Claria/Gain/Gator Test

[AndyManchesta]

I think all this negative feedback about Microsoft and
Claria isnt justified at all .Ive tested this myself and
MS Antispy still make it very clear that Claria is
Adware.It has changed them to ignore when the scan
finishes but thats the only difference, it still detects
claria and the option to ignore can easily be changed to
remove

I have loads of protection products installed and it was
only MS Antispy that gave me repeated warnings that i was
installing Adware on my system.Spysweeper and Spyware
guard even though the real time protection is enabled
both failed to notice the changes when i installed Claria.

It was only after the installation finished and i
rebooted to let the changes take effect that spy sweeper
then noticed Claria on my system then gave a warning ,Id
allowed the changes on 3 MS Antispy alert pop-ups and
then it even gave another warning when i rebooted that
Claria was trying to run on my pc which made it 4
warnings from MS



I downloaded and run CPU Rocket which is one of Claria's
many programs .Straight away i received Red Alert Popups
from MS Antispy for each part of the Adware that was
installing (Claria-Gain,Claria-Gain-Trickler,Claria-
Dashbar)

Heres the Alert for Claria.Gain.Trickler

WARNING : MS Antispy Alert

MS Antispy has detected the threat Claria.Gain.Trickler
trying to install a start up file on your computer.
If you would like to allow Claria.Gain.Trickler to
install the start up file click the 'Allow' Button below

Name : Claria.Gain.Trickler
Type : Adware
Threat Level : Moderate
Author : Claria Corporation(Formerly known as Gator Corp)

Advise : Moderate risk items have some potential for
adverse effects,but may be part of a wanted service,Users
may decide to ignore such programs after review.


Even after pressing allow on all the pop up alert windows
i then rebooted to make sure the install was complete and
then got another warning from MS Antispy when i rebooted
saying

Allow threat to run ?

Are you sure you would like to allow the threat
Claria.Gain to run on your system

Looking at the scan results MS Antispy are doing alot
better than some of the other well known removers


MS Antispy - 3185 Traces of Adware Claria

Spysweeper - 809 Traces

Adaware SE - 52 total references to Claria

Spybot - 20 Claria files detected


To be fair to Ad-Aware and Spybot they mostly only
detected the folders and not the files inside the folders
but removing the folders probably would of removed most
of the files that the other scanners detected .


It was very easy to clean up the pc just by uninstalling
CPU Rocket ,After i removed that and rebooted MS Antispy
detected 30 traces in the registry in the classes folder
and software folder for Gator related items which i
removed and that was the end of Claria so i appreciate
why MS Antispy are not regarding this as a big problem.

It still made it very clear i was installing Adware and
gave repeated warnings which none of my other protection
products did except spysweeper but it was already
installed on my system by then.

Hope this helps people see Microsofts Antispy is still
removing Claria and in my opinion the amount of traces
found by MS Antispy makes the other removers look really
bad considering MS is still in the beta testing stage and
doesnt cost anything.


Regards


Andy

 

[Vanguard]

I have loads of protection products installed and it was
only MS Antispy that gave me repeated warnings that i was
installing Adware on my system.Spysweeper and Spyware
guard even though the real time protection is enabled
both failed to notice the changes when i installed Claria.

JavaCool's SpywareGuard signatures are ancient, live over a year and
half old so don't expect it to detect any but the oldest malware
variations. The only functions usable in SpywareGuard is to have it
detect when an AX is getting installed, but you can configure IE to
prompt you for that (or disable AX altogether). The claim by its fans
is that the heuristics in SpywareGuard will catch what the ancient
signatures will miss. However, those rules are just as old so they
won't reflect the behaviors for the current crop of malware. The only
functions still of any worth in SpywareGuard are its browser
anti-hijacking functions. However, WinPatrol and Microsoft AntiSpyware
protect against that. SpywareGuard would tell if you were installing a
BHO (browser helper object) in IE, but BHO Demon will tell you that (and
does MSAS). WinPatrol and MSAS operate as monitors which *poll* for
changes in critical areas. They do no intercept those changes and why
you cannot configure them to block or allow the program that made those
changes: by the time WinPatrol or MSAS get around to their next poll
looking for changes, the program may no longer be loaded. If you want
to *intercept* the change as it occurs (which forces a pend of the
application that is making the change until you choose to allow or block
that change), use Prevx. The Home version is free.

SpywareGuard's signatures are way too old to be of any value. Its
download and execute protection for ActiveX can be accomplished by
upping your security zone settings. And other products provide for
brower hijack protection (along with other protections). SpywareGuard
lingered, grew stale, and is no longer of value. However, JavaCool's
SpywareBlaster is still useful but understand the author's current
stance argues with his previous stance. His new claims are that
SpywareBlaster will stop an AX control from infecting your machine when,
in fact, all it will do and all it ever did was to neuter AX controls
(by adding a killbit in the registry for the classID of the AX control).
It is NOT an anti-virus product as now claimed. It will NOT prevent
infection as is now claimed. It doesn't stop the malware from
depositing its files on your host but it will prevent those files from
being used.

I used SpywareGuard when it was effective and current. When it grew
stagnant, I continued using it for its non-signature protections (AX
warnings, BHO warnings, and browser anti-hijacking). However, other
products duplicated those other protections and eventually I got rid of
SpywareGuard. It's not an effective tool anymore.

 

[AndyManc]

Hi Vanguard

I wasnt really trying get users opinions on spyware
guard, that was just added because it was another program
with real time protection,

The point i was making was the negative feedback about MS
& Claria isnt justified because MS Antispy did better
than any of my protection products in warning me of the
changes then picked up far more traces than any other
product i tried. I didnt use any of the scanners to
remove files only to scan and record what was detected
and as you can clearly see Adaware and Spybot failed and
Spysweeper did well but still didnt compare with MS
Antispy in the amount of entries it found

BHO Demon isnt needed for me as i have XP with service
pack 2

About the changes i got warnings from MS Antispy at every
stage of installing Claria and could of blocked it at any
time and it was intercepted as soon as i tried to run
Claria and again i could of blocked it then so im not
sure why you think i should use prevx

Maybe i didnt make this clear in my post ,The claria
download was just for a test to see how well MS Antispy
did in detecting and removing the problem.

Thanks for all the info on spyware guard but i dont rely
on this for protection and im fully aware its not getting
updated anymore, like i say i just included it in the
original post because MS Antispy ,Spysweeper and Spyware
Guard have the real time protection feature.


Maybe my post was a waste of time as i think the people
who want to spread all this Anti-Microsoft rubbish will
always find reasons to knock the product and MS even
though its still a beta test and even at this stage its
overtaking most of its rivals


Andy

 

[Vanguard]

Hi Vanguard

I wasnt really trying get users opinions on spyware
guard, that was just added because it was another program
with real time protection,

Maybe my post was a waste of time as i think the people
who want to spread all this Anti-Microsoft rubbish will
always find reasons to knock the product and MS even
though its still a beta test and even at this stage its
overtaking most of its rivals

I'd like to see the Spybot S&D fans explain why that product is
configured to default to ignoring (i.e., delisting) CDilla, New.net, and
SideStep. At least, MSAS was notifying you of the existence of the pest
wherease Spybot was hiding from you that the pest existed - unless you
remember to go into the settings and un-ignore those items. I don't
remember ever seeing anyone ranting that Spybot and Macrovision were in
cohoots with each other.

 

[AndyManc]

I agree with you Vanguard it is strange why they are set
to ignore in the default Spybot setup plus you would
think spybot would make you aware these are ignored
incase you wanted to change the setting.

Id just seen all the reports on Microsoft and Claria so
wanted to try it out for myself instead of just going
with everyone else's view.

Most sites that are Negative towards MS regarding them
setting Claria to ignore fail to mention all the warnings
that MS give when you try to install Claria. They seem
abit too eager in my opinion to judge MS and from what i
saw when i downloaded Claria i cannot fault MS Antispy
one bit,It detected more than the rest and gave me very
clear warnings that i was installing Adware.

Spybot's scanner really wasnt much use for claria and
only detected 20 entries which is hard to justify when MS
found over 3000.Spysweeper scans alot more files than MS
and even that failed to pick up all the files,I could
even see it scanning through the infected folders without
finding problems

This was all the folders plus some files were created in
my temp folder for pdpsetup5105.exe

c\programfiles\CPURocket
c\programfiles\Gain
c\programfiles\commonfiles\GMT
c\programfiles\commonfiles\CMEII


I just thought i'd post abit of positive feedback for MS
because in my view they are doing a great job at such a
early stage and things can only get better for them and
at least i know now that all these reports about Claria
are probably coming from people who either havent tested
MS Antispy or from people who are just not aware how easy
it is to uninstall claria just by using the add/remove
screen although it did leave a few traces in the registry
these were easily removed by MS Antispy once i
uninstalled CPURocket.


All the best

Andy Manc