Spyware Fighters
Five antispyware programs focus on tackling the latest threats.
The question is when, not if, adware and spyware will strike your PC. That's why you need a good antispyware program, and several companies specialize in delivering just that.
We tested three paid products (two of which were in beta) and two popular free products.Our chart lists the names and versions of the packages, with links to full reviews, test reports, and vendor sites or download pages.
To evaluate each program, we looked at price, features, ease of use, and performance. We contracted German research company AV-Test.org to evaluate each products ability to detect and disinfect 20 adware and spyware applications. AV-Test.org also pitted the apps against nine rootkits, programs that allow malware to install and operate clandestinely. Analysts tested the products' ability to provide real-time defense on contact with threats, as well as their propensity to falsely identify harmless files.
The beta version of Webroot Software's Spy Sweeper 5.0 emerged as our Best Buy. It earned the top scores in our detection and disinfection tests, and it offers protection against rootkits and phishing sites. It also includes conveniences such as the ability to choose between a fast system scan that takes priority over other work and a slower but less intrusive scan.
Spyware Doctor 3.8 came in a close second overall and in performance. It fought active rootkits the best, and its scanning interface offers results that are easy to read, understand, and act on.
The beta version of CounterSpy 2.0 didn't fare as well as expected. This perennial top contender offers solid malware detection and real-time protection, but it struggled with disinfection.
Of the two free programs, Ad-Aware SE Personal 1.06 produced better results, ranking fourth in performance. As the app lacks real-time protection, however, it makes a great choice for a second opinion but not much more.
The popular Spybot did the worst. One of the first antispyware programs, it was built in the proverbial home basement. It has deep, detailed settings, but these days it is just not competitive with the other options here.
Spyware, Adware, and Rootkits
In detecting actively running adware and spyware samples, Spy Sweeper and Spyware Doctor tied for first place, catching 90 percent of our test set. CounterSpy and Spybot brought up the rear, nailing 80 percent. In detecting a collection of inactive adware and spyware (apps that sit dormant on your PC until activated), Ad-Aware scored first by far, detecting 69 percent of 837 samples. At the other end, Spybot caught a mere 2 percent of samples.
Three of the five apps--CounterSpy, Spy Sweeper, and Spyware Doctor--profess to fight an increasingly important category of malware known as rootkits. Spyware Doctor detected all nine of our actively running rootkits, and Spy Sweeper detected four. CounterSpy managed to nab only two. The free tools caught none. All five programs--regardless of their rootkit capabilities--found one or two inactive rootkits. According to AV-Test.org, the apps' standard code-based scanning can detect inactive rootkits, but they need special routines to find the active ones.
Detecting malware is one thing; cleaning it thoroughly from your system is another. We tested these products' abilities to remove files and Registry changes caused by ten pieces of adware and ten pieces of spyware.
Disinfecting the spyware proved difficult: To elude security software, spyware writers continually change the way their malware behaves. In our spyware disinfection tests, Spy Sweeper and Spyware Doctor ranked first, disinfecting 65 percent of the files. Spybot came in last, disinfecting merely 20 percent of the files. (Our chart combines adware and spyware disinfection results.)
Evaluating the disinfection of adware apps is more complicated, because their changing behavior can cause antispyware firms to modify policies on them. Take the free version of HotBar, an ad-supported toolbar for Internet Explorer. Webroot classifies HotBar as adware; in contrast, PC Tools no longer does and therefore won't disinfect it, as our tests confirmed.
Overall, Spyware Doctor cleaned up adware the best, disinfecting 50 percent of the files and Registry entries. Spybot and Ad-Aware tied for second, disinfecting 45 percent of samples. CounterSpy came in fifth with a 35 percent disinfection rate. Sunbelt Software says that CounterSpy's low score is due to the beta status of the program.
All of the products have real-time adware and spyware protection except Ad-Aware; that protection is available in the Ad-Watch feature in Lavasoft's $27 Ad-Aware SE Plus. Spy Sweeper and CounterSpy detected all changes to HKCU and HKLM Run keys (Registry keys targeted by many malware threats), Windows Startup, and the Hosts file, as well as Internet Explorer Home and Search pages. Spyware Doctor missed some Hosts file and IE Search page changes. Spybot failed to catch Startup changes. See our chart for more test details.
Extra Tools
Spyware doctor has the best selection of features, with full startup, scheduled, and custom-file scanning options. It lets you set a system restore point in case you accidentally delete important files. Its also the only product to scan within some IM clients. Spyware Doctor's antiphishing protection guards you as well, by preventing access to known bad sites.
The second most feature-rich program, Spy Sweeper, kicks up the antiphishing protection a notch by analyzing suspect Web sites on the fly. In version 5.0, Webroot has removed Spy Sweeper's ability to set a system restore point and relies instead on the restorative features of the app's Quarantine (where you decide whether to remove questionable files found in scan results). Spy Sweeper also adds itself to the Windows Explorer contextual menu for quick scanning of files and folders.
While CounterSpy lacks a startup scan and antiphishing utilities, it has system restore features and four privacy tools that we didn't test for this story: My PC Explorer, My PC Checkup, History Cleaner, and Secure File Eraser.
Spybot lacks antiphishing capabilities, but it offers solid scanning, CPU-usage, and system restore options.
Giving Advice
All five products proved easy to use, but CounterSpy, Spy Sweeper, and Spyware Doctor did the best job of identifying potential pieces of malware, explaining them, and presenting options for action. I preferred Spyware Doctor's brightly colored bars and detailed levels of threat classification. Collapsible check boxes reveal the exact names and paths of suspected files and Registry entries. Highlighting the name for a threat brings up its description and advice for action.
One gripe: Spyware Doctor counted 287 doctor-themed "infections" but categorized the vast majority as low-level advertising and tracking cookies. While it took me only a few seconds to realize that most weren't dangerous, the growing count during the scan did quicken my pulse.
CounterSpy also has a good threat classification, explanation, and color-coding system, though this beta software's alert dialog boxes werent fully complete as of press time.
Spybot's scan results are full of information about potential threats and recent changes in adware policies, but Spybot stops short of the bonehead-simple "Get rid of this" type of advice that the paid applications give you.
Our recommendation is to run Spy Sweeper--our Best Buy and top performer--or Spyware Doctor, which has thorough rootkit protection. However, the results of our disinfection tests suggest that one product can't do it all, and that adding a second antispyware product, such as the free Ad-Aware Personal or a spyware scanner in an all-in-one security suit makes a nice two-fisted defense.
Photograph: Robert Cardin
"In the service business, time is money. The Micro2000 Universal Diagnostic Toolkit is worth its weight in gold for any service company. The cost of the product is quickly recovered because of faster turn around time when fixing problem systems. The product also helps control business costs simply because technicians are more accurately diagnosing what parts they require for system repairs." Compunotes
