Windows Defender Last in Review

[MikeV06]

Windows Defender came in last according to this review:

http://www.comparespywareremovers.org/reviews.html?gclid=CJiJi9nDrowCFSgRGgod_B7SSQ

Anyone know anything about this group and/or the accuracy of said review?

Thanks.

 

[Anonymous Bob]

Windows Defender came in last according to this review:

http://www.comparespywareremovers.org/reviews.html?gclid=CJiJi9nDrowCFSgRGgod_B7SSQ

Anyone know anything about this group and/or the accuracy of said review?

Thanks.

The site is registered by Domains by Proxy to hide their identity.

Looking at a couple of their higher ranked programs:
http://www.f-secure.com/sw-desc/max_spyware_detector.shtml
http://www.spywarewarrior.com/viewtopic.php?p=142985
http://forums.stuffedguys.com/index.php?showtopic=223&hl=

I've seen enough to convince me that it's a rouge site.

Bob Vanderveen

 

[Anonymous Bob]

I've seen enough to convince me that it's a rouge site.

hmmm...make that a rogue site.<g>

Bob Vanderveen

 

[Anonymous Bob]

Windows Defender came in last according to this review:

I curious about how this site came to your attention.

Bob Vanderveen

 

[Bill Sanderson MVP]

I'm convinced that is one word whose spelling will change in future
dictionaries, based on usage. The other one, as my teenagers remind me
nearly daily, is "versus", which is apparently now spelled, or at least
pronounced, "verse"--or perhaps the full spelling is now "vs".

As in Lions verse Bears...

--

 

[someone]

Consumer's Report in a recent issue also did not think very highly of WD.

 

[Anonymous Bob]

Consumer's Report in a recent issue also did not think very highly of WD.

Do you mean this test?
http://sunbeltblog.blogspot.com/2006/08/consumer-reports-testing-scandal-its_25.html
And they have now confirmed that they did not test against any spyware for
their antispyware testing. (Feel free to read that sentence again.)

Bob Vanderveen

 

[Bill Sanderson MVP]

Thanks for that post. I've always wondered about that review, which was
completely different from their previous rating of the beta product.
--

 

[Anonymous Bob]

Thanks for that post. I've always wondered about that review, which was
completely different from their previous rating of the beta product.

In all honesty, I don't believe WD would score at the top on anyone's test.
However, it irritates me to see people presenting bogus tests results to
downgrade a program that I think has a chance to develop into a decent
product.

Bob Vanderveen

 

[MikeV06]

I curious about how this site came to your attention.

Bob Vanderveen

A link on this page

http://www.sciencedaily.com/releases/2006/02/060204001054.htm

Mike

 

[Bill Sanderson MVP]

I haven't seen any rave reviews lately. I do think that the team working on
the issue knows what they are doing, though, and that all the existing
testing methodologies are probably flawed.

As I looked at it, I'm sure mad as a long time subscriber at CU's attitude
on this one--they didn't publish their testing methodology at all on that
report--and I can see why!

OTOH, I'm not sure what they did was wrong, even though contrary to the
intent of the test provider--A major point of Windows Defender is that it
isn't purely signature based. I can remember going through that test suite
when it was first made available and puzzling over the results, myself.

I suspect that if you had a product which blocked all the actions in that
test suite, you would find it quite irritating--probably worse than UAC on
Windows Vista.

--

 

[Bill Sanderson MVP]

AARGH! That's one of the most obnoxious collections of Google ads for rogue
products that I've seen in a long time.

If you have any connection to the publisher of that page, you might want to
have them check out the ads against Eric Howes rogue list:

http://www.spywarewarrior.com/rogue_anti-spyware.htm

And we all ought to see whether we can get Google to rein this stuff in,
too.

This stuff is hard to catch--I just went back to the page a second time, and
see only a single ad for Bally--so maybe Google is doing something.

--

 

[Anonymous Bob]

A link on this page

http://www.sciencedaily.com/releases/2006/02/060204001054.htm

Mike

Thank you very much, Mike.

I don't see to ads when I visit that page due to ad blocking by my firewall
and hosts file. Looking at the log from my Outpost Pro firewall I see 10
blocked ads from adhostingsolutions.com. They all use Oasis php, an open
source ad server. It's possible the link you see is a result of http
injection, but more likely the ads are from an ad broker who will take
anyone's money.

The comparespywareremovers site itself seems to my to be the work of an
scamware affiliate program.

Adhostingsolutions.com is also blocked by the MVPS hosts file:
http://www.mvps.org/winhelp2002/hosts.htm
I highly recommend it's use as a component of safe surfing.

Thanks again,
Bob Vanderveen

 

[Anonymous Bob]

AARGH! That's one of the most obnoxious collections of Google ads for rogue
products that I've seen in a long time.

If you have any connection to the publisher of that page, you might want to
have them check out the ads against Eric Howes rogue list:

http://www.spywarewarrior.com/rogue_anti-spyware.htm

And we all ought to see whether we can get Google to rein this stuff in,
too.

This stuff is hard to catch--I just went back to the page a second time, and
see only a single ad for Bally--so maybe Google is doing something.

Related links:
http://blogs.pcworld.com/staffblog/archives/004248.html
http://blogs.pcworld.com/staffblog/archives/004213.html
http://www.pcworld.com/article/id,131285-page,1/article.html

In a system where ad space is blindly sold to the highest bidder and
Google's recent ad related acquisition I would only expect the problem to
get worse.

Bob Vanderveen

 

[Vanguard]

in message

Windows Defender came in last according to this review:

http://www.comparespywareremovers.org/reviews.html?gclid=CJiJi9nDrowCFSgRGgod_B7SSQ

Anyone know anything about this group and/or the accuracy of said
review?

comparespywareremovers.org hides behind GoDaddy's Domains by Proxy
service so you don't know who is the true registrant for the domain.
The registrants have their reasons for hiding. I have my reasons for
knowing who they are. I don't deal with anyone that hides their
identity.

 

[Stuart]

It seems to me that Jha and Christodorescu's Static Analyzer for Executables
(SAFE) might be the way of the near future.
http://www.secprodonline.com/articles/48268/ What do you think?
Stuart//

 

[Stuart]

It seems to me that Jha and Christodorescu's Static Analyzer for Executables
(SAFE) might be the way of the near future.
http://www.secprodonline.com/articles/48268/ What do you think?
Stuart//

 

[Bill Sanderson MVP]

This seems like the right approach. I do wonder about the rate of false
positives, and about how you incorporate such an analysis tool into the
daily life of the average computer user. I'm quite sure that getting away
from signature-based detection a high priority for the Microsoft
anti-malware team--this is a theme I've heard for awhile, I think.

--