Comments on: Why are Spyware removal and Antivirus software separate products?

Question: Why are Spyware removal and Antivirus software separate products?

abcde — Sat, 03 Apr 2004 14:47:37 -0800

Why are Spyware removal and Antivirus software separate products? Both are spread insidiously and often involuntarily, the scanning processes are identical, etc. There are a few political/commercial reasons I can think of, but nothing that persuasive.

By: mr.marx

mr.marx — Sat, 03 Apr 2004 15:36:55 -0800

At least historically the AV companies have treated any commercial product as legit, even obvious Remote Access Trojans such as Eblaster. I would guess the reason is the fear of being sued, but I'm not sure about that.
However, this seems to be changing, as the 2004 issue of Norton Antivirus includes spyware-removers.

By: sohcahtoa

sohcahtoa — Sat, 03 Apr 2004 15:47:17 -0800

AV companies are slowly getting around to more spyware detection and removal - slowly.

The first reason is simply that spyware isn't viral. When you installed Gator (for example) you agreed, in a manner of speaking, to let it install its friends at a later date, to let it send anything back to its creators, etc. So, although spyware does Bad Things much like viruses, there's a thin line of distinction. This distinction is important because AV companies don't want to risk action from an legitimate (if unsavory) company because the AV software removed their wares.

From the AV company's perspective - at what point do you draw the line? Do you un-install the 'web accelerator' that proxies all your traffic through third-party servers, but leave Weatherbug which provides a useful (and popular) service but with often unpopular (amongst those concerned) privacy statements? Remember as well that the real customers of AV software are corporate users - annual desktop plus management server license fees are the real cash cow - so the AV vendors aren't going to roll out this functionality until they can present an enterprise-friendly interface.

All that having been said, AV companies are getting into spyware removal. They have a clever euphemism for it that doesn't spring to mind - "possibly undesirable installed programs" or something like that - but I've seen it as a checkbox on some (enterprise) AV configuration software.

OK, I've got to leave for the airport. The other answer is that behavior-based HIPS software (Cisco Secure Agent and Entercept) are the next-generation AV software, and they may recognize and neutralize spyware based on behavior alone.

By: birdherder

birdherder — Sat, 03 Apr 2004 16:12:10 -0800

Dell got a lot of flack recently for instructing its tech support people NOT to tell customers how to remove spyware when it is determined it was the spyware that was causing the customer's problem. The reason is legal. Dell, like the AV companies don't want to have the Gators and the other spyware companies up in its grill threatening lawsuits.

Like sohcahtoa said, there's that line and technically users are giving the spyware companies permission to install.

I've switched to Mac but the other night I had to switch into VPC and run Windows for a while and was blown away by all the opportunities to get spyware presented to the Windows crowd. You unfortunate bastards.

By: Keyser Soze

Keyser Soze — Sat, 03 Apr 2004 18:02:39 -0800

Not to derail, but the only reason there is so much spyware (or anything else for that matter) for windows is because of its overwhelming popularity. Mac's have viruses, so does Linux. The difference is the sheer number of users change how often new viruses and malicious code (I am putting spyware under malicious) gets introduced into the operating system. This is unfortunate for the people who do not know their computer very well and put up with, what for me would be enough to shoot the damn thing, bullshit from all the spyware adverts and system hogging processes.

By: birdherder

birdherder — Sat, 03 Apr 2004 20:30:56 -0800

True Keyser. Malware/Virus writers go for volume. I've gotten spoiled by not seeing any of those annoyances since switching. A benefit of not running the popular OS is less threats of harm or annoyances.

One the first apps I bought was NAV so I get a little reassuance every time I open a .dmg, .sit, or .tar. One of these days someone will write a virus for the Mac to wipe the smug smile off our Mac loving faces.

By: thatwhichfalls

thatwhichfalls — Sun, 04 Apr 2004 00:19:04 -0800

Good point Keyser, and one of the reasons why I got my mother an imac as her first computer. It's hard enough talking her through problems on that from a distance of several thousand miles without having to deal with some crappy piece of software accidentally downloaded from some malicious pop-up.

By: kaibutsu

kaibutsu — Sun, 04 Apr 2004 03:40:07 -0800

Yet another reason to diversify the OS scene.

By: dgaicun

dgaicun — Mon, 05 Apr 2004 21:53:31 -0800

My new Norton bitch-slapped Gator.