Windows Defender statistics released

Reply to topic
29 posts
What would you say if I told you that Windows Defender Beta 2 discovered 22 million pieces of spyware in its first three months of existence?

Full Post
Ummm... Removing 14 million out of 22 million infections is a good ratio?
Considering how screwed up some machines are from spyware and viruses, as well as the average level of user intelligence, I'd say that's a pretty good ratio.
Statistics are one thing, but how about resource issues? MS has yet to address why thing routinely pegs a CPU for 50-75% for minutes at a time, and then drops off the radar completely, only to pop it's head back up hours later and pull the same shit.

Don't get me wrong, in Safe Mode, with System Restore off, this tool is rather effective, but for real-time system monitoring and scanning, Grisoft's Ewido has it smoked. Too bad Grisoft can't see that it would be better to offer the full program for free.

I thought MS's Antispyware tool was a far better offering, and the fact that it told you things that were happening, when they happened, are exactly the things I want to see. I've only seen Defender go off when the shit and the fan are about to co-mingle.
I guess if you're going by Microsoft standards, then 63% would be considered good. But after helping clean out several infested machines that had Defender installed, I would say that it's kinda like a leaky roof. It's better than nothing but it ain't going to keep you dry.
It's easy for a veteran tech with the right tools (PE shell with registry hive loading, Autoruns, Process Explorer, CLI scanners, etc) and intimate knowledge of Windows internals.

However, for the average consumer armed with automated software, successful cleaning's a total crapshoot. Building a program that can do it from within an already-infected environment is damn near impossible.

I clean spyware off of consumer PCs for a living. I'll usually deal with 60-100 PCs a month. I'm not in a depot somewhere far, far away - I deal with the people as much as I do the machines. It's been a huge, massive problem for the last 3 years and, ironically, it's kept this old-school tech employed.

Given what I've seen of MS's competitors (which is quite a bit), 14,000,000 cleaned out of 22,000,000 infected is about on par with some of the better stuff out there. Even the best stand-alone tools like Spyware Doctor and Spy Sweeper can't successfully deal with certain types of memory-resident trojan/spyware infections on their own and, unfortunately, those tend to be very widespread.

Bottom line with Defender: It'll take a long time before it (along with OneCare) knocks the reigning champs off my recommendation lists. I recommend stuff that keeps my clients from calling back with problems! Uneffective software is a quick casualty when you guarantee your work... Wink
How the heck can you guarantee that a Windows Machine cleaned of Spyware will stay that way. I mean, you do what you can, clean out what's there, mandate Firefox/Opera usage. Install some tools, but good lord! Short of insisting on the usage of a Knoppix Live CD with Open Office and Firefox, with saved files to be placed on a Flash Drive, I have no freaking idea how you can guarantee a Windows machine will stay Spyware-free!?
I had the um, opportunity, to fix a spyware encrusted winXP machine a month ago, and decided to run a little experiment. After running ad-aware and norton anti spyware, defender removed more spyware than the other two combined. (This machine had about 1800 reported infections. It was so crazy I wanted to image the drive, just for posterity...kinda like taking a picture of the largest tumor or something.

I reinstalled XP on principal alone, but figured the results of the scans would be entertaining.
Both Adaware and NAV suck for antispyware.

The reigning champions are SpyBot, SpySweeper and SpyWareDoctor (see Windows Defender comes nowhere near those and against a bad spyware infection it is worthless.

Funny part is that Windows Defender came out of Giant Antispyware which was really very good. At the same time CounterSpy came out of Giant Antispyware and it has stayed good. With all its resources MS couldnt keep up with a small antispyware company like the makers of CounterSpy starting at excactly the same place.
Hell, I can't even guarantee my own system will stay clean. Everybody makes pretty serious mistakes every once in a while.

Luckily I've never been infected with anything that worked. I've nearly been infected by two viruses in the past from being an idiot, but luckily the first one was plain out nonfunctional (bad code?), and either the second one was also crap or it wasn't compatible with Vista.

Both with less damage than the time when I was a kid and deleted DOS. I clicked on the wrong folder and just went through all the dialogs without looking... now, ten or so years later, I look at EVERY question windows pops up to make sure it's good. Never, ever repeating that one...
Has anyone else noticed spyware ramping up attempts to hijack systems? I've had 3 PCs in the last week with spybot, NAV9 and defender running, yet spyware has managed to change critical windows system files requiring a nuke. None of these programs stopped the spyware, or could remove it..though they did a great job of detecting it!

In the last 2 months I've downloaded 3 different removal tools for specific spyware infestations. Ewido is an excellent option for those who can afford it, but for the rest of us dealing with spyware infestations is becoming ridiculous. Defender is simply too far behind the 8-ball. Open source anyone?

I really do hope that Vista has better protection for spyware and that a limited user account will in fact be useful for home PC owners, instead of relying on admin accounts to accomplish basic tasks.. giving a free door to viruses and spyware.
God, I'm so happy I don't have a PC at home anymore. And I stay clear of anything fishy with my work PC. Keeping your machine virus and spyware free is a job in itself.
I don't use it or recommend MS security products, at one point I did and it total my system, took 3 solid days to get rid of every troaqjn\spyware module which MS missed.

Have been using bitdefender for 3 months, never had a problem with spyware etc.
it's kind of funny, with proper lock down both on the pc and the network, none of my PCs (4 on my home network) have ever had one piece of spyware and all are running Xp SP1. More time and effort should be spent building a good lockdown tool then on a removal tool. So the masses can lock down their installs.
A spyware prevention program that actually works would be nice. It's great to clean things out, but that's reactive, where's the quality proactive software? Recommendations?

As it sits now, I run F-Secure and SpyBot. Besides using Firefox and not installing stupid toolbars and garbage on my machine, what else can I do to help me avoid getting the damn things in the first place?
Hunh? I've never gotten spyware with my XP box.

Don't install anything that's not from a major vendor, run a firewall, keep up with you antivirus, and use Firefox with No Script installed.
YES 14 million out of 22 is good, if you notice P2P programs are in the list of spyware, i'd stand to bet that other 8 million or so were p2p programs that people set to "ignore" instead of "delete"

Spaceman: That's exactly it, the best feature of Windows defender is the *real-time protection*.

That (aside from it being free) is why I recommend Defender to most newbies. Once you're infested most spyware apps are just too confusing for the average user, and there's no guarantee they'll be able to clear out your system even if you're experienced. Defender stays out of your way until it detects something suspicious.

Aggressive cleaning tools are fine after disaster has struck, but the point is to not let it get on their in the first place. AFAIK, Defender is the only free spyware product that offers real-time protection.
-- SpacemanSpiff0x0 -- Thankfully, I haven't had to deal with this stuff in a couple years. But unless things have drastically changed since then, I found SpyBot's resident "Tea Timer" utility with a little end-user training highly effective. It will basically prompt a user to allow/forbid any significant change to their browser or registry.

Some users get intimidated by these prompts and don't know what a BHO is, or whether program X changing registry key Y from A to B is something they should allow to proceed always, just that one time, or never. SpyBot also had immunization updates you could instruct them to keep up with. SpyBot even had a start-up utility that provided some info on all the TSRs that squat in people's RAM and bog down boot times. Make sure to switch to advanced mode to have acess to all this stuff.

Also, HijackThis is a valuable tool if prevention should fail.

Seriously, my Windows XP Pro based home system has been running for over a year with ZERO adware/spware/viruses. I get software cracks from places Google tells me not to go, I surf porn with my wife. Did I just say that? No infections. That's on the web side of things....

I've been lucky to not get bit on P2P or Bit Torrent, and I don't use any messenger programs, not because I don't like them, but because I don't need to. I've also been lucky to not get any email viruses, but I'm not dumb enough to open any attachments.

So that being said, I attribute it to No Script, the makers of which should be given the Nobel Prize, Mr. Burns' Trillion Dollar bill, and a guaranteed shot into a virgin filled hot tub in heaven.
"uncleanable" spyware? I picked up a little nasty on my aux Win XP system. It apparently has two tskmgr~1.exe processes running. When NAV or defender kills one process, the other instantly regenerates another. Apparently NAV and defender don't know about synchronized processes and until they do, this little POS spyware in uncleanable.

Any suggestions?

- AndrewZ
Originally posted by AndrewZ:

Any suggestions?

- AndrewZ

Do said processes still load in safe mode?
Just browse in a sandbox in the first place. no virus or spyware will ever bother you again...
AndrewZ, if you know where the bugs are hiding, you can boot to a Live CD and nuke the files/folders from there. I had a lappy I worked on with SurfSideKick on it, which had made itself a system folder and even had a repair@#$%.dll built into the system32 folder to repair any damage that a spyware scanner would cause.

I used BartPE to boot and run from the CD, then manually rip out the bad files/folders. Any Linux Live CD will do the trick as well. BartPE comes with the added benefit of having installed software and plugins that can copy the partitions, or even edit the registry if need be.
The fix? Go back to dialup! I don't get any infestations since switching from DSL to dialup. Period.

Of course, I also don't have any inclination to surf or download any longer... Wink
Originally posted by _NARC_:
Hunh? I've never gotten spyware with my XP box.

Nor have I on two XP machines. In fact, have never had any detections - safe, sensible, usage practices are all that is required.
Indeed. I second that. Safe, sensible usage practice. Doesn't work for everyone though I'll agree to that.
I'm the product manager for Windows Defender at Microsoft. Actually - the reason why in the 3 months we detected 22 million packages and only removed 14 million has to do with the fact that we do not automatically remove everything we detect. Spyware/adware is unlike viruses/worms in that it is a gray area and someone's adware is someone else's legitimate software, and the only way you can tell is to ask the user "did you want this software?". A great example is Kazaa, or VNC. Some people are ok with the ads for software model, and in the case of VNC, if you installed VNC for administrative purposes, that is fine. If you did not install VNC, but find it on your computer, there is a good chance spyware has put it there to remotely control your computer without your knowledge. So if you read the report, the 14 million removals correspond to the 22 million detections with an average removal decision of about 60%. So a little less than 2 out of every 3 times, the user decided to hit the "remove" button, instead of the "allow" button when prompted with a software package what Windows Defender detected.
29 posts