big deal with Hijackthis. The only difference is that you can read the list and choose manually what may look suspicious to you.
Why choose something that requires manual intervention and researching(in which sometimes you -simply- cant find and understand everything), when adware/spybot have the ability to preform the -exact- same tasks without 2-3 page long lists, as well as describing what each process, violation, spyware, adware, and infection does, as well as where to read up more on it.
To me it's quite similar to pulling a cart yourself, rather than using an automobile.
So it can't be about choice, because spybot/adaware both give you the detailed information as well as the choice to remove or not remove. It can't be about features, because I've compared the programs and so far hijackthis seems to be nothing new or inventive to further -prevention- and -detection-, both being primary things users need to get rid of spyware. Who wants to read up about what process might be real, what process might be fake, but has the same name, what hijack is real or blah blah blah when they are still sitting on an infected computer?
Get the jod -done- while learning about what has infected you. Spyware/adaware detects, prevents, explains, and teaches users. Bah to hijack this.
edit:
I'm not done. One of the largest things that gets me about people recommending hijack this as if it was the all empowering fix-it tool, is that this is what you get when people use hijack this:
"Can you review my log file?"
"see anything odd in my log file?"
".. blahlog file?"
"...blah log file?"
"...blah the log file?"
So in essence, people go out and google all the listings on the log to find out about the processes. This is something that has already been done, people. Adaware/spybot has already gathered up the information, and that combined amount of information per process and program has surpassed 30,000. Do you know 30,000 off the top of your head? In fact, could you google all 30,000 in the time it would take spybot and adaware to discover them, show you the information, and then remove them?
Recommending hijack this to everyone on the face of the earth not only drives IT's mad (we don't have time to research each and every process, sorry), but is a step back in program usability. Surely you have better time (and bandwidth for those LARGE log files) you could use scanning and letting the research of companies that not only receive massive donations for their hardwork, but get paid on a regular basis to make sure their products are updated near daily to keep up with 1-day (what I call it when one day has passed after discovery) adwares and spywares.
hijack this is a useful tool. nothing new or great and not very user freindly but if its your job to keep machines running adware makers like virus writers are comming out with new things faster than the anti-adware writers can include them and it is helpful to get a fairly complete list of whats happening on the machine if you want to fix it. if its free and it helps, i use it. i dont always use it if spybot/ad-aware work that would be pointless but in the case of the last CWS piece of crap nothing worked, it had to be done manually and thats where hjt helped. im familiar with what processses are supposed to be running on my machines and i check them constantly (almost gave me a heart attack when all remote locations were sent hp all-in-ones and tom cat started showing up in the process tree) and the only time looking up the process is needed is when its something different to see how it should be delt with.
That's my point exactally. Let's say you notice a process that makes no sense to you, or a registry key that doesn't make sense to you. You don't know if it belongs or doesn't belond because it isn't on google yet, but you wouldn't want to remove something you don't understand because that's just bad admin practices.Quote:
nothing new or great and not very user freindly but if its your job to keep machines running adware makers like virus writers are comming out with new things faster than the anti-adware writers can include them
What do you do? Guess?! I would hope not. Adware almost always has daily updates (usually a day behind 0 days) and spybot is a few days behind. If I want to trust my choices when google and blind-guessing won't help, I won't rely on a program that just lists 'possibilities' when a tool already exists that understands the problem and the most secure/stable way to fix it.
Wait, so it gives you a list. Nothing more? So there are still going to be (by chance) a ton of processes and rouge registry entries that you don't understand? Just scan with spybot or adaware, and bingo. Now you know what's odd according to -researched and tested material- as well as very in depth explainations of each instance. Why on earth are you going to rely on a list that requires google, when the work is already done for you and put into a singular place?Quote:
and it is helpful to get a fairly complete list of whats happening on the machine if you want to fix it.
Both adaware and spybot are free. Both have features that have been proven to speed up system recovery and repair times. Both inform you to processes and threats that not even google is very good at explaining. Am I missing something?Quote:
if its free and it helps, i use it.
It would be like sticking to the 1.4 linux kernel when a proven 2.x family tree exists that has the ability of 1.4, but with things fixed, explained, better documented, and quicker responce times.
And that is all I feel HJT should be used for, even if that. Since Spybot/adaware has the exact same ability but also have the capability to preset lists of allowed processes (meaning to deny rogue, unconfirmed processes), why even bother? Sure, HJT makes a great process checker, but not a spyware/adware removal tool. Even then, if I wanted to keep an eye on processes I would use a real processes viewer, so I could gain more information about each running process in terms of access, time, RAM/CPU usage, what called it, when it was called, what it forks and what forked it.Quote:
im familiar with what processses are supposed to be running on my machines and i check them constantly
sorry pooh sun tzu i edited my post while you were writing yours i guess...
well actually i use pslist to keep an eye on the processes. i can do it remotly that way. BTW im not disagreeing with you i see far to many hjt logs posted everywhere. it just helpful sometimes thats all
No worries! Don't get me wrong, and please understand this is not a personal attack on you or your ability to have your own opinion. :)
As you may tell though, I've quite a bit of pent up rage against HJT because of the damage I've seen it to do users, both guru and end alike. It was good for it's time, and I remember it being an amazing tool to slap on a mini-cdrom. But tools have come to further and help protect people from the dangers of the net, with more capability. So my rage is moreso concern and worry for those who depend upon older tools when sometimes the speed and dangers of the net are more advanced and need to be dealth with more quickly than in the years past. :)
i dont know any except those here that use it but like i say its not user friendly and your right, those that would let their system become so infected could destroy a system in no time with it
I use Spy Sweeper, SpyBot Remover and Ad-Aware 6 just to cross check each other
Excellent point, however I'd like to tend to think I know what's running on my system and what's running in the background. I'll scan for viruses/trojans and spyware/adware and if something come's up I don't understand, I'll investigate the file and look more into it (i.e google, etc). IT wise, you're correct pooh, it's not the best thing. It defeat's many purpose's that some application's created in the first place.Quote:
That's my point exactally. Let's say you notice a process that makes no sense to you, or a registry key that doesn't make sense to you. You don't know if it belongs or doesn't belond because it isn't on google yet, but you wouldn't want to remove something you don't understand because that's just bad admin practices.
However, I still like the ability to see my log file's and to see what processes were/is running and what application's were/is running. Good to look back and compare to see if any change's were/is being made without you knowing.
My primary suggestion, make's life ALOT easier and less strenuous (sp.?).Quote:
Just scan with spybot or adaware, and bingo.
I don't either, all of the people I worked with typically use Ad-Aware or S&D.Quote:
i dont know any except those here that use it
I am just using 2 programs and they clean me up really great...
They are S&D and Ad-Ware 6
But yah it would be cool to have a really good spyware adware tool that is 100% free that is all in one.
My major concern, and the reason I am asking this, is that for an IT manager that has to deal with 1000+ computers under his belt, can obviously never be able to run HJ this on even 10% of his machines. Specifically if his machines are thousands of miles away. Some sort of remote connection program or enterprise version of a spyware removal tool must be created. I am getting my MCSE and will soon be an IT manager (hopefully) and I know spyware is becoming more and more of an issue. It used to be you could use SB and AD to remove pests, and the stubborn ones would be removed in safe mode, but as noted before, those pests now start in safemode as well. What features, for the IT manager in mind, would you want to see in a spyware program? Good suggestions about home based users, but what about 1000+ machines? Support using MS networking? AD?
The usefulness of HJT showed itself to me in the dorms this past school year. I would always have a usb key ready with adaware, spybot, a batch file with "shutdown -a" and a sasser cleanup tool.
Whenever I got an IM from someone asking to "fix their internet" (I work for dvd borrowing privledges :cool:) I would update the ref files and cleanup tools on the key and head on over.
Safe mode, scan, safe mode / networking, scan, normal mode, scan and I'd would hope to be done. 4 times out of 5 however, something wouldn't be stopped. Viruses would be taken care of nicely it seems, but CWS and others are clever.
I haven't been doing spyware kind of work since this past year at school, but ad aware and spybot did next to nothing for hijacks when I did. Their definitions were rarely bleeding edge. I don't blame them though, CWS and otheres seemed to change really really often.
This is exactly what I would try to prevent....is to be forced to travel around with your "spyware medical pack" and deploy it on all computers. I guess the people in AO (in no offense at all) are more client type users than enterprise users...thanks for the help however.
If you want to protect your users on a wide scale, prevention is more effective than widescale, multiple solutions. Tighten down the browsers they use, or consider moving to a mozilla variant w/ tightening, add AV products acrosss all systems, Scan for viruses at the mail server (or make like Tiger Shark and remove anything with legs) and implement / enforce a strict user policy.
The only problem with this is that users bring their laptops home and bring malware into work. In that case you would need some realtime adaware action in hand with realtime AV. So far I haven't heard of any reccommended AV / Spyware hybrid solutions.
But by then malware appearances will be so slowed that a solution like a live disc wouldn't be so bad after all I guess?
What about Websense, which seems to be the mainstream enterprise-level spyware/adware/etc application?
Greens go out to MsMittens...thats one product I have yet to hear about. Thank you. I will look into it.
What are you trying to prevent.. ? The fact that machines get infected or is it to be traveling out to each PC to remove the parasite's?Quote:
This is exactly what I would try to prevent....is to be forced to travel around with your "spyware medical pack" and deploy it on all computers.
If it is the first:
Review or write a company Policy for Internet use (and users responsabilities - Check the tutorials.. I think Tiger Shark has a tut on this subject)
Lock down the machines - those that don't need Internet access - block it..
Consider useing an alternate browser to IE.(ok this can be site dependant)
Yes and install a product like Websence.
Threaten bodily harm to any user that breaks policy
Cheers
Edit: I basicly rewrote Soda's reply.. sry..
I add.. that work !Quote:
So far I haven't heard of any reccommended AV / Spyware hybrid solutions.
I
To take a topic that is dangerously off topic even further off topic..
Yes and no. Adaware and Spybot do the best they can, but they are limited. There are just some things that thay can't handle. I will give Adaware due credit though. They are developing plug-ins that are starting to target specific malware.Quote:
Both adaware and spybot are free. Both have features that have been proven to speed up system recovery and repair times. Both inform you to processes and threats that not even google is very good at explaining. Am I missing something?
There are many other applications that will list running processes..HJT was developed to target specific vulnerable areas in the registry and OS that malware takes advantage of. (poorly stated, but hopefully you understand) No other tool does that.
Me too. I cringe when I see "Run Adaware, Spybot, the Shredder, and HJT"..reminds me of Sesame Street.. "Three of these things belong together, three of these things are kind of the same.." It is not a safe tool. It removes nothing. It is simply another tool in the arsenal for when everything else has failed. And until I find something that works better, I'll use it.Quote:
As you may tell though, I've quite a bit of pent up rage against HJT because of the damage I've seen it to do users, both guru and end alike.
**************************************
Now to try and bring this back on topic..
I seem to remember Catch had a few nice posts related to this also. I'm not having much luck finding the right threads though.Quote:
Review or write a company Policy for Internet use
For what it is worth, although I don't use it myself, I have heard good things about Websence on other forums.
Cheers!!