You are here : HomeTopicsAntivirus Reviews→Microsoft AntiSpyware  
     
Antivirus Reviews
Microsoft AntiSpyware
Written by lifang   
February 20, 2008 11:21

A public beta of Microsoft AntiSpyware was released on January 6, 2005. Beta software is software that has not been thoroughly tested and may exhibit unexpected behavior ranging from benign inconsistencies (i.e. misspelling in dialog boxes, inability to use certain features, etc.) to serious incompatibilities (i.e. inability to access the Internet, system crashes, etc). Beta software should never be installed on production systems. Participation in the public beta is at your own risk. Tech support is not available. Those who wish to test the public beta for themselves may download a copy at http://www.microsoft.com/spyware.

Microsoft AntiSpyware (beta1) was tested against a representative set of commonly labeled adware/spyware, including 180 Solutions, Avenue Media, BargainBuddy, BonziBuddy, Claria, CoolWebSearch, Cydoor, Dashbar, Exact Searchbar, Hotbar, Huntbar (WinTools), Internet Optimizer, IST.SlotchBar, NEO, Troj_StartPage, WebSearch, WhenUSearch, WinTools, Xrenoder, and Zango Search Assistant.

While programs in the above list may commonly be tagged as adware/spyware, not all are installed surreptitiously.

For the purposes of this review, spyware is considered any application installed surreptitiously and without the user's express approval, whereas adware is considered advertising-supported software the user deliberately or knowingly installed.

Superb detection
Microsoft AntiSpyware (beta1) achieved an overall score of 91% effectiveness in removing the active components of the adware/spyware used in the tests, tackling:

    96% of processes running in memory
    67% of start/search page modifications
    100% of BHO/Toolbars
    95% of startup vectors
    100% of other (buttons/menu items, etc)

Unfortunately, leaving even one startup vector or running process behind can result in the spyware infection reinitiating itself. Though Microsoft AntiSpyware provides realtime registry monitoring - preventing recognizable spyware from reinstalling itself - unrecognizable spyware, like new viruses, remain undetected until signatures are created.

During the tests, we encountered a few downloader components that were not detectable by Microsoft AntiSpyware (or by other anti-spyware apps we tested). After ‘cleaning' our system with these products, the downloaders would surreptitiously do as their name suggests - they would download other components to our system and attempt to reinfect it with spyware.

For comparison purposes, the free versions of Ad-Aware and Spybot achieved only 65% and 55% detection respectively in the same tests.

False positives
Microsoft AntiSpyware left several benign registry keys behind; other anti-spyware packages registered false positives - identification of non-existent threats - when scanning after the system had been cleaned with Microsoft AntiSpyware.

Other beta testers report that Microsoft AntiSpyware triggers false alarms with non-spyare/adware components, ranging from remote management tools to Internet Explorer restricted zone settings.

Vendors who find their products flagged by Microsoft AntiSpyware may wish to view the Microsoft criteria for spyware designation and file a report at the Vendor dispute page should the designation prove to be erroneous. Note that this site has experienced some outages, likely a result of heavy traffic. If unable to access the URL provided, try again at a later time.

Glitches, bugs, and crashes
Problems have been reported with the scheduling feature, history cleaning, and back button. Still others claim system crashes, an inability to access the Internet, and problems with Outlook Express after installing the beta. While our tests did not result in any system anomalies, we did encounter some program bugs that we felt could lead to infection.

For example, when prompted to allow or disallow a change to the system, "Remember this action" is the default setting. A user who makes the wrong decision will not be prompted again should the action reoccur. Additionally, alerts that do occur disappear rather quickly; oftentimes there is not enough time to read and respond appropriately. It would be preferable if the alert waited for confirmation from the user prior to closing.

Overall impression
It's important to remember that these tests involved beta product. It can be expected that many, if not most or all, of the reported bugs will be fixed prior to its being released as commercial product. The unsurpassed detection rates provided by Microsoft AntiSpyware are coupled with an interface that is exceptionally easy to use and understand. This is a product that will benefit both novice and expert, and provide a significant improvement over existing anti-spyware solutions.