What is the difference between Counterspy and MS Anti-Spyware?

[JohnG]

I have been running a MS Anti-Spyware for a couple of
weeks and it seem to doing a pretty good job finding stuff
that other apps like spybot just can't contend with
anymore. Someone else I work with had mentioned Counterspy
and that he liked it. I installed and ran it today and
other than cosmetics it looks almost identical to
Microsofts Product except it found things MS Anti-spyware
did not.
Anyone know if this is a partnership?

 

[Bill Sanderson]

They could better be termed siblings.

Sunbelt licensed Giant Antispyware's technology at one point in time, and
also the rights to updated definitions for that technology through, I think,
July of 2007.

Microsoft at a later point in time purchased the rights to Giant's
Antispyware technology, and is thus providing definitions regularly to
Sunbelt's customers.

Both companies are free to innovate and differentiate and generally develop
their respective products further.

So--at the moment, they look like close cousins, and are. I don't expect
this to remain true for long, though.

In terms of detection differences, I don't know whether Counterspy is
presently scanning for cookies. Microsoft Antispyware is not, in the builds
distributed so far.

 

[Bigbruva]

Hi guys

A few other important differences, for people who don't know Counterspy:

Microsoft Antispyware is free, Counterspy is currently $19.95.
Microsoft Antispyware is in Beta and unsupported, Counterspy is released and
supported code.
There is an enterprise version of Counterspy available now (Microsoft are
still working on what theirs will be)

Finally, just for the record, Counterspy can scan and remove cookies

HTH

BB

 

[Derek N]

My son and I have found that CounterSpy has detected 6 spywares (both
programmes installed 12 days ago) which were overlooked by MS AntiSpyware.
However, we will continue to make a comparison between the two programmes
(MS version is/will be free of charge). Don't ask me to name the spywares,
we have deleted them from the quarantine area.
Derek N

 

[Derek N]

Just scanned my computer with MS AntiSpyware followed by a scan with
CounterSpy. MS AntiSpyware found nothing but CounterSpy found a keylogger
called "PC Watch Personal Edition (Surveillance). Incidentally, I have also
SpyGuard, SpyBlast, SpyBot S&D (resident) and Ad-Aware SE was used this
morning none of them stopped or detected this keylogger.
Derek N

 

[Bill Sanderson]

Derek - a keylogger is a pretty significant find. It would be a poor
antispyware app which missed such a detection.

Is it still possible for you to look over the actual files involved in the
detection, and compare them to, say, Sunbelt's documentation of the files
involved in this keylogger, and be sure that the real executable code for
the keylogger was, in fact, present on your machine?

 

[Derek N]

Bill I have contacted CounterSpy to see if they can give me any further
information on this keylogger. Incidentally I elected to ignore it
(temporarily) so apparently it is still on my computer while I find out more
about it (needless to say I will not be going to any sensitive sites).
Attached are screen shots with details report by the CounterSpy Programme.
To find out more about this keylogger I went to the site
http://www.snapfiles.com/get/pcwatch.html and found that there is a freeware
programme called "PC Watch Personal Edition", I previously have never been
to this site so I did not pick up the keylogger from there.
I will keep you informed on the info I get from CounterSpy
Derek N

 

[Bill Sanderson]

I was able to find this in their library:

http://research.sunbelt-software.com/threat_display.cfm?name=PC-Watch

It gives few details--just the MD5 hash of setup.exe.

I can't read the JPG's very well via remote desktop from where I am
now--will look at them again later this afternoon when I can see them on my
machine directly.

 

[Derek N]

Hi Bill,
I found the comment below posted on the CastleCops discussion forum for CounterSpy. I have re-scanned and the keylogger can't be found. I must say this has dented my confidence with CounterSpy.
"Last night we release version 144 of our spyware definitions. This should fix most if not all of the false positives reported here. Please Update.
Sorry for any inconvenience this may have caused. We work very hard to keep false positive from happening.
Thanks, Phil Owens, Product Manager, Sunbelt Software"
Derek N

 

[Bill Sanderson]

I looked at the pix you posted, and I can't tell what they are detecting--it could easily be a commercial common control which might have been used in producing the commercial key logger package, but could also just as well be used in a number of other commercial products. I believe I ran into one such false positive in the past from a different scanner.

False positives go with the territory in this business--so I'm glad to hear that Sunbelt is getting them taken care of--they are bad--you can break other legitimate software on the machine, and unnecessarily worry the user--a key logger in place that you didn't know about would certainly be something that might cause you to spend a lot of time changing passwords, and even changing banking arrangements, perhaps.

--
FAQ for Microsoft Antispyware:
http://www.geocities.com/marfer_mvp/FAQ_MSantispy.htm

Hi Bill,
I found the comment below posted on the CastleCops discussion forum for CounterSpy. I have re-scanned and the keylogger can't be found. I must say this has dented my confidence with CounterSpy.
"Last night we release version 144 of our spyware definitions. This should fix most if not all of the false positives reported here. Please Update.
Sorry for any inconvenience this may have caused. We work very hard to keep false positive from happening.
Thanks, Phil Owens, Product Manager, Sunbelt Software"
Derek N

 

[Derek N]

Bill,
On the CastleCops website (found via Google) the CounterSpy forum was discussing "PC Watch Personal Edition" (keylogger) along with another called "PC SpyCam 2" which were a result of false positives. I suppose it is a case of "all's well that ends well" and chalk it up to experience. Anyway thank you for your interest.
Derek N
I looked at the pix you posted, and I can't tell what they are detecting--it could easily be a commercial common control which might have been used in producing the commercial key logger package, but could also just as well be used in a number of other commercial products. I believe I ran into one such false positive in the past from a different scanner.

False positives go with the territory in this business--so I'm glad to hear that Sunbelt is getting them taken care of--they are bad--you can break other legitimate software on the machine, and unnecessarily worry the user--a key logger in place that you didn't know about would certainly be something that might cause you to spend a lot of time changing passwords, and even changing banking arrangements, perhaps.

--
FAQ for Microsoft Antispyware:
http://www.geocities.com/marfer_mvp/FAQ_MSantispy.htm

Hi Bill,
I found the comment below posted on the CastleCops discussion forum for CounterSpy. I have re-scanned and the keylogger can't be found. I must say this has dented my confidence with CounterSpy.
"Last night we release version 144 of our spyware definitions. This should fix most if not all of the false positives reported here. Please Update.
Sorry for any inconvenience this may have caused. We work very hard to keep false positive from happening.
Thanks, Phil Owens, Product Manager, Sunbelt Software"
Derek N

 

[Bill Sanderson]

I'm glad that you were able to find out that it was a false positive before you'd taken steps to deal with the loss of confidentiality that you might have assumed otherwise.

Indeed--alls well that ends well. Microsoft Antispyware hasn't been immune to these issues either--in the end, the ability of the vendor to keep up with the flow of information--both new bugs to remove, false positives, and setting apps up as "known"--is going to make the difference between products, I suspect.

--
FAQ for Microsoft Antispyware:
http://www.geocities.com/marfer_mvp/FAQ_MSantispy.htm

Bill,
On the CastleCops website (found via Google) the CounterSpy forum was discussing "PC Watch Personal Edition" (keylogger) along with another called "PC SpyCam 2" which were a result of false positives. I suppose it is a case of "all's well that ends well" and chalk it up to experience. Anyway thank you for your interest.
Derek N
I looked at the pix you posted, and I can't tell what they are detecting--it could easily be a commercial common control which might have been used in producing the commercial key logger package, but could also just as well be used in a number of other commercial products. I believe I ran into one such false positive in the past from a different scanner.

False positives go with the territory in this business--so I'm glad to hear that Sunbelt is getting them taken care of--they are bad--you can break other legitimate software on the machine, and unnecessarily worry the user--a key logger in place that you didn't know about would certainly be something that might cause you to spend a lot of time changing passwords, and even changing banking arrangements, perhaps.

--
FAQ for Microsoft Antispyware:
http://www.geocities.com/marfer_mvp/FAQ_MSantispy.htm

Hi Bill,
I found the comment below posted on the CastleCops discussion forum for CounterSpy. I have re-scanned and the keylogger can't be found. I must say this has dented my confidence with CounterSpy.
"Last night we release version 144 of our spyware definitions. This should fix most if not all of the false positives reported here. Please Update.
Sorry for any inconvenience this may have caused. We work very hard to keep false positive from happening.
Thanks, Phil Owens, Product Manager, Sunbelt Software"
Derek N

 

[Bigbruva]

Just for the record I have tested the MS Antispyware application with PC Watch and it is correctly detected and removed with the following information:

"CapScrn ActiveX Control
Type: Key Logger
Threat Level: Severe
Author: Malloc Coding Software

Description: The CapScrn ActiveX Control enables you to capture the desktop as a bitmap file."

An interesting thread thanks Derek and Bill

BB
I'm glad that you were able to find out that it was a false positive before you'd taken steps to deal with the loss of confidentiality that you might have assumed otherwise.

Indeed--alls well that ends well. Microsoft Antispyware hasn't been immune to these issues either--in the end, the ability of the vendor to keep up with the flow of information--both new bugs to remove, false positives, and setting apps up as "known"--is going to make the difference between products, I suspect.

--
FAQ for Microsoft Antispyware:
http://www.geocities.com/marfer_mvp/FAQ_MSantispy.htm

Bill,
On the CastleCops website (found via Google) the CounterSpy forum was discussing "PC Watch Personal Edition" (keylogger) along with another called "PC SpyCam 2" which were a result of false positives. I suppose it is a case of "all's well that ends well" and chalk it up to experience. Anyway thank you for your interest.
Derek N
I looked at the pix you posted, and I can't tell what they are detecting--it could easily be a commercial common control which might have been used in producing the commercial key logger package, but could also just as well be used in a number of other commercial products. I believe I ran into one such false positive in the past from a different scanner.

False positives go with the territory in this business--so I'm glad to hear that Sunbelt is getting them taken care of--they are bad--you can break other legitimate software on the machine, and unnecessarily worry the user--a key logger in place that you didn't know about would certainly be something that might cause you to spend a lot of time changing passwords, and even changing banking arrangements, perhaps.

--
FAQ for Microsoft Antispyware:
http://www.geocities.com/marfer_mvp/FAQ_MSantispy.htm

Hi Bill,
I found the comment below posted on the CastleCops discussion forum for CounterSpy. I have re-scanned and the keylogger can't be found. I must say this has dented my confidence with CounterSpy.
"Last night we release version 144 of our spyware definitions. This should fix most if not all of the false positives reported here. Please Update.
Sorry for any inconvenience this may have caused. We work very hard to keep false positive from happening.
Thanks, Phil Owens, Product Manager, Sunbelt Software"
Derek N