The Spyware Warrior Guide to

Anti-Spyware Programs:

Feature Comparison

 

Return to top

Overview

As spyware and adware have become increasingly powerful and difficult to remove, developers of anti-spyware programs have added a wider range of functionality to their applications to give users more powerful tools as well as greater control over those tools. Moreover, although anti-spyware applications have long resembled standard anti-virus applications in many ways, they have also started to acquire their own distinctive set of features in order to help users deal with the unique problems posed by spyware and adware. Given the bewildering array of programs and features available to users looking for anti-spyware applications, users may find it difficult to usefully compare anti-spyware programs and their feature sets.

To remedy that potential confusion, this page presents two Feature Comparison Tables for the major anti-spyware programs currently available. An explanation of the features considered can be found below the table in the Notes section. 

Please note...

Please note that the anti-spyware programs listed on this page comprise a limited subset of the larger array of anti-spyware programs that can be found on the Net (numbering at last count over 150). Moreover, this page is restricted to dedicated anti-spyware programs with scanning capabilities. 

Thus, not considered on this page are anti-virus programs, anti-trojan programs, or general anti-malware programs, many of which may be adding spyware and adware detection and removal. Also not considered are anti-spyware programs that are devoted exclusively to spyware prevention. Finally, the programs listed here may offer additional features that are not considered on this page.

Recommendations...

A set of Recommended Programs is listed below. Readers interested in purchasing anti-spyware applications are advised to investigate and test those programs on their own systems. No one program will be useful, convenient, effective, and appropriate for every user. Moreover, as testing with these anti-spyware applications has demonstrated, no single anti-spyware application will remove everything. Therefore, users are advised to install and use at least two anti-spyware applications.

Finally, users should take additional steps to protect their systems beyond just installing one of the anti-spyware programs listed below. If your system is currently infested with spyware and adware, see below for tips on what you can do.
 

Return to top

Anti-Spyware Feature Comparison Table: Group 1
(see Notes)
Feature/Application Ad-aware SE Spybot S&D Pest Patrol Spy Sweeper Windows Defender CounterSpy
- Company Lavasoft SaferNetworking CA Webroot Microsoft  Sunbelt
- Version SE 1.0.6 1.4 2005 5.0 Beta 2 1.5
- URL link link link link link link
- Price free / $26.95 * free $39.95 $29.95 n/a + $19.95
- Renewal free / n/a * free $19.95 $29.95 n/a + $9.98
- Full-featured trial X X --- --- n/a + X
Scanning Ad-aware SE Spybot S&D Pest Patrol Spy Sweeper Windows Defender CounterSpy
- Memory scans X X X X X X
- Registry scans X X X X X X
- Drive scans X X X X X X
- Customized scans X X X X X X
- Remove on reboot X X X X X X
- Rootkit detection --- --- --- X --- ---
- ADS scans X --- --- --- --- ---
- Scan log/report X X X X X X
Scan Configuration Ad-aware SE Spybot S&D Pest Patrol Spy Sweeper Windows Defender CounterSpy
- Whitelist (exclude) X X X X X X
- Quarantine/recovery X X X X X X
- System start scans X X --- X --- ---
- Scheduled scans --- X X X X X
Prevention/Protection Ad-aware SE Spybot S&D Pest Patrol Spy Sweeper Windows Defender CounterSpy
- Memory processes  (X) X X X X X
- Browser hijack  (X) X --- X X X
- Startup settings  (X) X --- X X X
- HOSTS file  --- X --- X X X
- ActiveX kill bits --- X --- --- --- X
- Restricted sites --- X --- --- --- ---
Diagnostic Tools Ad-aware SE Spybot S&D Pest Patrol Spy Sweeper Windows Defender CounterSpy
- BHOs --- X --- X --- X
- ActiveX controls --- X --- --- --- X
- Browser settings X X --- X --- X
- Startup locations --- X --- X X X
- HOSTS file --- X --- X --- X
- Winsock LSPs [X] X --- --- X X
Updates Ad-aware SE Spybot S&D Pest Patrol Spy Sweeper Windows Defender CounterSpy
- Manual X X X X X X
- Program start X X X X X X
- Scheduled --- --- --- --- X X
Supported Windows Ad-aware SE Spybot S&D Pest Patrol Spy Sweeper Windows Defender CounterSpy
- Windows XP X X X X X X
- Windows 2000 X X X X --- X
- Windows NT 4 X X X --- --- ---
- Windows Me X X X X --- X
- Windows 98 SE X X X X --- X
- Windows 98 X X X --- --- ---
- Windows 95 --- X --- --- --- ---
Feature/Application Ad-aware SE Spybot S&D Pest Patrol Spy Sweeper Windows Defender CounterSpy

Return to top

Anti-Spyware Feature Comparison Table: Group 2
(see Notes)
Feature/Application AntiSpyware Anti-Spyware Spyware Doctor SpyCatcher Spyware X-term. X-Cleaner
- Company McAfee TrendMicro PC Tools Tenebril StompSoft Xblock.com
- Version 2006 (2.0) 3.0 4.0 2006 (4.0) 2005 2.2
- URL link link link link link link
- Price $29.99 $29.95 $29.95 $29.95 $29.99 $39.95
- Renewal $9.99 n/a $14.97 $19.95 $29.99 $9.95
- Full-featured trial X --- X X X ---
Scanning AntiSpyware Anti-Spyware Spyware Doctor SpyCatcher Spyware X-term. X-Cleaner
- Memory scans X X X X X X
- Registry scans X X X X X X
- Drive scans X X X X X X
- Customized scans X X X X X X
- Remove on reboot X X X X X X
- Rootkit detection --- --- X --- --- ---
- ADS scans --- --- X --- --- ---
- Scan log/report --- X X X X {X}
Scan Configuration AntiSpyware Anti-Spyware Spyware Doctor SpyCatcher Spyware X-term. X-Cleaner
- Whitelist (exclude) X X X X X ---
- Quarantine/recovery X X X X X ---
- System start scans --- X X --- X <X>
- Scheduled scans X --- X X --- ---
Prevention/Protection AntiSpyware Anti-Spyware Spyware Doctor SpyCatcher Spyware X-term. X-Cleaner
- Memory processes  X X X X X ---
- Browser hijack  X X X X --- ---
- Startup settings  X --- X X --- ---
- HOSTS file  X --- X X --- ---
- ActiveX kill bits --- --- X --- --- X
- Restricted sites --- --- X --- --- ---
Diagnostic Tools AntiSpyware Anti-Spyware Spyware Doctor SpyCatcher Spyware X-term. X-Cleaner
- BHOs --- --- X X --- ---
- ActiveX controls --- --- --- X --- ---
- Browser settings X --- --- X --- X
- Startup locations X --- --- X X X
- HOSTS file --- --- --- X --- ---
- Winsock LSPs --- --- --- X --- X
Updates AntiSpyware Anti-Spyware Spyware Doctor SpyCatcher Spyware X-term. X-Cleaner
- Manual X X X X X X
- Program start X X X --- X X
- Scheduled --- --- X X --- ---
Supported Windows AntiSpyware Anti-Spyware Spyware Doctor SpyCatcher Spyware X-term. X-Cleaner
- Windows XP X X X X X X
- Windows 2000 X X X X X X
- Windows NT 4 --- --- --- --- X X
- Windows Me X X X --- X X
- Windows 98 SE X X X --- X X
- Windows 98 X --- X --- X X
- Windows 95 --- --- --- --- --- X
Feature/Application AntiSpyware Anti-Spyware Spyware Doctor SpyCatcher Spyware X-term. X-Cleaner

Return to top

Anti-Spyware Feature Comparison Table: Group 3
(see Notes)
Feature/Application SUPERAntiSpyware AVG Anti-Spyware Ashampoo AntiSpyware ZeroSpyware Spyware Fighter Spyware Terminator
- Company SUPERAdBlocker ewido/Grisoft Ashampoo FBM Software SPAMFighter Crawler
- Version 3.2 4.0 1.4 2006 (3.4) 1.7 2.5
- URL link link link link link link
- Price $29.95 $29.95 $29.99 $29.95 $29.00 free
- Renewal $9.95 $14.97 $29.99 $19.95 $29.00 free
- Full-featured trial X X X X X X

Note: full feature comparison of products in Table 3 to follow in the next few weeks.

Return to top

 

Notes:
 
* Ad-aware SE Personal is free for personal use; Ad-aware SE Plus is $26.95
+ On Dec. 16, 2004 Microsoft announced that it had acquired GIANT Company. On Jan. 6, 2005 Microsoft announced the release of a public beta of Microsoft AntiSpyware, which is based on GIANT's old AntiSpyware product. In Feb. 2006, Microsoft released a second beta of its anti-spyware product, this time named "Windows Defender."
X feature is present
--- feature is not present
(X) feature is present only in Ad-aware SE Plus & Professional, not free Personal version
[X] feature is present in Ad-aware SE w/ free, downloadable plug-in
{X} feature is present in X-Cleaner through use of command line switches and/or scripts
<X> feature is present in X-Cleaner during installation but not configurable thereafter
   
General Info: Price information is taken from the vendor's home page. Prices may vary at resellers, both online and offline. Stated price includes an initial 12 month subscription to updates. Renewal price is for a 12 month renewed subscription to updates, where applicable (some applications are not subscription-based but rather supply free updates until the next major version release of the program). All vendors listed here offer trial versions of their programs, however, many of these trial versions are severely limited. A Full-featured trial version offers at a minimum the ability to scan and remove spyware and adware, though even this kind of trial version will usually be time-limited and/or may not perform updates.
Scanning: Anti-spyware applications should, at a minimum, scan Memory, the Windows Registry, and all Drives on the system. Users should also be able run Customized scans (e.g., select only certain drives to scan or scan memory only). Anti-spyware applications must also be able to Remove on reboot spyware/adware that refuses to be removed through normal processes. Anti-spyware applications should have Rootkit detection capabilities that are not signature dependent, and they should be able to scan NTFS Alternate Data Streams (ADS). Finally, anti-spyware applications should generate an exportable Scan log/report (plain text or HTML).
Scan Configuration: Users should be able to add items to be ignored or excluded during scans to a Whitelist. They should also be able to undo removals through a Quarantine/recovery function. Anti-spyware applications should be able to performs scans on System start. Moreover, users should be able to run Scheduled scans on days and times of their choosing.
Prevention/Protection: Anti-spyware applications should have a resident component that: 1) scans Memory processes for spyware/adware modules; 2) monitors the Registry for Browser hijacks and changes to system Startup settings; and 3) monitors the HOSTS file for additions and changes. Anti-spyware applications should also be able to immunize Internet Explorer by setting ActiveX kill bits for known spyware/adware and adding a list of known problem web sites to the Internet Explorer Restricted sites list (or otherwise blocking installations from a black list of sites)..
Diagnostic Tools: Anti-spyware programs should offer users a set of tools to examine key aspects of their systems including: installed BHOs (Browser Helper Objects), installed ActiveX controls, key user configurable Browser settings (e.g., home page and search pages), programs added to system Startup locations, entries in the Windows HOSTS file, modules in the Winsock LSP chain.
Updates: Users should be able to perform Manual updates as well as configure the anti-spyware application to automatically check for updates on program Program start and at Scheduled intervals.
Supported Windows: Anti-spyware programs should support a range of different versions of Windows, not just the "latest and greatest".
 

Return to top

Recommended Programs

Although all of the programs listed on this page are worthy of consideration, at present time we officially recommend the following:
 

Note to Vendors: please do not email me and request to be added to the above list of "recommended" products. This list of "recommended" products is based on extensive experience with the listed products and is not a list to which one can apply for admission.
 
Disclaimer: the maintainers of Spyware Warrior have enjoyed consulting relationships with Sunbelt Software, makers of the CounterSpy anti-spyware application. Given that relationship and the inherent conflict of interest it represents, we refrain from recommending CounterSpy. Spyware Warrior has no financial relationship with any of the companies whose products are listed or recommended above. We are not employees, affiliates, representatives, or other agents of any of these companies.

In addition, there are other "freeware" scanners that you may find useful:

You should not rely exclusively on this short list of anti-spyware applications, however. Rather, you should investigate and test a range of reputable anti-spyware programs to find the programs that are best suited to your own privacy and security needs.

Moreover, we recommend that you install and use at least two anti-spyware programs because, unfortunately, no single anti-spyware program detects and removes 100 percent of the spyware and adware on the Net. For more information see the anti-spyware testing reported elsewhere on this site.

Anti-Spyware for the Mac

We're starting to get more and more questions from Mac users about anti-spyware. At this time, the only anti-spyware program that we know of for the Mac is:
 

Anti-Virus & Firewall Applications

In the past year, several anti-virus, anti-malware, and personal firewall applications have incorporated robust anti-spyware detection and removal. These programs include:
 

Although these anti-virus and personal firewall products may offer some protection against spyware and adware, we still recommend that users not rely exclusively on one of these products in lieu of a dedicated anti-spyware product, such as those listed earlier on this page.

Disclaimer: the maintainers of Spyware Warrior have enjoyed consulting relationships with Sunbelt Software, makers of the CounterSpy anti-spyware application. Given that relationship and the inherent conflict of interest it represents, we refrain from recommending CounterSpy. Spyware Warrior has no financial relationship with any of the companies whose products are listed or recommended above. We are not employees, affiliates, representatives, or other agents of any of these companies.

Other Things You Can Do...

Protecting your system against spyware and adware involves more than just installing one of the anti-spyware programs listed above. What follows below is a set of recommended additional steps for protecting for your PC. If your PC is already infested with spyware or adware, see the instructions for getting help included later on this page.

1.   Install anti-malware protection
     

Basic Free Protection

Scanning for spyware and adware isn't enough to protect your PC. You also need to take preventative steps to ensure that unwanted software doesn't come back. One effective way to prevent spyware and adware from returning is to install an anti-spyware prevention program such as:

SpywareBlaster and SpywareGuard are excellent, free programs from JavaCool. I recommend installing and using both, as they protect your computer in different ways. SpywareBlaster "inoculates" your Internet Explorer browser against the installation of unwanted spyware and adware from the internet. SpywareGuard actively monitors your PC and prevents spyware infestations. Both are easy to install and update.

Advanced HIPS & Rootkit Protection

In the past few years a new generation of anti-malware protection products has emerged. This new type of anti-malware protection, called HIPS (Host Intrusion Protection System), works at the kernel level to intercept malware before it hits your hard drive and infects the system. Although this technology is still maturing, a HIPS defense may be worth looking into for some users. For a run-down of the latest HIPS applications, see this discussion on the Spyware Warrior forums:

Advanced users may also be interested in the broadening array of anti-rootkit programs that are available:

Please keep in mind the HIPS and anti-rootkit applications are both emerging technologies that may not be appropriate for home users who aren't technically savvy.

     
2.   Lock down your browser
     

One of the most prevalent means for spyware and adware to be installed is through Internet Explorer. To prevent spyware and adware from installing without your knowledge and permission, you need to "lock down" Internet Explorer. There are several ways to do this.

Securely configure the Internet zone

First, you can securely configure the Internet zone of Internet Explorer and add sites that you trust to the Trusted sites zone. This means that by default web sites will not be able to use "active content" (i.e., ActiveX controls, Java applets, and scripting) until you explicitly choose to trust those web sites. See this page for instructions on how to securely configure Internet Explorer:

Internet Explorer Privacy & Security Settings

By turns, you could also use this free program, which will automatically configure Internet Explorer for you:

Enough is Enough!

One potential downside to securely configuring the Internet zone is that some web sites will not work properly until you add them to the Trusted sites zone -- a process that some users find cumbersome.

Add bad sites to the Restricted sites zone

Second, you can use another approach to "locking down" Internet Explorer which avoids the hassle of broken web sites by adding known "nasty" sites to the Restricted sites zone. Doing so gives your PC protection against known threats while still allowing most web sites to work by default. To put the clamp down on a long list of undesirable web sites, you can install and use this free program:

IE-SPYAD

If you choose to use the Restricted sites approach of IE-SPYAD, be sure to update your copy of IE-SPYAD regularly, as new web sites are constantly being added to the list.

     
3.   Use an alternative browser
     

Internet Explorer is not only the most popular browser on the Net, it is also the browser most widely and easily exploited by spyware pushers to install spyware and adware behind users' backs. Thus, you might decide that Internet Explorer is simply not worth the hassle or risk. In that case, you can install and run an alternative, non-IE browser such as:

All three of these browsers are mature, robust, and fast. Moreover, they have built-in pop-up blocking and several other nice features that Internet Explorer simply lacks. More importantly, all three of these browsers are much less susceptible to unwanted adware and spyware installations. And all three are free.

Note: even if you do switch to an alternative browser, you should still lock down Internet Explorer, as described above. Given that Internet Explorer has effectively been integrated into Windows, it can still be exploited by adware and spyware that gets installed to your system through other means. Thus, locking down Internet Explorer remains important even if you're not regularly using Internet Explorer to browse the internet. 

     
4.   Keep your system safe & secure with Windows Update
     
    To prevent unwanted spyware and adware from being installed behind your back, you need to install all the latest "Critical Updates" from Microsoft. Doing so is easier than you might think. 

Microsoft has an entire Windows Update site devoted to automatically updating users' systems with all the latest fixes and patches for a wide range of Microsoft software, including Windows, Office (Word, Excel, PowerPoint, Access), and Internet Explorer. 

We strongly urge you to take your system past the Windows Update site and let that site download and install the appropriate fixes for your computer. Doing so just might save you some grief and headaches down the road:
Windows Update
http://windowsupdate.microsoft.com/

Much of the update process at Windows Update is automated, so it's simple and convenient. The Windows Update site will install a small program to analyze the software on your system and recommend the appropriate fixes. This process takes only a few minutes. 

Once Windows Update has finished analyzing your system, you'll be presented with a menu of downloads that Windows Update deems appropriate for your computer. At a minimum you should let Windows Update install the fixes marked as "Critical Updates." The other available updates ("Recommended Updates," "Drivers and Enhancements") are optional.

Check the boxes for the updates that you wish to install ("Critical Updates" are checked by default). Then click the appropriate button to start the download and installation process. You'll be shown a summary of the updates that you've selected, and then you'll presented with a "License Agreement." After you click through the "License Agreement," the download and intallation process will start.

Since the entire download and installation process is automated, there's almost nothing for you to do except reboot the computer after all the updates have been installed.
      
5.   Read Licenses & Privacy Policies
     
   

Anti-spyware applications alone can't protect you entirely from unwanted spyware and adware. You have to do your part as well by being vigilant in your online behavior.

One of the more common sources for spyware and adware is "freeware" (e.g., Grokster or KaZaA) that bundles unwanted third-party applications. Another common source involves third-party web sites that automatically start the installation of spyware and adware when you visit those sites. These auto-installed spyware and adware programs may initially appear to be plug-ins necessary for the web site itself, though usually they are not.

Wherever you happen to encounter spyware and adware, you will usually be presented with a EULA (End User License Agreement) and/or Privacy Policy. Do not blindly click through these documents. Read them carefully and look for the tell-tale language that discloses the presence of adware or spyware. For tips on what to look for, see these pages:

 
Most if not all of the "adware-supported" or "advertising-supported" applications on the Net have adware-free equivalents. There's simply no need to use advertising-supported applications. If you're looking for truly free software without any unwanted surprises, see the following sites:
 
     

Other Anti-Spyware Tools

     

There is a wealth of specialized anti-spyware tools on the Net, many free for the taking. For a more complete list of anti-spyware products, see:

 

Return to top

If Your PC is Already Infested w/ Spyware & Adware...

If your PC is already infested with spyware and adware, resist the temptation to succumb to impulse buys of anti-spyware products that you see on the Net, esp. those included in the "rogue/suspect" list or advertised on Google. Instead, you can get help online from a corps of savvy volunteers who specialize in busting spyware.

To get help with a spyware infestation:

1. Clean your PC as best you can
     

Download and run one (or all) of these free anti-spyware scanners and remove whatever spyware and adware it finds. 

You should also scan and clean your computer with whatever anti-virus program you happen to have installed on your computer. If you don't have an anti-virus program, you can scan your computer with one of these online anti-virus scanners:

... or download and run one of these free standalone virus removal tools:

     
2.  

Visit a spyware removal forum

     

Once you've cleaned your PC as best you can, visit one of the following spyware removal forums:

     
3.   Follow the instructions for posting a HijackThis! log
     

Most of the above forums will request that you post a HijackThis! log. HijackThis! (HJT) is a free program that will scan key system settings on your PC and generate a plain text log that you can copy and paste into a post. The volunteers at the above forums will examine that HJT log and recommend a course of action to fix your PC. HijackThis! can be downloaded from HERE

Each forum has its own set of instructions and procedures for requesting help and posting a HJT log, so abide by the requirements of the forum you're visiting. Also, do not attempt to use HJT on your own to fix problems. Let one of the expert volunteers examine your HJT log and advise you on what to fix.

     
4. Help the volunteers help you
     

In order to help you clean your system, the volunteers at these anti-spyware forums need a good sense for what's going on with your computer. When you're ready to post and request help...

  • Start a new discussion topic/thread.
  • Give your discussion topic/thread a distinctive title.
  • Describe the symptoms and problems you're experiencing.
  • Describe what you've already done to solve the problem.
  • Copy and paste your HJT log into your post.
  • Be patient while waiting for a response.

Note that some of the forums listed above may require you to register for free before posting.

     
5.   Follow removal instructions precisely
     
Once a volunteer does give you advice for cleaning your PC, follow those instructions precisely and report back what the results are. Also, you may be asked to download and run other specialized anti-spyware tools to remove the particular spyware that's on your computer.
     
The volunteer spyware busters who work these anti-spyware forums do this kind of thing all day long, so you'll be in good hands. At times they can be a bit overwhelmed, so please be patient while waiting for help.

Once your PC has been cleaned, be sure to take steps to prevent it from being overrun with spyware adware again.
 

     

Return to top

Questions & Contact

If you have questions or comments about any of the information presented on this page, please don't hesitate to get in touch. 

Best regards,

SpywareWarrior.com

Full disclosure: the maintainers of this page have performed consulting work as independent contractors for Sunbelt Software, makers of CounterSpy. Because of that relationship and the conflict of interest that it represents, we must recuse ourselves from public comment on CounterSpy. That means that we cannot and will not publicly evaluate, test, or even recommend Sunbelt's anti-spyware product. The anti-spyware products that we do recommend, all of which are competitors to CounterSpy, are included above. Moreover, the opinions, judgments, and conclusions found on these pages are those of SpywareWarrior.com alone.

Return to top

This page is maintained by

Forums: http://spywarewarrior.com/index.php

Blog: http://www.netrn.net/spywareblog/

This page last updated: Nov. 9, 2006

Copyright 2006 SpywareWarrior.com