Anti-Spyware

Spyware and adware covertly gather system or personal information from your computer and report that data to the perpetrator. This information is used by identity thieves or sold to advertisers to use as they wish. Adware is closely related to spyware and often uses information gathered by spyware to send unsolicited and sometimes inappropriate advertisements to your computer, sometimes as pop-up ads. The most commonly collected information includes your buying habits, history of website visits, personal information and e-mail addresses. The most insidious (and rarest) spyware can collect password and financial-account information.

Tracking cookies are common programs that track your web browsing and report that information. Even if you don't mind the invasion of privacy, you are harmed by any malware because these mini-applications are always running. If you have too many tracking cookies, they can dramatically slow your computer.

The best defense against spyware is to practice defensive computing. Don't click on advertising. Don't download any software from unknown sources, especially without reading its documentation and end user license agreement (EULA). Find a trustworthy review before downloading. Anti-spyware software helps, but reviews say common sense can go a long way towards avoiding spyware. See our Important Features section for tips.

Best spyware removers

In recent years, reviewers have found that two anti-spyware software programs work best: Webroot Spy Sweeper (*est. $20) and PC Tools Spyware Doctor (*est. $30). Sunbelt CounterSpy (*est. $20) has generally fallen short of the two market leaders in reviewer tests. The software developers constantly tweak these programs and issue incremental updates. In some cases, the update enables one program to leapfrog a competitor in spyware detection and removal ability. The downside is that updates are sometimes rushed to market, and often introduce system and software conflicts that didn't exist with the previous version. Recent user reviews are the best gauge of such problems.

Since Spy Sweeper reached version 5.0, it has generally been regarded by reviewers as the best all-around anti-spyware program. (The current version is 5.5.7.122.) Program updates are free for a year after installation.

UK magazine Web User selects Spy Sweeper 5.5 as the best commercial program. Neil Mohr reports, "Real-time protection passed all of our tests, warning or offering to block potentially unwanted system changes." PC World ranks Spy Sweeper third; Ryan Naraine says version 5.5 is a step down from version 5.0. Detection of known malware was unimpressive in his tests. The program excelled at catching new threats, though.

Webroot also sells Spy Sweeper 5.5 with Antivirus (*est. $45). This is either an effort to provide a full security solution for people who don't need a software firewall, or an effort to prevent conflicts with other antivirus programs. Webroot did not develop new software for this purpose. Instead, it licenses Sophos antivirus software. All reviewers praise the program for passing all tests, but Sophos has not passed some of the most recent lab tests, which postdate the newest reviews.

PC Magazine chooses Spy Sweeper 5.5 with Antivirus as its Editors' Choice. Even so, the endorsement is not glowing. Neil Rubenking and Web User's Andy Shaw say you must adjust the default settings to achieve maximum protection. Rootkit detection is turned off by default in order to speed scanning. (Rootkits are not themselves spyware programs -- instead, they are programs that hide the presence of spyware.) In PC Pro, Davey Winder recommends "sticking with Webroot for spyware and leaving the [antivirus] to a best-of-breed standalone client."

Neil Rubenking reports that Spyware Doctor with AntiVirus 5.0 (*est. $40) is a little more effective at preventing and removing spyware than its competitor. Yet, he says that bugs and glitches in the program cause him to recommend Spy Sweeper with Antivirus instead. In newer reviews of Internet security suites, Rubenking often compares their spyware prevention test results with these two programs, and the specialty programs are invariably more successful. Other reviews rate Spyware Doctor with AntiVirus and Spy Sweeper with Antivirus as equal. Several reviewers criticize both programs for lacking other components contained in Internet security suites (especially a firewall). Webroot and PC Tools are filling a market niche with these hybrid programs. In spite of that, reviews indicate implementation is not entirely successful, and you could do better with separate programs or save money with a suite.

PC World honors the standalone Spyware Doctor as a Best Buy among anti-spyware software. It outscores its nearest competitor by a huge margin. Ryan Naraine reports that the program is superb at detecting adware, but missed much spyware. "It successfully cleaned up only 70 percent of spyware files and Registry entries," he says. "Still, that performance put it ahead of
the rest."

As with standalone antivirus programs and Internet security suites, user reviews are harsh relative to professional reviews. Both leading anti-spyware software programs have issues on many computers. Spyware Doctor earns the bottom rating from slightly more than half of Amazon.com customers. Many users were quite satisfied with version 4.0, but experienced problems with 5.0 or 5.1. The naysayers say the program is a huge drain on system resources. Along with system slowing and slow scans, it causes crashes on some users' computers and appears to conflict with other programs (users are unable to identify specific conflicts, but a couple mention Norton and McAfee programs).

Spy Sweeper fares somewhat better in twice as many user reviews. About 45 percent of Amazon.com customers give it the bottom rating. Many of the Amazon reviews are of version 5.0 or 5.3, which can be misleading. However, as with Spyware Doctor, many unhappy users cite a previous version as being problem-free. The other gripes are very similar, too. ZoneAlarm programs are said by some to conflict. Spy Sweeper's average rating in user reviews is three out of five. That may sound unexciting, but it's well above average for any security software.

Webroot offers a 30-day return policy for Spy Sweeper. Most retailers won't take back opened software, so at least this seller of security solutions will limit your financial risk. PC Tools also offers a 30-day money-back guarantee, but only if you download Spyware Doctor from the PC Tools website. If you install one of the top two programs and do encounter difficulties, you should be able to uninstall it and switch to the competing product. You may also be able to get your money back.

Sunbelt CounterSpy (*est. $20) is better than either Spy Sweeper or Spyware Doctor according to a couple of reviewers. A consumer magazine gives it the top score for features and a very good score for detection. CNet.com rates it as an Editors' Choice among anti-spyware software. In a scan, CounterSpy detected 80 percent of spyware. Robert Vamosi informs that in the removal test, "CounterSpy removed all traces from 70 percent of the spyware."

PC Magazine doesn't agree that CounterSpy is the best, but it's close. Neil Rubenking explains, "CounterSpy V2 ranks just below the best standalone anti-spyware. It had some trouble on badly infested systems, but after cleanup it did a fine job of keeping things clean." Like other programs, CounterSpy is better at detection than removal. Computer Shopper does not test effectiveness, but does an excellent job of evaluating other considerations. Barry Brenesal thinks the anti-spyware software program's tools are great and that it's easy to use, but he has concerns. One is "intermittent memory conflicts with other programs." He also reports, "Slowdown was slight, but noticeable, on our 2GHz Athlon-equipped test PC." Computer Shopper rates CounterSpy 7/10 in a very balanced review.

Sunbelt offers a 15-day free trial and a 30-day money back guarantee for CounterSpy anti-spyware software. Reviewers note that CounterSpy includes some antivirus protection, but do not compare its effectiveness for that purpose. CounterSpy has very few user reviews compared with the leading competitors. The average ratings of the first 15 reviews at Amazon.com are mixed-to-positive. User complaints are the same as those for Spy Sweeper and Spyware Doctor. Slow scanning speed is another issue.

Grisoft AVG Anti-Spyware 7.5 (*est. $30) ranks second in PC World's tests. Reviewer Ryan Naraine says it's great against known threats, but not so good at catching new ones. It was the only anti-spyware program of the six tested to produce false positives. Naraine doesn't identify the ten false positives; they could be meaningless cookies or something that might matter to you more. PC Magazine's Neil Rubenking summarizes that AVG Anti-Spyware 7.5 "costs the same as programs that do a much better job," and that the free version is not robust. The commercial version has the lowest rating of anti-spyware software programs reviewed by PC Magazine.

AVG Anti-Spyware is apparently only available as a download from Grisoft. A crippled version is available as free anti-spyware software. Web User says the free program was disappointing in its tests, and it earns a lower rating than a couple of other free anti-spyware programs. The free version lacks real-time protection and automatic updates. Those features are enabled during the 30-day trial period, which means you should only test the program if you are considering buying the commercial version.

Internet security suites

Internet security suites have advantages and disadvantages when compared with individual programs. They are usually cheaper than even just two standalone programs. If you plan to buy antivirus, anti-spyware and firewall software, they are certain to be cheaper. They don't all coexist with free anti-spyware programs, but otherwise, they greatly reduce the likelihood of software and system conflicts. If you are uncomfortable with installing and using software, a single program is an elegant solution. If you want extras, like spam filters and parental controls (both are controversial and not completely effective), a suite gives you everything.

Experts say Internet security suites are not as effective as standalone programs, especially at preventing spyware. They include aggressive and sometimes intrusive firewalls that you may not need (primarily if you have a hardware firewall – note that most routers include one). The firewalls are not optional installations with suites.

We found favorable reviews for five Internet security suites: BitDefender Internet Security 2008 (*est. $50) , BitDefender Total Security 2008 (*est. $60), Norton Internet Security 2008 (*est. $55) , Panda Internet Security 2008 (*est. $40) , and Kaspersky Internet Security 7.0 (*est. $50) . Full details are in our report on Internet security suites. All of these include anti-spyware software and adware detection tools.

The Norton and Kaspersky suites reputedly conflict with some free anti-spyware programs. PC Magazine's Neil Rubenking says BitDefender's spyware removal in his tests was not as effective as Spy Sweeper or Spyware Doctor, but it was close. Panda is more competitive. Rubenking says, "Virus/spyware protection is Panda Internet Security 2008's super standout: It's the first product ever to remove every single one of my spyware samples and also prevent every single one of them from installing on a clean system." On the other hand, he downgrades the program for poor performance of its secondary components (firewall and parental filters).

If you're considering the Spy Sweeper or Spyware Doctor programs with antivirus software, Panda is a good alternative in the same price range. If you want the firewall, review tests suggest it is a better choice.

Free anti-spyware tools

A consistent theme emerges in reviews of anti-spyware programs. Laura Hunter, author of "Stopping Spyware: Protecting Your Computer, Your Data, and Your Privacy," says, "The question you probably have after all of this is 'Which program should I install out of all the ones that are available?' " She answers, "All of them… I'm not asking you to spend $50 apiece on three or four different anti-spyware utilities … but … enough free products [are] available that you can run two or three products without breaking the bank." Hunter asserts, "You'll find that each of these programs will find spyware infections that the others won't."

PC Magazine agrees, saying, "Anti-spyware tools … should stop all 'in-the-wild' spyware that they encounter -- anything less is unacceptable -- but, at PC Magazine Labs, we've yet to find one that does." Adware Report says, "We did find that running Spyware Doctor in conjunction with Webroot's Spy Sweeper eliminated 100% of the spyware in our test, so this will probably be a good option for those who don't mind buying two programs."

Several highly regarded free anti-spyware programs are available, and reviews suggest using one or more of these to supplement Spy Sweeper or Spyware Doctor. All the free programs have limited functionality, however, so they aren't the best choice as your primary anti-spyware software. Reviews, forums and knowledgeable computer users recommend four programs. These programs are small, safe and consume few system resources (except when manually scanning).

In the past, many experts wrote that free anti-spyware software like Lavasoft Ad-Aware and Safer Networking's Spybot Search & Destroy were as robust as any of the commercial products. Now, they say that's no longer true. In tests, both Ad-Aware and Spybot Search & Destroy are not competitive with Spy Sweeper and Spyware Doctor.

If your computer is running Windows Vista, you already have Windows Defender, a free anti-spyware tool. Make sure real-time protection is turned on (the default option). The current version is 1.1. The program is also available as a free download to Windows XP users who accept Microsoft's Windows validation process. In PC World's tests, Windows Defender 1.1 is excellent at detecting adware, but barely removes half of it. It's much poorer at catching spyware. Ryan Naraine concludes, "Windows Defender is certainly better than nothing. It combats adware and offers behavior-based protection that should block many threats, but if … malicious spyware slips past Defender's first line of defense, you'll need something else to clean up the mess." In spite of the tepid recommendation, Windows Defender is the magazine's top-rated free anti-spyware program, and it even outscores the commercial version of Ad-Aware (Lavasoft Ad-Aware 2007 Plus 7.0, *est. $30).

Web User's cursory review of Windows Defender doesn't reveal much. The rating is average, but Neil Mohr likes the options that "warn about unknown start-up and system changes." At
CNetDownload.com, Windows Defender has the highest rating of any free active anti-spyware tool. We found many reviews of the pre-Vista beta version of Windows Defender, but consider them to have no current validity, as Vista was released a year ago and Windows Defender was upgraded to version 1.1 in March 2007.

Lavasoft Ad-Aware 2007 (free) is a recent upgrade of a unique protection tool. The poor results of the commercial version in tests by PC Magazine and PC World also apply to the free version. The major difference between the two is that the free version has no real-time protection. You must regularly run manual scans (and manual updates, which are commonly issued once or twice a week). Web User gives Ad-Aware 2007 a low rating, and ranks four other free anti-spyware software programs higher. Most users at CNet Download.com are pleased with the program. Many note that the new version scans faster than the preceding version. In spite of the professional criticisms of Ad-Aware, users find that it catches many nasty cookies that commercial programs like Spy Sweeper can miss.

Safer Networking Spybot Search & Destroy 1.5 was upgraded a few months ago; all recent reviews are of version 1.4. Spybot Search & Destroy was one of the first tools to combat spyware, and it is the most similar alternative to the commercial programs. Spybot does have some real-time protection. It blocks attempts to hijack your web browser and change items in your host file (which controls your browser's startup), but does not prevent the installation of malware in its real-time monitoring. The program has a particularly useful tool called immunization; it modifies Internet Explorer to block malware from known perpetrators. It also supports alternative browsers Firefox and Opera. Most anti-spyware software programs won't offer real-time protection through anything other than Internet Explorer.

PC World says Spybot Search & Destroy version 1.4 "no longer provides good spyware protection." Ryan Naraine concludes, "For many years, this freeware program was the anti-spyware standard, but, regrettably, it is no longer competitive." Naraine and Web User's Neil Mohr both think the user interface is unduly complicated. Mohr offers a variety of criticisms but says Spybot performed very well in his tests, and Web User ranks it as the second best free anti-spyware program. User reviews at CNet Download.com are mostly very favorable, but we found many of the same complaints that people have with commercial anti-spyware software.

SpywareBlaster is another popular free program. This program is just a blocker; it will not find preexisting malware on your system and it does not include an anti-spyware scanner. It uses a regularly updated database to block harmful websites. The program also disables the installation capability of known malware in the Windows registry. In simpler language, if you update SpywareBlaster regularly, the program will block most known spyware without even having to be open. SpywareBlaster uses no system resources. If you pay a $10 annual fee, the program will automatically update itself. Otherwise, it requires manual updates.

More than 13 million people have downloaded SpywareBlaster from Download.com. CNet.com's editors note that the interface is clunky, yet editors conclude, "SpywareBlaster proves a helpful preventative addition to any anti-adware arsenal." SpywareBlaster is rated 4/5 stars by the editors and an average of 4.5 stars by more than 900 site users.

Crawler Spyware Terminator 2.0 (free) wins a Gold Award from Web User. The anti-spyware program includes real-time protection and a slew of other features. Neil Mohr says it's easy to use and did well in his tests. PC Magazine is far less impressed. Neil Rubenking says it "did poorly in testing, at both malware removal and malware blocking." Ad-Aware 2007 performed better. Rubenking adds, "Of course, the high-end products do much, much better." He notes that the anti-spyware program used to contain adware, but no longer does.

We also found praise for a couple of other free tools. Hijack This, reviewed by PC World, doesn't try to sniff out spyware at all. Rather, it compiles a list of all active processes running on your computer. You can then examine the list for suspicious applications. Experts say only experienced, sophisticated computer users are able to interpret the log and spot suspect activities. However, novices can post their log on a forum to get help from other users.

Editors at PC World say Hijack This is a unique tool and not one to be used lightly. Before changing anything with the tool, back up your system or create a restore point. That will ensure you'll be able to recover if you make a mistake and delete something important. If other anti-spyware tools aren't ridding your system of spyware, reviews say Hijack This is an effective last resort.

One particularly persistent spyware application is CoolWebSearch, which also goes by a bunch of other names. This spyware appears as a toolbar and can sometimes hijack your home page. The program mutates every few days, so it's very resilient to removal. Spy Sweeper claims it can remove CoolWebSearch, but we found several experts who say a free software program called Trend Micro CWShredder does it better. CWShredder is now bundled as part of Trend Micro Anti-Spyware 3.0 (*est. $30) . However, you can still just download the free Trend Micro CWShredder: http://www.intermute.com/products/cwshredder.html.

Reviews recommend using Ad-Aware 2007, Windows Defender, SpywareBlaster and Spybot Search & Destroy in conjunction with commercial anti-spyware software. The four free programs will occupy very little hard disk space. They do not conflict with each other or with the leading commercial programs, but Spybot and Ad-Aware occasionally conflict with some antivirus programs and Internet security suites. An advantage to using all of them is that their strengths and weaknesses complement each other. For example, SpywareBlaster only works on the front end (preventing malware installation) and Ad-Aware only works on the back end (removing downloaded malware).

Alternative browsers can help (for now)

Experts say you can avoid the majority of spyware if you avoid Internet Explorer entirely and switch to an alternative web browser such as Mozilla Firefox. At this point, most spyware and adware is written to exploit Internet Explorer. Switching may protect you for a while, but as alternative browsers gain popularity, spyware and adware writers will target them. See our report on web browsers for alternatives to Internet Explorer. If you prefer to stick with IE, make sure you are using the latest version.

Many anti-spyware programs don't work with Firefox. Although you can still scan your system, these spyware removers can't provide any real-time protection if you use an alternative browser.

Beware of fake anti-spyware programs

Some spyware masquerades as legitimate spyware-removal tools. Experts say you should never click on a pop-up or e-mail link that offers to scan your computer for viruses or spyware. While some of these are time-wasting marketing tools that will identify -- but not remove -- malware, others are spyware installers. A notable exception is Trend Micro, which offers a free web-based scan and removal program at Housecall.trendmicro.com. It scans for viruses and spyware. The program is slow, however. Experts recommend verifying any anti-spyware product at SpywareWarrior.com, which maintains a list of legitimate anti-spyware software.

SpywareWarrior reports that there are more than 200 spyware programs masquerading as anti-spyware. Many of them have names that are similar to top-rated spyware removers, aiming to confuse potential victims. Some examples of these anti-anti-spyware programs (according to SpywareWarrior) are SpyKiller and InternetShield, both of which have already been subject to prosecution. Others include SpyAssassin, SpyEliminator, Ad-Eliminator, Doctor Adware Pro and Elimiware.

Alternative operating systems

Experts disagree about the need for anti-spyware software on Macintosh and Linux systems. Most spyware and adware is written to exploit Windows. Apple claims that its newer, UNIX-based systems are secure, and the company encourages users to download updates often. In the article "The 10 Biggest Myths of IT Security" (July 20, 2006), the staff of Dark Reading say, "Just because you're a Linux or Mac person sipping coffee in your server room on Patch Tuesdays doesn't mean you're immune from exploits. Nothing is bulletproof these days." Allen Wilson, director of research for SecureWorks, agrees that "nothing is 100 percent safe." Several experts make the case that Apple wouldn't be offering frequent security fixes if its OS didn’t have breaches.

We did not find a favorable review of a standalone Macintosh anti-spyware program. Norton Internet Security 3.0 for Macintosh (*est. $70) is a suite of applications that removes cookies and cache files, which will provide some protection. Intego sells several security programs, and we've seen recommendations for Intego's VirusBarrier (*est. $50) . MacScan 2.5 (*est. $30) is a standalone Macintosh anti-spyware program. The latest update was issued in November, and user reviews are mostly unfavorable.

Linux users can find free programs through Linux support vendors, user groups and bulletin boards. The University of Virginia offers helpful information in the article "UNIX/Linux Security Best Practices."

Important Features: Anti-spyware software

Spyware detection and removal are the most important considerations. Compatibility with other security programs is also critical. Anti-spyware software should include the following:

• Real-time blocking and background monitoring that occurs before spyware is downloaded or installed. It is far easier to prevent spyware from installing in the first place than to clean out an affected system after the fact.

• Automatic spyware definition updates. Some free tools require manual updates.

• Restoration/rollback capability is a good feature if legitimate application components are inadvertently deleted. With this feature, components can be restored from quarantine so that the application will work again. Some applications may not work without their spyware components. Windows Media Player, for example, includes a mild spyware component that reports to Microsoft. Apple's iTunes reports information to Apple.

• Automatic scan scheduling allows you to set the day and time for automatic scans. Alternatively, you can instruct the software to run scans at startup or shutdown.

• Threat level description and severity analysis in the user interface allows you to make good decisions about what components to ignore, quarantine or delete. The description gives information as to origin or function.

• Support features including online help, forums, e-mail support and free telephone support. Given the reported difficulties some users have in getting anti-spyware utilities to upgrade cleanly or play nicely with other applications -- particularly security applications -- good product support can be crucial.

Types of spyware and adware

"Malware" is an encompassing term that includes viruses, spyware, adware, worms, Trojan horses and other computer afflictions. According to Consumer Reports, spyware infections caused 850,000 people to replace their computers in the first half of 2007.

Clicking links in pop-ups or viewing e-mail messages with graphics or HTML can invite spyware into your system. Spyware is often bundled with useful or entertaining software, such as games. Most spyware comes from the Internet, but removable media is another source. Spyware is integrated into some commercial media, primarily software. Some Sony music CDs automatically install digital rights management software when inserted into computer CD-ROM drives. Sony's intention was for the software to prevent users from copying and redistributing copyrighted material. However, many CDs installed rootkit cloaking software, which created a security hole in infected computers. Removing the software disabled CD drives. Sony's first patch made the problem worse.

Some of the Apple Video iPods made in China inadvertently shipped with Windows malware. In Japan, promotional MP3 players distributed by the MacDonald's hamburger chain contained data-stealing spyware. Apple iTunes for Windows contained a since-patched security vulnerability that enabled evildoers at remote locations to control a user's computer.

There are several signs that spyware is on your computer system. Pop-up ads may appear whether or not you are browsing the Internet, your browser's home page may be reset to a page you have not chosen, your Internet connection may be markedly slower, or you may notice new items in your startup menu. Some spyware and adware are browser plug-ins in the form of toolbars, which enable advertisers to redirect your home page. Many add unwanted bookmarks. More rarely, spyware can include a remote administration tool that can allow an attacker to control your computer. Spyware in the form of a key logger can record your keyboard strokes for later retrieval, but these are rare.

Dialers are frequently used by pornography websites. A dialer disconnects the user from a dial-up Internet connection, and reconnects them to another dial-up telephone number where the user is then billed at a very high rate.

Our Consensus Report shows how many times products are top-ranked by reviewers included in our
All The Reviews Reviewed chart.

# of Picks	Model (with Retailer Links)
3	Safer Networking Spybot Search & Destroy 1.5 (free)
2	PC Tools Spyware Doctor (*est. $30)
2	Webroot Spy Sweeper 5.5 with Antivirus SE Personal (*est. $45)
2	Sunbelt Software CounterSpy 2.0 (*est. $20)
1 each	Lavasoft Ad-Aware 2007, Spyware Terminator 2.0, SpywareBlaster, Spy Sweeper 5.5

Professional reviewers are evenly divided about which is the best anti-spyware program, but the most credible reviewers select one of the two leading programs, Webroot Spy Sweeper and PC Tools Spyware Doctor 5.0. Both programs are also available with bundled antivirus software. These versions also receive favorable reviews, but the antivirus component of Spyware Doctor has not yet been widely tested by independent labs.

Sunbelt Software CounterSpy 2.0 isn’t as widely reviewed as the market leaders, but it is cheaper and all reviews are favorable. Some reviews say CounterSpy is better at detecting spyware than removing it.

The free programs (Ad-Aware 2007, Windows Defender, SpywareBlaster, AVG Anti-Spyware, Spyware Terminator, and Spybot Search & Destroy) are all recommended in some reviews, but lack the necessary full functionality of the commercial programs, and do not perform as well in tests. The consensus among reviewers is that they should supplement a more successful program.

Sponsored links