Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 



Forgot your password?
typodupeerror
×
Privacy Microsoft IT

Microsoft Denies Claria got Spyware Exception 275

daria42 writes "Microsoft has denied its AntiSpyware application has given adware-maker Claria special treatment. The denial has been issued amid reports MS is looking to buy Claria, and is in response to security researchers' reports stating AntiSpyware had downgraded the threat level posed by Claria's adware products. The downgrade in threat level merely represented an effort to be "fair and consistent with how Windows AntiSpyware (Beta) handles similar software from other vendors," according to a statement published by Microsoft." As reader jfengel writes, though, "they neglected to mention what software that might be, nor did they publish the analysis."
This discussion has been archived. No new comments can be posted.

Microsoft Denies Claria got Spyware Exception

Comments Filter:
  • by Anonymous Coward on Monday July 11, 2005 @08:43AM (#13031943)
    There's some really excellent analysis [edbott.com] on this by Ed Bott [edbott.com].

    Compare and contrast to the lies and misdirection spread (as is normal), by Microsoft's resident spin doctor Robert Scoble [weblogs.com]. See his Ballmer interview [msdn.com], aka, The Idiots Guide to Brownnosing, to see his true colors.

    Lots of Gator-bashing is rightly occurring all over the MSDNosphere, see here [msdn.com] for a funny example. Remember, even Microsoft employees [blogspot.com] (commenting anonymously, of course) hate this idea.

    I'm guessing that Microsoft will somehow integrate Claria's obnoxious 'personal marketing' tactics into Internet Explorer 7 or the new RSS functions to get a chunk of the targeted intarweb ad market which Adsense has completely sewn up for normal web pages. We should go and tell them [msdn.com] what we think about Claria and Gator, not to mention their general business ethics. Don't let Scoble's lies deceive you, and don't hold back.
    • by bigman2003 ( 671309 ) on Monday July 11, 2005 @08:50AM (#13031973) Homepage
      As a relatively big fan of many Microsoft products...(hey, it's how I make a living!)

      Any attempt to incorporate software like Gator into Windows, or an attempt to allow software like Gator greater control...will mean I am no longer a card-carrying member of the fan club.

      Seriously, I have spent way too much time cleaning that junk off of my daughter's computer. The MS anti-spyware program works well now, but if they disable it for their 'partners' it will royally suck.

      And then I'll have to eat crow for quite a while.
      • by bill_mcgonigle ( 4333 ) * on Monday July 11, 2005 @09:31AM (#13032201) Homepage Journal
        And then I'll have to eat crow for quite a while.

        Admitting you have a problem is the first step. Welcome.
      • by overshoot ( 39700 ) on Monday July 11, 2005 @09:34AM (#13032217)
        Seriously, I have spent way too much time cleaning that junk off of my daughter's computer.

        They're solving that. Once MS buys Gator, they'll fix the bugs that make it removable.

        "Integrated into the operating system," like IE, Media, etc. The script should be familiar by now.

      • by Anonymous Coward on Monday July 11, 2005 @09:45AM (#13032300)
        OK, you're just a go along get along kind of guy, a little bit thoughtful, but more interested in leading a full life than fighting the good fight, that's all fine, I don't want to change your way or your choices.

        But please, don't fall into the fallacy that if Microsoft didn't exist, that you would have no way of earning a living, or any of the other variations along the continuum.

        The Microsoft monopoly hurt the computer industry including everybody in it from consumer to worker to investor to competitor. Monopolies charge prices that are too high and that depresses economic activity and that hurts people. It's that simple. That is the beef, and you are free to hold all the other opinions you have.

      • by mr_luc ( 413048 ) on Monday July 11, 2005 @10:45AM (#13032817)
        I think that the original poster has a point about MS competing with AdSense, but as many people will bring out, WinXP will be a gigantic installed base for the next 5 to 10 years at least.

        MS is likely hoping to counter Google by integrating an AdSense competitor directly into the browser, in a manner similar to Claria, but shipped with the next OS. However, the huge install base of previous versions of windows is likely to be dominant for the next 5 years at least.

        This is their way of ensuring that their AdSense competitor is available for previous versions of their OS -- allow their own viral marketing products to slip by.

        Frankly, it would be an intelligent tactic, and not necessarily a bad way of accomplishing their ends.

        The less scrupulous way would be to force people to upgrade to the newer OS, but they are rightly wary of losing trust, particularly with corp. clients.

        Disclaimer: hey, I'm a .NET developer ... using Pythonnet, or RDNZL. ;) Figure out for yourself where my loyalties lie.
      • by man_of_mr_e ( 217855 ) on Monday July 11, 2005 @11:44AM (#13033385)
        While I 100% encourage people to make their opinion on this known, I think there really isn't enough information on just what MS plans to do with claria.

        There are any number of scenario's, some good, some bad, as to what MS will do. They could be buying them to shut them down (and don't want to tip their cards before the purchase, thus we have their silence on the matter). Or they could be buying them for some other technology they hold, and don't plan to continue their business (or sell it off without said technology to someone else).

        I think it's a bit premature to be claiming the sky is falling, especially in light of the fact that other spyware vendors seem to reclassify vendors all the time:

        http://www.benedelman.org/spyware/threats/ [benedelman.org]
    • by cygnusx ( 193092 ) * on Monday July 11, 2005 @09:10AM (#13032073)
      Scoble did link [weblogs.com] to Ed Bott's take. If you think the Scobleizer is an echo chamber you've a lot to learn.

      And oh, it's really funny to see an anonymous coward carp at Scoble, who consistently has shown that his opinions are his own, whether it be about MSN/China or Microsoft/Gay Rights. Yes he works for Microsoft. Yes he blogs. If you can't deal with that, don't read him. But stop calling _him_ a brown-noser when we know nothing about you or your biases.
    • by Hortensia Patel ( 101296 ) on Monday July 11, 2005 @09:11AM (#13032076)
      We should go and tell them what we think about Claria and Gator, not to mention their general business ethics.

      On the contrary, we should encourage them to integrate obnoxious adware into every aspect of the browser and OS. If that doesn't persuade the world to switch, nothing will.
  • Spy Sweeper too (Score:5, Interesting)

    by professorhojo ( 686761 ) * on Monday July 11, 2005 @08:43AM (#13031945)
    I don't know if you guys know this, but Webroot's Spy Sweeper is also delisting obvious spyware. Microsoft is not alone in this! I personally think this is going to become a real problem with most spyware scanners unless laws are brought on to fight spyware more aggressively and some kind of standard list is defined like there is for viruses.
    • Re:Spy Sweeper too (Score:3, Insightful)

      by Anonymous Coward on Monday July 11, 2005 @08:48AM (#13031961)
      Evidence please. We use their corporate product and would be very irritated were this true.
    • Re:Spy Sweeper too (Score:5, Insightful)

      by Alex P Keaton in da ( 882660 ) on Monday July 11, 2005 @09:01AM (#13032036) Homepage
      For me, I am interested in open source spyware removal. I would like a product designed by people with a mindset like mine (anti all spyware). One of the issues is that anti-spyware/virus companies are getting sued by adware companies for slander etc. for calling the adware, well, adware.
      That is part of why a program that installs itself, logs your keystokes, saves your credit card info, and turns on your webcam while you are in the shower is a "petentially unwanted program" As long as anti-adware companies are suable entities, we are going to have these issues in addition to absolutely egregious issues like MS buying a spyware company.
      Next thing you know Cancer will have to be called "potentially unwated cells."
      And let us not be of the mindset, if people can't figure out how to keep spyware off their computer, they deserve it. A lot of those people are our parents and grandparents.
      Can you imagine spyware clippy- It looks like you are writing a letter to a bankruptcy attorney. Would you like me to set you up with my rich exiled Nigerian uncle?
      • Re:Spy Sweeper too (Score:5, Interesting)

        by GlassUser ( 190787 ) <slashdot.glassuser@net> on Monday July 11, 2005 @09:37AM (#13032232) Homepage Journal
        For me, I am interested in open source spyware removal. I would like a product designed by people with a mindset like mine (anti all spyware). One of the issues is that anti-spyware/virus companies are getting sued by adware companies for slander etc. for calling the adware, well, adware.

        The needed mechanism is already in windows. All we need to do is find and distribute hashes of known spyware (software permissions policy, or something like that, it works by hash, filename, certificate, and maybe location). Windows will then simply refuse to execute (if it's an executable, or load it if it's a library or control).
      • by Pollardito ( 781263 ) on Monday July 11, 2005 @10:13AM (#13032529)
        That is part of why a program that installs itself, logs your keystokes, saves your credit card info, and turns on your webcam while you are in the shower is a "petentially unwanted program"
        where exactly do you keep your computer?
      • Re:Spy Sweeper too (Score:3, Insightful)

        by 1800maxim ( 702377 ) on Monday July 11, 2005 @11:07AM (#13033017)
        If there is such a problem with lawsuits over labels, simply change the labelling system. INstead of calling it "adware" or "spyware", use description off the vendor's site. For example, Gator says

        The GAIN Network has a unique permission-based relationship with tens of millions of users. The GAIN Network enables consumers to download and use some of the Web's most popular software applications -- for free. In return, consumers agree to receive targeted promotions/ads from GAIN Network advertisers


        Instead of ad-ware removal tool, call it permissions-based Universal Uninstaller of Various Advertisment Delivery Applications.
      • Re:Spy Sweeper too (Score:3, Insightful)

        by jp10558 ( 748604 ) on Monday July 11, 2005 @07:56PM (#13038106)
        First I do think it's important to keep the definitions clear. What you describe is spyware - it tracks users without their permission, and steals information.

        AdWare is very different IMHO - it displays ads in the program in lieu of you paying for it.

        Now, I think adware can work as a business model - it works for most websites for instance, no reason it can't work for some software - like Opera for instance.

        Spyware should be flat out illegial - anything that installs as part of another program, or like GAIN pops up windows to display ads is just wrong. It's one thing to have an ad that is clearly part of the program chrome, and you know what program it's associated with as well as presumebly why it's there and another to cause more pop-ups on the web.
    • Re:Spy Sweeper too (Score:3, Insightful)

      by OglinTatas ( 710589 ) on Monday July 11, 2005 @09:28AM (#13032180)
      anti-spy software ignoring certain results will only be a problem if they also intentionally (or "unintentionally," or "incidentally" or whatever they call it when they are discovered) disable competitors' anti-spy software. I run lavasoft and spybot regularly, I have reasonable confidence in the integrity of both programs' developers. I run both because some find spyware that the others don't. If a company intentionally missed spyware, it would be underhanded, but the effect would be no different than if a company just didn't update its definition file yet. That's why you run 2 or more scanners.

      Now antivirus software, that is dangerous, because in some cases they really do interfere with each other, and therefore you have to rely on a single product to catch everything.
    • Re:Spy Sweeper too (Score:3, Insightful)

      by garcia ( 6573 ) * on Monday July 11, 2005 @09:31AM (#13032202)
      I don't know if you guys know this, but Webroot's Spy Sweeper is also delisting obvious spyware.

      This is why people should not be supporting commercial entities that are selling spyware detection/removal software.

      This should all be free, open source, software that includes a community updated database of spyware junk. That way money and corruption stay out of the mix.
  • A question of trust (Score:5, Informative)

    by TripMaster Monkey ( 862126 ) * on Monday July 11, 2005 @08:45AM (#13031948)
    From TFA:
    "Windows AntiSpyware (Beta) continues to notify our users when Claria software is found on a computer, and it offers our users the option to remove the software if they desire."
    The issue here is not whether or not Windows Antispyware still detects Claria products...the issue is Microsoft's recommendation on said products. While it is true that users still have the option to remove Claria products if they so choose, the fact is that users had the option to keep Claria products on their system back when Microsoft was recommending removal. The insinuation that this change offers users more choice than previously available is tacitly false.

    The real issue here is Microsoft abusing their position of trust within the general computer user community. No, I'm not talking about people like us here...I'm talking about Ma and Pa Computer User...the ones who see a virus or spyware warning and panic. Many of these people rely upon the recommendations offered by the spyware detection/removal applications to decide on how best to manage their systems. By artificially upgrading Claria products from 'remove' to 'ignore', Microsoft is taking unfair advantage of these users' trust.

    Also from TFA:
    "All software is reviewed under the same objective criteria, detection policies, and analysis process," Microsoft claimed. "Absolutely no exceptions were made for Claria."
    As far as I'm aware, no other spyware removal application has promoted Claria products in this fashion. Until Microsoft publishes these 'objective criteria', and shows how Claria products managed to get upgraded from 'remove' to 'ignore' under them, we will have no choice but to assume more ulterior motives.
    • by doublem ( 118724 ) on Monday July 11, 2005 @09:26AM (#13032169) Homepage Journal
      This all makes sense when you realize one key, critical piece of information.

      First, a quote:

      Has Microsoft given in to vendors' threats? Or forgotten how badly "adware" damages the Windows experience (ultimately encouraging users to switch to other platforms)? [benedelman.org]

      Now, the key, critical piece of information.

      Microsoft's anti-spy ware devision is headed by a MAC user! You see, MAC zealots have infiltrated the Microsoft hierarchy, and are plotting it's downfall from within.

      As a matter of fact, this is a pervasive presence, weaving into all levels of the company.

      Think about it. Doesn't Clippy make much more sense as MAC sabotage than as an actual feature? No doubt someone floated a mock up with the note, "Looks just like something I saw at the last MAC expo."

      Architecture changes that mean the XBOX II won't be able to run XBOX games, the endless delays in Longhorn, the XP default theme, the differences between XP Home and XP Pro, these are all contributed by MAC users who are gradually whittling away Microsoft from within.

      And because Microsoft has been shamelessly copying the MAC for so long, all they have to do is float the rumor that MAC is going to do something, and Microsoft programmers and management throw themselves into trying to replicate it, or at least toss together a half asses rip-off of the feature / technology.
    • by keraneuology ( 760918 ) on Monday July 11, 2005 @10:32AM (#13032717) Journal
      The issue here is not whether or not Windows Antispyware still detects Claria products...the issue is Microsoft's recommendation on said products. While it is true that users still have the option to remove Claria products if they so choose, the fact is that users had the option to keep Claria products on their system back when Microsoft was recommending removal. The insinuation that this change offers users more choice than previously available is tacitly false. The real issue here is Microsoft abusing their position of trust within the general computer user community. No, I'm not talking about people like us here...I'm talking about Ma and Pa Computer User...the ones who see a virus or spyware warning and panic. Many of these people rely upon the recommendations offered by the spyware detection/removal applications to decide on how best to manage their systems. By artificially upgrading Claria products from 'remove' to 'ignore', Microsoft is taking unfair advantage of these users' trust.

      The real issue is "where does Microsoft want to go tomorrow"? Today they downgrade the recommendation on what to do with Claria. Microsoft revolves around the long-term strategy and to believe that this is one of the few times when one of their decisions isn't a stepping stone towards something else is to take the bet on the horse with the longest odds on the field.

  • by Underholdning ( 758194 ) on Monday July 11, 2005 @08:47AM (#13031953) Homepage Journal
    "We firmly believe that people should have complete control over what runs on their computers," Microsoft added."

    Well, 10 million compromised windowsboxes seems to contradict that belief.
  • by oddheart ( 898891 ) on Monday July 11, 2005 @08:48AM (#13031962)
    From the bottom of that ZDNet article:
    "'We firmly believe that people should have complete control over what runs on their computers,' Microsoft added."
    Anyone else find that funny?
  • by Da Fokka ( 94074 ) on Monday July 11, 2005 @08:50AM (#13031970) Homepage

    Please take off your tin foil hats, guys!

    One might say that Microsoft is primarily responsible for the entire spyware issue (although I suspect Firefox's track record would be worse, albeit better than IE, if it were as popular). But MS AntiSpyware is a fine piece of software, however. It's easy to use and does its work better than many of its competitors.

    • by TripMaster Monkey ( 862126 ) * on Monday July 11, 2005 @08:56AM (#13032015)
      It's a bird...it's a plane...it's AstroTurfMan!

      Microsoft's AntiSpyware worked well because Microsoft didn't write it...Giant did. Back before Microsoft got their hooks into it, it was a fine piece of sofware...past tense.
    • by kahei ( 466208 ) on Monday July 11, 2005 @08:58AM (#13032026) Homepage

      It's not a fine piece of software. It _was_ one and it has been intentionally made otherwise.

      I'm keeping my tinfoil hat firmly on. Imagine if Ford bought the company that checks for defects in cars, and the next week all Ford defects were considered as desirable behavior. Imagine if Monsanto bought the company that decides whether Bovine Growth Hormone is bad for you, and the next week it was announced that BGH is just fine... actually, you don't really have to imagine that.

      This is a tiny attempt to extend to the software industry what is already standard in the 'traditional' industries; the use of quality and safety regulating entities to discourage competition rather than to protect the consumer.

      I _will_ say that I don't expect MS to be as evil about it as Monsanto et al for a good many years yet.

    • by Alien Being ( 18488 ) on Monday July 11, 2005 @09:24AM (#13032154)
      "Please take off your tin foil hats, guys!

      Please take your head out of the sand.

      "One might say that Microsoft is primarily responsible for the entire spyware issue..."

      No, thousands of knowledgeable people *do* say it.

      "I suspect Firefox's track record would be worse, albeit better than IE, if it were as popular"

      That's a moot point.

      "MS AntiSpyware is a fine piece of software..."

      Penicillin is a fine medicine, but its makers don't go around spreading syphilis.
  • bah (Score:4, Funny)

    by Janek Kozicki ( 722688 ) on Monday July 11, 2005 @08:52AM (#13031987) Journal
    I have 2modpoints left, and I'm in bad mood. So I wanted to mod insightful a comment like: "microsoft sucks!" but there was no comment like that. What's up with you guys?
  • YRO? (Score:5, Insightful)

    by Tim C ( 15259 ) on Monday July 11, 2005 @08:54AM (#13031997)
    MS's anti-spyware tool isn't the only one available, it isn't bundled with the OS, it doesn't attempt to prevent the user from installing other anti-spyware tools - in short, it is one option of many and you are free to install others as well or instead of MS's one.

    Why is this in YRO? What right is being infringed or threatened? If you don't like MS's anti-spyware tool, don't use it!
  • by cablepokerface ( 718716 ) on Monday July 11, 2005 @08:55AM (#13032006)
    *chuckles*

    this is /. NOone believes it. doesn't matter what it's about.

    [evil demonic laugh]MWHAHAHAHA ![/evil demonic laugh]
  • by farker haiku ( 883529 ) on Monday July 11, 2005 @08:56AM (#13032013) Journal
    fair and consistent with how Windows AntiSpyware (Beta) handles similar software from other vendors,"

    So, um, what other program has had it's threat level changed?
  • by binkzz ( 779594 ) on Monday July 11, 2005 @08:56AM (#13032016) Journal
    is that they're also using AntiSpyware for motivating people to remove competing products. For instance, MSN Plus and RealVNC will come up in a search, and although I don't particularly like MSN Plus myself, I don't think it's really fair.

    The small print says they may not be actual spyware, but potentially dangerous items, most unknowledgable people will just remove them anyway, because it's the default option.

    • by chrisnewbie ( 708349 ) on Monday July 11, 2005 @09:24AM (#13032158)
      Well you can add dameware and pc anywhere to your list because they are distant remote control software and some spyware will threat them as dangerous.
      Why doesnt remote desktop show as a possible threat?
      It's easier to connect to a remote host with that software!
      OH yeah right,,,it's a ms product!
    • by Tezkah ( 771144 ) on Monday July 11, 2005 @12:22PM (#13033745)
      MSNger Plus! is a great program, but it asks you to install an adware IE toolbar when you install it. The last time I ran MS Antispyware it recommended that you keep it.

      At least MSNger Plus! doesn't automatically check the "Yes, install this" box for the adware, you'd have to ignore the warnings, then click "YES, INSTALL THIS" to get it. I use MSNger Plus! and don't have any spyware at all.
  • Master Plan (Score:2, Funny)

    by Freaky Spook ( 811861 ) on Monday July 11, 2005 @08:57AM (#13032019)
    1. Microsoft Buys anti-spyware, 2. Microsoft buys up all spyware company's 3. Microsft delcares the war on spyware is won & emails 7 billion email addresses announcing that the WinXp SP 15 will be "Spyware Free"
  • by wpiman ( 739077 ) * on Monday July 11, 2005 @08:57AM (#13032020)
    This simply reaffirms my belief in the running of multiple anti-spyware programs. If MS won't remove a certain piece of Spyware because of business/political reasons- adaware will get it- or Spybot will.

    PS. M$ sucks.

  • by FidelCatsro ( 861135 ) <(moc.liamg) (ta) (orstacledif)> on Monday July 11, 2005 @09:00AM (#13032033) Journal
    Does anyone know of any OSS that is dedicated to the removal of ad-ware and spyware.
    I manage a number of windows machines at the office and wit he recent declassification's without good explanation that has occurred in the sector i have lost all faith in most of the products .
    An OSS solution would be wonderful (hell i would rather switch the machines to linux , but that is not an option right now due to certain programs that are required by the company) .
    Commercial solutions always to me seem rather susceptible to legal action for the classification and or bribery.
    • by slavemowgli ( 585321 ) on Monday July 11, 2005 @09:14AM (#13032099) Homepage
      It's not FOSS, but as far as I'm aware of (which admittedly isn't that far), there is no big company behind SpyBot S&D [safer-networking.org], at least. It also offers an option to immunise IE by blocking known bad webpages, which I think is an important option even when you don't run IE as your default browser - there are many apps that embed it. Generally, the problem of unjustified whitelisting of spyware can be solved by running more than one tool. It's a crutch, of course, but it works; what one vendor was bribed to gloss over, another vendor will pick up.
    • And if you don't mind using hostfiles (I know, I know - bad word), then you can download some fairly updated ones that direct a lot of Adware related hosts to 127.0.0.1 or 0.0.0.0 from here [remember.mine.nu].
  • by Arthur B. ( 806360 ) on Monday July 11, 2005 @09:04AM (#13032051)
    MS antispyware should rather show the threat level the user represents to the computer by analyzing the number of unused files squirreled on the desktop, viruses & spywares on the system, time spent on configuration panel, number of time a double click is performed when a single click is expected etc.
  • I get it! (Score:3, Insightful)

    by roman_mir ( 125474 ) on Monday July 11, 2005 @09:10AM (#13032075) Homepage Journal
    MS is going to buy off all businesses that have anything to do with delivering any kind of unwanted software to users' computers. This maybe part of their plan for security on MS platform :)

  • by CaptainZapp ( 182233 ) * on Monday July 11, 2005 @09:12AM (#13032083) Homepage
    "fair and consistent with how Windows AntiSpyware (Beta) handles similar software from other vendors,"

    Hmm, I'm sure they wouldn't lie and I shall read the statement as soon my flying pig is back.

    It's on a mission, surveying the earth in order to prove that it's flat.

  • by dtfinch ( 661405 ) * on Monday July 11, 2005 @09:19AM (#13032132) Journal
    Is that Claria isn't the only malware to get this exception?
    • by jfengel ( 409917 ) on Monday July 11, 2005 @10:15AM (#13032552) Homepage Journal
      That is what they're saying, though they don't say which other malware they're comparing it to.

      If you read their whitepaper, they probably consider the thing to be relatively low on the damage scale, which is kinda true: it doesn't wipe your disk or log your keystrokes. It is sending out personal info, but it's not sending out your credit card numbers. It's just tracking your browsing habits.

      I'm not saying that's good, especially since it's potentially worse than the declared intent if there are any bugs or undeclared "features". But the declared intent is comparatively benign. The tin-foil-hatters will tell you that any privacy breach is major, and they're not wrong, but it's not the reason I'm ticked off.

      The real evil with Gator is how hard it is to remove. That's what makes the thing truly malicious malware. The "ignore" setting should only be applied to software that can believably be removed by uninstalling it. That's not Gator, at least not last I heard. (I'm sure not gonna install the thing to find out.)

      If you install it and you like the popups and don't mind people tracking your browsing, well, bully for you. But if you don't like it and you can't get rid of it, that makes it an even better candidate for the "quarantine and remove" setting even than a keylogger that can at least be deleted easily.
  • confusing the user (Score:2, Insightful)

    by nealfunkbass ( 701961 ) on Monday July 11, 2005 @09:27AM (#13032175)
    It is good that the Claria stuff is still being detected, and maybe it is not necessarily bad that the default recommendation has changed, if one were to assume that all similar products were treated in the same way.

    However, with some programs having the "ignore" recommendation, and others having "quarantine", it will probably give users the impression that Claria is at least somewhat ok, or something like that, which it is not (at least in my opinion).

    Actually, what kind of impression does that give someone who doesn't know any better?

    Something is detected by the spyware scanner, but the default recommendation is to leave it there.

    "Hey, this one is ok because it only spies me or invades my privacy a little bit."
  • by astrashe ( 7452 ) on Monday July 11, 2005 @09:39AM (#13032257) Journal
    I'll probably burn some karma here, but I'm a big fan of the MS anti-spyware product.

    There are really two issues. The first is the catalogue of what's spyware and what isn't. I don't know if MS's program is good at that, and the stories we're reading are sort of disturbing. I buy all of that.

    But the second issue concerns the product's ability to remove nasty stuff on your machine. And their anti-spyware app is very good at that.

    It's much better than spybot or ad-aware, in fact -- especially with the stuff that scatters hundreds of files and registry entries around your system and reinstalls itself after you try to clean it with another program.

    There's nothing that will prevent you from running another program to clear off the stuff that MS's product doesn't get rid of. So don't let this situation prevent you from running this software to get rid of other stuff. It's good at it, and it's free.

    • Let me give you something to test, you'll most likely enjoy this.

      If you've got a spare machine that can handle a 2k/XP install, install either of those OS on the computer. Grab MS Anti-Spyware, Grab Ad-Aware, and Spybot S&D. Install all of them.

      Let MS-AS be your default scanner/detector of on the fly spyware threat detection instead of Spybot. Now go find a webpage (or deliberately install thru some other program) the ISTsvc (Internet Search Toolbar) spyware. Now, run either ad-aware, or spybot, and try to remove it. Worked, right? Ooops, notice how MS just trusted a change to your computer? Okay, that's detcting spyware being removed. You should get another notification immediately afterwards showing that another change has been allowed within windows. Go to MS-AS security section, look up all the alerts you've gotten. Scroll down that list. Notice a trusted change by MS-AS allowing ISTsvc to reinstall itself on your computer?

      Now, I admit I may not be totally correct. I have yet to do a vice-versa and allow Spybot S&D to be the on the fly detection program. But from what I've noticed, companies providing anti-spyware solutions seem to have incentive to sneakily allow some unwanted stuff on your computer; they eventually want you to pay for their full version of the program, which you'll hope will do the job even more thoroughly. They've set out a mousetrap in order to try to make more money off of you.
      • by astrashe ( 7452 ) on Monday July 11, 2005 @11:58AM (#13033507) Journal
        I'd like to try that because it would be interesting, but I'm sure that what you say is correct.

        I don't dispute that they're letting some things through, and that the decisions they make about what gets through aren't always in the end user's best interest.

        I don't have a lot of experience with spyware, because I mostly run linux, and on windows I find that it's not too hard to avoid it in the first place. I'm not an expert. But the other day I had to clean off someone else's machine that was infect with the IBIS toolbar.

        I couldn't get rid of it with spybot or ad-aware. They'd find a bunch of junk and clean it off, but you'd reboot and it would come back.

        When I ran the MS tool, it found more than 500 files and registry entries for it, and it cleaned them off. When I rebooted, it didn't boot cleanly (missing files were being referenced in the registry), and I thought "oh no, here we go". Then I started to get pop up windows about things trying to make changes. It told me to rerun the scanner. I did, rebooted again, and it was clean.

        This is speculative on my part, and I could be wrong -- so people, please don't yell at me too much if I am, I'm aware I'm on shaky ground here -- but I had the impression that the MS tool was tagging things as spyware *because* they were trying to change registry entries and hijack the browser.

        In other words, they weren't just using a file name, or a signature of a file to tag something as spyware, they were looking at the behavior of the thing. If a process tries to do something nasty, they follow it back to the source, and nuke it.

        If that's what it's doing (and again, I think, but don't know, that it is), it's a big innovation. It's a good way you to fight spyware that generates lots of random files with randomized data and random names to reinstall itself.

        MS, for all of their flaws (and they have plenty, I don't want to be an apologist) has vast resources and a lot of smart people. Their tool lets people report back on infestations automatically. They can throw people at the problem and code for new problems almost as soon as they arise.

        They understand the OS better than anyone, obviously, and can use that knowledge to track down the source of reinstalls more effectively than comparatively small outsider shops.

        That doesn't take away from the negativity of their deals with the devil. That sucks, they shouldn't do it, and they're really shooting themselves in the foot over the long run by making those deals, because no one has a bigger stake in making windows solid and trustworthy than MS, and this crap really undermines that effort.

        But if you have IBIS, and you need to get rid of it, their tool is terrific. If you have that problem, don't let the fact that they've decided to be deliberate bad at ISTsvc removal prevent you from using it for IBIS. That's really all that I'm saying.

        Don't stop running spybot or ad-aware. But add the MS tool to your arsenal. It does a lot of good stuff.

        I will try to run your expiriment so I can learn more about this... thanks for posting about it.

    • by Master of Transhuman ( 597628 ) on Monday July 11, 2005 @12:50PM (#13034020) Homepage
      "It's much better than spybot or ad-aware, in fact"

      Not from what I've read from numerous people who have tried it, here and on Usenet.

      It finds some stuff the others miss, it protects against some stuff the others miss - but so do they in relation to it.

      Adding the MS product to your bag of tricks is reasonable, but dumping any other antispyware product would be a mistake, as you said.

      But saying it's MUCH better than Ad-Aware or Spybot I think is incorrect.

      And finally, the point of the article is: you can't trust it anymore. That simple.
  • by J Barnes ( 838165 ) on Monday July 11, 2005 @09:39AM (#13032258) Homepage
    In related news:

    Microsoft has made a stunning leap forward in the field of bicycle locomotion technology, developing a system of operation that allows for the appearance of forward progress whilst routinely backpedaling.
  • by Scorpius-nl ( 827901 ) on Monday July 11, 2005 @09:51AM (#13032345)
    Microsoft is only a Marketing Company, I hear that alot, and it makes sense.

    When microsoft bought Giant their antispyware program was one of the best. When microsoft re-launched it under Microsoft AntiSpyware (and marketed as a new product), it got raving reviews.

    The effects are that people will start to trust MS antispyware, and will be starting to ditch their other antispyware programs. As soon as the majority of the people are used to the program, microsoft can dictate their own terms to what is spyware and what is not. Ofcourse microsoft will never go too far, but the changes will be "subtle", not enough to get angry about and still have solid bunch of supporters defending the program for microsoft.
  • by JasonBee ( 622390 ) on Monday July 11, 2005 @09:58AM (#13032404) Homepage
    I think this is going to MS's way of getting "patch management" into the mainstream.

    Think about it...delivering A/V and system updates via clickable Ads - brilliant!

    Oooohhhh...and so so profitable.

    JB
  • Well MS is badly placed for any kind of critics towards other companies. Didn't MS themselves put spyware onto people's computers before they got nailed for it?

    This denial just proves once again MS' dishonesty towards customers, may they be corporate or individuals.

    Why don't people act upon the fact that MS is just lying so blatantly? Oh sure, their lawyers are good, but lawyers can't do anything against massive boycott!

    Action, to the streets dammit! Make piles of MS CDs to melt!
  • How they do that (Score:3, Interesting)

    by jamesl ( 106902 ) on Monday July 11, 2005 @10:19AM (#13032587)
    Windows AntiSpyware (Beta): Analysis approach and categories

    http://www.microsoft.com/athome/security/spyware/s oftware/isv/analysis.mspx/ [microsoft.com]

    This white paper provides an overview of the approach and criteria categories currently used by the Microsoft research team to analyze and classify software.

  • by m2bord ( 781676 ) on Monday July 11, 2005 @10:31AM (#13032709) Homepage Journal
    can't someone create a program to tell a user every program/service that is running on his/her pc (including those that like to remain hidden) and let the user decide if they want that piece of software in the first place?

  • by kryptx ( 894550 ) on Monday July 11, 2005 @11:10AM (#13033055)
    Following the link to the original story on the status change leads to this page [blogspot.com] detailing the list of software that has been downgraded. Screenshots included for the doubtful.

    ...including certain WhenU adware programs, WebHancer and Ezula Toptext. So the Claria downgrade is quite likely part of a bigger picture regarding Microsoft's listing criteria for adware.
  • by Nom du Keyboard ( 633989 ) on Monday July 11, 2005 @12:18PM (#13033713)
    Think about it folks. Would Microsoft EVER admit they had done this? Screw over the users for crass commercial gain.

    Let me give you a hint.

    NO!

    So if they're going to make any statement about it at all, this is the one it will be. Anybody having trouble understanding this?

A failure will not appear until a unit has passed final inspection.

Working...