melboy,

 

as i read/interpret that article, it seems to be saying that SpyBot is doing the right thing.   Yes, I did refer to it as being "old hat"... and still believe that to be the case.   My opinion is not based on any official/publicized tests I can cite... but rather, on what i perceive to be the effectiveness of various tools used in these DELL forums.

 

first off, let me begin by stating that the absolute number of threats in a scanner's definitions/database file is meaningless... because some scanners make a big deal over "tracking cookies" (searching for hundreds, if not thousands, of them), while others choose to completely ignore tracking cookies.    In general, tracking cookies are not a threat.   So any scanner whose reputation is solely based on its ability to find/remove them does not impress me.

 

years ago, it used to be that case that many (most??) adware/spyware problems could easily/simply be removed by running the "one-two" combination of lavasoft's ad-aware, and SpyBot Search & Destroy.   in fact, we used to routinely recommend that all people run these two scanners, before generating/posting a HJT log in the forum.   Often, these two completely solved people's problems, and there was no need to proceed any further (with HJT).

 

But as soon as word spread that Ad-Aware and SpyBot were "miracle workers", the malware creators took steps to make even worse stuff, that these two couldn't handle.   a particularly nasty problem, initially known as WinFixer [and later morphing into the Vundo/Virtumonde trojan], made its way onto the scene.   Neither Ad-Aware nor SpyBot... nor even HJT by itself... could remove WinFixer.   In fact, most anti-virus programs and removal tools -- including the "heavyweights" Symantec/Norton and McAfee --- could [neither prevent nor] remove WinFixer. Fortunately, we soon learned of specialized tools... the early versions [2.x] of Atribune's VundoFix, and then Secured2k's VirtumundoBeGone... that allowed us to successfully attack Vundo/Virtumonde.   When Atri found a way to automate VundoFix [I believe that was no later than version 4.x], it became the clear tool of choice to combat this particular ailment.

 

We then went though a long phase of SmitFraud/DesktopHiJack variants.   Again, I believe Ad-Aware... and I'm sure SpyBot... claimed these were in their database --- and indeed upon scanning, they would often find them.   But either they couldn't remove them... or they removed them only partially, allowing the infection to come back repeatedly.   So again, we waited for other/newer/specialized tools to arrive:   in this case, first NoAdFear's SmitRem, and ultimately,

S!ri's SmitFraudFix.  

 

Another great tool around this time was sUBs' ComboFix.

 

Note:   I am simply outlining my sense of some history here.   I am NOT suggesting/recommending that anyone run SmitRem, SmitFraudFix, ComboFix, or other specialized tools, unless/until explicitly directed to do so by an HJT expert. 

 

SmitFraud variants continued to spawn [either evolving into, or being caused by, "Zlob" trojans].   While SmitRem and SmitFraudFix remained the tools of choice of the HJT experts, two new scanners gradually made their way into popularity:   the "semi-specialized" MalwareBytes RogueRemover, and the much-more-"generic" SuperAntiSpyware.   these two fully automated scanners were doing an amazing job.   By virtue of being (relatively-)newly created, they were at the "cutting edge" of modern malware removal.

 

in contrast, both Ad-Aware [SE] and SpyBot [1.4] were either resting on their laurels/reputations, or more likely, "impaired" by the limitations of the older technology that was an inherent part of their "antiquated" algorithms.   They ultimately realized as such, and both came out with new versions:  ad-aware 2007 and SpyBot 1.5.

 

Ad-aware '07 was indeed a major "change" in programming... but unfortunately (at least, according to the consensus that i've seen here), a change for the worse.   we found problem after problem with AA'07, and gradually, one "expert" after the other gave up on it... until at this point, I don't know of anyone still "pushing" it.   [There IS one "positive" thing I can say about Lavasoft:  they hired "Atribune", the creator of VundoFix.   So that certainly gave Lavasoft the potential to create a superb anti-malware program.   But, even with the recent introduction of Ad-Aware 2008 (Beta), that potential has yet to be realized.]

 

In contrast, SpyBot 1.5 was merely an "evolutionary" (rather than "revolutionary" ) improvement upon Spybot 1.4.   The author, "PepiMK", is certainly well-respected.   and there are some DELL forum VIPS that still swear by it.   [One person has asserted to me that SpyBot will take care of "any" problem, provided it is run in SafeMode (with a follow-up scan in normal mode).  Just stating this, be it true or "legend"].

 

But no matter how they tried, neither the new Ad-Aware 2007 nor SpyBot 1.5 ever "caught on" with the HJT people as a suggested/recommended removal tool.   for quite a while, SuperAntiSpyware remained the (generic) scanner of choice.   Only recently (a few months ago), the overall consensus here switched to adopting "the new kid on the block", MalwareBytes Anti-Malware [which boasts a most enviable pedigree of authors].   I am perhaps one of the few holdouts still advocating use of both MBAM (first choice), to be "backed up" by SAS (second choice).

 

Having now elaborated on all this:   I personally still am a fan of SpyBot, primarily for its TeaTimer resident protection module, and (to a lesser extent, for) its immunization feature [which i use in addition to SpywareBlaster's immunization].   I also invoke SpyBot's SDHelper IE-BHO, but admittedly, i have no way of knowing just what level of protection it's offering me.   For me, those 3 aspects are worth keeping SpyBot around.   As such --- since i have it around anyway --- i'll take a few minutes to run a weekly scan with it.   But I really don't expect it to find anything on my PCs at this point.   And if I ever actually experienced a malware problem, I'd certainly jump on my other scanners [MBAM, SAS] first.

thoroughly interesting reading ky331!

 i hope my original post was'nt taken as knocking you for calling spybot 'old hat' as that certainly wasn't the intention!

i was merely trying to point out that test results , and there seems to be a lot of them , aren't to be taken at face value. it seems different products achieve different results depending on the criteria they are tested under, so judging a product, old hat or new kid on the block , shouldn't be judged solely on a magazines, websites etc findings that "product A found 10 threats, whilst product B found only 3 threats therefore you should buy product A".

the article seemed to say that the way spybot went about detecting threats was better than one that merely scanned all the system matching all the files to all the database of detections.

 

With reference to mbam ,the new kid on the block, Nosirrah of MalwareBytes said on the castlecops forum:

 

" IMO it would be a good thing for people who use security products to have more clearly defined choice types . I would like to see things settle out into three distinct families . Antivirus (unpatching , decrypting , unpacking , heuristics) , antimalware (less emphasis of file internals and more on file environment , like lsass.exe running from system32/config=malware even if you dont have its signature in defs) and firewall . I have no problem with antivirus and antimalware having the majority same defs but having them go after malware in completely different ways would be a very good thing . The way things seem to me now is that most vendors are trying to do too mnay things and as a result are doing a bad job at all of them .
MBAM has 7 completely different ways it can detect malware , that is how we make it detect so much even though there is onely one person on defs full time . Zlob is one of the ones we have all 7 for , most have at least 3 ."

 

That seems similar to me, what the article on lavasoft was trying to say, that matching definitions isn't the only way to go. maybe thats why spybot was(is?) so effective , as is MBAM. 

 

no question, any tests [of anti-virus, anti-malware, firewall, or other products] can be strongly influenced [be it intentionally or unintentionally] by data-choices made and criteria invoked... and consequently, a product that passes one test with flying colors could just as easily find itself the laggard when subjected to a different standard of comparison.

 

One of my supervisors used to express a related philosophy:   Anytime we needed to perform a survey, he would first ask:   "What do we want the results to be?"   Because then, he could proceed to carefully phrase ("load" ) the questions in such a way as to virtually guarantee that our desired result would in fact be concluded!