Yes, false positives are quite a bad thing for the
reputation of an anti-spyware product. Even worse is when
an anti-spyware outfit gets the idea in their heads that
they can leave in all the false positives that don't
totally break things and then market on the motto "we
detect 'more' than the other products" where 'more' seems
better to the uniformed user but is actually a collection
of false positives.
When I tried to report false positives to pestpatrol the
end result from the (drawn out) conversation was
something along the lines of "we know the detection is
false, but we let it up to the user to decide whether or
not to remove what is detected"
I had a chance test the trial version of giant anti-
spyware and compare it to MS-AS. Even with MS-AS beta1
with the first definitions many false positives had been
removed from the last giant release.
The acknowledgment that false positives exist and
can/will be removed puts MS-AS on a track far better than
the one pestpatrol is on.
Right now I am waiting for the beta2 build to be
released, and by that time I hope a large number of the
false positives will be resolved as well as problematic
program behavior (like allocating memory until it crashes
when getting an access denied error from the registry)
will be fixed, then I will re-evaluate MS-AS and get down
to some real beta testing/false positive hunting.
I wish there was a more significant disclaimer on the
beta that tells users who trust MS-AS beta too much just
because it says "Microsoft". Like a short non-legalese
disclaimer that says what they should expect of MS-AS
beta (and what beta means) and have several check boxes
that the user has to check to continue the install
(like "I acknowledge this is a beta and that there are no
guaranties that this program won't break my system's
OS/software" and "I acknowledge that this beta may have
false positives and I will not take the scan results as
gospel")
-----Original Message-----
Yeah--I thought about it afterwards and decided it was unlikely that you'd
be able to provide sufficient ID that I'd be willing to take your word over
others.
My understanding is that false positives are a pretty significant issue in
this area of work--we're certainly seeing some in this beta, but I believe
they are being resolved, although perhaps not as fast as some might wish.
What's your equivalent experience with Microsoft Antispyware?
--
FAQ for MS AntiSpy
http://www.geocities.com/marfer_mvp/FAQ_MSantispy.txt
I would expect that you should take that point of view no
matter who I choose to call myself. Would you have taken
my view more seriously if I had called myself "Bob Jones"
or something?
Instead of deciding whether or not to oppose my point of
view based on what I choose to call myself when I give a
quick comment to the community, check out pestpatrol, do
a scan, find a false positive (don't worry, there are
plenty), and try to get it removed. You will see what I
meant and it won't matter how well you know me.
-----Original Message-----
Should we believe an assertion about relative
reputation
from someone who
posts anonymously?
--
FAQ for MS AntiSpy
http://www.geocities.com/marfer_mvp/FAQ_MSantispy.txt
That link leads to pestpatrol information, pestpatrol is
a moderately disreputable anti-spyware program with a
reputation for absolute refusal to remove false detection
(even ones they acknowledge are false!) Maybe you could
post a link to a good antispyware site.
-----Original Message-----
Edward Torkington
wrote:
Having contacted spynet some time ago about incorrectly
identifying Crime Catcher (
http://www.crime-
catcher.com )
as a commercial key logger (err hello?) I was wondering
what the turn around is between filling in that vendor
dispute form and actually seeing the product removed?
See
http://www3.ca.com/securityadvisor/pest/pest.aspx?
id=453074702 if you
wish to understand why Crime Catcher is considered to be
potentially hostile
software. Microsoft are not the only organisation
placing Crime Catcher in
this category. If someone installed it on my PC without
my knowledge, I
would be glad that MS AntiSpyware drew it to my
attention, and offered me
the option of deciding what to do with it.
Your users just have to make up their minds as to
whether they intended
Crime Catcher to be there. If so, they can just
select "Ignore always" in
MS AntiSpyware.
--
Robin Walker [MVP Networking]
(e-mail address removed)
.
.
.
