Re: Sunbelt Adjusts WhenU Detections in Security http://www.dslreports.com/forum/r13954343 en Sun, 06 Dec 2009 09:14:40 EDT Sun, 06 Dec 2009 09:14:40 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,14000799 ctrip : nevermind]]> http://www.dslreports.com/forum/remark,14000799 Thu, 28 Jul 2005 02:28:03 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,14000437 mongol : You rant at us about doing our homework and doing our own research and then admit you skipped 16 pages of posts. I think you sat in front of me at College. Is that you Bob??.]]> http://www.dslreports.com/forum/remark,14000437 Thu, 28 Jul 2005 01:02:19 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13998995 antiserious :
said by IndustryBurnout:

First let me say that I skipped about 16 pages of posts but from what I've seen it all looks the same anyway.

... and that's as far as I got, except to scroll through your verbose blather to get to the 'post reply' button ...

... but thanks for stopping by ... :uhh: ... always swell to hear from a burnout ...



--
... "Do You Know Where Your Towel Is ?" ...]]> http://www.dslreports.com/forum/remark,13998995 Wed, 27 Jul 2005 21:48:58 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13998900 doormans : You really should have taken the time to read the 16 pages of posts you admitted to skipping. I'm sure some of the info in them would have enlightened your somewhat sour and obtuse view of the companies and people involved.Oh and by the way, YOU never stated your qualifacations to berate the posters involved in this thread. :p]]> http://www.dslreports.com/forum/remark,13998900 Wed, 27 Jul 2005 21:38:46 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13998773 anon : OK I have to rant here. First let me say that I skipped about 16 pages of posts but from what I've seen it all looks the same anyway.

I think this thread is a perfect example of one of the major problems that plagues this industry today. This industry has developed a regrettably zealous and uninformed following. By that I mean that absolutely nothing any of these companies ever does will ever work as an apeasement to the large group of individuals that 1. Do not do their own research, 2. Take the word of self-appointed "experts", and 3. Allow their mentality to be formed by the highest common denominator, or simply, follow the herd.

From what I've seen here about the only thing that would satisfy the majority of these posters is to plant a nuke at each and every one of these adware companies and delisting antispyware companies and wipe them out. Unfortunately this is the kind of juvenile mentality that these antispyware companies are up against. It doesn't matter that these companies typically stock themselves with anywhere from 5 to 100 real experts that evaluate and fight this stuff everyday, publish legitimate research, and have the background to actually decide what stuff is harmful and what is not, as seen with Lavasoft and Pest Patrol one zealot starts a rampage about a delisting that 1,000 blind sheep jump on board with and naturally a commercial company has to cave. It's a disservice, to the antispyware companies, to the delisted companies, and believe it or not to the end user. This mentality is so rampant that often an end user that doesn't spend 10 hours a day often receives this extremist advice in some forum from some 13 yr old kid who received the same advice from an "expert" and they take it as gospel and voila, we're crowning another tin foil beanie chief. Now the antispyware company providing that end user with the solution has to take 3 days to calm down and explain to that user how their information is wrong.

I would venture to say that 95% of people in these forums have no formal education in regards to spyware evaluation, detection, and removal. Their education is solely in HJT logs and what someone else has told them is bad. Find me 10 people that have researched every entry on their own and based their decision on that and I'll come to your house and brush your teeth. I would also say that 85% of these people do not do their own research and accept what is spoon fed to them. You spend 3 hours a day on Hijack This logs you say? Great, from that I want you to tell me every distribution method that application takes advantage of as well as provide me with a detailed analysis of captured packet sniffer logs. Along with that I will need to know the company that produces the application, including registrar, address, and contact info. While you're at it go ahead and disassemble all the executables and dlls and get me a detailed report on those.

While we are on the subject and you have your assignments lined up you might as well provide us with every correspondence, contract, agreement, and conversation that has taken place between every antispyware company and every adware company or researcher that they have dealt with. I'm sure this will help you to prove the "conspiracy". Transparency is your argument to that? Well folks unfortunately we live in a corporate world and there's things called NDA's or Non Disclosure Agreements that are typically precursors to any kind of exchange of proprietary technology and information, which of course is a necessity to an honest and partial evaluation.

Now I'll use what I've seen in this thread as a perfect example. I've seen Eric Howes posting in this forum and references to his research. I'll be frank and say that I'm no fan of that rogue antispyware list. While I do believe it serves a purpose and can be informative to those who know how to filter out the biased leaning in favor of Lavasoft I have seen that thing quoted left and right, up and down, 9 ways to Sunday by this zealous following. Up until the point when he justified the Sunbelt changes you all thought Eric and that list was the best thing since sliced bread. Once his research came out and he justified the claims of Sunbelt you people turned on him, tried to chew him up, and spit him out. Absolutely zero weight was given to the fact that he actually did perform and provide non-biased research to back up the decision.

I don't think you can find in any other industry, firewall, antivirus, or otherwise, such a close minded, uninformed, blinder view of progression than in the spyware industry. It suffers from a mentality that is a cancer to the greater good. With such a blind outlook on things you have to realize, if an adware or whatever company honestly cleans up its act and justifies non-detection, only to have the antispyware company have to cave to a herd following public, we're never going to see an end to the problem. What encouragement do these guys have at all if their best efforts go for nill because of an uninformed public? They might as well keep exploiting loopholes and achieving installs and just deal with the antispyware removals than attempt to spend money righting their wrongs.

OK I think I've ranted enough and hopefully you understand my point. I think it applies to life as it does to the industry and I'll provide a couple recommendations to what should be done.

Lessons:

1. Do your own research
2. Use what your told as a factor of your research, not an excuse to do your research
3. People are grownups and need to accept some of the responsiblity over what they do. Your hand wasn't held when installing Windows, why can't we expect the same responsibility for an install dialog?

Resolution:

1. A non-biased researcher standard needs to be created, such as an MCSE or MVP for antispyware studies. This standard could be collaberated on by antispyware developers and open to the public for testing.

2. Subject the standard to strict revocation until we balance the industry. You start slanting in a bias manner or providing pure opinions in your advice, bye bye certification.

3. DO YOUR OWN RESEARCH. DO YOUR OWN RESEARCH. DO YOUR OWN RESEARCH. God, Buddha, and all others gave you a mind of your own and you didn't spend 13+ years in school to be told what to believe by others.

4. Use SaranWrap, not tin foil. This has got to be the most important of all. And no, antispyware vendors didn't kill JFK, build and isolate Area 51, hide Martians, start the FreeMasons and New World Order, pollute the water with pacifying hallucinogens, or turn a blind eye to Pearl Harbor]]> http://www.dslreports.com/forum/remark,13998773 Wed, 27 Jul 2005 21:22:35 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13983163 ghost16825 :
said by eburger68 See Profile:

That's all very well and good, but things do get a bit murkier when we're dealing with less knowledgeable users who don't always act consistently.
...which goes back to the point about assumed user knowledge.
--
Admin of the Kerio 2x-like open source project:
http://sourceforge.net/projects/kerio/
http://kerio.sourceforge.net/
]]> http://www.dslreports.com/forum/remark,13983163 Mon, 25 Jul 2005 20:48:31 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13982621 eburger68 : Bruce:

You wrote:

said by roamer_1:
Not exactly- You had said something to the effect that past reputation could be taken into account, but could not be an "end all" criteria, I simply proposed that if the company offered no spyware in any way for a reasonable period (1 yr was the example) then the delisting would take place- Perhaps I read you wrong. It seems you are now saying that past reputation cannot be a factor whatsoever! (?)

Perhaps you could flesh out how you see "past reputation" being applied?


I'm sorry, but the pre-checked boxes still amount to the same thing as a default action of "Remove," and you want those pre-checked boxes to be determined on the basis of a "known offender" status, which is itself reputation, which takes us right back to the original argument that some made in this thread, which was: "WhenU ought to be set to 'Remove' by default because it's WhenU." That's why I called it merely "another attempt to insert a 'because-it's-WhenU' trump card into the review process."

said by roamer_1:
I understand perfectly that labels are useless for targeting decisions (and I agree with your writings to that effect), but they are awfully handy in discussions. One saves alot of time labeling a creature a "duck" rather than explaining all the features that separate it from other avians in general every time a duck is described... Perhaps with a few well placed labels we might stop talking past each other.


Well, we're talking about the nitty targeting decisions here. For general coversation, labels can be handy. Beyond that, though, they become problematic. We like to think that the world is so simple that we can "call a duck a duck." But when we're dealing with anti-spyware targeting decisions, things are a bit more complicated because different people have different ideas as to what's a duck in some cases -- and we've seen as much right here in this thread.

said by roamer_1:
I was trying to delineate software that has install, notification, keeps ads within itself, and has an uninstall etc. Features you (seem to) describe as making it legitimate, though it is still adware. To me there is no difference, but if you need to define a legal difference, so be it.

I was suggesting an expansion of detect/remove to cover that "group" as well (AolMess and YahooBar were suggested earlier as examples of inclusion), so that these morphing companies could not say they were being unfairly singled out.


Actually, Sunbelt already does include similar applications in its database: Download Accelerator Plus and Weatherbug, for example. But Sunbelt doesn't include those apps because they fit some general label. They're included because they trip particular targeting criteria -- criteria which were developed with an eye towards what could cause users significant problems.

said by roamer_1:
I am against the idea that since the user was stupid enough to install it there should be no easy way to remove it and it must be relegated to A/R simply because it supplies an uninstall routine, or that it would be "Line item only" for removal.


First, what's not "easy" about Add/Remove Programs (assuming the uninstaller does the job as advertised? It seems that you want a general uninstallation utility for all manner of applications, but anti-spyware apps are not that kind of beast. They selectively detect and present applications of a certain quality based on certain criteria, which suggests to users that the selected/detected apps are somehow less desirable or more problematic than the ones not selected/detected. And once they do that, they've got take great care in how they select/detect/present.

Anti-spyware vendors can detect and present a wide range of different apps to users, but they must have some good rational for doing so (e.g., the app verifiably could present a problem or threat to users of some sort). Moreover, they must take special care in presenting applications that could be wanted and voluntarily installed by users, as I've explained in several other posts. That's where "Low risk adware" adware categories come from -- from an attempt to treat these types of applications differently.

It looks like you to want an easy way to erase all the default presentation differences, because you think it would suit your needs. But erasing those presentation differences could cause problems for other users -- tech gurus with clueless clients are not the only ones using anti-spyware apps.

said by roamer_1:
However, since you raised the point (and with any couched threat unintended), you would be suprised how many of your users ARE your users only with the blessing of their local guru or tech. If it doesn't fly with me, you can bet my users will be elswhere- especially when it comes to security software. My previous post aside, most of my users listen to me and accept my recommendations. I say this only to highlight the point that you do well to be here (and other places like in kind) and pound this out in an acceptable fashion.


Fine, but tech gurus are not the only ones using the anti-spyware applications, and anti-spyware vendors can't enshrine their preferences as the defaults just because they might feel they ought to be, esp. once we're dealing with types of software where the users themselves are divided and have differing needs and expectations.

Now, what anti-spyware companies CAN do is build in features that allow users of all kinds to customize the behavior of the anti-spyware programs to suit their particular needs -- a "Select/Remove All" button is a very simple example of that. A user-customizable "blacklist" (which I also discussed earlier today) is another example of that. But those kinds of preferences have to be incorporated into the product's performance through your own expressed customization/preference selecting actions. The defaults for anti-spyware applications, by contrast, have to be very carefully selected, and they may not absolutely match your own preferences.

said by roamer_1:
But you also can't take away the ability of the program to do the meat and potatos work that we rely on it to do. As I said before, CYA legally... fine. but give me a "Select all /remove" and keep detecting... Or a global option to select all... so that I can override the suggested action.

I know that you are holding your nose while you do this. I understand that you don't like these companies any more than I do. But in the midst of it you seem to be making the case for a type of "acceptable" level of adware, rather than a rally to "how do we beat 'em now?" which is an uncomfortable residue of this discussion.

So what are you saying in a general sense (not WhenU particularly for the moment)? Is there no productive way that Anti-Spy can assist if an adware drops below a certain level? And if such is the case, where might that level be defined? And if defined, How does one prevent further slippage (herein lies the brow of the proverbial slippery slope)?


It's not a matter of "acceptable" vs. "unacceptable" adware: it's a matter of finding ways to deal with applications that users can very well regard differently. As I've said several times, anti-spyware vendors can't just use your preferences as the defaults for the behavior and performance of their applications; they have to accommodate a wide range of users, and once we get down to handling what you're calling "ad-sponsored software," your preferences aren't universally held and could cause problems for other users if enshrined as the default preferences within anti-spyware applications.

said by roamer_1:
I didn't figure there would be any. Adware is within your pervue (at least traditionally). There are lots of mass uninstallers out there (regedit comes to mind), so that concept shouldn't be a problem...


But those kinds of applications don't selectively detect and present software based on the kinds of criteria that anti-spyware apps do. And users don't necessarily interpret the "results" presented to them by system cleaning applications in the same way as they do the "results" from "anti-spyware" apps.

As I said before, it looks like you want a general system cleaning app, and anti-spyware applications can come to resemble such applications, but the evolution isn't easy because of the expectations (from users, vendors, admins, etc.) that are brought to bear on anti-spyware apps, which started their lives closer to the "malware cleaning" side of things rather than the "system cleaning" side of things.

said by roamer_1:
If the "known offender" thing is what is in the way, then just give me a PUP (Spybot S&D) page with a "Select all" in settings. Then I can cherry pick the acceptable ones out of the list rather than checking the whole list except three or four...


Such a thing is easily implemented. Your suggestion from a later post to "make it global, make it stick," is more problematic without building checks or safety features for less knowledgeable users. You know enough to "select all" and then cherry pick the "acceptable ones," but I can already hear the complaints from users who didn't fully understand that the detected apps may not all be "bad" and who blindly selected that global option: "This @$#$%F*&S)#W! anti-spyware program said my screensaver and weather program were viruses and removed them!" And then we're right back to square one.

Best,

Eric L. Howes
--
Microsoft MVP
Sunbelt Software Consultant
Spyware Warrior]]> http://www.dslreports.com/forum/remark,13982621 Mon, 25 Jul 2005 19:35:30 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13982152 roamer_1 :
said by eburger68 See Profile:

Bruce:

otice the "Set a single action for all items" link next to the "Take Action" button. That link brings up a dialog box (see the second screenshot) that allows you do configure all detected items to for "Remove" or "Quarantine," no matter what the default action is.

I guess I didn't remember that such an option existed because in the testing I do, I never use it. I always inspect each detection one by one and select or verify the actions for each detection.

My apologies for the oversight and confusion.

(Note: the screenshots above are from CounterSpy 1.5 beta, but the same option and dialog box exist in the current release version 1.0.29.)

Best,

Eric L. Howes
Apologies not required.

Beauty day. Make it GLOBAL, Make it stick.

Regards,
Bruce]]> http://www.dslreports.com/forum/remark,13982152 Mon, 25 Jul 2005 18:36:34 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13982109 roamer_1 : Eric,

You wrote:

This looks to me like yet another attempt to insert a "because-it's-WhenU" trump card into the review process.

You worried earlier about anti-spyware vendors getting buried by petitions and legal threats -- this is the surest way to achieve that outcome.
Not exactly- You had said something to the effect that past reputation could be taken into account, but could not be an "end all" criteria, I simply proposed that if the company offered no spyware in any way for a reasonable period (1 yr was the example) then the delisting would take place- Perhaps I read you wrong. It seems you are now saying that past reputation cannot be a factor whatsoever! (?)

Perhaps you could flesh out how you see "past reputation" being applied?

Sunbelt does not make targeting decisions by starting with labels, which I've already explained are useless as the basis for targeting decisions
I understand perfectly that labels are useless for targeting decisions (and I agree with your writings to that effect), but they are awfully handy in discussions. One saves alot of time labeling a creature a "duck" rather than explaining all the features that separate it from other avians in general every time a duck is described... Perhaps with a few well placed labels we might stop talking past each other. :)

Truth be told, I don't even know what you mean by "ad-sponsored" software and how that would differ from the wide range of software most folks already call "adware." These labels are a dead-end street -- they're pointless and useless as the basis for targeting decisions.
I was trying to delineate software that has install, notification, keeps ads within itself, and has an uninstall etc. Features you (seem to) describe as making it legitimate, though it is still adware. To me there is no difference, but if you need to define a legal difference, so be it.

I was suggesting an expansion of detect/remove to cover that "group" as well (AolMess and YahooBar were suggested earlier as examples of inclusion), so that these morphing companies could not say they were being unfairly singled out.
I am against the idea that since the user was stupid enough to install it there should be no easy way to remove it and it must be relegated to A/R simply because it supplies an uninstall routine, or that it would be "Line item only" for removal.

In other words, Sunbelt should start basing its targeting and evaluation decisions not on what its customers and users want, but what some IT guys think is appropriate for them.

Sorry: that dog just died.
I didn't mean that in any legal way- I was just suggesting that "user wants" are not an effective platform in this forum. We all know what the user wants, and it is generally not thought of as a good thing... at least not with me. Whether that is legally defensible wasn't the point. Sorry if I was not clear on that.

However, since you raised the point (and with any couched threat unintended), you would be suprised how many of your users ARE your users only with the blessing of their local guru or tech. If it doesn't fly with me, you can bet my users will be elswhere- especially when it comes to security software. My previous post aside, most of my users listen to me and accept my recommendations. I say this only to highlight the point that you do well to be here (and other places like in kind) and pound this out in an acceptable fashion.

But we can't take a consumer product and turn it into a poor-man's backdoor admin tool for IT admins to exert control over their know-nothing clients.
But you also can't take away the ability of the program to do the meat and potatos work that we rely on it to do. As I said before, CYA legally... fine. but give me a "Select all /remove" and keep detecting... Or a global option to select all... so that I can override the suggested action.

I know that you are holding your nose while you do this. I understand that you don't like these companies any more than I do. But in the midst of it you seem to be making the case for a type of "acceptable" level of adware, rather than a rally to "how do we beat 'em now?" which is an uncomfortable residue of this discussion.

So what are you saying in a general sense (not WhenU particularly for the moment)? Is there no productive way that Anti-Spy can assist if an adware drops below a certain level? And if such is the case, where might that level be defined? And if defined, How does one prevent further slippage (herein lies the brow of the proverbial slippery slope)?

And who will be paying the legal bills of anti-spyware vendors once they start targeting such software and hanging scarlet letters on the ones that IT admins really hate?
I didn't figure there would be any. Adware is within your pervue (at least traditionally). There are lots of mass uninstallers out there (regedit comes to mind), so that concept shouldn't be a problem... If the "known offender" thing is what is in the way, then just give me a PUP (Spybot S&D) page with a "Select all" in settings. Then I can cherry pick the acceptable ones out of the list rather than checking the whole list except three or four...

I'm sorry, but most of the ideas you've offered in this latest post are simply not practical or advisable for anti-spyware companies, who are already faced with a minefield of trouble as it stands.
*sigh* that is odd, as this post was basically a recap of a previous one which I felt you found acceptable (re: What were we arguing about?)

Regards,
Bruce]]> http://www.dslreports.com/forum/remark,13982109 Mon, 25 Jul 2005 18:31:04 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13981651 SpannerITWks : Hi Eric,

Thanx 4 your earlier reply, i did check out those links you posted, and a few more besides !

I don't know where you + Suzie + TeMerc + all the other good peeps get the patience to to do as MUCH as you All do. I'm a very patient guy, but i think the mountains of info you all must read/write, along with the significant amount of time it must take researching + cross referencing it all + hosting/posting it etc, would burn most people out.

- - -

2 everybody -

Sure people will have differences, that's just how life is. Not perfect, never has been and Never will be, and they should get used to it and relax a bit more. But when it gets personal it's stepped over the line and benefits No One or the issues. In fact it makes it so much worse cos some people waste lotsa time on that and not what it's Really about.

Exchanging ideas and discussion is great cos it helps us All move forward, sometimes faster, sometimes with hurdles thrown in the way. Who said everything was meant to be easy peasy all the time, cos it aint, but let's @ least try and move in the right direction together.

The crapware merchants would just love it if we all fell out and couldn't sort it out amongst ourselves ! So let's try and keep focused on the Real bad guys hey.

Regards,

Spanner
--
I Only Know What I Know But I'm Learning all The Time - Stay Safe - Spanner intheWorks /SpannerITWks]]> http://www.dslreports.com/forum/remark,13981651 Mon, 25 Jul 2005 17:28:47 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13979229 eburger68 : Sybille:

You wrote:

said by sybille See Profile:

I still believe that what users want, in so far as it can be determined and however complex it may be, could run counter to the interests of the ASW vendor.

I didn't see that you responded to that concern in particular.
It's always possible that there could be instances in which their interests are not identical. The better that anti-spyware vendors can discern or compel users to announce their true intentions and preferences, the less likely that will be a problem. In fact, it's in the interests of anti-spyware vendors to align their programs with users' desires and intentions.

I agree, though, that convergence can never become perfect union.

Eric L. Howes
--
Microsoft MVP

Sunbelt Software Consultant

Spyware Warrior]]> http://www.dslreports.com/forum/remark,13979229 Mon, 25 Jul 2005 12:09:47 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13979144 sybille : I fully agree that what users want is convoluted. If it were not, the users would not install unwanted software in the first place, for example.

I think your idea to require that users clarify their intentions by means of different checks is a very good one. It both helps protect the ASW vendor and can serve to educate the user.

In that case, the aims of the two parties converge, at least to some extent.

I doubt this would be the case in each instance.

I still believe that what users want, in so far as it can be determined and however complex it may be, could run counter to the interests of the ASW vendor.

I didn't see that you responded to that concern in particular.

Of course, you're not required to respond, either. :)]]> http://www.dslreports.com/forum/remark,13979144 Mon, 25 Jul 2005 11:58:48 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13979111 eburger68 : JustBasics:

You asked:

said by Just Basics See Profile:

Let me see if I understand this correctly -

The program will still detect the 3 adjusted programs from WhenU and if Quarantine or Remove All is selected AS THE PROGRAM DEFAULT the programs will be automatically deleted or Quarantined?
Yes, CS will still detect the three programs. When you're presented with the scan results list, the default action for those three programs will be "Ignore." If you want to remove the programs, you can:

* Change the action for each program individually to "Remove" or "Quarantine," or

* Change the action for ALL detected programs in the scan results list to "Remove" or "Quarantine"

Note that if you scan again and those three programs are detected again, the default action will still be "Ignore." In other words, the "Set single action" option applies only to the current scan results.

Now, one thing I have been recommending anti-spyware vendors do is add a "Blacklist" function in addition to the "Whitelist" ("Always Ignore" or "Don't Detect") function that most anti-spyware apps already have. This option would allow users to customize their scan detections to better suit their own preferences.

TrendMicro AntiSpyware (formerly SpySubtract) already has such a blacklist (see attached screenshot). The trick is that the only way to add items to the blacklist is to select them from the scan results, which means that the items have to be detected first before they can be blacklisted (you can't specify in advance, for example, that you always want WhenU products removed).

Best,

Eric L. Howes
--
Microsoft MVP

Sunbelt Software Consultant

Spyware Warrior
Click for full size
]]> http://www.dslreports.com/forum/remark,13979111 Mon, 25 Jul 2005 11:55:41 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13979012 Shriyash : i think thats a great suggestion Diazruanova. definitely worth considering, IMO.]]> http://www.dslreports.com/forum/remark,13979012 Mon, 25 Jul 2005 11:43:54 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13979009 Cudni : Yes, indeed we like long and convoluted arguments :)

but civil

Cudni
--
Think locally, @#!? globally!
Help yourself so God can help you]]> http://www.dslreports.com/forum/remark,13979009 Mon, 25 Jul 2005 11:43:12 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13978999 antiserious :

... what, and spoil all the fun ? ...
]]> http://www.dslreports.com/forum/remark,13978999 Mon, 25 Jul 2005 11:41:15 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13978916 Just Basics : Let me see if I understand this correctly -

The program will still detect the 3 adjusted programs from WhenU and if Quarantine or Remove All is selected AS THE PROGRAM DEFAULT the programs will be automatically deleted or Quarantined?

If this is the case I wish someone would have mentioned it on page 1 of this thread!]]> http://www.dslreports.com/forum/remark,13978916 Mon, 25 Jul 2005 11:26:56 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13978851 Diazruanova : Quote.
------------------------------------------------------------------
Alex said : Ignore is probably the wrong word, as it does not mean the program is not detected. It is detected and presented to the user, and the user then decides if he/she wants to keep it or not. I have blogged a lot on what Ignore means - you can read some of my thoughts on this matter at sunbeltblog.com.
------------------------------------------------------------------

What about IF instead of "ignore", appears the word:

"OPTIONAL" and just to the right/left (or wherever possible) of the results, or with a pop-up window, a legend with the meaning of the "OPTIONAL" suggestion? maybe something like:

"Because of the low risk clasification of this software, you can delete, quarantine or ignore and keep it as desired"

Just a suggestion for your new version.

Diazruanova]]> http://www.dslreports.com/forum/remark,13978851 Mon, 25 Jul 2005 11:14:43 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13978712 eburger68 : Bruce:

OK, this is a bit embarrassing. Last night you wrote:

said by roamer_1:
So here are a couple proposals to pass on to your pals at Counterspy:

1. Give me a "Select ALL /remove" option


I chirpily said that it was a good suggestion. Had I explored the dim recesses of my memory first, however, I would have told you that CounterSpy already HAS such an option -- see the first attached screenshot above.

Notice the "Set a single action for all items" link next to the "Take Action" button. That link brings up a dialog box (see the second screenshot) that allows you do configure all detected items to for "Remove" or "Quarantine," no matter what the default action is.

I guess I didn't remember that such an option existed because in the testing I do, I never use it. I always inspect each detection one by one and select or verify the actions for each detection.

My apologies for the oversight and confusion.

(Note: the screenshots above are from CounterSpy 1.5 beta, but the same option and dialog box exist in the current release version 1.0.29.)

Best,

Eric L. Howes
--
Microsoft MVP
Sunbelt Software Consultant
Spyware Warrior
Click for full size
 
]]> http://www.dslreports.com/forum/remark,13978712 Mon, 25 Jul 2005 10:54:25 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13978615 eburger68 : Sybille:

You wrote:

said by sybille See Profile:

It is understandable that the ASW vendor would want to protect its interests and avoid such a situation.

However, what if the customers and users want something that is not in the interest of the ASW vendor?

For example, what if customers and users want am ASW program that will identify all programs made by WhenU as being equally undesirable?

This would not be in the interest of the ASW vendor that wants to protect itself from being sued, but it's certainly something that customers and users could desire.

How could such a conflict of interest be resolved most usefully?
Actually, this isn't quite as big of a problem as the previous hypothetical that I was responding to. A few observations and points:

1) The more that anti-spyware vendors can demonstrate that the features and performance of their applications reflect the actual preferences of their users, the stronger a position they'll be in. It's much sounder for anti-spyware vendors to point out that what adware vendors might object to is actually wanted by the customers of anti-spyware applications.

2) The trick here is that -- I hate to say it -- users are fickle and engage in self-contradictory behavior. Polls do show that most folks don't want spyware/adware on their systems. They hate it. But they don't always act in a manner consistent with that expressed wish because, as Bruce already pointed out (and which the study I referenced earlier also emphasizes), users like the freebie goodies as well. Moreover, as I noted several times earlier, users can even be divided themselves over what constitutes undesirable software in some cases.

So, we can get into situations where "what normal users want" isn't always clear and simple, esp. when a software vendor puts very clear forms of notice and disclosure in front of them and the users click through, apparently indicating their consent.

Note: I don't happen to think that much of what passes for "notice and disclosure" among adware vendors is meaningful because of all kinds of problems which I can't get into right at the moment. There are going to be some forms of notice and disclosure that are so clear, conspicuous, and straightforward that it becomes difficult for me to look at them and imagine how users could get through without knowing what they were installing. Those situations are very much the exception at present, though.

3) When user intent or desire becomes murky or divided, the best thing anti-spyware vendors can do is add "extra checks" (for lack of a better term at the moment) into their anti-spyware apps to get a better sense of what users' real intentions and desires are.

For example, forcing users to change the default in some cases from "Ignore" to "Remove" is one way to do that, because it allows anti-spyware vendors to claim that the users made the affirmative, unambiguous choice to remove the software of their own volition.

There other "extra checks" that anti-spyware vendors can build in to strengthen the case that the removals were the actual desire and intent of the user, but the above is one example.

I know that some folks here will read this and say, "I know what I want! It's not so difficult to figure out, and I'm completely consistent in my actions." That's all very well and good, but things do get a bit murkier when we're dealing with less knowledgeable users who don't always act consistently.

Best,

Eric L. Howes
--
Microsoft MVP
Sunbelt Software Consultant
Spyware Warrior]]> http://www.dslreports.com/forum/remark,13978615 Mon, 25 Jul 2005 10:42:55 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13977553 fatdcuk : First of all,a big thanks to WCB for bringing this discussion back to alevel of respectibility/intelligence(Its more productive this way:)).

Thanks Alex for returning to the discussion and persuing a company policy of full disclosure on this thorny issue.

I was amazed at he backlash at youself,Eric &Suzi but having said that as all have acknowledged this is a thorny issue open to discussion.

But none the less full disclosure and openess should be greeted with respect and not open hostlity even if its a thorny issue.

Half the problem with Lavasoft's stealth removal of all WhenU detections was when discovered the company refused to address user's concerns or explain their actions for quite some period of time.Even then i'm fairly sure the truth never emerged:(
IRC AC did'nt make any appearances,it took a while for one of their support forum admins not even LS employed(the amiable "Corrine") to start doing the PR rounds without any concrete information.Subsequently MW(LSMikeW) of Lavasoft came other to try and put down the mob&concerned user's by telling them to practice DHAO.Lesson 101 in dire corperate PR:(

Im glad that yourself&your reps do not operate this way:)

I understand the situation that all Bot killer vendors are facing with reguards adware companies and lawsuits(detection&removal issue's).
So far i've found the Sunbelt model of defining problematical software as being the best in the industry.
I would also like to say that your way of dealing with threatened legal action is also second to none in the privacy industry.
Please for the sake of all keep it up:)

All-

Here's an interesting discussion on another relevent topic here at dslr security forums.

»www3.dslreports.com/forum/remark,13966689]]> http://www.dslreports.com/forum/remark,13977553 Mon, 25 Jul 2005 05:44:13 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13977517 sybille :
said by eburger68 See Profile:

said by roamer_1:

The people you are talking to here are the guys that have to tell those users "You can't have that. All this crap is pluggin up your box."
In other words, Sunbelt should start basing its targeting and evaluation decisions not on what its customers and users want, but what some IT guys think is appropriate for them.

Sorry: that dog just died.
I agree with this, although I notice that your hypothetical example focuses on the ASW vendor being taken to court.

It is understandable that the ASW vendor would want to protect its interests and avoid such a situation.

However, what if the customers and users want something that is not in the interest of the ASW vendor?

For example, what if customers and users want am ASW program that will identify all programs made by WhenU as being equally undesirable?

This would not be in the interest of the ASW vendor that wants to protect itself from being sued, but it's certainly something that customers and users could desire.

How could such a conflict of interest be resolved most usefully?

Even if we do not have "hard numbers" to demonstrate what customers and users want in the particular case under consideration at present, it does not seem far-fetched to me to suppose that the interests of customers and users would differ from and possibly conflict with those of any company, including those of an ASW vendor.]]> http://www.dslreports.com/forum/remark,13977517 Mon, 25 Jul 2005 05:18:23 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13977490 eburger68 : ctrip:

You wrote:

said by ctrip See Profile:

Make all the well reasoned arguments you want. I believe that over 50% of your customers do not want WhenU downgraded.
As I already explained several times now, Sunbelt did not "downgrade" WhenU across the board, as you imply. It downgraded three particular apps that it determined were comparatively low risk, but will still remove them if users elect to remove them.

The main WhenU adware application, Save!/SaveNow, which in my experience causes the most consternation among users because of unwanted pop-up advertising on the desktop, has not been downgraded at all. It remains targeted for removal with a default action of "Quarantine."

I'm all for taking users' opinions into account -- they're ultimately the ones we serve. But it won't do to simply assert with no evidence that you believe you know what the majority of users would want. I don't doubt that many wouldn't want those three apps downgraded. Just what percentage we don't know, however, and neither do you.

Eric L. Howes
--
Microsoft MVP

Sunbelt Software Consultant

Spyware Warrior]]> http://www.dslreports.com/forum/remark,13977490 Mon, 25 Jul 2005 04:55:54 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13977465 eburger68 : Bruce:

You wrote:

said by roamer_1 See Profile:

I would be sayin "Hell Yes"! (providing explicitly that "Known Offenders" are prechecked for removal, and that "Known Offender" status has a real, un-watered effect and a long and serious probationary period).
And the known offenders would have to be determined by some set of criteria that themselves would have to be drafted. Moreover, hanging a "known offender" status on vendors because of reputation issues would be an invitation to still further complaints and legal threats. This looks to me like yet another attempt to insert a "because-it's-WhenU" trump card into the review process.

You worried earlier about anti-spyware vendors getting buried by petitions and legal threats -- this is the surest way to achieve that outcome.

said by roamer_1 See Profile:

It's the "ignore" action that got me baked.

And that is the gist of the downgrade as I see it... that WhenU now only meets the criteria of "ad-sponsored" rather than spyware or adware. Well fine, then EXPAND the software to include "ad-sponsored" software too...
Sunbelt does not make targeting decisions by starting with labels, which I've already explained are useless as the basis for targeting decisions, and then determining threat levels. We start with the specific practices, behaviors, and functionality included in the Listing Criteria...

»research.sunbelt-software.com/li···eria.cfm

...so telling Sunbelt to include "ad-sponsored" software is simply pointless -- Sunbelt doesn't even USE such a label or category. The categories we do use are assigned at the end of the entire evaluation process and are more designed to provide a simple description of the software for users. We could throw the labels out tomorrow and still do reviews of software, but it is the criteria we look to, not the labels.

If you want to suggest changes, start with the Listing Criteria. If there are behaviors, functionality, or practices that you think are ommitted, then please suggest them -- it's always possible that we've missed something.

Truth be told, I don't even know what you mean by "ad-sponsored" software and how that would differ from the wide range of software most folks already call "adware." These labels are a dead-end street -- they're pointless and useless as the basis for targeting decisions.

said by roamer_1 See Profile:

It has been bandied about here that these types of programs are actually desireable to users- That dog don't hunt.

Users desire EVERYTHING. especially if it is free and has bouncy, flashy bits...

The people you are talking to here are the guys that have to tell those users "You can't have that. All this crap is pluggin up your box."
In other words, Sunbelt should start basing its targeting and evaluation decisions not on what its customers and users want, but what some IT guys think is appropriate for them.

Sorry: that dog just died.

Adware vendors would make so much legal hay with that targeting philosophy. I can see the courtroom now:

* Adware vendor's legal team shows the judge all the notice and disclosure provided during installation -- notice screens, EULAs, you name it -- and demonstrates how users must indicate their consent to the installation of the software.

* Anti-spyware vendor's legal team then replies that such may be true, but the anti-spyware vendor has polled IT admins, who know better than than the users themselves what those users need.

* Adware vendor's legal team then brings in five outraged users who really did want the screensavers and the talking purple monkey and were distraught when the anti-spyware program removed it.

* Anti-spyware vendor's legal team brings in five IT admins who all roll their eyes in unison and explain how the users shouldn't have been downloading that trash to begin with.

No, I'm afraid that's not going to work.

said by roamer_1 See Profile:

This is another whole facet to the war on the ground, and people are scared that you guys (in general) are gonna drop the ball and leave us in "Add and Remove" hell. You've got to remember that we don't have a fancy server down in IT preventing users from installing crap we don't want.
If you work in a corporate environment and are dealing with recalcitrant users who won't follow company policy, then you need an enterprise level anti-spyware product that gives the admins more administrative control over the software that gets installed on the company's computers. Sunbelt offers such a product, as do a number of other anti-spyware vendors.

But we can't take a consumer product and turn it into a poor-man's backdoor admin tool for IT admins to exert control over their know-nothing clients.

said by roamer_1 See Profile:

So be a pal... make it better. Expand into ad-sponsored "legitimately" installed Doh-ware... you'll make my day.
And who will be paying the legal bills of anti-spyware vendors once they start targeting such software and hanging scarlet letters on the ones that IT admins really hate?

I'm sorry, but most of the ideas you've offered in this latest post are simply not practical or advisable for anti-spyware companies, who are already faced with a minefield of trouble as it stands.

Best,

Eric L. Howes
--
Microsoft MVP
Sunbelt Software Consultant
Spyware Warrior]]> http://www.dslreports.com/forum/remark,13977465 Mon, 25 Jul 2005 04:34:55 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13977217 ctrip : Make all the well reasoned arguments you want. I believe that over 50% of your customers do not want WhenU downgraded.

You can either take into consideration your customers opinions or not when deciding your criteria.

If you decide to consider their opinions, you will. If not, then we have the status quo. It is a business decision and nothing we say will change that.
--
Spread Internet Explorer! - The browser you can trust to not have those annoying Firefox twits pushing it!]]> http://www.dslreports.com/forum/remark,13977217 Mon, 25 Jul 2005 02:46:04 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13977103 Shriyash :
said by roamer_1 See Profile:

Eric,

It's the "ignore" action that got me baked.

Users desire EVERYTHING. especially if it is free and has bouncy, flashy bits...

The people you are talking to here are the guys that have to tell those users "You can't have that. All this crap is pluggin up your box."

I have a particular client .....
She is inordinately fond of electronic pets and free internet games. She LOVES emoticons and font packages. She has downloaded every screensaver known to man... and she just doesn't get it. No matter how often I explain it to her, no matter what preventive software I load on... And her teenage daughter is just as bad. They both are clueless, the worst I've got... but they are very far from alone.

So just because it is desired by the user (lets not even talk about underage kids "legally" installing on the family box) does not mean that it is good for the user. They aren't ever gonna read a EULA and don't care what it says. They glaze over when I start talking geek...They just expect me to show up, waive my ju-ju beads, mutter some x-rated incantations, and exorcise the evil they have let into their lives.

Regards,
Bruce

you said it very well roamer1, i have someone closer to home thats exactly like the client{and her daughter!} you mentioned, namely my little sister! :)

she is almost a mirror image in terms of behaviour to the 2 ladies mentioned above, and it is me, who has to clean up her pc everytime as a result!
she says to me " oh but i dont know how my pc became so slow........... i dont know how to remove all this,......... its too complicated...."

i dont mind the practice, but i, in turn would like to transfer this job to an anti-spyware application, because they can do a much thorough and efficient and complete job than i could ever do manually.

but i am just dreading the day that she runs an antispyware app. only to be given 3 options,{she cant understand what this'qurantine' business is} for 10 detected things that she has no idea, wether to keep or delete. ]]> http://www.dslreports.com/forum/remark,13977103 Mon, 25 Jul 2005 02:12:44 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13976877 roamer_1 : Eric,

Actually, when I discussed flexible presentation methods within scan results earlier in this discussion thread, they were widely dismissed by people who insisted that there should be no distinctions made, that "flexibility" was tantamount to "sell-out," and that all adware/spyware programs should be presented to users in the same way and handled in the same way with no exceptions. That's part of what was being argued about.
Well, perhaps it got missed in the fray...

As discussed between you and I earlier:

If you added a page to the scan results wherein all ad-sponsored software (as opposed to adware)were listed, and where "Known Offenders" were pre-checked for removal... where I could also remove all the Doh-ware like YahooBar, AolMess (just to name two)... well that would be a big gain to me! I would be sayin "Hell Yes"! (providing explicitly that "Known Offenders" are prechecked for removal, and that "Known Offender" status has a real, un-watered effect and a long and serious probationary period).

It's the "ignore" action that got me baked.

And that is the gist of the downgrade as I see it... that WhenU now only meets the criteria of "ad-sponsored" rather than spyware or adware. Well fine, then EXPAND the software to include "ad-sponsored" software too...

It has been bandied about here that these types of programs are actually desireable to users- That dog don't hunt.

Users desire EVERYTHING. especially if it is free and has bouncy, flashy bits...

The people you are talking to here are the guys that have to tell those users "You can't have that. All this crap is pluggin up your box."

This is another whole facet to the war on the ground, and people are scared that you guys (in general) are gonna drop the ball and leave us in "Add and Remove" hell. You've got to remember that we don't have a fancy server down in IT preventing users from installing crap we don't want.

I have a particular client (doesn't everyone?) who needs my service on a semi-monthly basis. She is inordinately fond of electronic pets and free internet games. She LOVES emoticons and font packages. She has downloaded every screensaver known to man... and she just doesn't get it. No matter how often I explain it to her, no matter what preventive software I load on... And her teenage daughter is just as bad. They both are clueless, the worst I've got... but they are very far from alone.

So just because it is desired by the user (lets not even talk about underage kids "legally" installing on the family box) does not mean that it is good for the user. They aren't ever gonna read a EULA and don't care what it says. They glaze over when I start talking geek...They just expect me to show up, waive my ju-ju beads, mutter some x-rated incantations, and exorcise the evil they have let into their lives.

So be a pal... make it better. Expand into ad-sponsored "legitimately" installed Doh-ware... you'll make my day.

Regards,
Bruce

EDIT: Ladies, please don't flame me because my representation involved only those of the fairer sex... I have plenty of male users that are nearly as bad as the two I mentioned...
B]]> http://www.dslreports.com/forum/remark,13976877 Mon, 25 Jul 2005 01:09:07 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13976667 Kmtnwmn : Eric and Suzie,

I can see both sides of the issue. You can't condemn one that is truly walking the walk to reform. But you have to watch their every step for many miles. That's where CS's job gets tough.

Most of all I wanted to thank you for the dignity you have maintained though out this thread. That in itself speaks volumes to me. I don't get a chance to post much, but do read as often as I can. But I felt compelled because for the 1st time since I have read this forum, I felt almost ashamed to be on it's member list due to this thread.

I lost respect for some people whose opinions I once held in high regard, and gained more respect for others. Thank you both for your tact and not stooping to the back biting, jealousy I saw going on in this thread.

Again, that speaks volumes of your character and motivation.

Keep up the great work!
--
Life is not holding a good hand. Life is playing a poor hand well.]]> http://www.dslreports.com/forum/remark,13976667 Mon, 25 Jul 2005 00:18:08 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13976506 eburger68 : Bruce:

You wrote:

said by roamer_1 See Profile:

IMHO, That remains to be seen. The obvious reason for spyware vendors to pursue C&D, delistings, etc. is that they are shaking up the game, looking for a way to preserve themselves. any change to the playing field will undoubtably be exploited.
Oh, that's quite clearly their intention. But I said that it "need not happen," not that I could guarantee it WOULD not happen. It still could happen if anti-spyware companies aren't careful and disciplined. It's a possibility, but not a foregone result.

said by roamer_1 See Profile:

No, but "anti-adware" goes right along with Anti-spyware... you could do us all a favor by ADDING emphasis to the anti-ad part... no need to distinguish between adware and ad-sponsored-ware...:D
I use the term "anti-spyware applications" because that's what most people know those programs as. Truth be told, I've never liked the term "spyware" for all kinds of reasons. In fact, I often write "spyware/adware" just to be clear that I most certainly do include advertising software within the scope of programs that I'm discussing. And if you take a look at the Sunbelt Listing Criteria...

»research.sunbelt-software.com/li···eria.cfm

...you'll notice that "adware" functionality is a big part of what Sunbelt considers in its review process. And for my own thoughts on useless labels like "spyware" and "adware," see:

»https://netfiles.uiuc.edu/ehowes/www/junkware.htm
»https://netfiles.uiuc.edu/ehowes/www/ftc···ents.htm

Quite frankly, I'm sick of silly arguments that revolve around labels.

said by roamer_1 See Profile:

Ummm... so remind me again... what were we arguing about? I doubt anyone here would take exception to the scenarios above...
Actually, when I discussed flexible presentation methods within scan results earlier in this discussion thread, they were widely dismissed by people who insisted that there should be no distinctions made, that "flexibility" was tantamount to "sell-out," and that all adware/spyware programs should be presented to users in the same way and handled in the same way with no exceptions. That's part of what was being argued about.

Best,

Eric L. Howes
--
Microsoft MVP
Sunbelt Software Consultant
Spyware Warrior]]> http://www.dslreports.com/forum/remark,13976506 Sun, 24 Jul 2005 23:51:07 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13976402 roamer_1 :
The bottom line is that there need be no Pandora's Box of adware de-listings, provided anti-spyware companies construct robust review processes. But it does require them to make tough calls that may not always be popular in some quarters.
IMHO, That remains to be seen. The obvious reason for spyware vendors to pursue C&D, delistings, etc. is that they are shaking up the game, looking for a way to preserve themselves. any change to the playing field will undoubtably be exploited.

Can anti-spyware programs start targeting all manner of programs that could bring the system to its knees?
No, but "anti-adware" goes right along with Anti-spyware... you could do us all a favor by ADDING emphasis to the anti-ad part... no need to distinguish between adware and ad-sponsored-ware...:D


said by roamer_1 See Profile:

1. Give me a "Select ALL /remove" option
Good suggestion.

said by roamer_1 See Profile:

2. Give me a separate page in the scan results for "Ad-Sponsored" software.
Include YahooBar, AOLMess, etc. (Not picking on them, just examples).
Any on that page rated as a "Known Offender" would be automatically checked for removal.
Those not so rated would not be checked.
You're thinking along the same lines I do -- revamp the scan results in anti-spyware programs to provide more flexible, useful, and intelligible ways for presenting a wide range of potentially risky software (from the lowest of the low risk adware programs to out and out malware) to users for possible removal.
Ummm... so remind me again... what were we arguing about? I doubt anyone here would take exception to the scenarios above...

Rgds,
Bruce]]> http://www.dslreports.com/forum/remark,13976402 Sun, 24 Jul 2005 23:30:29 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13976275 StraitShoot :
said by alexeck See Profile:

We've done our due diligence on WhenU, as have many other antispyware vendors. Some other antispyware vendors just took WhenU off, which is patently wrong.
Alex Eckelberry
Presdient
Sunbelt Software
For some reason reading your post made me lighten up.. Maybe because you didn't get crazy with us "WhenU" haters out there and maybe because you actually said you respect our opinion..For that, thanks...

Now a question;... Who delisted WhenU? We have a right to know..I am assuming Aluria is one company...
Thanks
Jim]]> http://www.dslreports.com/forum/remark,13976275 Sun, 24 Jul 2005 23:09:34 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13976060 eburger68 : Ghost16825:

You wrote:

said by ghost16825 See Profile:

You're saying that just by coming up with a scan result, you're already made a recommendation.
Yep, that's what I'm saying. And that IS how users interpret the scan results, whether we like or not.

said by ghost16825 See Profile:

As I alluded to earlier, this seems to be a problem due to not having a clear scope of detection to begin with and/or not clearly telling consumers what the scope of detection for your AS app is.
Actually, I think you've got it backwards. The less clear, more vague, and more exapnsive your scope, the less and less you're making recommendations. The wider of a net you throw, the more you move away from making recommendations. That's why system cleaning apps have generally not had to deal with the hassles that anti-spyware vendors do -- because they're not discriminating and classifying the way anti-malware vendors do.

Selective Detection + Classification = Implied Recommendation (at least to non-knowledgeable end users; sysadmins are a bit of a different case)

said by ghost16825 See Profile:

Additionally, I would say it also comes down to user control. If the user has no or few options, than yes you have already made a recommendation for them.
I would agree that improved user control is a must, and most reputable anti-spyware vendors are struggling to figure out how to deliver that without overwhelming confused users with burdensome decisions that they find difficult to make.

Best,

Eric L. Howes
--
Microsoft MVP

Sunbelt Software Consultant

Spyware Warrior]]> http://www.dslreports.com/forum/remark,13976060 Sun, 24 Jul 2005 22:39:05 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13975982 alexeck : SnoweOne:

I hear you. I hope it never comes across that I'm glowing over any adware vendor. I recognize the work they've done to clean up their channels, but we're certainly not happy play buddies.

Alex Eckelberry]]> http://www.dslreports.com/forum/remark,13975982 Sun, 24 Jul 2005 22:29:09 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13975958 eburger68 : MerlynTech:

said by CajunTek See Profile:

I think the biggest problem here is that WhenU is still a bad company with many bad products.. and singling out some as not so bad is not a good thing..
Well, this is essentially the same "because-it's-WhenU" argument that numerous other people have alrady made in this thread and which I have already responded to at length several times. Rather than rehash my responses yet again, let me simply point you to those earlier responses.

said by CajunTek See Profile:

The other bad thing is this, you have had to spend many hours of your very valuable time defending this action. I wish you could have spent it working on IE-spyad, or the helping Sunbelt develope fixes for more serious malware, or even researching other rogueware...
I don't especially enjoy doing this, and I'm certainly no fan of WhenU. The decision was a tough one -- not pleasant or easy by any means. And, yes, I would much rather have spent my weekend doing something else. But the job had to be done, as unpleasant and frustrating as it might have been.

Also, if you look back through this thread and disregard the petty sniping and other such nonsense, you'll actually find a useful discussion between me and others (including critics) of some of the more substantive and knotty issues currently surrounding anti-spyware programs and how they detect and present potential threats to users. I do enjoy those kinds of discussions, as the topics and issues involved are my "bread-and-butter," so to be speak -- the kinds of problems I mull over endlessly.

So, I would hardly consider this thread a complete waste -- far from it.

Best,

Eric L. Howes
--
Microsoft MVP
Sunbelt Software Consultant
Spyware Warrior]]> http://www.dslreports.com/forum/remark,13975958 Sun, 24 Jul 2005 22:26:03 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13975937 ghost16825 :
said by eburger68 See Profile:

The minute you selectively DETECT some programs but not others on the user's hard drive, you're already saying to the user: "These programs are somehow different or more problematic than the others we haven't detected, and you ought to remove them from your system."

My point is that you're making implied recommendations even when you don't use the words, "We recommend that you..."

No, you can't get around making recommendations as long as you're selectively presenting detected programs to users. The only option you have is to make the recommendations more appropriate, accurate, informative, useful, and intelligible to users.

Best,

Eric L. Howes
No, I for one strongly disagree with this. (See my previous post). You're saying that just by coming up with a scan result, you're already made a recommendation. As I alluded to earlier, this seems to be a problem due to not having a clear scope of detection to begin with and/or not clearly telling consumers what the scope of detection for your AS app is. Additionally, I would say it also comes down to user control. If the user has no or few options, than yes you have already made a recommendation for them.
--
Admin of the Kerio 2x-like open source project:
http://sourceforge.net/projects/kerio/
http://kerio.sourceforge.net/
]]> http://www.dslreports.com/forum/remark,13975937 Sun, 24 Jul 2005 22:24:05 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13975936 SnowyOne : All well & good except I think Sunbelt Software took a turn south when it referred to WhenU as straight, decent internet citizens.]]> http://www.dslreports.com/forum/remark,13975936 Sun, 24 Jul 2005 22:23:59 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13975830 alexeck : Against perhaps my better judgment, I'm going to wade into this soup again. I'm also currently out of town on vacation and haven't been able to follow this issue as closely as I would have liked too.

Every one of you who has expressed concern over the WhenU listing is, in fact, totally justified in doing so.

Antispyware vendors have a disgraceful history dealing with adware. There's even a vendor out there that actually did a financial transaction with WhenU, something that still makes my head whirl.

I have always felt that the problem in this business was one of trust and broken trust. You buy a product, and then your vendor gets weak in the face of a threat or a desist letter or whatever, and then betrays your trust by delisting a program.

I've stayed clear of petty snipes at some of competitors, because my opinion is so totally, obviously biased that it would be meaningless to say anything. However, I have privately fumed with our team as to how these vendors could do such things.

So there I sat at the Antispyware conference a few months back, watching all the adware vendors do their shtick as to how they had improved and gotten better. And a bunch of us got up, myself included, and offered conclusive proof as to why there wasn't the ring of truth to their claims. There were a lot of very, very pissed off Antispyware people there.

Then Bill Day from WhenU got up and talked, and a number of us listened. Because out of all the slick slimeballs there, this guy actually sounded sincere and had real actions to back his words. He is not an adware guy. He was the founder of About.com and is more of an adverting guy, brought in to clean up WhenU.

We went back to business after the conference and then, as can be expected, got a call from WhenU.

They wanted to get delisted.

I personally got on the conference call with their president, along with members of my research team and told them flat out: You will never, ever be delisted from a Sunbelt database. The only thing we would ever consider doing is changing their threat level.

We have a very carefully followed protocol when it comes to these things. We put any vendor complaint through an exhaustive, formal review process. It is based on objective and subjective criteria and takes some time.

We went through this process, and we were genuinely surprised.

WhenU had actually done a considerable amount to reform their actions.

This didn't mean, however, that their past actions weren't an issue. But there current state was 180 degrees different than just 12 months ago.

I was actually a bit worried. Could we have made a mistake? So I personally downloaded, on my work production system (not a Vmware), every single WhenU app I could find. I did the same as an innocent user might do.

Then I let the programs run. Now, I am a fairly experienced with spyware, having done my share of de-infestations of machines.

Well, WhenU Save was certainly still a problem, as the research team had found. But programs like WeatherCast simply didn't justify being in at their threat level.

So we determined, that in line with our listing criteria, they would be downgraded to Low Threat and a default action of Ignore. (Ignore is probably the wrong word, as it does not mean the program is not detected. It is detected and presented to the user, and the user then decides if he/she wants to keep it or not. I have blogged a lot on what Ignore means - you can read some of my thoughts on this matter at sunbeltblog.com.)

When it comes to antispyare databases, consistency is key. And we certainly feel that transparency is the key as well. So we posted our reasonings and announced it to the world. If you read the PDF, it clearly lays bare our thinking (what's incredible is that WhenU is now back at us arguing our decision -- something that I admit to being a bit irritated about myself).

So for those who are upset about this, good. Your voice is the conscience of this industry.

I pay some pretty big legal bills fighting spyware vendors. Being alone is tough sometimes, and having a strong voice out there to support people in our position is greatly valued.

The problem is that we need to fight the major problems. 180, DR, CWS, and all the others who need work.

We've done our due diligence on WhenU, as have many other antispyware vendors. Some other antispyware vendors just took WhenU off, which is patently wrong.

But WhenU is not worth the fight. They are absolutely in the database and will be detected on user systems, but believe it or not, the installations that are getting on people's machines are, for the most part, ACTUALLY WANTED.

(I can't understand why someone would want a program like WeatherCast, but some people actually like a little ticker that gives them weather alerts. So be it.)

We need help on the major issues, the ones that are taking down people's machines, the stealth installs, the poor or non-existent disclosures, and the idiotic lawsuits and cease and desist letters that are causing endless hassle to us Antispyware vendors.

I really do value this forum and the input. I don't post often, but I do a lot of reading. Many of you posting here are people I have a great respect for, having read other posts of yours. It means a lot that you care to take the time and make your points.

As always, you can always email me directly at alex(at)sunbelt-software.com

Keep up the good fight,

Alex Eckelberry
Presdient
Sunbelt Software]]> http://www.dslreports.com/forum/remark,13975830 Sun, 24 Jul 2005 22:11:49 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13975827 eburger68 : SpannerITWks:

You wrote:

said by SpannerITWks See Profile:

Why would Anyone want ANY adware etc on their comps in the first place ! Surely they would want to get rid of it all @ the first available oppourtunity, Not choose to keep it ?
Hard as it may be to believe, there are some folks who either want or are willing to put up with some of the *milder,* more *inncouous* forms of adware (I can't imagine anyone actually wanting EliteBar/SearchMiracle or Aurora, unless they were some wierd techno-masochist).

Want some heavy reading? Try this out:

Stopping Spyware at the Gate: A User Study of Privacy, Notice and Spyware
»www.sims.berkeley.edu/~jensg/res···tudy.pdf

That ethnographic study examines the way users actually make download and installation decisions, and their decision-making processes are more involved than you might think.

The study is not without its problems -- see here for my response:

Muddy Data, Vague Notice, & the Swamp of User Consent
»www.spywarewarrior.com/elh/muddy_data.htm

The point here is that there are *some* programs that users themselves are actually divided over -- we've seen examples right here in this thread. The challenge for anti-spyware vendors is to figure out how to accommodate the competing demands and expectations of these users.

Best,

Eric L. Howes
--
Microsoft MVP

Sunbelt Software Consultant

Spyware Warrior]]> http://www.dslreports.com/forum/remark,13975827 Sun, 24 Jul 2005 22:11:36 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13975793 CajunTek : Eric,

I think the biggest problem here is that WhenU is still a bad company with many bad products.. and singling out some as not so bad is not a good thing..

The other bad thing is this, you have had to spend many hours of your very valuable time defending this action. I wish you could have spent it working on IE-spyad, or the helping Sunbelt develope fixes for more serious malware, or even researching other rogueware...
--
Lost in Texas]]> http://www.dslreports.com/forum/remark,13975793 Sun, 24 Jul 2005 22:07:26 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13975749 eburger68 : Wildcatboy:

You wrote:

said by Wildcatboy See Profile:

Why would you want to recommend anything in the first place? The software's job is to detect what's there. Who says the software's job to tell me what to do? Just detect the malware based on a certain guidelines and leave a link in front each to a help file.

Once you stay away from the business of telling people what to do, then we won't have to go through similar situations.
You can't avoid making recommendations. The minute you selectively DETECT some programs but not others on the user's hard drive, you're already saying to the user: "These programs are somehow different or more problematic than the others we haven't detected, and you ought to remove them from your system."

Slap a label like "Spyware found" in the scan results screen, and you've effectively suggested to users that the programs presented below that label are "bad" and should be removed.

Throw up warning boxes with flashing red text (as some anti-spyware programs do) or sound alarm bells (as still others do) and the recommendation is even more pronounced.

My point is that you're making implied recommendations even when you don't use the words, "We recommend that you..."

And that is most certainly how users interpret those scan results: as advice, warnings, and recommendations. Take a look at threads here at DSLR where users breathlessly post screenshots of their anti-virus program or anti-spyware program detecting some file or program on their systems. They often say something like, "My AV program said this was a trojan and that I should remove it."

Implied recommendations are also what make false positives so alarming to non-tech-savvy users, who are confused and frightened that their anti-malware programs are apparently "telling" them that a program they thought was OK is now a "virus" that has to be removed.

No, you can't get around making recommendations as long as you're selectively presenting detected programs to users. The only option you have is to make the recommendations more appropriate, accurate, informative, useful, and intelligible to users.

Best,

Eric L. Howes
--
Microsoft MVP
Sunbelt Software Consultant
Spyware Warrior]]> http://www.dslreports.com/forum/remark,13975749 Sun, 24 Jul 2005 22:00:29 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13975713 SpannerITWks : Why would Anyone want ANY adware etc on their comps in the first place ! Surely they would want to get rid of it all @ the first available oppourtunity, Not choose to keep it ?

Even better is not to get it installed anyway by securing their PC's + Browsers properly, and not accepting too good to be true Apps etc, that they don't Really need.

Spanner
--
I Only Know What I Know But I'm Learning all The Time - Stay Safe - Spanner intheWorks /SpannerITWks]]> http://www.dslreports.com/forum/remark,13975713 Sun, 24 Jul 2005 21:55:37 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13975692 Wildcatboy :
Unless you have something more intelligent to say than Puh-lease, LOL and I'm baaaaack you may consider staying out.
--
You can catch the Devil, but you can't hold him long.]]> http://www.dslreports.com/forum/remark,13975692 Sun, 24 Jul 2005 21:52:18 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13975655 eburger68 : Bruce:

You wrote:

said by roamer_1 See Profile:

If criteria need be established in order to CYA in legal terms, then that obviously must be done- but as I said in my previous post, I worry that thousands of "Change of Rating" requests would have a tendency to overwhelm the resources of an Anti-Ad company and I foresee and hereby predict that logical end.
I worry about this as well -- not only with respect to anti-spyware companies but even more so with independent researchers and web sites, who don't have the financial resources to defend themselves legally.

One thing I've been urging the anti-spyware vendors that I talk to to do is to set up some kind of informal process or structure for sharing information about who's been approached or threatened by various adware companies. Anti-spyware companies need to cooperate more on a lot of things, but sharing information on challenges and threats would be most useful and could allow the anti-spyware industry to formulate a more coordinated and effective defense against legal challenges.

said by roamer_1 See Profile:

It is far easier for me to believe these companies are building a "Bait and Switch" rather than to surmise they have "Seen the Light" and are now noble creatures suitable for edification as bronze busts on marble columns.
That's also a very legitimate worry, and most of the adware companies that I've seen have exhibited very little tendency or inclination to actually do the hard work of cleaning up their acts. At best, they're more interested in making cosmetic changes and then bullying anti-spyware companies into dropping their software from the detections.

In the rare case that we do encounter a company that appears to be making substantive changes, though, I find it hard to maintain that we should ignore such progress, where it can be verified.

said by roamer_1 See Profile:

As I said in my previous post- It isn't so much whether or how you rate things that I care about, it is what you do with that rating, and therein lies the friction between "your side" and "mine". The ACTION taken by the software is where all the gripe is here.
As I've said in numerous posts here, I think that the actual behavior and functionality (the "action," as you put it) should be the primary (but not exclusive) focus, and that's exactly why I've been asking folks here over and over to tell me what specifically these three programs (WhenUSearch, ClockSync, Weathercast) do that warrants a risk rating of higher than "Low risk." So far, no one's been able to address this question square-on or back up their conclusions with evidence.

said by roamer_1 See Profile:

I envision a time when 300 of those 500 spy\ad bots are rated to "ignore" and I have to laboriously wander down the entire list hitting the pulldown and changing the "ignore" to "remove" line by line...
That certainly would be an extreme annoyance. In fact, Lavasoft Ad-aware Personal already forces users to laboriously check every box in the scan results (one of the benefits to upgrading to the Plus or Pro versions is that you get a nice checkbox to automatically select all results in the scan results screen).

That said, I really don't think we'll get to the point where 300-500 adware/spyware programs are set to "Ignore." Here's why:

The nightmare scenario you lay out is based (I assume) on the fear that in downgrading or reclassifying one adware program, anti-spyware vendors open a Pandora's box which will quickly cause hundreds more to be downgraded. But that scenario happens only if anti-spyware vendors don't have a solid review process in place and haven't established standards of some sort to guide (but not completely determine) that review process.

It is quite possible to have a review process in place that allows for reclassifications and de-listings without giving away the store. I can vouch for this from personal experience. Not only do I maintain several well known block lists...

»https://netfiles.uiuc.edu/ehowes/www/resource.htm

...but I administer the Rogue/Suspect Anti-Spyware page:

»www.spywarewarrior.com/rogue_ant···ware.htm

Both projects attract their fair share of complaints and even threats from companies of one sort or another. In both cases, though, I have occasionally reclassified or even removed domains or listed software from the block lists or the Rogue/Suspect page. Removals are very much the exception, not the norm. But I do have to provide a review process of some sort and give requests from companies due consideration. I end up rejecting far more removal requests from companies than I grant. In some cases, I've been rejecting the repeated requests from the same companies for a year or more because they haven't fundamentally changed their products or their web sites.

I must admit that when the first credible removal request hit my inbox, I was very worried that if I gave in to one, I'd effectively give away the whole store. That concern was misplaced, as it turns out. I've found it quite practical to grant removals in the rare instances where I think they are truly warranted while holding the rest of the problem actors at bay.

The bottom line is that there need be no Pandora's Box of adware de-listings, provided anti-spyware companies construct robust review processes. But it does require them to make tough calls that may not always be popular in some quarters.

said by roamer_1 See Profile:

Privacy issues aside, in answer to your question posed to StraightShooter, it isn't the one adware left behind that is terribly harmful to to the system, it is the aggregate. This is true of ad-sponsored and purchased softwares too. Shutting off all the TSRs in a box is already a problem. There is no sense making it worse.
Well, I'll hand it to you -- that's the most credible answer I've heard yet to my question, though it still doesn't quite address the question or scenario square-on. It's also somewhat problematic, because the implied standard ("aggregate effect on the system if installed in volume") would be easily applicable to other types of completely legitimate software.

For example, I've seen boxes where the users were infatuated with cool screensavers, wallpapers, icons, custom cursors and so forth that were so completely junked up that using the system was difficult indeed. I've also seen boxes that were simply overwhelmed with the sheer number of programs installed by the OEM and running in the system tray (in fact, back in the Win9x days, tech support at OEMs used to routinely advise users to resolve their problems by disabling all the resident auto-run programs clogging the system tray).

Can anti-spyware programs start targeting all manner of programs that could bring the system to its knees? You could certainly build a cleanup and removal tool that would help users unclog their systems of all the (legitimate) garbage they or their kids installed, but that would resemble more one of the many system cleaning tools that are already on the market (and, yes, we have had proposals here at DSLR for anti-spyware vendors to revamp their programs into more general system cleaning tools).

said by roamer_1 See Profile:

1. Give me a "Select ALL /remove" option
Good suggestion.

said by roamer_1 See Profile:

2. Give me a separate page in the scan results for "Ad-Sponsored" software.
Include YahooBar, AOLMess, etc. (Not picking on them, just examples).
Any on that page rated as a "Known Offender" would be automatically checked for removal.
Those not so rated would not be checked.
You're thinking along the same lines I do -- revamp the scan results in anti-spyware programs to provide more flexible, useful, and intelligible ways for presenting a wide range of potentially risky software (from the lowest of the low risk adware programs to out and out malware) to users for possible removal. Anti-spyware vendors are currently changing their scan results in just this way. See this page for a discussion of those changes with screenshots:

»www.spywarewarrior.com/asw-notes···ults.htm

Best,

Eric L. Howes
--
Microsoft MVP
Sunbelt Software Consultant
Spyware Warrior]]> http://www.dslreports.com/forum/remark,13975655 Sun, 24 Jul 2005 21:46:52 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13975647 SnowyOne :
said by DakAD:

I wonder wether that simple change would satisfy most of the people who have objected to counterspy's reccomendation to 'ignore' WhenU?
I'd consider that change a change for the better.
It would also hamper the ability of a known Ad/SpyWare vendor to put out a few "clean" apps for the only purpose of creating argument & discourse among the AntiSpyWare Community. Divide & conquer is a time honored strategy.]]> http://www.dslreports.com/forum/remark,13975647 Sun, 24 Jul 2005 21:46:07 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13975644 StraitShoot : Forget it... This is ridiclous. ]]> http://www.dslreports.com/forum/remark,13975644 Sun, 24 Jul 2005 21:45:57 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13975615 Wildcatboy :
Why would you want to recommend anything in the first place? The software's job is to detect what's there. Who says the software's job to tell me what to do? Just detect the malware based on a certain guidelines and leave a link in front of each to a help file.

Once you stay away from the business of telling people what to do, then we won't have to go through similar situations.
--
You can catch the Devil, but you can't hold him long.]]> http://www.dslreports.com/forum/remark,13975615 Sun, 24 Jul 2005 21:42:00 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13975603 anon : I haven't read this entire thread, but I've read some pages and reading the last entries I have a question. I don't have CounterSpy, but if I installed it, I think I would have it delete anything it found regardless of if it said "ignore". Could doing that compromise your Windows system or cause other problems?]]> http://www.dslreports.com/forum/remark,13975603 Sun, 24 Jul 2005 21:40:16 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13975546 anon :
Truth be told, I've never been a big fan of the "Ignore" label and have recommended changing it to something that more accurately reflects what Sunbelt is trying to do and say with that particular default action

^E Howes
----------------------

I dunno... i think the ignore (oh, thats how its spelt :D) recomendation is useful, but should be for programs that are no longer a problem at all (but are still included incase anyone has an older, objectionable copy) or are on a 'probationary' period; I agree that ignore, as applied to dubiouse apps like WhenU, is a tad misrepresentative of what users should actually do (ie, assess the program themselves and chose wether to keep it or not).

I like suzi's idea of 'user choice'... just that one simple change from 'ignore' --> 'user choice' could do alot, by prompting users to actually check up on the program, rather than disreguard it.

I wonder wether that simple change would satisfy most of the people who have objected to counterspy's reccomendation to 'ignore' WhenU?]]> http://www.dslreports.com/forum/remark,13975546 Sun, 24 Jul 2005 21:32:57 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13975413 suzi : Eric wrote:

quote:
Truth be told, I've never been a big fan of the "Ignore" label and have recommended changing it to something that more accurately reflects what Sunbelt is trying to do and say with that particular default action, which is:

"We've analyzed this program and assessed it as 'low risk,' so there's no dire need to remove this program if you want to keep it. You may want to remove it, however -- see the information we've provided about the program. If you want to remove it, we can do that, but you'll need to affirmatively elect to do so by changing the action to 'Remove' or 'Quarantine.'"

The trick, of course, is how to compress that "message" or "advice" into a one word label. Not easy


That's my thinking, too. IMO a better option might be to have the recommended action say something like "user choice" or just "choice" and force the user to select one of the 3 options to remove, quarantine, or ignore. If the user wants more information, they can click on the link to the research center page.
--
aka Suzi, Spyware Warrior
Microsoft MVP Windows Security 2005
Sunbelt Software Consultant]]> http://www.dslreports.com/forum/remark,13975413 Sun, 24 Jul 2005 21:16:10 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13975274 eburger68 : DakAD:

You asked:

said by DakAD:

Does the 'more info' button link to this (or a very similar) page by any chance?
Yes. There's info within the scan results itself plus a link to more information like you found. See the attached screenshot for an idea of the kind of information presented in the scan results screen. (Btw, that screenshot is of a beta of CS 1.5, however, the scan results screen in the current release version 1.0.29 is very similar.)

said by DakAD:

If so, for what its worth, I think thats fine as it gives the user the info they need to make their own descision; although I suppose it could benifit from a really succinct summary at the top, and possibly a 'should you keep WhenU wizard' (as someone suggested) for the terminally computer-unsavvy, although that's crossing over from (hopefully constructive) critisism to nit-picking.
Sunbelt is presently in the process of overhauling its database, which includes not only the boilerplate descriptions of things like threat levels, but also the more detailed summaries and descriptions for individual threats. This is a time consuming process, though.

said by DakAD:

Although having said that, it would open the possibility of a third reccomendation -- 'uncertain: check link'.
Truth be told, I've never been a big fan of the "Ignore" label and have recommended changing it to something that more accurately reflects what Sunbelt is trying to do and say with that particular default action, which is:

"We've analyzed this program and assessed it as 'low risk,' so there's no dire need to remove this program if you want to keep it. You may want to remove it, however -- see the information we've provided about the program. If you want to remove it, we can do that, but you'll need to affirmatively elect to do so by changing the action to 'Remove' or 'Quarantine.'"

The trick, of course, is how to compress that "message" or "advice" into a one word label. Not easy.

said by DakAD:

this could be reserved for apps like WhenU, which are generally OK but have in the recent past been installed without the users permission, and still have trouble uninstalling/come in bundles etc. It could be used to draw to the users attention a potentially unwanted product and help the user descide wether to keep it without actually recomending wether they keep it or not, and reserving the status of 'ignoor' for apps which have almost completely cleaned up their act and are only objectable in a few very limited circumstances/are in a 'probationary' pieriod before being removed completely, etc.

I guess counterspy should probably review its current modus operandi reguarding the ignor/quarenteen recomendation, if only to avoid coming under fire like this again.
See my discussion of the "Ignore" button just above -- looks like we're thinking along the same lines.

Best,

Eric L. Howes
--
Microsoft MVP
Sunbelt Software Consultant
Spyware Warrior
Click for full size
]]> http://www.dslreports.com/forum/remark,13975274 Sun, 24 Jul 2005 20:59:05 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13975098 roamer_1 : Eric,

I don't question the color of your hat, and please realize that I do not consider myself enough of an authority to judge your judgements. I believe you and respect your position (which is quite articulate, I might add). I don't mean to be hot-headed or rancorous.

If criteria need be established in order to CYA in legal terms, then that obviously must be done- but as I said in my previous post, I worry that thousands of "Change of Rating" requests would have a tendency to overwhelm the resources of an Anti-Ad company and I foresee and hereby predict that logical end. It is far easier for me to believe these companies are building a "Bait and Switch" rather than to surmise they have "Seen the Light" and are now noble creatures suitable for edification as bronze busts on marble columns.

As I said in my previous post- It isn't so much whether or how you rate things that I care about, it is what you do with that rating, and therein lies the friction between "your side" and "mine". The ACTION taken by the software is where all the gripe is here.

I am a service tech (as I suppose many here are). I remember back to the days when adware was first coming out and the Anti-virus companies decided that ad trojans were somehow different than a viral trojan and declared "That is not my job" thus spawning the entire Anti-ad / anti-spy industry.

That "classification", that supposed "difference" was horror-highway to those of us that had to rip tons of nasties out by hand to get a user back to normal.

The classifications being made today make me jumpy for the same reason. I rely on Anti-v\s\a\t to prevent in the first case, or to clean things up adaquately and efficiently to keep my time down and reduce cost to my client.

Even in the midst of the greatest awareness of spyware ever, it is really not uncommon for a client to bring in a box that will not run due to 100 virus and 500 spy/ad running TSR in the machine.

I envision a time when 300 of those 500 spy\ad bots are rated to "ignore" and I have to laboriously wander down the entire list hitting the pulldown and changing the "ignore" to "remove" line by line...

Privacy issues aside, in answer to your question posed to StraightShooter, it isn't the one adware left behind that is terribly harmful to to the system, it is the aggregate. This is true of ad-sponsored and purchased softwares too. Shutting off all the TSRs in a box is already a problem. There is no sense making it worse.

So here are a couple proposals to pass on to your pals at Counterspy:
1. Give me a "Select ALL /remove" option

2. Give me a separate page in the scan results for "Ad-Sponsored" software.
Include YahooBar, AOLMess, etc. (Not picking on them, just examples).
Any on that page rated as a "Known Offender" would be automatically checked for removal.
Those not so rated would not be checked.
If a "Known Offender" cleans up his act and keeps it clean for a year delist him as a Known Offender.
Of course the user may uncheck a desired software and it will stay unchecked (until I show up).
A user may also CHECK an unchecked box and it will stay checked (which is what I will do when I show up).

This would give me the added bonus of having a handy place to rip out all the ad-sponsored annoyances currently not handled as a malware...

Bruce]]> http://www.dslreports.com/forum/remark,13975098 Sun, 24 Jul 2005 20:34:20 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13974917 anon : When i said 'WhenU', i was reffering to the downgraded WhenU apps, not savenow; but it bore pointing out.

Does the 'more info' button link to this (or a very similar) page by any chance?

»research.sunbelt-software.com/th···id=14835

If so, for what its worth, I think thats fine as it gives the user the info they need to make their own descision; although I suppose it could benifit from a really succinct summary at the top, and possibly a 'should you keep WhenU wizard' (as someone suggested) for the terminally computer-unsavvy, although that's crossing over from (hopefully constructive) critisism to nit-picking.

Although having said that, it would open the possibility of a third reccomendation -- 'uncertain: check link'.

this could be reserved for apps like WhenU, which are generally OK but have in the recent past been installed without the users permission, and still have trouble uninstalling/come in bundles etc. It could be used to draw to the users attention a potentially unwanted product and help the user descide wether to keep it without actually recomending wether they keep it or not, and reserving the status of 'ignoor' for apps which have almost completely cleaned up their act and are only objectable in a few very limited circumstances/are in a 'probationary' pieriod before being removed completely, etc.

I guess counterspy should probably review its current modus operandi reguarding the ignor/quarenteen recomendation, if only to avoid coming under fire like this again.]]> http://www.dslreports.com/forum/remark,13974917 Sun, 24 Jul 2005 20:09:35 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13974659 eburger68 :
said by DakAD:

So counterspy still will warn (even outside of a scan) if WhenU gets onto the machine, and will still find WhenU in a scan and offer the option of removing it. that seems to be quite fitting for a product which has been demonstrated to be undesireable in some cases, but fine in (most?) others.
In a word, yes. The Active Protections don't make distinctions between programs as the scan results screen does.

Also, keep in mind that WhenU's main adware program Save/SaveNow, has not been changed in teh CS database or scan results. It's only three other comparatively low risk programs (WhenUSearch, ClockSync, Weathercast) that have been reclassified, but even they will be presented to the user in the scan results screen with a default action of "Ignore."

said by DakAD:

Although having said that, id still only be perfectly happy if the user was in some way given more information in order to make the descision as to wether to ignor or not, either by a 'more info' button or, as someone else suggested, by a user-configured set of criteria for counterspy to descide wether to reccomend ignoring or quarenteening a program.

or maybe some kind of 'installation shield', which would block the installation of WhenU and pop-up a message informing the user that WhenU will deliver text adverts, and quoting relevant parts of the EULA, and asking the user if they want the instalation to proceed (thus ensuring that the user is actually knowingly installing WhenU whilst being fully aware that this will result in adverts)?
In both the scan results and the Active Protection warning box that pops up, users have the ability to get more information.

said by DakAD:

My only problem remains that some less computer-savvy users will blindly follow counterspys advice and ignor WhenU, even if (were they to understand what WhenU did) they wouldn't want it to remain on their PC*; hence my desire to see anti-slyware programs help the user in making an informed descision.

*or, i suppose, change it to 'quarenteen' on the grounds that anything detected by an anti-spyware program is evil, even if (were they to understand what WhenU does) they would willingly tolerate the adverts in return for the main program.
Again, keep in mind that the Sunbelt review of WhenU was not an across-the-board reclassification of WhenU -- the main adware program, Save/SaveNow remains classified as "Adware" with a default action of "Quarantine."

Best,

Eric L. Howes
--
Microsoft MVP
Sunbelt Software Consultant
Spyware Warrior]]> http://www.dslreports.com/forum/remark,13974659 Sun, 24 Jul 2005 19:34:54 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13974541 mers2 : Eric has acknowledged for a long time that he has been a paid consultant to Sunbelt and no one until now seemed to care. His work and test results were taken as gospel. He is speaking out on this issue as it is his work that contributed to the decision by Sunbelt to downgrade 3 of WhenU's programs. Both Eric and Daphne have done a tremendous amount of work against spyware and I for one am ashamed that some in this forum have sunk to the low of insulting them rather then sticking to the facts of the issue. I thought the Security Forum was better then this.
--
God put me on this Earth to accomplish a certain number of things. Right now, I am so far behind I will never die. ]]> http://www.dslreports.com/forum/remark,13974541 Sun, 24 Jul 2005 19:14:45 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13974484 anon :
The changes that Sunbelt announced affect only the scan results in the scan/removal engine. The "Active Protections" remain unaffected, so if one of the "downgraded" programs is detected by one of the Active Protections, they should kick in and warn the user, just as with any other program listed in the database. (If for some reason they don't in a particular case, that's because of a lack of proper data to detect a particular variant, not a decision to not detect it.)

^E Howes
--------------------------

cheers

my main concern was that the active protection for it would have been removed for some reason.

So counterspy still will warn (even outside of a scan) if WhenU gets onto the machine, and will still find WhenU in a scan and offer the option of removing it. that seems to be quite fitting for a product which has been demonstrated to be undesireable in some cases, but fine in (most?) others.

Although having said that, id still only be perfectly happy if the user was in some way given more information in order to make the descision as to wether to ignor or not, either by a 'more info' button or, as someone else suggested, by a user-configured set of criteria for counterspy to descide wether to reccomend ignoring or quarenteening a program.

or maybe some kind of 'installation shield', which would block the installation of WhenU and pop-up a message informing the user that WhenU will deliver text adverts, and quoting relevant parts of the EULA, and asking the user if they want the instalation to proceed (thus ensuring that the user is actually knowingly installing WhenU whilst being fully aware that this will result in adverts)?

My only problem remains that some less computer-savvy users will blindly follow counterspys advice and ignor WhenU, even if (were they to understand what WhenU did) they wouldn't want it to remain on their PC*; hence my desire to see anti-slyware programs help the user in making an informed descision.

*or, i suppose, change it to 'quarenteen' on the grounds that anything detected by an anti-spyware program is evil, even if (were they to understand what WhenU does) they would willingly tolerate the adverts in return for the main program.]]> http://www.dslreports.com/forum/remark,13974484 Sun, 24 Jul 2005 19:07:01 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13974357 eburger68 : TeMerc:

You wrote:

said by TeMerc:
I would not call it universalizing at all. I would call it a conclusion based on said history with regard to WhenU, that's all. And just because some people here came to different conclusions is by no means any reason to change my mind, not by any stretch, regardless of how high I hold some of you.


Except that you framed that conclusion by suggesting everyone would reach the same as you:

said by TeMerc:
There is no way anyone who reads this thread, or has read any other thread about WhenU and its actions...


Setting that aside, it seems to me that your history still ignores the past 8-9 months of verifiable improvements. Those changes have got to count for something, yet I don't seen any allowance in your assessment of "trustworthiness" that gives any consideration to the changes that have occurred and can be verified.

And by the way, I am not saying that WhenU ought to be completely trusted -- that's part of the reason the Save/SaveNow application has not been changed in the CS database and the reason that I and Sunbelt will continue monitoring WhenU's installations as best we can.

said by TeMerc:
How you can say its spiteful and vengeful makes no sense to me. I would draw the same conclusions with any company with the history that WhenU has. I would indeed say they do not need to be given any leeway in regards to trying to improve their road to legitimacy. And again, considering the history, in my mind, I think that's just.


What you see as "just" I see as spiteful and vengeful -- either way, your proposed probation period seems more oriented towards exacting "just" retribution rather than in practical considerations such as "what is the required time period to verify that this particular vendor's distribution channels have been cleaned up and will likely remain cleaned up"?

said by TeMerc:
My 'standard'(your word, not mine) would need not be carved in stone, and would need to be on a per vendor basis. And carving anything in stone with adware related vendors, is just going to have them skirt the lines which were carved in stone.


I would agree that decisions have to be made on a case by case basis, and that's exactly why I've been comparing WhenU with 180solutions, which to me require different handling based on their respective histories.

Best,

Eric L. Howes
--
Microsoft MVP
Sunbelt Software Consultant
Spyware Warrior]]> http://www.dslreports.com/forum/remark,13974357 Sun, 24 Jul 2005 18:49:35 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13974218 TeMerc : said by TeMerc:
-----------------------------------------------------------
There is no way anyone who reads this thread, or has read any other thread about WhenU and its actions or, rather lack of actions, or for that matter, supposed actions could be taken as 'trustful' by any stretch. Just because they are doing something now, does not mean they will continue to do so. There certainly is not nearly enough history to prove this.
----------------------------------------------------------
Eric replied:
TeMerc, I'm sorry, but you can't universalize your own judgments and conclusions like that. A number of people in this thread -- credible people that you know, too -- have come to different conclusions than you.

I say:
I would not call it universalizing at all. I would call it a conclusion based on said history with regard to WhenU, that's all. And just because some people here came to different conclusions is by no means any reason to change my mind, not by any stretch, regardless of how high I hold some of you.

said by TeMerc:
--------------------------------------------------------------------------------
Consider the length of time that alleged company has given the users of their unsavory installs. Was it just 12 months? Not hardly. Was it just 'affiliates' as so many often say? More than likely just looking the other way, as has been proven by several other researchers.
--------------------------------------------------------------------------------

Eric replied:
The standard you propose is based on nothing other than spite and vengeful ness. The standard I proposed was grounded in practical considerations: what is the time required to verify that distribution channels have been cleaned up and that the company remains on the right course. That's a practical standard.

I say
How you can say its spiteful and vengeful makes no sense to me. I would draw the same conclusions with any company with the history that WhenU has. I would indeed say they do not need to be given any leeway in regards to trying to improve their road to legitimacy. And again, considering the history, in my mind, I think that's just.

Eric said:
Your own standard, by the way, would let off the hook in very short order vendors who have only been around for a short time. Is that really what you want? I think not.
I say:
My 'standard'(your word, not mine) would need not be carved in stone, and would need to be on a per vendor basis. And carving anything in stone with adware related vendors, is just going to have them skirt the lines which were carved in stone.

And that to me, is going to be the biggest problem with ASC and its mission. I look forward to seeing how the group approaches this task.

We all know what needs to done, the problem is making everyone happy(in a legal sense for the most part), and that simply, will not happen.]]> http://www.dslreports.com/forum/remark,13974218 Sun, 24 Jul 2005 18:28:02 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13974169 mongol : All this fuss and then I noticed this on Counterspy's homepage. You jave to get a chuckle out of it....

"Worse, Microsoft has recently downgraded several adware products from "quarantine" to "ignore." A good example is the Claria GAIN, formerly knowns as Gator and one of the most hated adware companies around. You might ask yourself: "Is Sunbelt also downgrading their adware threat definitions to "ignore" for Claria and other adware like Microsoft is doing?" The answer is NO, we ignore Microsoft's threat scoring values. We only use their threat data (like the file names, and locations where malware is found, etc.). We have not downgraded our Claria Gain recommendations and still have it set to be quarantined. If you run Microsoft AntiSpyware it detects the adware, but now presents "Recommended Action" of "Ignore" (!). You can draw your own conclusions... "]]> http://www.dslreports.com/forum/remark,13974169 Sun, 24 Jul 2005 18:17:38 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13974127 eburger68 : DakAD:

You asked:

said by DakAD:

My question is, how does counterspy handle the downgraded WhenU products with reguard to the active protection? will it unload WhenU from memory? Will it ignore, or not even look for, WhenU in memory? Or will it pop up a message if it finds WhenU running in memory and ask what the user wants to do, again suggesting the user ignor it? (same questions for 'what will counterspy do if it finds WhenU attempting to load to memory'?)
The changes that Sunbelt announced affect only the scan results in the scan/removal engine. The "Active Protections" remain unaffected, so if one of the "downgraded" programs is detected by one of the Active Protections, they should kick in and warn the user, just as with any other program listed in the database. (If for some reason they don't in a particular case, that's because of a lack of proper data to detect a particular variant, not a decision to not detect it.)

Best,

Eric L. Howes
--
Microsoft MVP

Sunbelt Software Consultant

Spyware Warrior]]> http://www.dslreports.com/forum/remark,13974127 Sun, 24 Jul 2005 18:12:24 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13974118 Spy :
said by eburger68 See Profile:

1) I reported the changes, which were not disclosed by the vendors themselves (unlike the case here);

2) I explicitly said that my largest complaint was the lack of disclosure and transparency in both cases (certainly not a problem here);

3) I called for readers here to back off Lavasoft after much the same lynch mob descended on them (see one of my early posts in this thread for the quote and link).

4) I asserted that I would continue to recommend both Lavasoft and Microsoft AntiSpyware, quite in contrast to the majority of readers who vented in those threads -- see:

»spywarewarrior.com/asw-features.htm#rec

That's not "smack-talk," sir. That's reasoned criticism for specific problems that I worked with Sunbelt to ensure it did not repeat.

Eric L. Howes
That's exactly what I remember and I believe it to be consistent with your posts.

Like I said in the beginning, I appreciate the fact that you notified us about the changes.

I admire the work you have done in the community and give full respect to your thoughts and beliefs.

I understand you provided consulting services to Sunbelt Software and they should be proud to have someone like you.

The industry is obviously changing due to lawsuits, etc. However, change is a part of the future and some may not like it.

If any one would like to start up an anti-spyware company that gets rid of everything and anything based on past experiences, please feel free to do so. Let me know how it goes.]]> http://www.dslreports.com/forum/remark,13974118 Sun, 24 Jul 2005 18:11:07 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13974046 anon : Iv never used counterspy, but have used ms-antispyware, which is a licenced clone of giant same as counterspy is; so I'm assuming that there will be some homology between the two.

I have a question:

Most of the valid critisism (ie, ignoring the emotive bitching) in this thread has been directed at counterspys hunter-killer function, ie its ability to scan for and remove slyware.

What about the active protection? specifically, what about the process shield, or whatever its called in counterspy: the bit which monitors prosesses running in memory/attempting to load to memory?

Again assuming some homology with ms antispyware, counterspy should offer some way of preventing 'known' slyware from loading, and should unload any 'known' slyware which manages to get up-and-running, and furthermore should alert the user to the fact that 'known' slyware was running/attempting to load.

My question is, how does counterspy handle the downgraded WhenU products with reguard to the active protection? will it unload WhenU from memory? Will it ignore, or not even look for, WhenU in memory? Or will it pop up a message if it finds WhenU running in memory and ask what the user wants to do, again suggesting the user ignor it? (same questions for 'what will counterspy do if it finds WhenU attempting to load to memory'?)]]> http://www.dslreports.com/forum/remark,13974046 Sun, 24 Jul 2005 18:01:05 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13972358 eburger68 : saddened:

You wrote:

said by saddened:

The whole thing comes across as "WhenU is OK now, prove me otherwise, or you are either ill-informed, or you are conducting personal attacks".
Please read what I and Sunbelt have actually said. We never made the blanket statement that "WhenU is OK now" -- nowhere have we said such a thing. In fact, in this very thread as well as the Sunbelt white paper we have said that WhenU continues to have problems and that WhenU's main adware application would continue to be recommended for removal.

Moreover, even when discussing the three particular applications that were downgraded or reclassified (WhenUSearch, Weathercast, ClockSync), we did not ask users and readers to take our assertions at face value, as you imply. We offered plenty of analysis and evidence to support our conclusions and made that evidence and analysis available to you and others for inspection. We also asked for reasons and evidence from critics to suggest that those applications were misclassified.

That's a far, far cry from the situation you've painted.

said by saddened:

P.S. and to think of all of the smack-talking about Lavasoft and MSAS from these consultants not long ago)
Excuse me, if there was "smack-talking," it didn't come from me. I did the following in those earlier situations:

1) I reported the changes, which were not disclosed by the vendors themselves (unlike the case here);

2) I explicitly said that my largest complaint was the lack of disclosure and transparency in both cases (certainly not a problem here);

3) I called for readers here to back off Lavasoft after much the same lynch mob descended on them (see one of my early posts in this thread for the quote and link).

4) I asserted that I would continue to recommend both Lavasoft and Microsoft AntiSpyware, quite in contrast to the majority of readers who vented in those threads -- see:

»spywarewarrior.com/asw-features.htm#rec

That's not "smack-talk," sir. That's reasoned criticism for specific problems that I worked with Sunbelt to ensure it did not repeat.

Eric L. Howes
--
Microsoft MVP
Sunbelt Software Consultant
Spyware Warrior]]> http://www.dslreports.com/forum/remark,13972358 Sun, 24 Jul 2005 13:16:11 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13972298 CajunTek : Thank you...

Eric..

Know this, I respect you and your work most highly and continue to do so.. I do disagree with Sunbelt on this point, but do understand your defense both personally and factually.. I just believe that separating a part of a known malware producers products out as not so bad is not the best thing to do.. :(
--
Lost in Texas]]> http://www.dslreports.com/forum/remark,13972298 Sun, 24 Jul 2005 13:05:05 EDT Re: Disproving by counter-example http://www.dslreports.com/forum/remark,13972269 eburger68 : Vampirefo:

The entire thing in most cases: all files, Registry keys -- the whole nine yards. That's the problem: the anti-spyware apps cannot distinguish between the for-pay version and the ad-supported version.

Some applications detect only a subset of the installed files and Registry keys, but that's out of sheer incompetence rather than conscious, purposeful design.

I suppose apps could target only the components that play a role in delivering ads, but in many if not most cases, the main app would be effectively broken as well. Moreover, the adware folks would just roll the ad-components into the main executable, making it still more difficult to distinguish between versions.

Eric L. Howes
--
Microsoft MVP
Sunbelt Software Consultant
Spyware Warrior]]> http://www.dslreports.com/forum/remark,13972269 Sun, 24 Jul 2005 13:01:13 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13972229 eburger68 : MerlynTech:

You wrote:

said by CajunTek See Profile:

I only really have one question.. You have most of whenu's stuff covered in IE-Spyad as well.. Will you be making changes there in relationship to whenu?
WhenU's domains will remain in IE-SPYAD because they are still distributing Save/SaveNow. A few other relevant points:

1) As WhenU no longer uses ActiveX installs, putting WhenU's domains into the Restricted sites zone won't absolutely prevent users from downloading and installing WhenU's apps, whether separately at WhenU's own web site (in the form of a traditional setup executable) or as part of adware bundle (say, as part of a freebie screensaver application or P2P app).

Given that, the best that the Restricted sites settings can do is "warn" users when they are on a WhenU site -- a warning that might tip users off to proceed with caution and take a good look around. In other words, it is a very blunt instrument in these circumstances.

2) At present most of WhenU's domains simply re-direct to WhenU's main site (whenu.com), so the majority of WhenU's domains aren't even being used to distribute software. In fact, WhenU distributes most of its software through "distribution partners," not its own web site.

3) IE-SPYAD is a general Restricted sites list that works much differently than an anti-spyware scanner and has different capabilities and limitations.

In making decisions about whether to target certain domains in IE-SPYAD, I always consider what particular usefulness such targeting would have for those domains if they were placed in the Restricted sites list. In other words, I tailor the list to suit the functionality of the Restricted sites zone.

Best,

Eric L. Howes
--
Microsoft MVP

Sunbelt Software Consultant

Spyware Warrior]]> http://www.dslreports.com/forum/remark,13972229 Sun, 24 Jul 2005 12:56:30 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13972153 jimkyle : The most reasonable suggestion I've seen so far, in this thread, is for Sunbelt to stop making any recommendations at all, and simply detect everything that fits ANY of their criteria. This would include Eudora's free version, Opera Free, VNC, AVG's update checking, Symantec Live Update, and yes, even Windows Automatic Update. Classify all using the current criteria, but make absolutely no recommendation. Let the user decide, either individually or by setting up default actions for each detected risk level.

That should satisfy those who, like Mele20, want no adware of any sort on their systems, as well as those who want to treat each case on its own merits. Both Spybot S&D, and AdAware SE, already do this to some degree although without explicit automatic default actions.

In lieu of recommendations, the program could include a recommendation wizard to explain in detail the various risk levels, and spell out the potential dangers at each. Since this would be a purely advisory item, not referencing any specific program, it should be safe from legal attack.

What do you think? Could this be a win-win solution for everyone?]]> http://www.dslreports.com/forum/remark,13972153 Sun, 24 Jul 2005 12:45:20 EDT Re: Disproving by counter-example http://www.dslreports.com/forum/remark,13972152 John2g :
said by Vampirefo See Profile:

What part of FlashGet paid version is being flagged as spyware?
C-dilla (cd_install277.exe). It is still left even with the paid version. At least that is what SAV detects.]]> http://www.dslreports.com/forum/remark,13972152 Sun, 24 Jul 2005 12:44:35 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13972139 eburger68 : the_sky_has_fallen:

You wrote:

said by the_sky_has_fallen:

Besides, WhenU is already making money. If they wanted to develop the "really evil" apps, 
they could do so right now.

am i reading this correctly? did you actually say that?

{ you are saying, you know for a fact, WhenU is absolutely NOT working on new malware 'strains'? how?? }
No, I cannot claim to have perfect, omniscient knowledge that WhenU is not working on new "malware strains." For the record, I also can't claim that I absolutely know that Yahoo, Microsoft, or Adobe isn't working on "new malware strains." I can say: I highly doubt it; I haven't seen any good evidence for it; and the burden of proof would be on those who claim the companies are working on such things to prove it.

As to WhenU, I can say that since announcing the first of several changes in Nov. 2004, the company has made verifiable improvements to its software and distribution channels. Moreover, in that time they've had plenty of opportunity to backslide or implement other objectionable schemes on the side. So far as I can tell, they have not. Still further no one here has been able to come up with solid evidence that they are.

If you've got evidence that WhenU is developing "new malware strains," I would welcome the opportunity to examine it.

Eric L. Howes
--
Microsoft MVP

Sunbelt Software Consultant

Spyware Warrior
]]> http://www.dslreports.com/forum/remark,13972139 Sun, 24 Jul 2005 12:42:46 EDT Re: Disproving by counter-example http://www.dslreports.com/forum/remark,13972108 Vampirefo : What part of FlashGet paid version is being flagged as spyware?
--
Best Regards Vampirefo ]]> http://www.dslreports.com/forum/remark,13972108 Sun, 24 Jul 2005 12:37:30 EDT Re: Disproving by counter-example http://www.dslreports.com/forum/remark,13972079 eburger68 : jp10558:

You wrote:

said by jp10558 See Profile:

But I guess the point for me is I have bought it. How would your antispyware app know the difference between a registered Opera and an unregistered Opera? What about one that was used with ads for some time, and then registered? How would you expect companies and users to react to an antispyware app recommending deletion of legitmately purchased software? I can smell lawsuits, ones with very strong backing IMHO.
This is already a problem. I have the for-pay version of FlashGet on my drive -- no ads, no ad banner window. Yet in all my testing of how many hundreds of anti-spyware apps, I can't tell you how many have flagged FlashGet as "adware," "spyware," "malware," or "whatever-ware." The anti-spyware apps simply can't distinguish between the for-pay version and the ad-supported version.

When FlashGet turns up in the scan results, that is for me at worst an annoyance -- I have had take the time to add FlashGet and its components into the application's white list.

Other users, however, become extremely upset when an app they purchased and assumed was "legitimate" turns up in the scan results, as I discussed several pages back. They start contacting the anti-spyware vendor. They lash out at the detected application's own vendor. It's a mess.

Inpart, the "Low risk adware"/"Ignore" classifications that several anti-spyware vendors have implemented represent an attempt to finesse the problem. They can still detect such applications, but present them in a different way (or not present them by default, if a particular box is not checked). In other words, anti-spyware vendors are working to please different users with different needs and expectations.

See here for more information on these efforts to make the scan results in anti-spyware applications moreusable, transparent, and flexible:

»www.spywarewarrior.com/asw-notes···ults.htm

Best,

Eric L. Howes
--
Microsoft MVP

Sunbelt Software Consultant

Spyware Warrior]]> http://www.dslreports.com/forum/remark,13972079 Sun, 24 Jul 2005 12:31:31 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13972074 S S K : And on some models, the engineers / managers knew beforehand of the less then perfect design, but did not correct it because it was cheaper to do it that way :)

The analogy I was talking about is to look at the merit of each and every product, and then decide what to remove and what not. :)]]> http://www.dslreports.com/forum/remark,13972074 Sun, 24 Jul 2005 12:30:30 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13972047 anon : 
Besides, WhenU is already making money. If they wanted to develop the "really evil" apps, 
they could do so right now.

am i reading this correctly? did you actually say that?

{ you are saying, you know for a fact, WhenU is absolutely NOT working on new malware 'strains'? how?? }
]]> http://www.dslreports.com/forum/remark,13972047 Sun, 24 Jul 2005 12:25:37 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13972026 Wildcatboy :
OK everyone. It is time for my obligatory warning in the thread. Criticism is great and fine. Attacking like a pack of dogs is not.

Frankly it amazes me how some people can praise someone and raise them to the status of Gods one day and the next day do a 180 degree turn and bite them like they don't even know them. Just amazing.

Eric, I personally think you made a mistake the moment you accepted the consulting job but unlike a few people here I don't think anyone is capable of becoming a monster overnight.

As for the critics, I've seen a lot of good points in this thread by our members. Majority of people in this thread are acting civilized and I'm looking forward to their further criticism and contributions. In fact I think some of those criticisms are very well deserved.

But there are also people in this thread who in my view either haven't made any contributions to this site or this thread except showing up when there's a fight or they simply love complaining about everything in this world to a point that their views no longer have any value to me. I'm not going to allow them ruin a very good and necessary discussion.

I never delete opinions. I delete behaviors. If you want your statements to stay here, control your behavior. Deleting your posts will not stop criticism in this thread. It just keeps you out due to your lack of social skills. If you want to stay in this thread, choose your words wisely.
--
You can catch the Devil, but you can't hold him long.]]> http://www.dslreports.com/forum/remark,13972026 Sun, 24 Jul 2005 12:21:57 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13972025 eburger68 : Reverend Ike:

You wrote:

said by Reverend Ike See Profile:

Actually, the best approach may be to simply list criteria, identify which programs match which criteria, and make no recommendations, forcing users to make their own decisions. Then the lazy ones can choose "delete all" including all WhenU variants, and we'll all be happy. :) Well, maybe some of us.
I've heard that or a similar proposal from several people, including at least one person (hpguru, I believe) earlier in this thread. There is indeed a lot to be said for forcing users to make choices in every case for every app that's presented to them. If nothing else, such a scheme would make it abundantly clear that the choice to remove was the user's own.

The downside, of course, is impatient, confused, and frustrated users -- folks who simply want an application to remove everything "bad" on their systems lickety-split and who would become very frustrated at having the make a decision about every app. Still others would demand a button or check box to mark all apps in the scan results for removal. That would make the app very similar to Ad-aware Personal (the freeware version), which already forces users to laboriously check every box for removal.

There are no easy solutions to this, but I'm hopeful that something useful and comparatively easy to implement can be found.

Best,

Eric L. Howes
--
Microsoft MVP
Sunbelt Software Consultant
Spyware Warrior]]> http://www.dslreports.com/forum/remark,13972025 Sun, 24 Jul 2005 12:21:46 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13972020 CajunTek : Eric...

I only really have one question.. You have most of whenu's stuff covered in IE-Spyad as well.. Will you be making changes there in relationship to whenu?
--
Lost in Texas]]> http://www.dslreports.com/forum/remark,13972020 Sun, 24 Jul 2005 12:21:10 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13971965 eburger68 : Martin:

You wrote:

said by Martinus See Profile:

Not only that, but giving any of WhenU's applications a more benevolent rating could help them get more revenue from the kosher apps. And those extra bucks are going to help paying for the development of the really evil ones.
And when the "really evil" ones appear, they will be targeted for removal. Besides, WhenU is already making money. If they wanted to develop the "really evil" apps, they could do so right now.

Eric L. Howes
--
Microsoft MVP
Sunbelt Software Consultant
Spyware Warrior]]> http://www.dslreports.com/forum/remark,13971965 Sun, 24 Jul 2005 12:11:50 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13971938 eburger68 : Martin:

Thanks for the kind words, but one correction:

said by Martinus See Profile:

The reason of the discussion, and at this point I can't see the different parties being reconciled any time soon is that, despite the 4 sanitized applications that have been downgraded - adjusted, if you will - WhenU is still pushing software - WhenU Save, etc - that we all agree is malicious.
That's incorrect. Three applications were downgraded, not four: WhenUSearch, Weathercast, and ClockSync. The fourth (Save/SaveNow) has *not* been downgraded. That pop-up ad programs remains as it was.

(Note: I suppose you could consider UControl to be a fourth app, but it is delivered as a component of WhenUSearch.)

Best,

Eric L. Howes
--
Microsoft MVP
Sunbelt Software Consultant
Spyware Warrior]]> http://www.dslreports.com/forum/remark,13971938 Sun, 24 Jul 2005 12:08:56 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13971913 eburger68 : Jet_Set:

said by Jet_Set:

eric, you asked me what i feel will befall the user who leaves WhenuSearch installed.
well, for someone who really knows what WhenU stands for,it wont be a warm, fuzzy feeling, thats for sure.
In other words, you can't answer the question either.

The question involved an less knowledgeable user who does NOT have a set opinion of WhenU and who takes the "Ignore" default action at face and leaves the software. Instead of answering the question, you inserted yourself (or someone like you) into the question -- someone who already has a strong opinion about WhenU. But of course YOU would have changed the "Ignore" to "Remove," not left the program on the system.

Moreover, the question asked you specifically about what HARMS would befall that user who left the program on the system, not about how they "feel." And you still can't tell me what ill effects would befall that user.

said by Jet_Set:

now eric, are you saying that you doubt that this will be the reaction of the vast majority of people ?
you say i cant possibly represent the vast majority of user reactions, and i cant, obviously.
however, i still maintain that the vast majority wont be at all pleased.
maybe you think they will be all calm and collected instead!
I make no claims to know what the majority would think, esp. when most users wouldn't have as entrenched a regard for WhenU as you do. As I said, one human foible is imagining that our view is the "norm" or is universally held, and you ably demonstrated that. I make no claim one way or the other.

Eric L. Howes
--
Microsoft MVP
Sunbelt Software Consultant
Spyware Warrior]]> http://www.dslreports.com/forum/remark,13971913 Sun, 24 Jul 2005 12:04:26 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13971737 antiserious :
... I can disagree with someone and STILL respect them and their opinions - apparently the same cannot be said for some of the people that have posted in this thread ...

... I would want ANY security-related vendor to have access to the best and most varied information and opinions available ...

... it seems clear to me that most people (myself included) want no part of WhenU (reformed or not) ... many of them (myself excluded) just want something else to do this for them, so they don't have to think about it, or be involved in the decision beyond simply running a program ... they refuse the notion that things are changing, that those days may be short-lived, and they lash out at the messenger ... I find that sad, and at times reprehensible ... Eric and Suzi and the others like them deserve respect even when you disagree with their findings - I can't take your disagreements seriously when they're couched in personal attacks and innuendo, and that's a shame because some of you may have valid points to make ...

** - from »www.answers.com/consultant

consultant

A person who acts as an advisor to users or to the technical staff. Consultants are available for all aspects of the computer industry, including electronic circuit design, information systems analysis and software development. In a business environment, consultants are often used to create the functional specifications from which vendors can respond. Consultants typically come from third party consulting firms, but the title is also used for internal specialists.

... ** disclaimer - I do not work or consult for CounterSpy, or Eric or Suzi, nor am I affiliated in any way with any of them ... I suspect we all have working brains in common, but that's merely a coincidence ...

--
... "Nobody's perfect - well, there was this one guy, but we killed Him" ... Christopher Moore, 'Lamb' ...]]> http://www.dslreports.com/forum/remark,13971737 Sun, 24 Jul 2005 11:34:50 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13971715 paperghost : "If you can't, then you are being hypocritical - and asking your antispyware vendor to go to court and lose a defamation case."

Exactly. As I've already mentioned, Antispyware tools (regardless of who they're made by) should rate the software, not the company. Who on earth wants a security tool that generates intentional false positives? I would slam such a product in a ditch quicker than you could blink.

Disclosure: I'm wearing short-shorts.]]> http://www.dslreports.com/forum/remark,13971715 Sun, 24 Jul 2005 11:30:03 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13971699 jp10558 :
said by Blackbird See Profile:

You have pointed out that the spyware reputation of the issuer, while important, is not the primary factor in evaluating risk level of a specific application... but, perhaps it ought to be in cases where the issuer has a long-established abuse record. I think what many of the posters here are trying to express is that they deeply and earnestly believe that the longer-duration and broader the abusive practices of a spyware house, the greater the reputation-weighting which should be applied in evaluating any application from that house. For extreme or extended negative reputations, this should perhaps carry more weight than the specific test results for any given piece of software from that outfit, regardless of the apparent "safety" of that program itself.

To people with a gut-level concern about the trustworthiness of "reformed" spyware houses, a heavy focus by an anti-spyware program on "mechanical", specific software behavior checklists seems to come across rather like a 3-foot leap over a 5-foot ditch, in terms of securely protecting their computers. I believe they are often less concerned with the specifics of a given piece of current software than with the top-level risk attendent with it - and that certainly includes corporate integrity of the issuer as perhaps the primary decision 'driver' when that integrity has long been demonstrated to be absent.

My own "2-cents" suggestion is that the issuer's reputation be much more dynamically involved in the risk-evaluation process, such that longer-term or more prolific "bad boys" have a significantly higher safety bar to cross for their programs than software from other sources, even to the extent of sometimes over-ruling "innocent"-appearing test results on any software from those houses. Certainly there needs to be a "path of cleansing" for spyware houses to get off the blacklists if they have indeed cleaned up their act - but that path must be narrow and demanding in proportion to the level of past abuses, or else trust in the "system" will disintegrate. And I think that's what all these anti-spyware "disappointment" threads have been telling us.
Personally, I prefer a mechanical analysis of the software. Why? Because I - and many other people - use software becasue of what it does, not who makes it. Case in point - Microsoft. I'd say for me their reputation is as bad as WhenU, for other and similar reasons. Yet I still use Windows XP. Because it does what I need, and doesn't do anything that triggers my [spyware] alarm. Likewise, I don't use IE because of risk of getting spyware, and I wouldn't use the MSN toolbar due to it's data collection. I avoid newer versions of WMP because of it's desire to collect lists of what I listen too and broadcast it to MS.

So, for all of you who claim one or many bad programs as well as behavior in the past ought to overshadow the actual behavior and function of the specific program you are using,I again ask - please justify your use of Windows... or MS Office... or MS Antispyware... or anything Microsoft.

If you can't, then you are being hypocritical - and asking your antispyware vendor to go to court and lose a defamation case.
--
Opera 8.01(Build 7642); Windows XP Pro SP2;Athlon 64 3400+; 1GB PC3200 DDR; 1M/128k DSL; NOD32(Version 2.5.25); Sygate Pro 5.5(Build 2637);Proxomitron 4.5j Grypen 7/20/05(Opera mod),GPG ID:0x0A1C6EE3]]> http://www.dslreports.com/forum/remark,13971699 Sun, 24 Jul 2005 11:24:26 EDT Re: Disproving by counter-example http://www.dslreports.com/forum/remark,13971638 jp10558 :
said by Mele20 See Profile:

You must not like it very much if you haven't bought it. If you bought it then you wouldn't have worry about it getting on a list of adware/spyware. ;) If you want a free browser then just use Fx.
But I guess the point for me is I have bought it. How would your antispyware app know the difference between a registered Opera and an unregistered Opera? What about one that was used with ads for some time, and then registered? How would you expect companies and users to react to an antispyware app recommending deletion of legitmately purchased software? I can smell lawsuits, ones with very strong backing IMHO.
--
Opera 8.01(Build 7642); Windows XP Pro SP2;Athlon 64 3400+; 1GB PC3200 DDR; 1M/128k DSL; NOD32(Version 2.5.25); Sygate Pro 5.5(Build 2637);Proxomitron 4.5j Grypen 7/20/05(Opera mod),GPG ID:0x0A1C6EE3]]> http://www.dslreports.com/forum/remark,13971638 Sun, 24 Jul 2005 11:11:57 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13971637 Martinus :
said by S S K See Profile:

Martin, the point is, they did make dangerous models (and still do). They have been fined, made to recall / replace (parts) of their cars!
And still people buy the other models. So the analogy IS valid! :)
I guess making those models dangerous was not part of the product specs.

- Product line manager: "Is it dangerous enough?"

- Chief Engineer: "You bet it is. It'll roll on the first corner and the gas tank will blow. We've made sure the doors lock automatically so the passengers won't have any chance of getting out. Pretty cool, huh?"

That would have been a side effect of cutting costs or sloppy engineering.

WhenU's software is as it is by design.
--
From the GSV "Ethics Gradient"]]> http://www.dslreports.com/forum/remark,13971637 Sun, 24 Jul 2005 11:11:53 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13971627 Reverend Ike : Sorry, Martin - that was an admittedly imperfect analogy. I was just trying to make the point that someone who differentiates between products (or models) and explains why one product is very dangerous and another not quite so much, is not necessarily a full-on spokeperson for evil.

Personally, I would be one of those people who refuse to buy any model made by that automaker ... :)]]> http://www.dslreports.com/forum/remark,13971627 Sun, 24 Jul 2005 11:09:46 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13971610 jp10558 :
said by Mele20 See Profile:

said by jp10558 See Profile:

In fact, for the two programs you list, you have 3 very clear and I think very fair choices. 1)don't use the software.

2)View ads in the software to pay for its development and your use of it.

3)Buy the software outright - no ads.

Especially with software like Opera or Adobe Reader, I don't see why the ads are a bad choice, or how it makes it any sort of threat. They both uninstall cleanly, and don't steal any information from you. And like TV, it makes us able to use important/useful software without paying lots of money for it.
Since when did Adobe Reader become software you can purchase? You mean I can purchase it and there will be no ads, no Yahoo crap, etc? It won't phone home without my permission? Really?? When did Adobe Reader become shareware? I missed that.

As for Opera, the problem with it is that you cannot do a trial of it to see if you want to buy it. They have no trial. The free version is NOT a trial version. It is an ADWARE version and you have to click constantly on the cookies to stop the third party nasty adware cookies which are all PERMANENT ones. (I could tell Proxo to make all cookies session and I could strip the ads using Proxo but that is not really the point). So, you can't tell if you would like the browser well enough to buy it. If, instead, you choose the Google ads then you must allow Google cookies. I won't allow that. Google has NO cookie from me, and never will, (the day Google goes to the dark side, and they will one day, and requires a cookie to use their search engine is the day I will stop using Google). I'm sure not going to let Google get their cookie from my trying Opera.
Buy Adobe Acrobat - no ads. As to Opera, I'm seriously not sure what the issue with cookies is - they seem to be innocuous to me, but you can always delete cookies on exit, or just refuse cookies. Also, you can always buy Opera and never have to deal with Ads. Granted, if you don't want ads, you have to purchase the program first, but having to buy before you try is far more common in software than the other way around. Also - did you look at the generic ad selection? If you choose that, no google involvement at all.

I don't think there ever will be consensus between us, because you (to me) sound like a frothing at the mouth paranoid who's positions are fanaticism. I most likely sound to you like a lazy and dangerously uncaring person who is ok with bending over for corporations to you. With no common ground, I don't think any product would fit both of our needs, and we'll have to see some market segmentation (Though I don't think you'll get a commercial app that works for your niche).
--
Opera 8.01(Build 7642); Windows XP Pro SP2;Athlon 64 3400+; 1GB PC3200 DDR; 1M/128k DSL; NOD32(Version 2.5.25); Sygate Pro 5.5(Build 2637);Proxomitron 4.5j Grypen 7/20/05(Opera mod),GPG ID:0x0A1C6EE3]]> http://www.dslreports.com/forum/remark,13971610 Sun, 24 Jul 2005 11:05:41 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13971587 S S K : Martin, the point is, they did make dangerous models (and still do). They have been fined, made to recall / replace (parts) of their cars!
And still people buy the other models. So the analogy IS valid! :)]]> http://www.dslreports.com/forum/remark,13971587 Sun, 24 Jul 2005 11:02:10 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13971573 S S K : I agree completely with your post, Reverend Ike! One of the most balanced opinions I have read in this thread so far!]]> http://www.dslreports.com/forum/remark,13971573 Sun, 24 Jul 2005 10:59:19 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13971567 Martinus :
said by Reverend Ike See Profile:

If an automobile company repeatedly makes SUV models that roll over every time they turn a corner, should those models be recalled and the company criticized or punished?
Reverend, automobile companies don't usually make "SUV models that roll over every time they turn a corner" on purpose and with aim of profit.

And if there was one you bet they'd be blacklisted forever, sued to death and put in jail.

That's the issue here. WhenU is making money from malware, and as long as they keep on doing so, they shouldn't be in business at all.
--
From the GSV "Ethics Gradient"]]> http://www.dslreports.com/forum/remark,13971567 Sun, 24 Jul 2005 10:58:02 EDT Re: . http://www.dslreports.com/forum/remark,13971560 jp10558 :
said by HAL 90001 See Profile:

LOL!

You've got to be kidding. You reproach me with a bullsh*t statement like this?:

quote:
When I said "truth", I was referring to the 25 page white paper, which clearly and objectively documents the behavior of WhenU apps that were tested. To me, that is "truth". I tested some of them myself and came to the same conclusions.


Sorry, but that has to be the most nonsequitur statement I've read in this thread so far.

So, you've read a twenty-five page paper; you agreed with its conclusions; you then tested some of them (what is "them?") yourself (wow, that's massively impressive); based on your having tested some of "them" (what?, the "apps?"), you came to the same conclusion.

Sorry, but Sunbelt's bally-hoo'd scientific methodology kinda gets kicked in the butt here, don't you think?

KEERIST! Rest assured, your "disclaimer" is not necessary; it's self-evident.
With the level of distrust here of the Anti-Spyware vendors and their employees, I can't see how you'd be able to use any program that you didn't write yourself... You have an impossible standard.

At this point, no one can list an alternate AntiSpyware program that meets all your criteria. I don't think you'll ever find one either. At some point, you've just got to give up.
--
Opera 8.01(Build 7642); Windows XP Pro SP2;Athlon 64 3400+; 1GB PC3200 DDR; 1M/128k DSL; NOD32(Version 2.5.25); Sygate Pro 5.5(Build 2637);Proxomitron 4.5j Grypen 7/20/05(Opera mod),GPG ID:0x0A1C6EE3]]> http://www.dslreports.com/forum/remark,13971560 Sun, 24 Jul 2005 10:57:20 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13971546 Martinus :
said by Just Basics See Profile:

That being said I still disagree with the decision that was made to downgrade the detections for any of the WhenU applications when they have the capability of being used as a vehicle for installing additional software.
Not only that, but giving any of WhenU's applications a more benevolent rating could help them get more revenue from the kosher apps. And those extra bucks are going to help paying for the development of the really evil ones.
--
From the GSV "Ethics Gradient"]]> http://www.dslreports.com/forum/remark,13971546 Sun, 24 Jul 2005 10:53:51 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13971521 Reverend Ike :
said by CajunTek See Profile:

said by doormans See Profile:

And this thread keeps degrading farther into the he said/she said mudslinging world. If you don't like CS, don't use it. Personal attacks need to be left at the curb. Eric and Suzi back up their statements with data for all to see and desiminate, the rest of you should do the same when making yours.:o
What he said...
Likewise.

Generally, I have the same reaction to announcements such as that in Eric's original post that Calamity Jane had. When a company has done as much past damage as WhenU has, I tend to be extremely cynical about any newly-cleaned-up image. I personally think any recognition of reduced risk should be intentionally delayed because of past behavior. I also think that if a company produces one or more malicious or annoying programs, that definitely casts some shadows on other benign (or semi-benign) products they offer.

However ...

If an automobile company repeatedly makes SUV models that roll over every time they turn a corner, should those models be recalled and the company criticized or punished? Of course. Will the company's other model sales suffer by association? Of course. Will some customers refuse to buy any model made by that company? Of course, and justifiably so. But if a buyer's guide individually evaluates each model according to specific criteria and assigns different safety ratings to different models, does that mean the guide is in the pocket of the automaker? No, it doesn't.

I fully understand what Sunbelt has done in adjusting their recommendations, and I think there is nothing wrong or sinister in their actions. The real problem, as I see it, is that Sunbelt's approach (and some other companies as well) assumes that those who use their products are methodical in dealing with spyware threats. I think this is generally not true - as others have mentioned, a large number of users simply do not distinguish between levels of threat. Due to laziness or lack of time, they want a security program to draw a line, label everything either good or "bad", and by default kill all the "bad" things. Unfortunately, companies who try to do all their users' thinking for them, and configure their software to do such labeling and killing, invite lawsuits. Actually, the best approach may be to simply list criteria, identify which programs match which criteria, and make no recommendations, forcing users to make their own decisions. Then the lazy ones can choose "delete all" including all WhenU variants, and we'll all be happy. :) Well, maybe some of us.

Otherwise, regarding the personality-directed comments in this thread, I find it absolutely unbelievable that some folks are such incredibly poor judges of character that they can accuse Eric and Suzi of selling-out. Very few people here have invested as much time and effort as they have in fighting spyware. People like them do not just wake up suddenly one morning and decide to become company mouthpieces, discarding their entire previous philosophy.]]> http://www.dslreports.com/forum/remark,13971521 Sun, 24 Jul 2005 10:48:05 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13971507 Just Basics : Y'all need to take a break and chill out.

Eric and Suzy do not deserve to be treated with anything less than respect regardless of their position with Sunbelt. They have presented the facts as they are now and have gone the extra mile to justify their position for supporting Sunbelt's decision to adjust the WhenU detections.

That being said I still disagree with the decision that was made to downgrade the detections for any of the WhenU applications when they have the capability of being used as a vehicle for installing additional software. Because WhenU has not had a history of doing so in the past is just not reason enough to assume that they will not do so in the future.

I believe that software from WhenU, and similar companies, should be judged on the merits of the product AND the other products the company offers. As long as WhenU offers even one product that Sunbelt feels deserves to be quarantined all of their other products that have the potential of being altered after installation should be considered riskware and be treated in the same manner.

At the very least Sunbelt needs alert it's users that installing the program does have risks involved and the vendor could choose to alter the program at a later date. ]]> http://www.dslreports.com/forum/remark,13971507 Sun, 24 Jul 2005 10:44:08 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13971446 anon : "before he really smashes his once great reputation to smithereens"

My *opinion* on the whole situation is this:

- individuals have worked at, or represent an anti-spyware/adware vendor that has said *portions* of WhenU are "not that big of a deal"

- said AS-vendor has done a brilliant PR move by aligning themselves with (previously) reputable spyware researchers, (partially) in the hopes of glossing over future spyware/adware "downgrades/adjustments" It's a 3-pronged strategy for the vendor: 1) finally address the WhenU downgrade, 2) have a previous respected group of "researchers" say "it's OK" 3) said vendor is now free of potential litigation.

- thinking about their legacy and prior reputation in the anti-spyware scene, they attempt to save face (i.e. conduct damage control), knowing ethics will be called out on this one.

- a job is a job, and if it requires bending your values a little bit, then so be it - do what it takes to sustain your livelihood, and for the "greater good" of the company.

I think it is insulting to assume that people will swallow 10 paragraph long posts saying "WhenU is OK, prove me otherwise"]]> http://www.dslreports.com/forum/remark,13971446 Sun, 24 Jul 2005 10:30:43 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13971443 Martinus : And I still believe that a company that is actively making profit from distributing malware should not have the benefit of having a couple of apps getting preferential treatment.

If it's WhenU, it's bad news. Therefore, out with the whole bunch of their applications.

The discussion of the sanitized apps being less malicious is just an academic exercise.
--
From the GSV "Ethics Gradient"]]> http://www.dslreports.com/forum/remark,13971443 Sun, 24 Jul 2005 10:30:24 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13971414 CajunTek : I disagree totally with you that Eric (or anyone else) should shut up.. I don't see Eric's bias as totally negative here.. He works for them.. (Like I might reccomend a TI chip over a National Semiconductor chip.. you can guess who I work for)... Now that said.. In this case I don't aggree with Eric.. but his opinion is just as valid as mine (he's just wrong).. But that's ok.. We've all been wrong before and we'll all be wrong again!!
--
Lost in Texas]]> http://www.dslreports.com/forum/remark,13971414 Sun, 24 Jul 2005 10:22:01 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13971380 RXDOC : If this is to truly be a discussion no one should "shut up" as everyone is entitled to a statement or opion (biased or not).

Remember we do allow freedom of speech.]]> http://www.dslreports.com/forum/remark,13971380 Sun, 24 Jul 2005 10:14:13 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13971341 anon : I am in total agreement with John2g.

The whole thing comes across as "WhenU is OK now, prove me otherwise, or you are either ill-informed, or you are conducting personal attacks". I will NEVER look at certain "consultants" posts/websites the same way ever again (if I look at them at all)

You should have known better.

P.S. and to think of all of the smack-talking about Lavasoft and MSAS from these consultants not long ago)]]> http://www.dslreports.com/forum/remark,13971341 Sun, 24 Jul 2005 10:02:11 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13971242 Martinus :
said by Mele20 See Profile:

I think the thread could be closed on this note.
Hold on a sec.

I think it's perfectly clear that nobody is doubting Eric and Sunbelt skills and the awesome work of Eric as a previous independent malware fighter.

The reason of the discussion, and at this point I can't see the different parties being reconciled any time soon is that, despite the 4 sanitized applications that have been downgraded - adjusted, if you will - WhenU is still pushing software - WhenU Save, etc - that we all agree is malicious.
--
From the GSV "Ethics Gradient"]]> http://www.dslreports.com/forum/remark,13971242 Sun, 24 Jul 2005 09:30:41 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13971231 anon : Mele20, i think its premature to think of closing this thread, a lot of questions still remain{on either side} that have yet to be answered.]]> http://www.dslreports.com/forum/remark,13971231 Sun, 24 Jul 2005 09:26:50 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13971221 anon : eric, you asked me what i feel will befall the user who leaves WhenuSearch installed.
well, for someone who really knows what WhenU stands for,it wont be a warm, fuzzy feeling, thats for sure.

the only person how will be comfortable with WhenU's software installed on their system, will be someone who unfortunattely for him/her isint aware of the dodgy & malware rich history of WhenU.
{and the moment he/she realises the fact of WhenU's malware-infested track-record , it will be removed from his/her system faster than anything he's deleted before, and he will be thinking..."wait a minute......isint my Anti-spyware/malware software supposed to take care of this?}

now eric, are you saying that you doubt that this will be the reaction of the vast majority of people ?
you say i cant possibly represent the vast majority of user reactions, and i cant, obviously.
however, i still maintain that the vast majority wont be at all pleased.
maybe you think they will be all calm and collected instead!

are you saying, that you believe, the vast majority of people, who will purchase CS to ELIMINATE ALL spyware/adware {yes, in one go} will be all calm and collected to realise that CS could have removed it all along, but didnt, and on top of that, actually recommended, YES, RECOMMEND that they "ignore" it?

will you tellyour angry customers{yes, they will be furious} them to read some 25 page explaination?

so you may think you are winning your argument, but are you really?
are you winning the hearts of your paid customers?
is Sunbelt the real winner here?]]> http://www.dslreports.com/forum/remark,13971221 Sun, 24 Jul 2005 09:20:49 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13971185 Mele20 : But the data they present is for one reason only and that is to support Sunbelt's chickening out. They are biased, therefore, the data they present is tainted. That is it in a nutshell. Take it or leave it folks.

I think the thread could be closed on this note. We are just going around in circles now and it is evident that the touted openess and availability of Sunbelt's president doesn't extend to this thread.

I'm going with John's software. He's right you know. I should have realized that long ago.
--
Around 2005 a sudden spark will catalyze a Crisis mood. The very survival of the nation will seem to be at stake.Sometime before 2025, America will pass through a great gate in history. The risk and promise will be very high. The Fourth Turning Wm. Straus]]> http://www.dslreports.com/forum/remark,13971185 Sun, 24 Jul 2005 09:04:34 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13971181 CajunTek :
said by doormans See Profile:

And this thread keeps degrading farther into the he said/she said mudslinging world. If you don't like CS, don't use it. Personal attacks need to be left at the curb. Eric and Suzi back up their statements with data for all to see and desiminate, the rest of you should do the same when making yours.:o
What he said...

Now, I am not happy over CS or MS decisions recently.. But at least neither of them actually removed detection of the listed malware (see I am avoiding the spyware term)..

Now I have tried CS (I was a Beta tester) but I had other problems with the Beta.. It would take over my entire computer using 98% + of my CPU time.. I had to give it up..

When it did work its detection rate was excellent and whether it was set to ignore or not I usually let it take it unless it was a FP..

My only complaint is for those who use the product who are not prepared to make an educated decision on what stays and what goes.. I believe if it is bad enough to make the list it is bad enough to go..
--
Lost in Texas]]> http://www.dslreports.com/forum/remark,13971181 Sun, 24 Jul 2005 09:03:06 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13971170 Mele20 : Hey, wait one minute! Can't you see the word "appear" is in italics in John's post? Do you not know what that means? It seems not. :( ]]> http://www.dslreports.com/forum/remark,13971170 Sun, 24 Jul 2005 08:58:28 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13971158 doormans : And this thread keeps degrading farther into the he said/she said mudslinging world. If you don't like CS, don't use it. Personal attacks need to be left at the curb. Eric and Suzi back up their statements with data for all to see and desiminate, the rest of you should do the same when making yours.:o]]> http://www.dslreports.com/forum/remark,13971158 Sun, 24 Jul 2005 08:55:16 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13971040 Shriyash : edit:]]> http://www.dslreports.com/forum/remark,13971040 Sun, 24 Jul 2005 08:01:01 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13971021 sybille :
said by John2g See Profile:

So you don't think that it is a shame that Eric has gone from being a well respected independent reviewer of malware and malware detection programs to a spokesman for Sunbelt?
I myself do not find that there is adequate evidence to draw this conclusion. I'm appreciative of eburger68 See Profile's efforts to the point that I would prefer to extend him the benefit of the doubt at present.

I suppose I might think differently if there were any other venue in which I could imagine that he and suzi See Profile would be appropriately compensated for their useful work.

(My disclaimer: I am a Linux user who no longer has a need for anti-spyware/anti-adware software. I do not use Adobe's pdf readers and my browser does not accept cookies by default.)]]> http://www.dslreports.com/forum/remark,13971021 Sun, 24 Jul 2005 07:52:59 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13971019 Cudni : I don't think it is a shame, more of a loss for independent research. I find it useful to know about these changes in detection so i know what to look for when using any of the Lavasoft, MS AS, CS or SD and other similar products to clean a comp.

It might be a coincidence that these shiftings are occurring in the spyware detection industy but then it might not.

Cudni
--
Think locally, @#!? globally!
Help yourself so God can help you]]> http://www.dslreports.com/forum/remark,13971019 Sun, 24 Jul 2005 07:51:33 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13970999 fatdcuk : Sorry to dissapoint you John, Eric has gone nowhere in my estimations.

His research is still a benchmark where i will continue to refer people to.It is unbiased and not sole product orientated.

The man has probaly directly/indirectly helped a damn sight more people than you could in several lifetimes.I can't quantify that but i'm fairly sure you get the picture.

If you call into question his integrity,you are calling into question the integrity of his research as well.

Now there is a few angry campers on either side of this discussions but lets face it John most MVM,MVP's etc concerned with privacy issue's will frown apon you calling into question the integrity of Eric's research which has been used as benchmark by most in the privacy community.

well done john,How true your signature is:(]]> http://www.dslreports.com/forum/remark,13970999 Sun, 24 Jul 2005 07:41:16 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13970967 John2g : So you don't think that it is a shame that Eric has gone from being a well respected independent reviewer of malware and malware detection programs to a spokesman for Sunbelt?

Seems to me that you can't ride with the horses and run with the hounds.
--
Better to remain silent and be thought a fool, than to speak and remove all doubt. ]]> http://www.dslreports.com/forum/remark,13970967 Sun, 24 Jul 2005 07:17:01 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13970947 sybille :
said by eburger68 See Profile:

And I must say that I'm rather taken aback at the level of discourse here: well reasoned arguments with empirical evidence grounded in actual testing are met with bogeyman arguments, insults, hysteria, and depressing assertions that "I don't have to read the white paper or do testing because I 'know.'"
It's kind of like this:

Imagine seeing Ralph Nader (the consumer advocate, not the presidential candidate) in a commercial for the local car dealership.

Even if he were making excellent, well-reasoned arguments, it would not be too surprising if a lot of folks were kind of shocked to find him in this role.

It's one thing to consult for a company. It's another thing altogether to be a spokesperson for a company. Even if they can overlap, the two roles have different implications because they aim at different ends.

Thus, it's not so much a question of what is said (the well-reasoned arguments), but rather one of the position from which these arguments are being made.

To me it seems that many of those who have posted in this thread fear that the change in policy concerning WhenU expresses more the interests of the company that owns CounterSpy than the interests of the consumer. I don't see anything in the well-reasoned arguments that responds to this particular concern, but perhaps I have missed something.

BTW, I think people like eburger68 See Profile and suzi See Profile deserve to be compensated for their knowledge and work. Today, when even MS has considered purchasing an adware company, who but a company that produces anti-spyware/anti-adware/anti-malware software would pay them?

I also think that the onus of negotiating differing professional roles in their complexities is on those who are being paid.]]> http://www.dslreports.com/forum/remark,13970947 Sun, 24 Jul 2005 07:05:53 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13970929 fatdcuk :
said by John2G:
I just think that it is a shame you appear to have sold your integrity.


That is the mother of all crass assertions so far in this thread.

Well done John,Can you go any lower or scrape the barrel a bit more ?

You do that MVM title much dishonour posting such tripe.

Hey modded away :(]]> http://www.dslreports.com/forum/remark,13970929 Sun, 24 Jul 2005 06:53:29 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13970920 John2g : Let me write this again. I couldn't give a stuff whether CS upgrades or downgrades its spyware definitions. I do not care a jot about the rights and wrongs of your case.

My opinion was not on the merits, or otherwise, of your case, but on the other posts in this thread. You do not appear to me to be carrying the argument with most people.

I just think that it is a shame you appear to have sold your integrity.]]> http://www.dslreports.com/forum/remark,13970920 Sun, 24 Jul 2005 06:32:33 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13970899 eburger68 : John:

You wrote:

said by John2g See Profile:

My point was not meant to be trite. It was meant as sincere advice. You are not winning your argument.
Others disagree, John, and they've been posting to this thread.

And I must say that I'm rather taken aback at the level of discourse here: well reasoned arguments with empirical evidence grounded in actual testing are met with bogeyman arguments, insults, hysteria, and depressing assertions that "I don't have to read the white paper or do testing because I 'know.'" A few here have certainly done better than that (mers2, Sheiny, Blackbird SR, TeMerc, for example), but they're a small minority.

said by John2g See Profile:

Your continued defense of the seemingly indefensible does little to help your cause. No matter how many times you write that your opinion is correct, people do not appear to accept it.
Here we go again, assuming that your own view of things is the "norm" or even the universally accepted view. Take a look in this mirror to see the way many of the critics of Sunbelt's decision here look to a well respected observer:

»www.vitalsecurity.org/2005/07/ra···ria.html

Eric L. Howes
--
Microsoft MVP
Sunbelt Software Consultant
Spyware Warrior]]> http://www.dslreports.com/forum/remark,13970899 Sun, 24 Jul 2005 06:13:46 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13970882 eburger68 : Blackbird SR:

You wrote:

said by Blackbird See Profile:

I guess I didn't realize I was proposing a formula... I was only trying to express a concept. Namely, that reputation, "past-performance", and current global behavior should materially adjust or impact the "threshold" used to establish a given software test result as being 'low-level' or 'moderate' or whatever risk level. And the honest efforts of a company to cleanse itself should indeed mitigate the reputation effect (however that would be employed).
Whether you frame it as a "threshhold" or a "formula," the effect is the same: reputation and the performance of one separate application trump everything else. It's simply too heavily weighted on one side -- it effectively boils down to an "all or nothing" approach to evaluating vendors and their applications.

said by Blackbird See Profile:

But it remains hard for me to see how a company, so clearly dedicated in the past to spyware, has reformed itself in a fundamental manner if it continues to radiate spyware of any sort. So I am inclined to argue that their reputation remains flawed, and WhenU's current clean-up efforts (though admirable) will only be fully authenticated when they have cleaned up their WHOLE act - and stay completely cleaned up over a meaningful timeframe.
First, let's dispense with the term "spyware." These useless labels have caused nothing but trouble and simply get in the way of a serious consideration of advertising software. Also, I'm loathe to hand the advertising software industry easy arguments to make hay with.

Second, I would agree that WhenU's reputation remains flawed and that they've still got problems -- that's currently reflected already in Sunbelt's classification and targeting decisions, which put WhenU's main adware application at "Moderate risk" with a default action of "Quarantine" and the others at "Low risk" (but still detected) with a default action of "Ignore" (but the option for the user to get more information about the application as well as to remove it).

said by Blackbird See Profile:

Eg: a car thief is still a car thief whether he steals one of twenty cars or one of five cars from some airport parking lot.
Bad analogy: the car thief in this case may have stolen some cars and may continue to nip a few, but he also went out and purchased a new car at a dealership and has the papers to prove it.

said by Blackbird See Profile:

Perhaps, along the lines suggested by some earlier posts by others here, it would be beneficial to have anti-spyware issue a dual report for any piece of questionable software: performance risk and reputational risk, with any composite risk assessment being the greater of the two risks.
Excellent suggestion. I'm all for giving users more information on which to base decisions, especially when they're presented with a default action of "Ignore."

Best,

Eric L. Howes
--
Microsoft MVP
Sunbelt Software Consultant
Spyware Warrior]]> http://www.dslreports.com/forum/remark,13970882 Sun, 24 Jul 2005 06:02:54 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13970858 John2g : My point was not meant to be trite. It was meant as sincere advice. You are not winning your argument.

Your continued defense of the seemingly indefensible does little to help your cause. No matter how many times you write that your opinion is correct, people do not appear to accept it.

I am a cynic. Beneath all this posturing and nitpicking over definitions, is the real reason for the "adjustments". CS do not want to be taken to the cleaners by the purveyors of this malware. Probably one successful lawsuit against them would put them out of business. To me, that is it in a nutshell.

I write as one who has never used CS and never will. It is of supreme indifference to me whether CS stays in business, or not. There is a vastly superior malware detector/remover and I am very content to use that. They do not go in for the handwringing over shades of grey. If it is detected and in the definitions, it is deleted.

This debate over shades of greyness, is about as futile as the debate on how many angels can dance on the head of a pin.]]> http://www.dslreports.com/forum/remark,13970858 Sun, 24 Jul 2005 05:49:46 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13970850 Blackbird :
said by eburger68 See Profile:

What you and others have effectively proposed is that Sunbelt take three apps that in and of themselves are comparatively innocuous and judge them primarily on the basis of corporate reputation (largely discounting all efforts made since Nov. 2004) and the functionality and behavior of some other application. Put another way, you want the fact that the company still distributes a pop-up advertising program to determine the threat level of separate programs that have their own unique characteristics -- a pop-up advertising program that itself has undergone significant changes in its functionality and distribution practices.

I am all for taking reputation and historical performance into account during the review and evaluation of applications targeted by anti-spyware programs, but the formula you've proposed is much too monolithic, one-sided, and impervious to a real assessment of the company's actual performance as well as the actual functionality and behavior of the programs themselves.
I guess I didn't realize I was proposing a formula... I was only trying to express a concept. Namely, that reputation, "past-performance", and current global behavior should materially adjust or impact the "threshold" used to establish a given software test result as being 'low-level' or 'moderate' or whatever risk level. And the honest efforts of a company to cleanse itself should indeed mitigate the reputation effect (however that would be employed). But it remains hard for me to see how a company, so clearly dedicated in the past to spyware, has reformed itself in a fundamental manner if it continues to radiate spyware of any sort. So I am inclined to argue that their reputation remains flawed, and WhenU's current clean-up efforts (though admirable) will only be fully authenticated when they have cleaned up their WHOLE act - and stay completely cleaned up over a meaningful timeframe.

It's really more about integrity, not about how many pieces of software they issue that are technically spyware and how many aren't. Eg: a car thief is still a car thief whether he steals one of twenty cars or one of five cars from some airport parking lot.

Perhaps, along the lines suggested by some earlier posts by others here, it would be beneficial to have anti-spyware issue a dual report for any piece of questionable software: performance risk and reputational risk, with any composite risk assessment being the greater of the two risks.
--
If God wanted us to work with electrons, He'd make them big enough to see...]]> http://www.dslreports.com/forum/remark,13970850 Sun, 24 Jul 2005 05:43:35 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13970837 eburger68 : John2G:

You wrote:

said by John2g See Profile:

Just an obsevation.

When you are in a hole: stop digging.
Please, John. I appreciate the sincerity of your well-meaning advice, but we are in a serious discussion and well beyond the point where trite truisms are appropriate or relevant.

Eric L. Howes
--
Microsoft MVP
Sunbelt Software Consultant
Spyware Warrior]]> http://www.dslreports.com/forum/remark,13970837 Sun, 24 Jul 2005 05:30:39 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13970831 fatdcuk : Fair comment John2G
quote:
The bigger danger, as I see it, is that Eric's independence has been compromised by taking the consultancy with CS. It seems to me, that no matter what he writes in future is going to be tainted in some people's minds. They will ask themselves "Is this really Eric's view, or does he have his CS hat on?"


But here's another place Eric has one very big hand ,I see no CS Hat.

»https://netfiles.uiuc.edu/ehowes/www/main.htm

This is just a plain crazy attitude for people to hold.Especially one's that claim to be from our side of the battle.
Their perogotive but plain ignorant IMHO]]> http://www.dslreports.com/forum/remark,13970831 Sun, 24 Jul 2005 05:28:01 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13970827 John2g : Just an obsevation.

When you are in a hole: stop digging.]]> http://www.dslreports.com/forum/remark,13970827 Sun, 24 Jul 2005 05:25:36 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13970819 eburger68 : BlackbirdSR:

You wrote:

said by Blackbird See Profile:

My own "2-cents" suggestion is that the issuer's reputation be much more dynamically involved in the risk-evaluation process, such that longer-term or more prolific "bad boys" have a significantly higher safety bar to cross for their programs than software from other sources, even to the extent of sometimes over-ruling "innocent"-appearing test results on any software from those houses. Certainly there needs to be a "path of cleansing" for spyware houses to get off the blacklists if they have indeed cleaned up their act - but that path must be narrow and demanding in proportion to the level of past abuses, or else trust in the "system" will disintegrate. And I think that's what all these anti-spyware "disappointment" threads have been telling us.
Thanks for the thoughtful post, but I'm sorry -- this is merely a more sophisticated restatement of the "because it's WhenU" position that was articulated very early on in this thread.

What you and others have effectively proposed is that Sunbelt take three apps that in and of themselves are comparatively innocuous and judge them primarily on the basis of corporate reputation (largely discounting all efforts made since Nov. 2004) and the functionality and behavior of some other application. Put another way, you want the fact that the company still distributes a pop-up advertising program to determine the threat level of separate programs that have their own unique characteristics -- a pop-up advertising program that itself has undergone significant changes in its functionality and distribution practices.

I am all for taking reputation and historical performance into account during the review and evaluation of applications targeted by anti-spyware programs, but the formula you've proposed is much too monolithic, one-sided, and impervious to a real assessment of the company's actual performance as well as the actual functionality and behavior of the programs themselves.

Best,

Eric L. Howes
--
Microsoft MVP
Sunbelt Software Consultant
Spyware Warrior]]> http://www.dslreports.com/forum/remark,13970819 Sun, 24 Jul 2005 05:17:49 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13970810 John2g : The bigger danger, as I see it, is that Eric's independence has been compromised by taking the consultancy with CS. It seems to me, that no matter what he writes in future is going to be tainted in some people's minds. They will ask themselves "Is this really Eric's view, or does he have his CS hat on?"
--
Better to remain silent and be thought a fool, than to speak and remove all doubt. ]]> http://www.dslreports.com/forum/remark,13970810 Sun, 24 Jul 2005 05:11:49 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13970801 fatdcuk : Enough people,stop with the baseless insults you really are downgrading your arguements by acting like a bunch of idiots, 1st sign of losing an arguement is turning to personal insults!

Anyone of note in the privacy community will be fully aware of Eric L Howes and Suzi Tanner's contribution towards the spyware wars.

They've been around for sometime now and have created some industrywide accepted resources down at
»www.spywarewarrior.com/

Anyone who is'nt fammiliar with this website i suggest you visit it.Bare in mind that both Eric&Suzi as stated hold paid consultancy positions within Sunbelt,Can any of you people that doubt their ethic's or ability to provide unbiased information because of there role with Sunbelt please highlight any bias towards counterspy software to validate your assertion ?

Sorry people you will luck out.

The reason is that Eric&Suzi have been two of the most foremost general's in the war against cr@pware.

Sorry guys,your infantry at best and at the moment your chucking grenades into your own lines.WTG(not!)

At this moment in time i have my own disclaimer to publish

I have no affiliation with Sunbelt whatsoever,I however have followed/benefited from a lot of Eric&Suzi's research and have the upmost respect for them and their achievements todate.

I would also like to apologise if i have seemed off hand towards any members here.The problem being if you strip away the FUD/personal attacks and deal with facts there are very few bones of contention left to disagree over.

PG's write up of the narrow sighted behaviour hits the nail on the head:)

»www.vitalsecurity.org/2005/07/ra···ria.html]]> http://www.dslreports.com/forum/remark,13970801 Sun, 24 Jul 2005 05:03:29 EDT Re: . http://www.dslreports.com/forum/remark,13970800 eburger68 : HAL 9000:

You wrote:

said by HAL 90001 See Profile:

My God (yes, that's self-proclaimed you, Eric)! So, you know whether I've read "the article?" How clairvoyant! I've no doubt that Kreskin would take a BIG back seat to you.
That's your own invention. I never said that you hadn't read the white paper. I implied that I suspected you had not, but made no such claim.

said by HAL 90001 See Profile:

LOL, I "mocked" her description of the methodology she said she employed--and mocked I did, because they were pathetic.
You piled on mockery and cheap insults in such a way to suggest that she shouldn't have made such claims in the first place. The larger point here, though, is that you mocked without offering any testing or analysis of your own, and that's not right.

said by HAL 90001 See Profile:

Absolutely. If ever I claim to have "tested" something, rest assured, I will have tested it in toto. suzi See Profile made no such claim. Wretch all you want, but she represented both Sunbelt and herself as a joke; if you don't like that, too bad.
The problem remains, HAL 9000, that you've nothing else to offer beside cheap insults. Suzi at least went several steps beyond what everyone else in this has done -- she began testing and investigating. You haven't even suggested or claimed that you've done anything close to what's Suzi's done.

said by HAL 90001 See Profile:


Give me a bloody break with this. In fact, I said in my last post to her that she can say what she wants to say, but she should also accept the criticisms that accompany her opinions, the manner in which she expresses her opinions, or both. If that's too tough or mean . . . oh well. And, I never insisted that she doesn't have the "right" (watch your language, by the way) to state her conclusions "based on her own 'testing . . . '" If, however, her own statements bring her testing methodology into question, then don't blame the critics.
Not only do you invent words to put in my mouth, you forget all too soon the words that came out of your own as well conveniently ignore the clear intent of your insulting rants. You said:

said by HAL 9000:
I really object to Sunbelt's foisting its interpretation of "the truth" on paying customers (and nonpaying evaluators, for that matter).


You followed up that up with the kind of crude mockery and insults that are designed to suggest that people stop posting and shut up. The net effect is that you most certainly did suggest that Suzi did not have the right and wherewithal to post her own judgments and conclusions about the truth and accuracy of the white paper.

Questioning someone's testing methodology is one thing, but you went far beyond that.

said by HAL 90001 See Profile:

But, until them, understand this: at no point in time did I ever claim that I have or had tested "all the apps." That's the difference, which is apparently lost on you.
You've still missing the point, HAL 9000. You mocked and derided someone for not testing all the apps when you offered no testing or analysis of your own to establish that you had done any better and had anything better to offer.

said by HAL 90001 See Profile:

Absolutely.
Good. Can't wait, because the rank hypocrisy in your posts was becoming far too much to bear.

Eric L. Howes
--
Microsoft MVP
Sunbelt Software Consultant
Spyware Warrior]]> http://www.dslreports.com/forum/remark,13970800 Sun, 24 Jul 2005 05:02:46 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13970795 Blackbird : Eric, first, thank you for your long efforts in the anti-spyware fray. We all owe you our thanks for a lot of hard work!

I think there is a perspective in many of the postings from this thread that is perhaps not coming across as clearly to you as it might.

In your second post to this thread, you wrote:
"It needs to be emphasized, however, that WhenU's main advertising application, Save!/SaveNow, has not been reclassified or otherwise changed in the Sunbelt detections database. The pop-up advertising and continuing problems with some Save!/SaveNow installations clearly set that pop-up advertising program apart from programs that display no ads (ClockSync) or that display ads within the context of their own windows (WhenUSearch, Weathercast)."

The long-term track record of WhenU shows a deliberate corporate strategy of software abuse; that philosophy continues even now, by your own reckoning, in their abusive Save!/SaveNow application. Against that well-established negative record now stand several recent initiatives by this company, beginning last fall, which show a reduction of abuse levels in several other software applications. But if the company has truly reformed its abusive philosophy and practices, is it not reasonable for us to expect it to be abuse-free, period, in ALL its current applications? Pure corporate ethics matter enormously in this arena - and this mixed-bag approach by WhenU leaves security-conscious users with a very bad taste about WhenU's ultimate trustworthiness. That carries directly over into their expectations placed on anti-spyware/adware applications upon which they rely.

You have pointed out that the spyware reputation of the issuer, while important, is not the primary factor in evaluating risk level of a specific application... but, perhaps it ought to be in cases where the issuer has a long-established abuse record. I think what many of the posters here are trying to express is that they deeply and earnestly believe that the longer-duration and broader the abusive practices of a spyware house, the greater the reputation-weighting which should be applied in evaluating any application from that house. For extreme or extended negative reputations, this should perhaps carry more weight than the specific test results for any given piece of software from that outfit, regardless of the apparent "safety" of that program itself.

To people with a gut-level concern about the trustworthiness of "reformed" spyware houses, a heavy focus by an anti-spyware program on "mechanical", specific software behavior checklists seems to come across rather like a 3-foot leap over a 5-foot ditch, in terms of securely protecting their computers. I believe they are often less concerned with the specifics of a given piece of current software than with the top-level risk attendent with it - and that certainly includes corporate integrity of the issuer as perhaps the primary decision 'driver' when that integrity has long been demonstrated to be absent.

My own "2-cents" suggestion is that the issuer's reputation be much more dynamically involved in the risk-evaluation process, such that longer-term or more prolific "bad boys" have a significantly higher safety bar to cross for their programs than software from other sources, even to the extent of sometimes over-ruling "innocent"-appearing test results on any software from those houses. Certainly there needs to be a "path of cleansing" for spyware houses to get off the blacklists if they have indeed cleaned up their act - but that path must be narrow and demanding in proportion to the level of past abuses, or else trust in the "system" will disintegrate. And I think that's what all these anti-spyware "disappointment" threads have been telling us.
--
If God wanted us to work with electrons, He'd make them big enough to see...]]> http://www.dslreports.com/forum/remark,13970795 Sun, 24 Jul 2005 04:55:35 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13970781 John2g : Ah......, but their customers won't have to pay the legal costs of fighting a C&D threat.
--
Better to remain silent and be thought a fool, than to speak and remove all doubt. ]]> http://www.dslreports.com/forum/remark,13970781 Sun, 24 Jul 2005 04:43:01 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13970779 ctrip :
said by Jet_Set:

{maybe we should take a poll: just how many people would actually WANT any of the 3 software from WhenU installed, AFTER knowing the past history of WhenU?
i predict 0.0001 %}
Eric, even though it was pretty universally decried as a bad thing (even by you), I didn't think it was a big deal when you started the thread about MSAS reclassifying Claria to "ignore". And I don't really think that Sunbelt's downgrading of WhenU to "ignore" is a big deal either. In both cases, the user can simply change the "ignore" recommendation to "remove". In both cases the spyware is still detected and can still be removed

Having said that, it seems pretty obvious that a lot of people are very upset by this decision. You had asked earlier about suggestions for criteria that Sunbelt should use if they didn't like the current criteria that Sunbelt is using to base this decision on. Have you considered asking your customers what they would like the default setting to be?

I'm just asking. I'm not really sure that I even think it's a good idea. But have you considered giving a voice to your paying customers or potential customers?

I mean if Sunbelt sent out a questionnaire to its customers or had a web survey on their home page asking if they would like WhenU downgraded to ignore and 75% or 80% or 85% responded "no", do you think that their sentiment should be considered at all?
--
Spread Internet Explorer! - The browser you can trust to not have those annoying Firefox twits pushing it!]]> http://www.dslreports.com/forum/remark,13970779 Sun, 24 Jul 2005 04:40:21 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13970761 John2g : The only things that are true are mathmatical. For example 2 + 2 = 4. This statement is only true by definition.

Everything else is opinion.
--
Better to remain silent and be thought a fool, than to speak and remove all doubt. ]]> http://www.dslreports.com/forum/remark,13970761 Sun, 24 Jul 2005 04:29:15 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13970748 eburger68 : TeMerc:

You wrote:

said by TeMerc:
There is no way anyone who reads this thread, or has read any other thread about WhenU and its actions or, rather lack of actions, or for that matter, supposed actions could be taken as 'trustful' by any stretch. Just because they are doing something now, does not mean they will continue to do so. There certainly is not nearly enough history to prove this.


TeMerc, I'm sorry, but you can't universalize your own judgments and conclusions like that. A number of people in this thread -- credible people that you know, too -- have come to different conclusions than you.

As for the issue of trustworthiness, I clearly indicated that "trustworthiness" was based on verifiable actions and even offered you examples. WhenU has taken several steps to clean up their distribution processes. That these actions have been implemented and have had significant effects on the distribution of WhenU's software is verifiable. Moreover, as I pointed out, these actions have not been followed up with significant backsliding, as in the case of 180solutions.

If you've got evidence to suggest otherwise, I would most appreciate hearing it.

said by TeMerc:
Consider the length of time that alleged company has given the users of their unsavory installs. Was it just 12 months? Not hardly. Was it just 'affiliates' as so many often say? More than likely just looking the other way, as has been proven by several other researchers.


The standard you propose is based on nothing other than spite and vengefulness. The standard I proposed was grounded in practical considerations: what is the time required to verify that distribution channels have been cleaned up and that the company remains on the right course. That's a practical standard.

Your own standard, by the way, would let off the hook in very short order vendors who have only been around for a short time. Is that really what you want? I think not.

No, the standard must be grounded in practical requirements.

said by TeMerc:
What of the vast amount of volunteers who offer help to users in the security forums across the net? I am fairly certain, many who do so would offer their time and efforts as 'watchdogs'. Companies who take advantage of these volunteers, usually offer some small offering as a 'reward'. And we all know this never amounts to enough to really pollute any findings. Guidelines could be set up, and strictly adhered to.


That's a possibility, and it merits looking into. As practical matter, such a network does not exist. And the volunteers would come from where? There are plenty of competent people who work HJT logs in anti-spyware forums, but they are overwhelmed and, in many cases, burned out.

I won't discount the possibility of setting up volunteer monitoring network of some sort, but that will take a lot of time and significant organizing, esp. given the fact that the volunteers at anti-spyware sites can't seem to coordinate their actions as it is without petty squabbles breaking out all over the place.

Eric L. Howes
--
Microsoft MVP Sunbelt Software Consultant Spyware Warrior]]> http://www.dslreports.com/forum/remark,13970748 Sun, 24 Jul 2005 04:20:19 EDT Re: . http://www.dslreports.com/forum/remark,13970732 HAL 90001 :
quote:
How candid, reasonable, and forthright of you to apply standards to Suzi that you're not willing to live up to yourself!

My God (yes, that's self-proclaimed you, Eric)! So, you know whether I've read "the article?" How clairvoyant! I've no doubt that Kreskin would take a BIG back seat to you.

quote:
You mock her for testing only some of the apps and then imply that she's not fit to offer her own assessments of the truthfulness and accuracy of the white paper?

LOL, I "mocked" her description of the methodology she said she employed--and mocked I did, because they were pathetic.

quote:
Q. And you've done what testing? You've tested how many WhenU applications?

A. None. Zilch. Zero. Nada.

Again, God, your clairvoyance ASTOUNDS me.

quote:
Does that standard apply only to Suzi, or can we say the same for you? I'd hate to think we were dealing with a case of rank hypocrisy, so please do tell me that you're willing to live by the same standards as you apply to others.

Absolutely. If ever I claim to have "tested" something, rest assured, I will have tested it in toto. suzi See Profile made no such claim. Wretch all you want, but she represented both Sunbelt and herself as a joke; if you don't like that, too bad.

quote:
If you're to insist that Suzi does not have the right or wherewithal to state her conclusions based on her own testing because she hasn't tested all the apps, then you ought to apply the same standard to yourself.

Give me a bloody break with this. In fact, I said in my last post to her that she can say what she wants to say, but she should also accept the criticisms that accompany her opinions, the manner in which she expresses her opinions, or both. If that's too tough or mean . . . oh well. And, I never insisted that she doesn't have the "right" (watch your language, by the way) to state her conclusions "based on her own 'testing . . . '" If, however, her own statements bring her testing methodology into question, then don't blame the critics.

quote:
So, in the spirit of fair play, let's make the following arrangements: when you've tested all the apps and read the white paper, please do let me know. And no unverifiable statements either: I want screenshots, logs, copies of files, the whole nine yards.

Sure, Eric. And, just as soon as suzi See Profile has tested all the apps, instead of just some, then we'll have a common ground. But, until them, understand this: at no point in time did I ever claim that I have or had tested "all the apps." That's the difference, which is apparently lost on you.

quote:
I'll be happy to receive the results of your testing, along with any observations and analysis you choose to include here:

eburger68@myrealbox.com

I look forward to your email.

Eric L. Howes

Absolutely.
--
’άριστον μεν ‘ύδωρ . . .]]> http://www.dslreports.com/forum/remark,13970732 Sun, 24 Jul 2005 04:11:50 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13970714 suzi : Mele20,

I disclosed my relationship with Sunbelt in my first post on the first page of this thread,

»Re: Sunbelt Adjusts WhenU Detections

I've been member here since May 2004 but I haven't posted heavily. I'm more often known as Suzi at Spyware Warrior and most places and Suzicat at CastleCops.
--
aka Suzi, Spyware Warrior
Microsoft MVP Windows Security 2005
Sunbelt Software Consultant]]> http://www.dslreports.com/forum/remark,13970714 Sun, 24 Jul 2005 04:04:57 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13970706 Mele20 :
said by jp10558 See Profile:

To Merle20 and others, I'd like to understand why you feel displaying ads = spying on you. I don't get it, especially now that you've come on to say that Google isn't spying on you with their display of ads. [Aside, Google is likely far more of a "spy" sort of company than most other vendors/software listed here. They not only put persistant cookies on the PC to track you, they save your search history, they track by IP, they encourage using their mail service and discourage deleting e-mails, but openly scan said mails for purpose of advertising to you, and overall likely collate all this to build a profile to target ads to you.

I also don't think auto updates are spyware - they are almost necessary, because otherwise we see what happens - programs that never get patched, and that's where a lot of these scumware issues come from.
I don't know what I said that made you think I don't mind Google ads. I DO mind ALOT! I did say that Proxo is currently showing me the sponsored links at the top of a page where I search for something like "CounterSpy". I see NO ads on the right though and I didn't use to see those paid links at the top. I was told the reason is because I am not using one of the Google style sheets. I don't like them because they make Google look different but they also get rid of the sponsored links at the top. That is the only thing I can think of that I said that might sound like I don't mind Google ads.

I am VERY aware of what Google does with information it collects! That is precisely why Google has NEVER put a cookie on my box and it never will. The day Google goes to the dark side and requires a cookie before we can use the search engine is the day I will stop using Google. I really DETEST Gmail. I will not communicate by email with anyone who uses Gmail because I don't want any of my emails being stored by Google to further their lust to invade people's privacy.
--
Around 2005 a sudden spark will catalyze a Crisis mood. The very survival of the nation will seem to be at stake.Sometime before 2025, America will pass through a great gate in history. The risk and promise will be very high. The Fourth Turning Wm. Straus]]> http://www.dslreports.com/forum/remark,13970706 Sun, 24 Jul 2005 04:02:54 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13970698 eburger68 : Mele20:

You wrote:

said by Mele20 See Profile:

I knew Eric was a consultant but I sure didn't know suzi See Profile was until she mentioned it CASUALLY in this thread! In fact, I had no idea who "daphne" was. I don't recall seeing a "daphne" posting here before.
Daphne/Suzi has been posting here for well over a year now, if not longer. And her sig has always identified who she is (aka, Suzi of SpywareWarrior). If you've been too unobservant to notice that, that's your fault alone, not anyone else's, so please don't blame your own failures on others.

said by Mele20 See Profile:

You and Eric are NOT one of us so please don't cover that up.
Please read your own posts before making these kinds of malicious, nonsense statements. I have not covered up my association with Sunbelt. You admit knowing it yourself remember?

Moreover, my disclaimer is posted at the start of this thread, in previous threads here at DSLR/BBR, and on all my pages at Spyware Warrior.

Eric L. Howes
--
Microsoft MVP Sunbelt Software Consultant Spyware Warrior]]> http://www.dslreports.com/forum/remark,13970698 Sun, 24 Jul 2005 03:59:42 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13970685 eburger68 : Jet_Set:

You wrote:

said by Jet_Set:

eric, if it needs to be pointed out, then so be it.

all this time, you are looking at this from the viewpoint of a computer-security expert/ hardcore spyware researcher.

but, you are neglecting to consider the consumer, for whome ultimately this product is made for, and being an average user myself, i view Sunbelts decision as not +ve, and a bit worrying and confusing too.
afterall, isint this all about a software application designed to make the RIGHT choice for consumers?
Jet_Set, if you're posting in the DSLR/BBR Security forum, then you hardly qualify as a typical "consumer," much less as a spokespersson for them. Typical consumers don't hang out and respond to posts in the DSLR/BBR Security forum.

What's very clear to me at this point is:

1) You can't get your facts straight or be trusted to report Sunbelt's decisions in an accurate manner, as we already saw.

2) You can't come up with solid reasons or evidence based on empirical experience with the applications themselves to point out specifically where, how, and why Sunbelt's analysis and evaluation of the applications in question are wrong.

3) You persist in the misguided notion that your own personal preferences can be universalized.

4) You ignore what doesn't fit your tidy world view in the hope that unpleasant information will simply disappear.

And since you raise the issue of consumers not being to make the "right choice" and "correct decisions" then please do step up to plate and answer the question that StraitShoot was unable to answer:

said by eburger68 See Profile:

said by StraitShoot See Profile:

Say what you wannna say, man, but a lot of people don't know better, and won't move it from "ignore" to remove... Wheras, by having it in "remove" Sunbelt was more protecting of the average user (not us exalted DSLR members, LOL) now that level of protection is not as strong.. If I have the brains to install WhenU, then in detection, I can choose to remove... or ignore...

B, I'm totally with you on this one..
So, let's suppose that some user picked up WhenUSearch along with a free screensaver or wallpaper. The thing's been on the desktop for a few days. Maybe this person finds it slightly annoying, maybe not.

This user then scans with CounterSpy and see sees the "Recommended Action" of "Ignore." And let's assume worst case scenario where the user places all faith in that, reads nothing of the additional descriptive text presented about WhenUSearch, and decides not to remove the WhenUSearch bar.

My question to you, Jim, is this: what will happen? Can you tell me what ills will befall the user who who leaves WhenUSearch installed?
Anyone who claims, like you, to know what the "right choice" and "correct decisions" ought to be able to answer the question I posed to StraitShoot.

So, Jet_Set, what's the answer? What ills will befall the user who doesn't make the "right choice" and "correct decision" to remove WhenUSearch? And you know this answer how? Based on what?

(Note: If you don't like the WhenUSearch example, you can substitute ClockSync or Weathercast.)

Eric L. Howes
--
Microsoft MVP
Sunbelt Software Consultant
Spyware Warrior]]> http://www.dslreports.com/forum/remark,13970685 Sun, 24 Jul 2005 03:53:12 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13970666 Mele20 :
said by B See Profile:

said by suzi See Profile:

You are correct that I am a paid consultant for Sunbelt. Shall I put that in my sig on every post? And Eric, too?
Yes, absolutely you both should do that, especially when you're both specifically discussing and/or defending Sunbelt's actions. Isn't that completely obvious to you?

Eric started this thread much as he has previous ones, but there is of course a critical difference. He has no claim to independence or impartiality here, and neither do you, no matter how pure of heart you both are.

Please see my earlier comment on the same matter.

-- B

Edit: »Re: Sunbelt Adjusts WhenU Detections

I knew Eric was a consultant but I sure didn't know suzi See Profile was until she mentioned it CASUALLY in this thread! In fact, I had no idea who "daphne" was. I don't recall seeing a "daphne" posting here before.

So, I agree totally with B See Profile that this disclosure should be made in EVERY POST EITHER OF YOU MAKE NOW OR IN THE FUTURE ABOUT SPYWARE AND/OR ANTISPYWARE APPLICATIONS.

You and Eric are NOT one of us so please don't cover that up.
--
Around 2005 a sudden spark will catalyze a Crisis mood. The very survival of the nation will seem to be at stake.Sometime before 2025, America will pass through a great gate in history. The risk and promise will be very high. The Fourth Turning Wm. Straus]]> http://www.dslreports.com/forum/remark,13970666 Sun, 24 Jul 2005 03:45:41 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13970643 Mele20 :
said by jp10558 See Profile:


Why the hell are you using Windows then? It certainly takes control away from the user, as you can't control all aspects of the product. I expect you to switch to Linux and totally FLOSS software immediately. That's ok, I'll wait. Or we'll see how hypocritical you are.
Well, gee that should be obvious! I'm using Windows (1) because my OEM won't sell a machine without an OS and (2) because I don't know enough yet to be able to use Linux. I'm going to be putting some flavor of Linux on a virtual machine I am setting up and start learning. I've only used a computer for the past 7 years, and the first year was before I got my own, and I went to a Hawaii County sponsored program for those 55+ to learn about computers. I think I've done pretty well and, yeah, Linux is out there waiting and maybe I know enough now to be able to learn it and finally move away from Windows.
--
Around 2005 a sudden spark will catalyze a Crisis mood. The very survival of the nation will seem to be at stake.Sometime before 2025, America will pass through a great gate in history. The risk and promise will be very high. The Fourth Turning Wm. Straus]]> http://www.dslreports.com/forum/remark,13970643 Sun, 24 Jul 2005 03:37:45 EDT Re: . http://www.dslreports.com/forum/remark,13970633 eburger68 : HAL 9000:

You wrote:

said by HAL 90001 See Profile:

So, you've read a twenty-five page paper; you agreed with its conclusions; you then tested some of them (what is "them?") yourself (wow, that's massively impressive); based on your having tested some of "them" (what?, the "apps?"), you came to the same conclusion.
How candid, reasonable, and forthright of you to apply standards to Suzi that you're not willing to live up to yourself!

You mock her for testing only some of the apps and then imply that she's not fit to offer her own assessments of the truthfulness and accuracy of the white paper?

Q. And you've done what testing? You've tested how many WhenU applications?

A. None. Zilch. Zero. Nada.

Does that standard apply only to Suzi, or can we say the same for you? I'd hate to think we were dealing with a case of rank hypocrisy, so please do tell me that you're willing to live by the same standards as you apply to others.

If you're to insist that Suzi does not have the right or wherewithal to state her conclusions based on her own testing because she hasn't tested all the apps, then you ought to apply the same standard to yourself.

So, in the spirit of fair play, let's make the following arrangements: when you've tested all the apps and read the white paper, please do let me know. And no unverifiable statements either: I want screenshots, logs, copies of files, the whole nine yards.

I'll be happy to receive the results of your testing, along with any observations and analysis you choose to include here:

eburger68@myrealbox.com

I look forward to your email.

Eric L. Howes
--
Microsoft MVP Sunbelt Software Consultant Spyware Warrior]]> http://www.dslreports.com/forum/remark,13970633 Sun, 24 Jul 2005 03:34:11 EDT Re: Disproving by counter-example http://www.dslreports.com/forum/remark,13970623 Mele20 :
said by jp10558 See Profile:


This is crazy. Does your program block 99% of websites? Are they spyware because they are ad supported? Would you want them to?

Lets take Opera as an example you brought up. To get Opera, you have to specifically download it. On first run, you are informed of the ad requirement to use it free, and given a choice as to two types of ads - clearly spelled out. You can uninstall it by using the built in uninstaller.

Now, when I run an antispyware app, I wouldn't want it picking up Opera, and certainly not automatically removing it. I'd suddenly be berefit of by browser of choice!
I see NO ads on the internet. I haven't for many years. First I used Ad/subtract when it was in beta and used it for several years then, when the free version for home users was dropped for paid versions only, I moved to its parent The Proxomitron. I've been using it for over three years and I see no ads because the Proxomitron acts as a local proxy server (as did Ad/subtract) and everything that goes through my browsers is filtered by Proxo.

As to Opera, I see ads because I have been ethical and haven't used Proxo, or there are other ways (we had a thread here just recently about how to strip the Opera ads), to strip them or hide them at least. I never wanted AD RIDDEN Opera. What I want Opera to do is offer a trial without the ads so that, if I like Opera, I will buy it. I can't trial an ad ridden Opera. I thought maybe I could but I won't allow all those spyware cookies. You must not like it very much if you haven't bought it. If you bought it then you wouldn't have worry about it getting on a list of adware/spyware. ;) If you want a free browser then just use Fx.
--
Around 2005 a sudden spark will catalyze a Crisis mood. The very survival of the nation will seem to be at stake.Sometime before 2025, America will pass through a great gate in history. The risk and promise will be very high. The Fourth Turning Wm. Straus]]> http://www.dslreports.com/forum/remark,13970623 Sun, 24 Jul 2005 03:27:42 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13970618 anon : eric, if it needs to be pointed out, then so be it.

all this time, you are looking at this from the viewpoint of a computer-security expert/ hardcore spyware researcher.

but, you are neglecting to consider the consumer, for whome ultimately this product is made for, and being an average user myself, i view Sunbelts decision as not +ve, and a bit worrying and confusing too.
afterall, isint this all about a software application designed to make the RIGHT choice for consumers?

and the experts who you say are comfortable with Sunbelts direction {you mentioned Paperghost,} are so with themselves and their own ability to effectively eliminate spyware, they are comfortable with their ability make the correct decisions, everytime.

just because they see it so clearly, dosent mean they think the rest of the users are so aware! because they arent!
so, the overwhelming majority of people here would NOT go with the current recommendation of "ignore", wether it be for themselves, or anyone else they are helping.

i dont think ANYONE here would actually say "oh, do whatever Sunbelt recommends as the default action"
they may have made such a recommendation to all few days ago, but NOT anymore.

{maybe we should take a poll: just how many people would actually WANT any of the 3 software from WhenU installed, AFTER knowing the past history of WhenU?
i predict 0.0001 %}]]> http://www.dslreports.com/forum/remark,13970618 Sun, 24 Jul 2005 03:25:47 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13970616 anon : Just finished the thread...Sad, really.

Is there anything sacred?

You have to pay the bills though, I understand (just know that there are people out there who can still read between the lines)

I applaud Hal, B, James, Mele20 (and a few others) for having the guts to call a spade a spade (in my opinion anyway)

What nonsense.

(BTW, I also support the consulting disclosure on each signature/post, thanks)]]> http://www.dslreports.com/forum/remark,13970616 Sun, 24 Jul 2005 03:24:27 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13970584 Mele20 :
said by jp10558 See Profile:

In fact, for the two programs you list, you have 3 very clear and I think very fair choices. 1)don't use the software.

2)View ads in the software to pay for its development and your use of it.

3)Buy the software outright - no ads.

Especially with software like Opera or Adobe Reader, I don't see why the ads are a bad choice, or how it makes it any sort of threat. They both uninstall cleanly, and don't steal any information from you. And like TV, it makes us able to use important/useful software without paying lots of money for it.
Since when did Adobe Reader become software you can purchase? You mean I can purchase it and there will be no ads, no Yahoo crap, etc? It won't phone home without my permission? Really?? When did Adobe Reader become shareware? I missed that.

As for Opera, the problem with it is that you cannot do a trial of it to see if you want to buy it. They have no trial. The free version is NOT a trial version. It is an ADWARE version and you have to click constantly on the cookies to stop the third party nasty adware cookies which are all PERMANENT ones. (I could tell Proxo to make all cookies session and I could strip the ads using Proxo but that is not really the point). So, you can't tell if you would like the browser well enough to buy it. If, instead, you choose the Google ads then you must allow Google cookies. I won't allow that. Google has NO cookie from me, and never will, (the day Google goes to the dark side, and they will one day, and requires a cookie to use their search engine is the day I will stop using Google). I'm sure not going to let Google get their cookie from my trying Opera.
--
Around 2005 a sudden spark will catalyze a Crisis mood. The very survival of the nation will seem to be at stake.Sometime before 2025, America will pass through a great gate in history. The risk and promise will be very high. The Fourth Turning Wm. Straus]]> http://www.dslreports.com/forum/remark,13970584 Sun, 24 Jul 2005 03:12:13 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13970546 Mele20 :
said by fatdcuk See Profile:

Please stick to the facts and stop spreading FUD gentlemen.

Sunbelt still considers most of WhenU software to be worthy of detection/action by default other than ignore:)
But if you had read the Sunbelt whitepaper on WhenU you would realise that,RTFA.
So? What does that have to do with anything? The company STILL PRODUCES SPYWARE. To reason that an antispyware application should downgrade a KNOWN NASTY spyware company is crazy. That is what has been done. You downgrade any part of a spyware company's products and they have their foot in the door..they are half way home to victory. It's just plain sleazy and Alec knows about sleazy (that's how I met him and granted he did stop the sleazy behavior of CS online scan after I complained publicly here but still once sleazy..puts a bit of a doubt in one's mind...maybe sleazy again?).

Anyone with a smidgen of intelligence (except for some paid consultants who come here and try to pull the wool over our eyes) knows you DON'T REWARD A SPYWARE COMPANY IN ANY WAY until they are totally clean and have been for a reasonable period of time which would probably be a year at least. Getting clean and staying clean shouldn't be made easy for these sleaze balls. As long as they have even one product that is obviously spyware they are still a spyware company and they should be given NO slack.

Why isn't Alex here? He posted one time and then lets his paid consultants do the dirty work. :(
--
Around 2005 a sudden spark will catalyze a Crisis mood. The very survival of the nation will seem to be at stake.Sometime before 2025, America will pass through a great gate in history. The risk and promise will be very high. The Fourth Turning Wm. Straus]]> http://www.dslreports.com/forum/remark,13970546 Sun, 24 Jul 2005 03:00:13 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13970465 HAL 90001 : Insults and attacks? No, they're not. You've (obviously) blessed your own posts with your imprimatur, so you must live with that.
EDIT: added "with"
--
’άριστον μεν ‘ύδωρ . . .]]> http://www.dslreports.com/forum/remark,13970465 Sun, 24 Jul 2005 02:34:21 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13970450 suzi : Hal 9000,

If you want to discuss the merits of the white paper and compare the research findings with your own findings upon testing the WhenU apps, I'd be glad to discuss that with you. I will not respond to your personal attacks and insults, however.

Edit for spelling.
--
aka Suzi, Spyware Warrior

Microsoft MVP Windows Security 2005

Sunbelt Software Consultant]]> http://www.dslreports.com/forum/remark,13970450 Sun, 24 Jul 2005 02:30:25 EDT . http://www.dslreports.com/forum/remark,13970435 HAL 90001 : LOL!

You've got to be kidding. You reproach me with a bullsh*t statement like this?:

quote:
When I said "truth", I was referring to the 25 page white paper, which clearly and objectively documents the behavior of WhenU apps that were tested. To me, that is "truth". I tested some of them myself and came to the same conclusions.


Sorry, but that has to be the most nonsequitur statement I've read in this thread so far.

So, you've read a twenty-five page paper; you agreed with its conclusions; you then tested some of them (what is "them?") yourself (wow, that's massively impressive); based on your having tested some of "them" (what?, the "apps?"), you came to the same conclusion.

Sorry, but Sunbelt's bally-hoo'd scientific methodology kinda gets kicked in the butt here, don't you think?

KEERIST! Rest assured, your "disclaimer" is not necessary; it's self-evident.
--
’άριστον μεν ‘ύδωρ . . .]]> http://www.dslreports.com/forum/remark,13970435 Sun, 24 Jul 2005 02:25:58 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13970384 TeMerc : Eric wrote:
It's important that we not discount past behavior and find a meaningful way to incorporate it into our analysis of advertising software vendors who appear to be reforming.

There are several considerations here:

1) How reliable and "trustworthy" is the company in making reforms?
I say:
There is no way anyone who reads this thread, or has read any other thread about WhenU and its actions or, rather lack of actions, or for that matter, supposed actions could be taken as 'trustful' by any stretch. Just because they are doing something now, does not mean they will continue to do so. There certainly is not nearly enough history to prove this.

You ask and offer:
How many sleazy installations in the installed base remain? What is to be done with them?
Another proposed solution (originally from Esther Dyson) is that adware vendors push out a notice prompt of some sort to the entire installed base and re-acquire users'/victims' consent. While intriguing, this proposal suffers from a number of problems, not the least of which is the quality and implementation of such a notice

A year long probation may be justified in some cases, esp. where there is a long track record of force-installs through third-party distribution networks and the vendor has had demonstrated problems in reining in its distributors. A year would be the time expected to verify that distribution channels have indeed been cleaned up.

I say:
Consider the length of time that alleged company has given the users of their unsavory installs. Was it just 12 months? Not hardly. Was it just 'affiliates' as so many often say? More than likely just looking the other way, as has been proven by several other researchers.

You ask and offer:
Then there's the question of monitoring and enforcement. Anti-spyware companies are struggling even now just to keep up with the flood-tide of malware being released on the Net every day. Must they now devote employees and other resources to monitoring efforts to ensure compliance among adware vendors?

I say:
What of the vast amount of volunteers who offer help to users in the security forums across the net? I am fairly certain, many who do so would offer their time and efforts as 'watchdogs'. Companies who take advantage of these volunteers, usually offer some small offering as a 'reward'. And we all know this never amounts to enough to really pollute any findings. Guidelines could be set up, and strictly adhered to.

This is an issue of great importance, and not likely to be resolved in a manner of complete agreement to all concerned. Debate can only help improve the way things are decided among the vendors who detect these bits of software which are installed by one means or another. (See how I avoided calling them anything specific?);)]]> http://www.dslreports.com/forum/remark,13970384 Sun, 24 Jul 2005 02:11:50 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13970307 suzi :
said by HAL 90001 See Profile:

I've still about seventy-five or so posts to read in this thread, but, you, suzi See Profile just articulated Sunbelt's massive hubris that I, for one, have found extremely distasteful, and with which I am MIGHTILY uncomfortable:

quote:
Ok, so let me clarify your statement. You are saying you *want* to form your opinions based on lack of knowledge and emotion? You don't want to know the truth so you won't read the white paper...
(Paragraph quoted in full, but emphasis is mine.)

So, you (or Sunbelt) know "the truth?" Congratulations: few people or organizations can lay claim to that. Be that as it may (or may not) be, I really object to Sunbelt's foisting its interpretation of "the truth" on paying customers (and nonpaying evaluators, for that matter).

At this point, I'm still finding B See Profile's, Mele20 See Profile's, and StraitShoot See Profile's comments to be the most relevant and spot-on, though I do still have a bit to read. In fact, the only reason I'm posting now is that the incredibly obnoxious arrogance of your statement--that you know "the truth" of WhenU--compelled me.
When I said "truth", I was referring to the 25 page white paper, which clearly and objectively documents the behavior of WhenU apps that were tested. To me, that is "truth". I tested some of them myself and came to the same conclusions.

Hal 9000 and anyone else -- can you say the same? Have you tested the WhenU apps? If so, please post your documentation and if it differs from Sunbelt's findings, we would be glad to review it.

Here are some definitions of truth:

n) truth (a fact that has been verified)

»wordnet.princeton.edu/perl/webwn···&s=truth

Conformity to fact or actuality.

»education.yahoo.com/reference/di···ry/truth

Perhaps I should have used the word "facts". The "facts" about WhenU's apps are in the white paper. Again, if anyone can can present different facts, please do.

Disclosure: I am a paid consultant for Sunbelt.
Edited for grammar.

--
aka Suzi, Spyware Warrior


Microsoft MVP Windows Security 2005]]> http://www.dslreports.com/forum/remark,13970307 Sun, 24 Jul 2005 01:50:00 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13970242 viperpa33s : All that matters to me is to giving the user the choice. As long as Sunbelt gives the user the choice and the ability of removing the "said" software, then I am happy. I only have a problem when a anti adware or spyware company starts removing detections all together for a "said" product.]]> http://www.dslreports.com/forum/remark,13970242 Sun, 24 Jul 2005 01:34:18 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13969812 eburger68 : Sheiny:

Sorry, I should have responded to this particular point in my previous post. You wrote:

said by sheiny See Profile:

The only true guarantee in that clause is to not change the "privacy protective nature of the Software". The ability to update the software seems clear also, but the ability to upgrade the software is less so. It seems that it would be ok for WhenU to install any of the other products in its stable without notice because they share similar policies - even the high risk products. As long as WhenU considers them an upgrade.
If WhenU were to start using the auto-updater in say, ClockSync, to push down its other products on users' systems without proper notice and disclosure, that would be enough in *my judgement* to bump the risk level up.

WhenU does not have a history of that. WhenU has been known to use installers (usually named VVSN*.EXE) that are capable of installing multiple products, but I have not seen WhenU's autoupdater drop new software (as opposed to "upgrades," and yes I am aware that there are grey areas there) on users' systems without notice and disclosure.

Best,

Eric L. Howes
--
Microsoft MVP
Sunbelt Software Consultant
Spyware Warrior]]> http://www.dslreports.com/forum/remark,13969812 Sun, 24 Jul 2005 00:07:35 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13969715 eburger68 : Sheiny:

You wrote:

said by sheiny See Profile:

Update without notification or option to opt out has to go. And while they are at give the users a log of the data they do send back.
I fully agree with you that auto-update functionality that's not configurable by users is obnoxious and objectionable. I've already butted heads with several vendors over this very issue. That's why it's included in the listing criteria in the first place.

That said, WhenU has no track record of abusing this functionality. You wanted us to take into consideration past performance and history? Here's an example where we do.

But I simply can't agree that this one function, objectionable as it is, represents a risk severe enough to bump an otherwise innocuous program like ClockSync, for example, up to "Moderate risk," esp. when the vendor in question has a track record of not abusing it. There's got to be something more to bump the program up to a higher risk level, and I'm still waiting for someone here to suggest just what that something is.

Folks, really and truly, it is long past time that one of the critics here actually started testing the software in question so as to enjoy at least a passing familiarity with the applications. This is a "security" forum, after all, and the critics here ought to be able to do this kind of basic testing. See Keith2468's earlier post for some suggestions, if you're truly at a loss for where to begin:

»Disproving by counter-example

The only thing I would add to Keith's suggestions is that you use an installation monitoring utility like Inctrl5 to log the files and Reg keys that are actually dropped on the test system. Do NOT simply run your favorite anti-spyware utility, whatever that might happen to be. You need to independently verify what was actually installed and identify the components yourself. If you can't do that, then don't pretend to test.

Eric L. Howes
--
Microsoft MVP
Sunbelt Software Consultant
Spyware Warrior]]> http://www.dslreports.com/forum/remark,13969715 Sat, 23 Jul 2005 23:49:00 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13969558 eburger68 : StraitShoot:

said by StraitShoot See Profile:

YOU'RE the one on trial here, Eric, NOT ME!!! HA HA... That's so funny! I forgot to laugh... C'mon, Eric.. this is going to wind up being a classic in the annuls of DSL Reports threads.. LOL..
Jim, when you're ready to be serious and start responding to these questions and issues with something other than childish taunts and mindless "LOL's," please do let me know.

Until then, you'll forgive me if I devote my time here to responding to the several folks who do have something substantive to contribute (and who include several critics of Sunbelt's decision).

(And, yes, my question to you still stands.)

Eric L. Hoaes
--
Microsoft MVP /
Sunbelt Software Consultant /
Spyware Warrior]]> http://www.dslreports.com/forum/remark,13969558 Sat, 23 Jul 2005 23:24:31 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13969529 jp10558 :
said by HAL 90001 See Profile:

I've still about seventy-five or so posts to read in this thread, but, you, suzi See Profile just articulated Sunbelt's massive hubris that I, for one, have found extremely distasteful, and with which I am MIGHTILY uncomfortable:

quote:
Ok, so let me clarify your statement. You are saying you *want* to form your opinions based on lack of knowledge and emotion? You don't want to know the truth so you won't read the white paper...
(Paragraph quoted in full, but emphasis is mine.)

So, you (or Sunbelt) know "the truth?" Congratulations: few people or organizations can lay claim to that. Be that as is may (or may not) be, I really object to Sunbelt's foisting its interpretation of "the truth" on paying customers (and nonpaying evaluators, for that matter).

At this point, I'm still finding B See Profile's, Mele20 See Profile's, and StraitShoot See Profile's comments to be the most relevant and spot-on, though I do still have a bit to read. In fact, the only reason I'm posting now is that the incredibly obnoxious arrogance of your statement--that you know "the truth" of WhenU--compelled me.
Well, basically we have one side (sunbelt) giving ample research results, sources to back their findings up(third party) and explanation of their anaylsis, which logically backs up their decision.

On the other side, we have people who have provided nothing but name calling, against the company (which has about 0 to do with how the program performs - how many of you are using Windows again vs the bad rep of MS?) and against Sunbelt.

I respect your basing your condemnation of Sunbelt purely on emotion and with no evidence otherwise, but to suggest that most people would feel that way is ludicrious. Well, maybe not - there are a lot of people who seem to make decisions disregarding logic or information and actually going out of their way to remain uninformed (I won't quote any examples, too inflamatory).

However, the idea that the people you (well some) pay for examining spyware, and others respect (up to today anyway) for their input are not people to go to for the information (mislabeled the truth - I think that misreads the statement)is somewhat specious. Really, they are the experts. It'd be like going to several different doctors and then claiming they were lying to you in their diagnosis. I can't see any reason to think Eric and company are unqualified or unmotivated to provide the correct information.

On the other hand, I certainly see not only an unreasonable bias (ads are evil and spyware) as well as a lack of qualifications in the people lambasting Sunbelt for this decision.

While not a Sunbelt customer, I understand and agree with their assesment. I have even come to understand their classification of VNC as a result, though I disagree with their position on that software, Eric has already clearly indicated why they would list it, and explains their ignore recommendation there.

I personally lump VNC as well as Opera and Adobe Acrobat Reader in the legitimate category, VNC more than the others as it doesn't have ads (in any version I've seen).

To Merle20 and others, I'd like to understand why you feel displaying ads = spying on you. I don't get it, especially now that you've come on to say that Google isn't spying on you with their display of ads. [Aside, Google is likely far more of a "spy" sort of company than most other vendors/software listed here. They not only put persistant cookies on the PC to track you, they save your search history, they track by IP, they encourage using their mail service and discourage deleting e-mails, but openly scan said mails for purpose of advertising to you, and overall likely collate all this to build a profile to target ads to you.]

In the end, I also dislike ads, and do everything I can to avoid them. Those of you saying to delete anything that shows ads - how far do you go with this? Only watch DVDs cause TV has ads? Never read magazines because those have ads? No newspaper?

I've personally done all that because ads bug me, and I too use proxomitron to remove all the ads I can from sites. But not because I think any or all of the above is evil, or is spying on me. And really - I'd like to see proof that all the companies that use adware are spying on you, because I don't see it.

I also don't think auto updates are spyware - they are almost necessary, because otherwise we see what happens - programs that never get patched, and that's where a lot of these scumware issues come from.
--
Opera 8.01(Build 7642); Windows XP Pro SP2;Athlon 64 3400+; 1GB PC3200 DDR; 1M/128k DSL; NOD32(Version 2.5.25); Sygate Pro 5.5(Build 2637);Proxomitron 4.5j Grypen 7/20/05(Opera mod),GPG ID:0x0A1C6EE3]]> http://www.dslreports.com/forum/remark,13969529 Sat, 23 Jul 2005 23:21:20 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13969485 ghost16825 :
said by eburger68 See Profile:

The trick lies in putting your finger on it without being completely arbitrary in doing so -- that is to say, without resorting to hidden, assumed criteria that are contentious.

Eric L. Howes
Ah, but that's it. What you're saying is that the difference is only intent. Wouldn't it be much easier to just detect spyware based arbitrarily on the whim of someone at Sunbelt (like yourself), regardless of the installation behaviour, what registry entries are put where, etc?
Sure, it would be a totally unprofessional and a non-transparent process but if dslreports users are any indication, most users might actually be happier with this criteria!!???

Thanks for taking the time to reply to the posts in this thread.

=======Somewhat irrelevant part starts here====

Re: my criteria-based idea - some explanation is needed.
In my opinion any detection policy is based mainly on two things. Firstly, decisions by any Anti-Spyware vendor need to have a clear scope. What should be detected, and what is some other software's problem to fix. I have not researched Sunbelt's scope of detection

I personally would stick with detection of only commercial-offerings or modifications of commercial software. Additionally, this anti-spyware software might contain some limited sandbox functions for common spyware vectors. eg. Software using global hook prompts, BHO install attempt etc. (This would be to cover a very small amount of any non-commerical spyware). Any home grown spyware which didn't use a common technique would not be detected.

The second main influence on a spyware detection policy is assumed knowledge of user. It would seem that most anti-spyware vendors have attempted to make minor setting adjustments based on user knowledge or just assumed no baseline whatsoever. In my opinion this has been a failure. It seems that it is much harder to differentiate between different user levels in the anti-spyware software market. Hence, the reason for my idea of a policy-based detection mechanism and forced user decisions on what the intent of the detected software is. I think this would be more accessible and transparent to everyone, than any industry-created terms for classes of spyware for which every software has a different term for, no matter how clear it may be. I think B See Profile may have stated in the past that he/she believed Acrobat Reader and the Google toolbar should be on some 'adware' list in anti-spyware applications. Whatever your opinions on this, it seems likely that we may see cases on the line between 'clear permission' and 'unauthorized or unwanted'. When this occurs I believe a policy-based software based entirely on pure functionality with forced user decisions, regardless of user skill level, will be the only way to deal with this issue.
--
Admin of the Kerio 2x-like open source project:
http://sourceforge.net/projects/kerio/
http://kerio.sourceforge.net/
]]> http://www.dslreports.com/forum/remark,13969485 Sat, 23 Jul 2005 23:12:27 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13969419 B :
said by suzi See Profile:

You are correct that I am a paid consultant for Sunbelt. Shall I put that in my sig on every post? And Eric, too?
Yes, absolutely you both should do that, especially when you're both specifically discussing and/or defending Sunbelt's actions. Isn't that completely obvious to you?

Eric started this thread much as he has previous ones, but there is of course a critical difference. He has no claim to independence or impartiality here, and neither do you, no matter how pure of heart you both are.

Please see my earlier comment on the same matter.

-- B

Edit: »Re: Sunbelt Adjusts WhenU Detections

--
In a realm outside causality and function]]> http://www.dslreports.com/forum/remark,13969419 Sat, 23 Jul 2005 23:02:55 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13969383 Cudni : Lol you don't have to say it, I am repeating what CS boss said .
And I'm repeating it because it is the other side of the coin. Do you know the terms of their contract? Maybe it stipulates the independence :)

Cudni
--
Think locally, @#!? globally!
Help yourself so God can help you]]> http://www.dslreports.com/forum/remark,13969383 Sat, 23 Jul 2005 22:57:42 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13969368 HAL 90001 : I've still about seventy-five or so posts to read in this thread, but, you, suzi See Profile just articulated Sunbelt's massive hubris that I, for one, have found extremely distasteful, and with which I am MIGHTILY uncomfortable:

quote:
Ok, so let me clarify your statement. You are saying you *want* to form your opinions based on lack of knowledge and emotion? You don't want to know the truth so you won't read the white paper...
(Paragraph quoted in full, but emphasis is mine.)

So, you (or Sunbelt) know "the truth?" Congratulations: few people or organizations can lay claim to that. Be that as it may (or may not) be, I really object to Sunbelt's foisting its interpretation of "the truth" on paying customers (and nonpaying evaluators, for that matter).

At this point, I'm still finding B See Profile's, Mele20 See Profile's, and StraitShoot See Profile's comments to be the most relevant and spot-on, though I do still have a bit to read. In fact, the only reason I'm posting now is that the incredibly obnoxious arrogance of your statement--that you know "the truth" of WhenU--compelled me.
--
’άριστον μεν ‘ύδωρ . . .

EDIT: typo.]]> http://www.dslreports.com/forum/remark,13969368 Sat, 23 Jul 2005 22:55:28 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13969352 jp10558 :
said by Mele20 See Profile:

I just shake my head in absolute wonder at what I read here. It is so simple. Any application that auto updates and I can't disable is spyware. Any application that is not under my control is spyware. It is that simple. Acrobat Reader 7 is spyware and I won't have it on my boxes. Windows Media Player since 6.4 is spyware. I ripped out versions 8 and 9 from XP thanks to an uninstall string provided by Microsoft to all of us who hate spyware. I use version 6.4 because I can control it and it is the last version that is totally under the control of the user.

You guys can debate these "fine" points that are irrelevant until doomsday. It is very simple. Anything that takes control away from me is spyware/crapware/adware, etc. and I want it off my box. In the case of MSN toolbar, it wouldn't uninstall. That's another hallmark of crapware. I had an awful time getting rid of it.
Why the hell are you using Windows then? It certainly takes control away from the user, as you can't control all aspects of the product. I expect you to switch to Linux and totally FLOSS software immediately. That's ok, I'll wait. Or we'll see how hypocritical you are.
--
Opera 8.01(Build 7642); Windows XP Pro SP2;Athlon 64 3400+; 1GB PC3200 DDR; 1M/128k DSL; NOD32(Version 2.5.25); Sygate Pro 5.5(Build 2637);Proxomitron 4.5j Grypen 7/20/05(Opera mod),GPG ID:0x0A1C6EE3]]> http://www.dslreports.com/forum/remark,13969352 Sat, 23 Jul 2005 22:53:02 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13969339 StraitShoot :
said by Cudni See Profile:

from
»Sunbelt Adjusts WhenU Detections
"...
As an aside, I will say that even though some of the members of the community perform research work for us, you can rest assured that they have full independence in their decisions and are not compromised in the least. They are not pressured to make any decisions. They are highly ethical and extremely conscientious and we wouldn’t have it any other way. ..."

It is worth repeating the above too but nevertheless it requires effort not to think about the possible influence of the contractual relationship

Cudni
Pardon me, but why? Why do we have to say what you're saying? We all know if Eric came out and said, "Sunbelt is wrong", management would not be very happy...

C'mon, a paid consultant is a paid consultant... Period..
Not to imply anything but independence? Well, I have to go out for a couple of hours, so don't hang me too much..LOL..]]> http://www.dslreports.com/forum/remark,13969339 Sat, 23 Jul 2005 22:50:45 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13969327 WFO :
said by Mele20 See Profile:

So, it was NOT alright for MSAS to alter the default action for Gator but it IS alright for Sunbelt to do so for WhenU? That doesn't make much sense. Or were you one of those who applauded Microsoft's also? (I don't have time to go wade through that long thread to see if you posted it).

All we are doing here is saying that NONE of the vendors should be altering default actions to ward off lawsuits. I think these vendors should all move off shore immediately including Microsoft and then we'd see an outraged yowl and some immediate action from Congress.

If the vendors can't protect us properly because of impending lawsuits then either go offshore or shut your company immediately and then in the ensuing uproar some good may come.
Mele, the same thoughts crossed my mind last night. Particularly Sunbelt making fun of MS in it's newsletter for downgrading definitions when Sunbelt did the same thing. The difference here is Sunbelt's testing proved some programs warranted the change. In the case of MS, they did it unannounced with no white papers to prove their actions were correct. (Lavasoft comes to mind here)There is a huge difference! I continue to have faith in CS. It's the best of the best. ;)
--
Sager NP4750-V Mobile Athlon 64 3700+, Mobility Radeon 9700, 2GB RAM, 60GB 7200 rpm HD. 17" Widescreen WXGA TFT LCD
Dual-boot x64 and XP Pro x32

Edit: If I ever see WhenU's software on my computer, it will get deleted no matter what any spyware app says. That's just a personal preference. LOL.;)]]> http://www.dslreports.com/forum/remark,13969327 Sat, 23 Jul 2005 22:49:28 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13969321 sheiny : The most objective way I can think to analyze a product's risk is to look at its EULA and privacy policy and ask what sort of risks are left unaddresed. I believe the privacy policies of ClockSync, Weathercast, or WhenUSearch allow potentially serious exploits.


WhenU reserves the right to periodically update and/or upgrade the Software at WhenU's discretion. Your installation of the Software indicates your acceptance of potential future updates and/or upgrades to the Software. For any material change to the privacy protective nature of the Software, WhenU will request your permission prior to making such change.

The only true guarantee in that clause is to not change the "privacy protective nature of the Software". The ability to update the software seems clear also, but the ability to upgrade the software is less so. It seems that it would be ok for WhenU to install any of the other products in its stable without notice because they share similar policies - even the high risk products. As long as WhenU considers them an upgrade.
I'm a little puzzled by the position that this is low-risk because it has not been exploited yet. Imagine an OS manufacturer that stated they will not patch security holes until they are being actively exploited. Risk implies a potential to do harm, and WhenU's EULA has a potential to do harm.
Update without notification or option to opt out has to go. And while they are at give the users a log of the data they do send back.]]> http://www.dslreports.com/forum/remark,13969321 Sat, 23 Jul 2005 22:48:47 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13969311 StraitShoot : Daphne, I still think Sunbelt is going the way of the fraidy cat and I also LOVE the way you and Eric are tag teaming!
LOL]]> http://www.dslreports.com/forum/remark,13969311 Sat, 23 Jul 2005 22:47:07 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13969300 StraitShoot :
said by eburger68 See Profile:

Oh, that's been apparent for quite some time now, Jim. If you're not willing to give what others' say due consideration, though, it's rather difficult to have a reasonable discussion with you. You can't demand others listen to you while refusing to give what others say fair consideration.
Hello, I did read the stuff... Still don't agree with it..

said by eburger68 See Profile:

Sorry, Jim, but you're not going to pull this victim act on me. Go back back and read my original post -- nowhere did I suggest you to stop posting, to be quiet, or to muzzle yourself. *Nowhere.*

Quite to contrary I've been *inviting* you over and over to make a productive contribution and to respond to questions and issues with answers and evidence. You simply haven't provided them. Still worse you've refused to listen to what others have to say -- see above.

My offer to you still stands, StraitShoot: give me good reasons and solid evidence to believe that Sunbelt has misanalyzed or misclassified ClockSync, Weathercast, or WhenUSearch, and I'll be entirely inclined to give your reasons and evidence a fair hearing. And, once again, you might start by answering the question I put to you yestserday.
YOU'RE the one on trial here, Eric, NOT ME!!! HA HA... That's so funny! I forgot to laugh... C'mon, Eric.. this is going to wind up being a classic in the annuls of DSL Reports threads.. LOL..

said by eburger68 See Profile:

Edit: I see now that you claim to have read the Sunbelt white paper and still disagree with it. Great. That's a good start. Why not point to a specific part and explain in very clear terms just why you disagree with conclusions.
It seems to me that most of the article says that WhenU is sneaky legitimate spyware, putting on a front to be legit but there are parts of WhenU that is innoculous... In other words, "because it's WhenU" is even more a stronger statement than ever... ]]> http://www.dslreports.com/forum/remark,13969300 Sat, 23 Jul 2005 22:44:59 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13969286 Cudni : from
»Sunbelt Adjusts WhenU Detections
"...
As an aside, I will say that even though some of the members of the community perform research work for us, you can rest assured that they have full independence in their decisions and are not compromised in the least. They are not pressured to make any decisions. They are highly ethical and extremely conscientious and we wouldn’t have it any other way. ..."

It is worth repeating the above too but nevertheless it requires effort not to think about the possible influence of the contractual relationship

Cudni
--
Think locally, @#!? globally!
Help yourself so God can help you]]> http://www.dslreports.com/forum/remark,13969286 Sat, 23 Jul 2005 22:43:56 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13969267 mers2 :
said by ctrip See Profile:

Not to nitpick but you are a paid consultant to Sunbelt. I know you disclosed it earlier in the thread but you didn't disclose it in your latest post. I just thought I'd point that out again in case anyone missed that association.
Criticizing a move by a software company is one thing. But stooping to malign the credibility of those who have tirelessly worked to educate and assist in the protection of users against spyware is just plain wrong. I think we have seen enough work from both Suzy and Eric to know they aren't swayed by paid consulting jobs.
--
God put me on this Earth to accomplish a certain number of things. Right now, I am so far behind I will never die. ]]> http://www.dslreports.com/forum/remark,13969267 Sat, 23 Jul 2005 22:41:52 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13969256 wehooper : How hard would it be to allow the user to select the behaviors she considers objectionable? Let the AS program report simply flag the apps that behave contrary to the user's preferences. The AntiSpyware companies are off the hook legally because they don't have to issue a recommended action. They just document the behavior and let the user decide. Take it another step and trusted researchers, privacy experts, or groups could issue their constitutionally protected "opinions" on which behaviors represent a threat to the users. Then publish the recommendations in a user downloadable format.
Would it work?]]> http://www.dslreports.com/forum/remark,13969256 Sat, 23 Jul 2005 22:40:39 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13969239 suzi : You are correct that I am a paid consultant for Sunbelt. Shall I put that in my sig on every post? And Eric, too?
--
aka Suzi, Spyware Warrior
Microsoft MVP Windows Security 2005]]> http://www.dslreports.com/forum/remark,13969239 Sat, 23 Jul 2005 22:37:50 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13969231 ctrip :
said by suzi See Profile:

I hardly think Sunbelt could be described as a "fraidy cat". For your information, a number of other anti-spyware vendors no longer target Hotbar at all.

»sunbeltblog.blogspot.com/2005/06···ion.html

quote:
Look who has delisted Hotbar (according to Hotbar): Microsoft. Lavasoft. SpywareDoctor. McAfee. Panda.


Who are the fraidy cats here? Perhaps the people who won't make the effort to learn the truth because it might mean they have to back down on their shot-from-the-hip irrational statements and admit they were wrong.
Not to nitpick but you are a paid consultant to Sunbelt. I know you disclosed it earlier in the thread but you didn't disclose it in your latest post. I just thought I'd point that out again in case anyone missed that association.
--
Spread Internet Explorer! - The browser you can trust to not have those annoying Firefox twits pushing it!]]> http://www.dslreports.com/forum/remark,13969231 Sat, 23 Jul 2005 22:36:21 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13969162 suzi : StraitShoot said:

quote:
Seriously though, Eric, I don't want to see or read anything..or any evidence.. The bottom line is Sunbelt is just as much a fraidy cat as every other antispyware company out there...


Ok, so let me clarify your statement. You are saying you *want* to form your opinions based on lack of knowledge and emotion? You don't want to know the truth so you won't read the white paper...

As far as Sunbelt being a fraidy cat, do you recall what happened when Hotbar sent a cease and desist to Sunbelt? Hotbar's software was carefully reviewed in detail just like WhenU's was. As a result of that review Hotbar's classification, threat level and recommended action were raised. See here:

»sunbeltblog.blogspot.com/2005/06···elt.html

quote:
After our initial response to Hotbar, our spyware research team spent a more time researching Hotbar's practices. We will be upgrading their threat level and default action in our database.

Hotbar will be re-classified from "Low Risk Adware" to "Adware."

Hotbar's "Threat Level" will be changed from "Low Risk" (5) to "Moderate Risk" (4).

The "Default Action" for Hotbar will be changed from "Ignore" to "Quarantine."

Recommendations

Hotbar's Web Tools software package exhibits a number of troublesome qualities. First, Hotbar's less-than-fully-transparent installation practices make it likely that the software could be installed without users' full, meaningful knowledge of and consent to the software's key terms and functionality. Moreover, although Hotbar's several types of advertising are labeled in some way, this labeling is not as clear and prominent as it ought to be. Finally, though the software can be uninstalled from the "Add/Remove Programs" Control Panel applet, Hotbar uses a randomly named resuscitator program to resist removal by anti-spyware software.
There is a white paper on Hotbar, too.

»www.sunbelt-software.com/ihs/alex/hotnew.pdf

I hardly think Sunbelt could be described as a "fraidy cat". For your information, a number of other anti-spyware vendors no longer target Hotbar at all.

»sunbeltblog.blogspot.com/2005/06···ion.html

quote:
Look who has delisted Hotbar (according to Hotbar): Microsoft. Lavasoft. SpywareDoctor. McAfee. Panda.


Who are the fraidy cats here? Perhaps the people who won't make the effort to learn the truth because it might mean they have to back down on their shot-from-the-hip irrational statements and admit they were wrong.
--
aka Suzi, Spyware Warrior


Microsoft MVP Windows Security 2005

Edit: I started this post before StraitShoot's last post.]]> http://www.dslreports.com/forum/remark,13969162 Sat, 23 Jul 2005 22:24:14 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13969108 eburger68 : StraitShoot:

You wrote:

said by StraitShoot See Profile:

Seriously though, Eric, I don't want to see or read anything..or any evidence..
Oh, that's been apparent for quite some time now, Jim. If you're not willing to give what others' say due consideration, though, it's rather difficult to have a reasonable discussion with you. You can't demand others listen to you while refusing to give what others say fair consideration.

said by StraitShoot See Profile:

I don't care if you think I have anything to contribute to this forum.. How dare you try to censor me? I don't tell you what to say...or sing...
Sorry, Jim, but you're not going to pull this victim act on me. Go back back and read my original post -- nowhere did I suggest you to stop posting, to be quiet, or to muzzle yourself. *Nowhere.*

Quite to contrary I've been *inviting* you over and over to make a productive contribution and to respond to questions and issues with answers and evidence. You simply haven't provided them. Still worse you've refused to listen to what others have to say -- see above.

My offer to you still stands, StraitShoot: give me good reasons and solid evidence to believe that Sunbelt has misanalyzed or misclassified ClockSync, Weathercast, or WhenUSearch, and I'll be entirely inclined to give your reasons and evidence a fair hearing. And, once again, you might start by answering the question I put to you yestserday.

Edit: I see now that you claim to have read the Sunbelt white paper and still disagree with it. Great. That's a good start. Why not point to a specific part and explain in very clear terms just why you disagree with the conclusions.

Eric L. Howes]]> http://www.dslreports.com/forum/remark,13969108 Sat, 23 Jul 2005 22:17:09 EDT Re: Disproving by counter-example http://www.dslreports.com/forum/remark,13969065 jp10558 :
said by Mele20 See Profile:

No,you have it all wrong. There is NO need to do testing like that. Anything that installs ads on my computer is ADWARE and I want it gone immediately. It doesn't matter one whit if it is software supported by ads. It's ADWARE/SPYWARE and I want it GONE. I expect my anti-adware/spyware software to, if running in real time, block my downloading this crap in the first place. But if the antispyware application is not being run in real time then, if somehow I was dumb enough to put this stuff that has ads to support it on my box, I want it gone. I wouldn't trust add/remove programs to remove it all. It's spyware. Anything with ads is spyware. It is so simple. You are making it way too difficult.
This is crazy. Does your program block 99% of websites? Are they spyware because they are ad supported? Would you want them to?

Likewise, there is lots of legitamate software that has and does support itself by ads. Those programs do not spy on you in any way.

That's the difference between this and the programs that silently install and transmit data about what you do back to a central server - and also possibly hijack your browser to display ads, other pages, and the like.

I fail to understand how someone could not see a clear difference here, and also why they would not want different recommendations for the vast difference there is.

Lets take Opera as an example you brought up. To get Opera, you have to specifically download it. On first run, you are informed of the ad requirement to use it free, and given a choice as to two types of ads - clearly spelled out. You can uninstall it by using the built in uninstaller.

Now, when I run an antispyware app, I wouldn't want it picking up Opera, and certainly not automatically removing it. I'd suddenly be berefit of by browser of choice! I would consider any dectection a FP, like detection of VNC by said apps. Those FPs are what make me throw out antispyware aps, and is why I never use MS antispyware or CounterSpy. Because it's suggesting I delete programs I purposefully installed, and which are by no definition I can think of spyware.
--
Opera 8.01(Build 7642); Windows XP Pro SP2;Athlon 64 3400+; 1GB PC3200 DDR; 1M/128k DSL; NOD32(Version 2.5.25); Sygate Pro 5.5(Build 2637);Proxomitron 4.5j Grypen 7/20/05(Opera mod),GPG ID:0x0A1C6EE3]]> http://www.dslreports.com/forum/remark,13969065 Sat, 23 Jul 2005 22:08:52 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13969042 StraitShoot : Okay, I read the whitepaper and the links Eric privided in the beginning, and I disagree with CounterSpy's viewpoint. I still think they are a fraidy cat, 3 out of 4 of WhenU's Adware programs are on "Ignore" status?
I don't know .. I just don't know...

Jim]]> http://www.dslreports.com/forum/remark,13969042 Sat, 23 Jul 2005 22:05:50 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13968965 jp10558 :
said by Mele20 See ProfileI have Adobe Reader 5.0 on this XP Pro box because I won't put up with ads, calling home, any of the crap that is on the later versions. When the time comes that 5.0 is too old to use, I'll look for free software, etc. that I can use as a substitute. If there isn't any then I simply will do without PDF files. As for Opera, yes I recently downloaded it. I almost never use it and when I do (only because it can help me figure out a problem because it has more information about what is going on with the browser than other browsers) I have to constantly click no to the steady stream of adware cookies it wants to set. I allow none of them and if I use Opera anymore I will strip the ads using Proxo.
[/BQUOTE:

First of all, I really think AdWare is very different from Spyware. AdWare inserts ads into the program's (that program you use, not other programs) interface to pay for it.

In fact, for the two programs you list, you have 3 very clear and I think very fair choices. 1)don't use the software.

2)View ads in the software to pay for its development and your use of it.

3)Buy the software outright - no ads.

Especially with software like Opera or Adobe Reader, I don't see why the ads are a bad choice, or how it makes it any sort of threat. They both uninstall cleanly, and don't steal any information from you. And like TV, it makes us able to use important/useful software without paying lots of money for it.
--
Opera 8.01(Build 7642); Windows XP Pro SP2;Athlon 64 3400+; 1GB PC3200 DDR; 1M/128k DSL; NOD32(Version 2.5.25); Sygate Pro 5.5(Build 2637);Proxomitron 4.5j Grypen 7/20/05(Opera mod),GPG ID:0x0A1C6EE3]]> http://www.dslreports.com/forum/remark,13968965 Sat, 23 Jul 2005 21:53:57 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13968936 StraitShoot : Then what the hell are we all arguing about? I will not read Sunbelt's essay.. LOL]]> http://www.dslreports.com/forum/remark,13968936 Sat, 23 Jul 2005 21:47:52 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13968923 fatdcuk : FUD alert:(

Sunbelt has not downgraded WhenU ala M$ recent developements with Claria aka gator.

AS stated by Mele and 2nd by StraitShoot.

Sunbelt has downgraded default action on only 3 of the many WhenU softwares(you know the innocous ones which are not malware).

Please stick to the facts and stop spreading FUD gentlemen.

Sunbelt still considers most of WhenU software to be worthy of detection/action by default other than ignore:)
But if you had read the Sunbelt whitepaper on WhenU you would realise that,RTFA.

On the other hand M$,went default action ignore across the board against claria products

That is unfortunetly fact gentlemen:(]]> http://www.dslreports.com/forum/remark,13968923 Sat, 23 Jul 2005 21:45:26 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13968763 StraitShoot :
said by Mele20 See Profile:


So, it was NOT alright for MSAS to alter the default action for Gator but it IS alright for Sunbelt to do so for WhenU? That doesn't make much sense. Or were you one of those who applauded Microsoft's also? (I don't have time to go wade through that long thread to see if you posted it).
That's exactly what I was trying to say before! Thank you Mele! You hit the nail right on the head! Why should everyone condemn M$? At least they are free! Eric, keep singing that song of yours, man... :D
Seriously though, Eric, I don't want to see or read anything..or any evidence.. The bottom line is Sunbelt is just as much a fraidy cat as every other antispyware company out there... I wonder what will be next? The only thing is Counter Spy had you to post their decision on this forum hoping to "diffuse" any potential backlash.. You said yourself Sunbelt knew their action would not be looked at kindly by some.. Hmmmm? I wonder why?
I don't care if you think I have anything to contribute to this forum.. How dare you try to censor me? I don't tell you what to say...or sing...]]> http://www.dslreports.com/forum/remark,13968763 Sat, 23 Jul 2005 21:17:16 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13968250 B :
said by fatdcuk See Profile:

said by B See Profile:

and that if WhenU's clock (or whatever the heck it is) didn't include any ads at all it wouldn't even be mentioned by Counterspy.

-- B
Do you realise how shredded in court they would get for targeting an innocent* application reguardless of its authors ?
*Software that dose not exibit malware traits etc
Hey, the RESAO2K6 (Roger Ebert Spyware Act of 2006) says differently.

Seriously, I've addressed that concern several times here and am tired of going in circles.

-- B

Edit: All I'd expect is that they say something like "this is from WhenU, who have been know to distribute applications that rate higher on our spyware scale", much as Ebert might write "you know, this movie was directed by George Lucas / Jan de Bont, and you might want to think twice".

--
In a realm outside causality and function]]> http://www.dslreports.com/forum/remark,13968250 Sat, 23 Jul 2005 19:44:57 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13968242 Mele20 : I just shake my head in absolute wonder at what I read here. It is so simple. Any application that auto updates and I can't disable is spyware. Any application that is not under my control is spyware. It is that simple. Acrobat Reader 7 is spyware and I won't have it on my boxes. Windows Media Player since 6.4 is spyware. I ripped out versions 8 and 9 from XP thanks to an uninstall string provided by Microsoft to all of us who hate spyware. I use version 6.4 because I can control it and it is the last version that is totally under the control of the user.

All of those applications Eric listed are spyware.

I thought MSN toolbar would be neat because it provides tabbed browsing for IE and I can't live without tabbed browsing. So, I tried it. As soon as it started popping up some stupid message about a new version, I immediately removed it from my box. I couldn't see a way to stop that notice so I removed it. (I had already had to use ProcessGuard to block it from automatically indexing my desktop which I didn't want and it started doing that the moment it was installed. I was given no opportunity to see if I could uncheck an option. It just immediately started indexing. That is how crapware behaves). Plus, while the toolbar was not autoupdating (horrors) it was bugging me, without my permission, regarding updating. That is just as bad and that makes it spyware/crapware in my book. Microsoft made that toolbar expressly so that I, the user, could not fully control it. I don't want any crapware that I can't control on my box PERIOD even if that crapware makes IE slightly usable instead of a piece of antiquated junk.

You guys can debate these "fine" points that are irrelevant until doomsday. It is very simple. Anything that takes control away from me is spyware/crapware/adware, etc. and I want it off my box. In the case of MSN toolbar, it wouldn't uninstall. That's another hallmark of crapware. I had an awful time getting rid of it.
--
Around 2005 a sudden spark will catalyze a Crisis mood. The very survival of the nation will seem to be at stake.Sometime before 2025, America will pass through a great gate in history. The risk and promise will be very high. The Fourth Turning Wm. Straus]]> http://www.dslreports.com/forum/remark,13968242 Sat, 23 Jul 2005 19:43:25 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13968217 fatdcuk :
said by B See Profile:

and that if WhenU's clock (or whatever the heck it is) didn't include any ads at all it wouldn't even be mentioned by Counterspy.

-- B
Do you realise how shredded in court they would get for targeting an innocent* application reguardless of its authors ?
*Software that dose not exibit malware traits etc

Bonus payday for the scumware lords and their investors.Not good:(

said by Mele20:
If the vendors can't protect us properly because of impending lawsuits then either go offshore or shut your company immediately and then in the ensuing uproar some good may come.


I don't follow your rational thinking here.How on earth dose closing a company benefit its customers or business reputation ?]]> http://www.dslreports.com/forum/remark,13968217 Sat, 23 Jul 2005 19:38:19 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13968181 antiserious :
... here's what I said about the MS/Claria incident > »Re: MS Downgrades Claria Detections - which I thought was a worse transgression since MS was in discussions at the time to acquire Claria (a little blatant self-interest there) ... and a good friend pointed out to me that as long as the detection was still there, users could still choose to remove it ... since then I've come to see that sometimes these alterations are unavoidable, and I didn't advocate that anyone stop using MSAS - I DID, however, recommend that people stop using AdAware when they REMOVED the detection for WhenU rather that modify the recommended action, and I stand by that decision ...

... don't get me wrong, I'm not HAPPY about Counterspy's decision, but based on recent events and some input from others I can understand it ... also, I now have less sympathy for the clueless who blindly click on things, whether getting them INTO their systems or getting them OUT ... it may be a failing on my part, but I never said I was perfect - not even close ...

--
... "Nobody's perfect - well, there was this one guy, but we killed Him" ... Christopher Moore, 'Lamb' ...]]> http://www.dslreports.com/forum/remark,13968181 Sat, 23 Jul 2005 19:32:49 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13968164 SpannerITWks : Hi Mele n All.

Hey guess what, going offshore doesn't actually mean thousands of miles away from home etc.

I read Very recently about a ship anchored a few miles ( 4 i think ) off San Diego LA CA USA. It's staffed full of software writers from all over the world, but mainly places like India, i seem to recollect. They are coding for US companys, on behalf of US companys, as i read it.

As they are outside US juristriction nobody can touch them legally. Howsabout that !!!

Anyone got a boat for sale or hire ? It could be done you know, cos it has been. Nice lifestyle too, and only a short trip to land.

I quite fancy the idea myself, Seriously.

Spanner
--
I Only Know What I Know But I'm Learning all The Time - Stay Safe - Spanner intheWorks /SpannerITWks]]> http://www.dslreports.com/forum/remark,13968164 Sat, 23 Jul 2005 19:29:02 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13968131 Cudni : I'd rather MS closes all the holes so the user has the ultimate choice whether to install a piece of software or not...

has the same chance as MS moving off shore?

Cudni
--
Think locally, @#!? globally!
Help yourself so God can help you]]> http://www.dslreports.com/forum/remark,13968131 Sat, 23 Jul 2005 19:23:26 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13968095 Mele20 :
said by antiserious See Profile:


but I really don't have a problem with altering default actions INSTEAD OF deleting detections altogether ... there's a quantum, fundamental difference between REMOVING detections and changing the recommended action when something is found, and if you can't or won't recognize this you're in for a long stretch of bumpy road ... IMHO ...
So, it was NOT alright for MSAS to alter the default action for Gator but it IS alright for Sunbelt to do so for WhenU? That doesn't make much sense. Or were you one of those who applauded Microsoft's also? (I don't have time to go wade through that long thread to see if you posted it).

All we are doing here is saying that NONE of the vendors should be altering default actions to ward off lawsuits. I think these vendors should all move off shore immediately including Microsoft and then we'd see an outraged yowl and some immediate action from Congress.

If the vendors can't protect us properly because of impending lawsuits then either go offshore or shut your company immediately and then in the ensuing uproar some good may come.
--
Around 2005 a sudden spark will catalyze a Crisis mood. The very survival of the nation will seem to be at stake.Sometime before 2025, America will pass through a great gate in history. The risk and promise will be very high. The Fourth Turning Wm. Straus]]> http://www.dslreports.com/forum/remark,13968095 Sat, 23 Jul 2005 19:15:46 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13968089 B :
Okay, that's a fair position, except that I wonder whether current scales at the major AS vendors flag AT ALL on apparently-benign software from known spyware producers. My guess is that they don't, and that if WhenU's clock (or whatever the heck it is) didn't include any ads at all it wouldn't even be mentioned by Counterspy.

-- B
--
In a realm outside causality and function]]> http://www.dslreports.com/forum/remark,13968089 Sat, 23 Jul 2005 19:14:47 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13968058 antiserious :
... sorry B, I wasn't shooting at you, but your quote was handy for the point I was trying to make ...

... say a crapware vendor attempts to clean up its' act - even just a little, for appearance sake ... some people here want it blackballed forever and ever, and I mostly agree with that sentiment ... BUT, if the antispyware program does it automatically, without accounting for the possibility of reform on the crapware vendor's part, in that scenario it might be considered libelous and actionable ... if, however, the USER simply sees the adjusted detection and recommended action and CHOOSES to click on 'remove' instead of 'ignore', well then that's simply a personal choice - the antispyware vendor can say "hey, we adjusted our database reflecting their new-found religion, we can't help it if nobody else believes them" ... and they're off the hook, legally, and can continue to exist and offer a way for users to detect and remove crapware, as opposed to being court-ordered to DELETE the detection altogether ...

... that's what I was alluding to ... it seems to me some people are asking that the app do ALL the work, but that means they take ALL the risk, and when the lawsuits eventually shut them down or cause detections to be removed, the users will be left without ANY effective tools ... apparently, some people want NO responsibility for their own security, 'just gimme an app to do all the work - and all the thinking for me' ...


--
... "Nobody's perfect - well, there was this one guy, but we killed Him" ... Christopher Moore, 'Lamb' ...]]> http://www.dslreports.com/forum/remark,13968058 Sat, 23 Jul 2005 19:07:30 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13967862 B :
said by antiserious See Profile:

be WITHOUT any product with the potential to actually remove this crapware, just because they were too damn lazy and too damn proud to simply make a decision on their own ... for want of a click or two, everyone will get the shaft ... and this is what so many people are advocating ... it's a trap, a setup, and you're gonna walk right into it ...
Sorry, I don't follow you at all. Surely you're not implying that Sunbelt or anyone else is listening to me and changing their product accordingly? 'Cause they're not.

What "click or two" are you referring to? Who's walking into "a trap, a setup"?

I've said several times that effective spyware removal probably needs to be lawsuit proof, and discussed two fledgling ideas for how to make that happen. A third idea, which I would dub The Roger Ebert Spyware Act of 2006, would explictly allow companies to offer their opinions of software products. Again, I don't see movie reviewers getting sued for saying that Star Wars sucks.

-- B
--
In a realm outside causality and function]]> http://www.dslreports.com/forum/remark,13967862 Sat, 23 Jul 2005 18:39:04 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13967793 antiserious :
said by B See Profile:

In short, Counterspy (and others that merely categorize individual product behavior) may not be the product for people who want to protect themselves from all software from malware producers, in the trust and reputation-based fashion that I have described. But people WANT such a product.

... and such a product will get sued out of existence in weeks, if not days ... MS talked about buying Claria for $500 mill, Murdoch bought Intermix for $580 mill - that's serious money, spelled Big Business and Real Legal Teams ... they'll simply take the spyware definitions so many people want published, alter the product just enough to fall in the gray area (haven't we just seen this done?), and sue the pants off ANY vendor that outright calls them spyware - and likely they'll win ... so all the people that want outright, unqualified detection and removal will then be WITHOUT any product with the potential to actually remove this crapware, just because they were too damn lazy and too damn proud to simply make a decision on their own ... for want of a click or two, everyone will get the shaft ... and this is what so many people are advocating ... it's a trap, a setup, and you're gonna walk right into it ...

... unbelievable ... wait, I take that back ... sadly, it's not ...

--
... "Nobody's perfect - well, there was this one guy, but we killed Him" ... Christopher Moore, 'Lamb' ...]]> http://www.dslreports.com/forum/remark,13967793 Sat, 23 Jul 2005 18:28:42 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13967723 eburger68 : B:

You wrote:

said by B See Profile:

In short, Counterspy (and others that merely categorize individual product behavior) may not be the product for people who want to protect themselves from all software from malware producers, in the trust and reputation-based fashion that I have described.


One correction: I never said that reputation and historical experience could play NO role in anti-spyware detection criteria and decion-making. I said that it can't and shouldn't play the primary, overriding, decisive, or exclusive role. And that's what the "because-it's-from-WhenU" criterion does -- make reputation the sole, overriding criterion irrespective of a specific analysis of the software.

See also my latest response to TeMerc, in which I address several thorny issues with regard to vendors' historical track records.

Eric L. Howes]]> http://www.dslreports.com/forum/remark,13967723 Sat, 23 Jul 2005 18:19:29 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13967657 eburger68 : TeMerc:

Thanks for the post, which raises several important issues, and which I've been tardy in responding to.

You wrote:

said by TeMerc See Profile:

I have been trying to read thru this thread most of the day, being interrupted by one thing or another, so forgive me if I missed this:

Has anyone addressed how long WhenU needs to continue their newly found path towards legitimacy?

Lets face it, after years of deceitful, unethical and at best, in many cases, explanations which run counter to what is provided by users across security forums all over the net, who could possibly trust them after a few installs get tested?
You raise a question that I've discussed on several occasions with other spyware researchers. It's important that we not discount past behavior and find a meaningful way to incorporate it into our analysis of advertising software vendors who appear to be reforming.

There are several considerations here:

1) How reliable and "trustworthy" is the company in making reforms?

180solutions has for years been claiming that it's cleaning up its act, yet every minor "reform" is followed by revelations of still further objectionable, even outrageous behavior, and even the "reforms" themselves look dubious once scrutinized carefully.

Contrast with WhenU, which announced that it was ending ActiveX installs back in November 2004 and has largely delivered in putting an end to them:

»www.whenu.com/press_release_04_11_10.html

Also, WhenU abandoned the use of third-party distribution networks, which have played a key role in facilitating sleazy installs and drive-by-exploit installs:

»www.clickz.com/news/article.php/3460101

180solutions, by contrast, continues to use them, notwithstanding its claim that by purchasing CDT, Inc. it could better control the distribution of its software.

2) How many sleazy installations in the installed base remain? What is to be done with them?

Even after vendors reform, we can expect that there will still be plenty of users out there who somehow acquired the software before those reforms were inplemented. There may even be plenty of victims of stealth-installs out there.

Obviously, anti-spyware companies can't ignore these potentially ill-gotten installations (of which the adware companies may still be making money). But what is to be done about them?

My understanding is that turnover rates with adware installed bases are rather high, for a lot of obvious reasons. We don't have good numbers for specific vendors, though PC Pitstop cites a figure of 70 percent with WhenU ( »www.pcpitstop.com/spycheck/whenu2.asp ), though even that number doesn't tell us, for example, what the churn rate over the period of, say, a month is. I've been told by one adware vendor that the installed base for their software installed during a particular time period degrades asymptotically, and that over a few months the churn rate could approach as high as 90 percent.

Still even that high chrun rate that leaves a potentially significant number of users that date from the pre-reform period.

So what is to be done?

One solution is to require that vendors overhaul their new software versions so that the "reformed" versions are easily distinguishable from the non-reformed versions. Anti-spyware apps could continue detecting and removing the pre-reform versions, while leaving the post-reform versions untouched.

Another proposed solution (originally from Esther Dyson) is that adware vendors push out a notice prompt of some sort to the entire installed base and re-acquire users'/victims' consent. While intriguing, this proposal suffers from a number of problems, not the least of which is the quality and implementation of such a notice -- 180solutions' recent notice effort was plagued, unsurprisingly, by a number of problems, as documented by Ben Edelman:

»www.benedelman.org/news/062805-1.html

Then there's the question of whether adware vendors with a potentially ill-gotten user base ought to be making any attempts at all to preserve that user base. Some have proposed that instead of pushing out a notice prompt via their auto-updater facilities, adware companies undergoing reform ought to simply push out uninstallers to remove their pre-reform software from users' boxes.

3) Should there be a probabation period, as TeMerc has suggested? If so, for how long and based on what factors?

Several knowledgeable folks that I've talked to have proposed such a probabation period, and the Sunbelt white paper on 180solutions that was released in March actually proposed a period of 12 months for 180solutions, conditioned on 180's actually cleaning up its act (which in the judgment of Sunbelt it hadn't).

A year long probabation may be justified in some cases, esp. where there is a long track record of force-installs through third-party distribution networks and the vendor has had demonstrated problems in reining in its distributors. A year would be the time expected to verify that distribution channels have indeed been cleaned up.

In other cases, though, a year might be excessive. WhenU, for example, announced the end of ActiveX installs 8 months ago and has apparently delivered on its promise to bring those to an end.

And what about vendors that have performed only bundled installs? Once we verify that all of its bundled installs have been cleaned up, is a full year of probabation appropriate or necessary?

Then there's the question of monitoring and enforcement. Anti-spyware companies are struggling even now just to keep up with the flood-tide of malware being released on the Net every day. Must they now devote employees and other resources to monitoring efforts to ensure compliance among adware vendors?

Still another issue related to probationary periods is the question of "user awareness." PC Pitstop has done several outstanding surveys on "user awareness" of WhenU and Claria applications, and the low levels of "user awareness" of those apps have indicated serious problems with notice and consent during installation -- see:

»www.pcpitstop.com/gator/Survey.asp
»www.pcpitstop.com/spycheck/whenu.asp
»www.pcpitstop.com/spycheck/whenu2.asp

One potentially useful idea might be to require reforming adware vendors to achieve a certain level of user awareness. But who is to administer the surveys and collect the data to measure "user awareness"? PC Pitstop is but one organization that has done but a few surveys on a very small number of adware apps. Must anti-spyware vendors take on this burden as well?

said by TeMerc See Profile:

33 out of how many? Even those which were lowered\downgraded\adjusted still leave a bad taste in my mouth.
At one time, WhenU had about 59 different "distribution partners." Some "partners" are more active than others, though. For the purposes of Sunbelt's review, I was made privy to proprietary data that indicated that the partner-installations that I tested account for over 99% of their monthly downloads.

said by TeMerc See Profile:

Give them a year of clean installs, show us that they have tracked down every last known affiliate who has some old installs then come back and say 'hey, how we doing?' If they expend half the amount of money doing that, that they raked in doing the unwanted, sneaky unethical installs, that would show some real guts and dedication to turning the company around to be legit.

Maybe then, the security community will give them a more friendly response.
See my comments above on probation periods. Again, you've raised some important issues here, and I certainly don't have the answers to all of them.

Best,

Eric L. Howes]]> http://www.dslreports.com/forum/remark,13967657 Sat, 23 Jul 2005 18:08:43 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13967465 B :
said by Mowergun See Profile:

It looks like I am in the minority amongst the posters in this thread, but I see nothing wrong with the actions of the folks at Sunbelt.
Neither do I! Based on their own practices and standards, they've reclassified some products. That particular ACTION isn't really my concern (and I'm not a customer).

I've been trying to speak more generally about why I'd rather see them (or someone) use a broader brush based on the realities of the current malware landscape. At least for now, there are known bad actors.

Cudni, until recently, I kind of thought he was. I still don't have any clear idea of how much of his brain is committed to Sunbelt per se and how much to the greater good. I'd like to say it doesn't really matter, but it really does.

-- B
--
In a realm outside causality and function]]> http://www.dslreports.com/forum/remark,13967465 Sat, 23 Jul 2005 17:38:34 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13967420 B :
Perfect example now on the front page

»Sanford Wallace: Not so Reformed

You're telling me that iHateSpam (which is I think Sunbelt's product) shouldn't be able to see that an e-mail message is from a Sanford Wallace entity and block based on that reputation?

'Cause that's sure what seems to be being argued re: spyware/adware.

-- B
--
In a realm outside causality and function]]> http://www.dslreports.com/forum/remark,13967420 Sat, 23 Jul 2005 17:31:50 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13967413 Cudni : Reading at these polished answers of yours and well oiled contra arguments i can not help but wish you were consulting for some independent body in charge of regulating Internet advertising. Free of commercial restraints.

Cudni
--
Think locally, @#!? globally!
Help yourself so God can help you]]> http://www.dslreports.com/forum/remark,13967413 Sat, 23 Jul 2005 17:30:50 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13967408 Mowergun : It seems to me that if an anti-malware vendor were to make decisions and classify software on the basis of emotion or personal bias rather than objective criteria, they might be making themselves legally vulnerable.

If you are in it for the long haul then it's wise to behave like an adult instead of like a stubborn impulsive child.

It looks like I am in the minority amongst the posters in this thread, but I see nothing wrong with the actions of the folks at Sunbelt.]]> http://www.dslreports.com/forum/remark,13967408 Sat, 23 Jul 2005 17:30:10 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13967365 Xzar : Well, All I got to say after reading the white pages, and the thread so far is. Thanks for one of the best products and support. You did make the right choice by jugeing the software rating by the software and not by the makers. I'll be sure to recommend your product even more now.

However if the choice is made to change any of the products back to the higher level. I demand that Adobe arcrobat reader, Opera, AIM, Yahoo IM, are all listed as ad-ware. Really every and any program that goes into my task bar, and or displays any kind of pop up or ad should also be classified as spy-ware. that seems what complainers want using there black and white logic.]]> http://www.dslreports.com/forum/remark,13967365 Sat, 23 Jul 2005 17:21:54 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13967349 B : We are all operating from different premises, and that's part of the problem (if there is a problem).

Eric and Counterspy -- trying to both effectively identify adware/spyware criteria and carefully analyze each separate piece of software vis a vis those criteria. (Leaving out the financial incentives for now.)

StraitShoot and Others -- want the best AntiSpyware detection rate they can find, and want to trust their vendor.

Me and Others -- want to keep undesirable software and software from disreputable companies off of computers.

Casual Readers -- may assume that Counterspy has blessed all WhenU software, and/or may not understand why there are ratings classifications instead of simple malware identifications.

Claria is a hugely disreputable company. So is WhenU.

But apparently none of the mainstream antispyware vendors are "allowed" legally to provide guidance to their users based on such simple (albeit TRUE) criteria.

Supporting adware companies, even by using their ad-free "freeware", is similar to supporting RJ Reynolds by buying (or just wearing) a T-Shirt from them, or supporting Spammers by buying their products, or supporting a criminal by giving him a talk show.

You can count on this -- if the "Stoned" virus had made money for its authors, we'd have been having this SAME kind of discussion about viruses 18 years ago, because, apparently, we're suddenly not allowed to hold malicious entities responsible for their actions if those actions are making them money.

There are entities that many of us just don't WANT to support, at all, because they are known to be malicious and untrustworthy. It is completely fair to say "WhenU has performed malciously and knowingly annoying acts against millions of people, and you may not want to install their software". Unless, of course, you're afraid of getting sued for saying it.

It appears, from the current arguments, that if WhenU produces a piece of software (free or paid) that doesn't contain ads at all or exhibit other spyware symptoms, then Counterspy, Eric, and lots of other commercial interests wouldn't even flag it at all! And that's just ridiculous to some of us ignorant consumers. we want nothing to do with WhenU, and don't want to support them in any way.

While I UNDERSTAND AS companies' urge to classify levels of risk, it doesn't well serve the average users, who simply don't want bad stuff on their machines, and don't want to support spammers or phishers or malware (including spyware) producers.

In short, Counterspy (and others that merely categorize individual product behavior) may not be the product for people who want to protect themselves from all software from malware producers, in the trust and reputation-based fashion that I have described. But people WANT such a product. (I still feel personally-defined self-contained filtering has got to be an answer.)

Ah well, rambling again. :(

-- B
--
In a realm outside causality and function]]> http://www.dslreports.com/forum/remark,13967349 Sat, 23 Jul 2005 17:19:46 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13967293 eburger68 : SnowyOne:

You wrote:

said by SnowyOne See Profile:

Eric,
This disclosure is starting to appear more as a disclosure by you rather than a "Sunbelt" disclosure.
In Sunbelt's newsletter of 07-22-05 (today as far as I can tell) I can only find a scant reference to the 'adjustment' that on it's own hardly qualifies as a disclosure of any sort.
I am only posting a portion of that newsletter even though it's requested that the newsletter be copied in it's entirety. I will post the entire contents if requested by Sunbelt.

"You might ask yourself: "Is Sunbelt also downgrading their threat
definitions to "ignore" for Claria and other adware like Microsoft
is doing in their Windows Antispyware?". The answer is NO, we ignore
Microsoft's threat scoring values. We only use their threat data
(the file names, and locations where malware is found, etc.). We
have not downgraded our Claria or other adware recommendations and
do not plan to, unless they shape up, get straight and behave like
decent Internet citizens, like WhenU recently did."

emphasis is mine, but even emphasised, I wouldn't call this disclosure by any stretch. This is the official newsletter sent to all CounterSpy" subscribers. Selectively full disclosing is not full disclosure.
As I understand it, the newsletters that came out yesterday were the "W2K News" and "WinXP Newsletter" newsletters, which are general Sunbelt newsletters that cover general topics of interest to subscribers, many of whom are enterprise customers. They are not CounterSpy-exclusive newsletters and is not presently designed to serve as a venue for breaking news about CounterSpy. There is a separate CounterSpy newsletter, but I'm not familiar with its distribution schedule.

That said, your point is a good one, and I have passed along your post to the folks at Sunbelt, who may consider adding announcements such as these to their several newsletters.

Also, as I noted in an earlier post, Sunbelt does provide a number of sources for users to get information about developments with CounterSpy:

1) CounterSpy forum (CastleCops)
»castlecops.com/f164-CounterSpy.html

2) Sunbeltblog (Alex Eckelberry)
»sunbeltblog.blogspot.com/

3) Sunbelt Research Center
»research.sunbelt-software.com/

4) Sunbelt Definitions Update Summary
»research.sunbelt-software.com/de···ions.cfm

5) Sunbelt Threat Library
»research.sunbelt-software.com/Br···rary.cfm

Edit: I was in error. One of the newsletters that went out Friday was indeed the "CounterSpy News" newsletter, not just the "Win2k News" and "WinXP News" newsletters. As I said, I have passed along the recommendation to add these kinds of announcements to Sunbelt's newsletters.

Best,

Eric L. Howes]]> http://www.dslreports.com/forum/remark,13967293 Sat, 23 Jul 2005 17:11:10 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13967152 eburger68 : StraitShoot:

said by StraitShoot See Profile:

That's okay Eric... you can sing any song you want, but i'm voting with my pocket and my downloads who I'm using..
Nice line, lousy logic. There are serious questions on the table waiting for those who are astute enough to step up to the plate and answer them with sound reasons and established evidence. Good reasons and solid evidence aren't a "game," StraitShoot, and those who provide them are not singing a "song." They're giving YOU the opportunity to offer serious, constructive input into a decision-making process.

If you're not able or willing to contribute productively, fine. But please don't pretend or imply that I, Sunbelt, or any of the others here who have defended Sunbelt's decisions haven't offered plenty of sound reasons and evidence to justify those decisions -- we have.

And please don't imply that we've stubbornly ignored you. We've also given you plenty of opportunity to offer us good reasons to think we're wrong. You haven't (in fact, you still haven't answered my question from several pages back).

Eric L. Howes]]> http://www.dslreports.com/forum/remark,13967152 Sat, 23 Jul 2005 16:43:36 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13967150 fatdcuk : For all the FUDmeisters on this discussion

Happy reading( A Bud moment,This one's for you;))

»www.vitalsecurity.org/2005/07/ra···ria.html]]> http://www.dslreports.com/forum/remark,13967150 Sat, 23 Jul 2005 16:43:16 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13967047 StraitShoot : That's okay Eric... you can sing any song you want, but i'm voting with my pocket and my downloads who I'm using.. If we start letting the antispyware companies get away with this kind of action, I am afraid that will give the wrong message to the adware companies, to congress, to who ever ... Also, the simple act of having to scroll from "ignore" to "delete" only shows user tolerance to a practice like that... So, yeah, if the program was free, like adaware or M$ antispyware, I guess I could scroll down..NOT IF I HAD TO PAY FOR IT! (Thank God I didn't.....!)]]> http://www.dslreports.com/forum/remark,13967047 Sat, 23 Jul 2005 16:26:02 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13967029 eburger68 : Davebo_:

You wrote:

said by 33591094 See Profile:

Of course you can't apply the same rules to any software that has an auto-update. However, let's use some common sense please. Some of the software in your list has a "history" of shady practises - others don't. And until a company exhibits such behaviour it should be labelled safe. Has ZoneLabs ever done anything shady (privacy-wise) to warrant attention of anti-spyware software? (Making a crappy firewall doesn't count... :p )
See my response above to Jet_Set, which addresses most of the points you make here.

The important thing to recognize is that anti-spyware vendors cannot make targeting decisions primarily or exclusively on the basis of "reputation" or "oast history." As I noted earlier, there is a role for those factors, but it is a limited one, esp. when we have direct knowledge of the products themselves.

As for the case of WhenU specifically, there is no history of WhenU abusing the auto-updater included in its programs (though if you have evidence to the contrary, I would be most anxious to see it). The functionality in and of itself is worrisome, which is why it's included in the Sunbelt Listing Criteria, but general reputation can't override empirical experience with WhenU's autoupdater so as to suggest a more serious threat classification based solely on this particular program function.

said by 33591094 See Profile:

Hell - why didn't you add XP's Automatic Updates service to your list. You never know... The point I was making is that you're comparing a legit company that has the ability to do something shady, to a shady company that has the ability to do something shady. See the difference?
You persist in thinking that your own preferences and distinctions are perfectly and universally obvious to everyone. They're not, and if you'd be so kind as to peruse the other posts in this thread (esp. those regarding the "legitimacy" of various kinds of programs) you would see this.

And by the way, just so we're clear, nowhere have I claimed that I regard WhenU (generally, as a company) and ZoneLabs (generally, as a company) to be equally trustworthy or to have the same track record of performance. Here we're talking about the proper analysis of one particular program function and what weight ought to be given general reputation within that analysis.

Eric L. Howes]]> http://www.dslreports.com/forum/remark,13967029 Sat, 23 Jul 2005 16:22:34 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13966893 eburger68 : Jet_Set:

You wrote:

said by Jet_Set:

eric, its tough, because you are making it tough, at least in thecase of WhenU.

when the overwhelming majority of people, experts and novices alike , are asking you to reconsider your current classification of WhenU, you still choose to stick by what you think is right.

we, the potential consumers/buyers of your ANTI-spyware product, dont want you to go down this path.
First, would you please get your facts straight: Sunbelt's decision was NOT a general reclassification of WhenU. Sunbelt's decision involved a reclassification of THREE WhenU programs that were considered comparatively innocuous. The main WhenU adware program, Save!/SaveNow, has NOT been reclassified and, as Alex Eckelberry indicated very early on this thread, will not be reclassified.

Second, contrary to what you state, there is no overwhelming majority of people here (including experts) who have asked Sunbelt to reconsider its classifications. Plenty have, but if you go back and look at the posts here, you'll find plenty of others who are comfortable with the decision. Paperghost, for example, would certainly be considered an expert -- in fact, he ought to be regarded as one of the top anti-spyware researchers currently at work. Take a look at Paperghost's posts here.

Third, I have been asking the folks who have responded here to provide good reasons and solid evidence to think that the three programs that were reclassified merit a classification higher than "Low risk adware" or "Adware bundler" with a default action of "Ignore."

Not a single person has been able to come up with convincing reasons or solid evidence (with the possible exception of Mers2, but even he had no specific information on the three programs). All anyone in this thread has been able to come up with is "because it's WhenU," which even the first person who first offered this reason admitted was based on irrational prejudice.

Example: I asked earlier that if WhenUSearch were to be left on a user's hard drive, what would happen? What ills would befall the user? That's a simple straightforward question -- a basic one, really -- that the "experts" here ought to be able to answer. But no one was able (or willing) to do it.

Keith2468 went so far as to outline a detailed procedure for testing the products in question here. Who among you critics has taken up Keith's challenge? None that I know of.

I'm sorry, Jet_Set, but simply repeating the same demand ad nauseam without providing good reasons or solid evidence to back it up isn't going to be convincing in this situation.

said by Jet_Set:

and drawing comparisons between Zonealarm and AAR 7.0 with WhenU dosent help your case one bit.
Thanks for proving my point, which you obviously missed. The entire point I was making was that general comparisons between products based solely on reputation or even hear-say are useless as evaluations of products -- at least when we're in the business of debating anti-spyware detections -- because different users have different preferences and different opinions about what's "legit" and what's not "legit." In your text above, you group three programs into two groups:

1) ZoneAlarm, AAR 7.0 (legit)
2) WhenU (not legit)

You cannot assume that your own personal preferences are easily universalized. People love to believe that their own personal preferences are the "norm" or are even universally shared. They are not. That users have differing ways of grouping certain programs ought to be well evident by now just by review of the posts in this thread.

Some users might group the programs/vendors this way, now that Adobe has added advertising and an unwanted toolbar to AAR 7.0:

1) ZoneAlarm (legit)
2) WhenU, AAR 7.0 (not legit)

Take a look at the discussions in security forums like this one that erupt every time ZoneLabs makes it impossible for users to disable auto-updates in ZA Free. Some of those users would group the programs this way:

1) none (legit)
2) ZoneAlarm, WhenU, AAR 7.0 (not legit)

The ultimate point is that anti-spyware vendors can't make targeting decisions on the basis of reputation alone or even primarily on the basis of reputation. That's arbitrary, capricious, and not soundly grounded in an honest evaluation of the products themselves, their functionality, and behavior.

Let me reiterate again: I am happy to listen to soundly reasoned arguments based on good reasons and hard evidence that the three products in question (WhenUSearch, Weathercast, ClockSync) merit a classification higher than "Low risk adware" or "Adware bundler" with a default action of "Ignore." If you can come up with good evidence that we have overlooked something -- perhaps even, god forbid, an ongoing rash of stealth-installs of these products through security holes -- than I would be most happy to hear it. I haven't heard it yet, though.

When Sunbelt performs these kinds of software reviews, it strives to base them on the best knowledge and information available about the products under review. Mantras of "Because-it's-WhenU!" simply don't constitute a substantive contribution to the specific analysis of the products.

Eric L. Howes]]> http://www.dslreports.com/forum/remark,13966893 Sat, 23 Jul 2005 15:59:54 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13966628 Diazruanova :
said by antiserious See Profile:



... frankly, I'm surprised at the reactions of some people in this thread - and not at all surprised by others ... but that's life, I suppose ...

What is surprising to me is that some of the people here that are supposedly open minded, intelligent and knowledgeable about web security and that besides, they have read the White Paper and all of Eric,s replies, still, after five pages, do not get it and insist over and over on the same stubborn and one track mind arguing, but I guess that it is because of this, that we as human race are doomed ! We have made the world the mess it is right now because of disputes and sterile arguing that derives in wars and fights.]]> http://www.dslreports.com/forum/remark,13966628 Sat, 23 Jul 2005 15:17:51 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13966510 antiserious :
... some people in this thread are getting a bit absurd - AdAware dropped detections, but MSAS and Counterspy STILL detect these things, they've simply changed the default choice ... how hard is it to change it to YOUR preference ? ... it's a simple matter of a click or two to remove things according to your own personal bias, and it probably covers their arses legally ... if you're looking for some magic app with ONE SETTING that will protect the Great Unwashed Masses AND the people with an awareness of what's actually going on, you're not gonna find it anymore - and I don't think that's the Apocalyptic Tragedy that some of you do ... I see it as Evolution In Action ... you simply cannot operate a computer safely AND without a clue any longer ... maybe that's not how it SHOULD be, but that's how it IS ... you don't need to be a fanatic, but some basic knowledge is required - as it should be ... I'd be heavily in favor of linking detections with more detailed explanations, and perhaps a 'Full-Paranoia' setting option (delete any and everything that might possibly be questionable in some parallel Universe), but I really don't have a problem with altering default actions INSTEAD OF deleting detections altogether ... there's a quantum, fundamental difference between REMOVING detections and changing the recommended action when something is found, and if you can't or won't recognize this you're in for a long stretch of bumpy road ... IMHO ...

... frankly, I'm surprised at the reactions of some people in this thread - and not at all surprised by others ... but that's life, I suppose ...

--
... "Nobody's perfect - well, there was this one guy, but we killed Him" ... Christopher Moore, 'Lamb' ...]]> http://www.dslreports.com/forum/remark,13966510 Sat, 23 Jul 2005 14:58:26 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13966036 Bobby_Peru :
said by Davebo_:

... The point I was making is that you're comparing a legit company that has the ability to do something shady, to a shady company that has the ability to do something shady. See the difference?
Thank-you for re-iterating this. I would expand it to follow the principles from known crapware entities in a Notice of "Offender Status", yep, a big red Scarlet Letter branded right on.

Legal threats? Sadly, always. Retain aggressive, top-notch council. I may be totally wrong on this, but as I and others have already mentioned, what about anti-crapware vendors using express, clear, EULA's designed to attempt protection from the crapmeisters?

The intensive, time-consuming efforts to deeply test and analyze crapware are all very welcome and much appreciated, and can serve quite a few legitimate purposes, including providing users with an accurate assessment of just what the crapware appeared to do at the time it was tested, and what that could mean to the user, but to me, one of those legitimate purposes should never have anything to do with _pleasing_ the crapmeisters in the least.

This seems part of the divergence here.

So how to handle the "novice user? A well designed "Wizard" could walk users through an initial configuration to get them to select a few basic risk and benefit questions dealing with crapware, with explanations of the risks/benefits, and handling rules for notice and clean-up. Users machines could be scanned for popular software presently proved/thought to be non-offending, and offending in the various ways known possible, and alert users to any "Exceptions" that may be required for their particular set-up.

While the above Wizard concept is simplifying this (as Eric and others have pointed out the myriad of software possibly impacted) this certainly seems to be technically, economically and novice user implementable. The aggressive legal council can weigh-in on this, along the designers who must accommodate the novice user.

No matter what we do, we need to stick together on this, though! So, just in case it got lost, another big thank-you to Eric, Suzi, CJ, and everyone else involved.
--
How to Secure (and Keep Secure) My (New) Computer(s): A Layered Approach]]> http://www.dslreports.com/forum/remark,13966036 Sat, 23 Jul 2005 13:37:54 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13965981 SpannerITWks : I tried to - check the boxes - but it didn't work ! Maybe it's cos of my security settings lol .....

I have S+D, Adaware, and have run SS etc too. They Never find anything, but that's cos i've got my IE + PC locked down. I run them maybe once a week just outa curiosity.

On EVERBODY elses PC's i look at it's a completely different story. Along with Viruses + Trojans etc. So for us it might not be a problem.

The trouble is though, the peeps with All the nasties are the ones least likely to know about them, and/or Really know what to do, and how to stop it happening time n time again.

So once, well not once cos they keep forgetting and some just don't/can't get it, they are shown how to use these Apps then they can start taking care of business. But stuff still gets thru, and Yes it's their fault, but they are the ones who Really need protecting from the crapware merchants. And that means probably 99% of computer users !

So the battle goes on n on, and i don't see it getting much better any day soon.

Keep up the good work Eric + Co.

Spanner
--
I Only Know What I Know But I'm Learning all The Time - Stay Safe - Spanner intheWorks /SpannerITWks]]> http://www.dslreports.com/forum/remark,13965981 Sat, 23 Jul 2005 13:27:34 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13965868 fatdcuk : More reality check for the protaganists.

The antispyware industry is on a slippery slope towards accepting legitimate adware programmes whether we like it or not.The clock is ticking on the innevitable:(

As straitshooter so wonderfully puts it in the above post.

Sorry folks bad news a comin' to town.Webroot/pest patrol will be following suit very soon if not they will be royally screwed in the courts by the adware companies.

Has no one seen the pattern emerging ?

:(]]> http://www.dslreports.com/forum/remark,13965868 Sat, 23 Jul 2005 13:11:05 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13965800 StraitShoot : I honestly don't know who or what to believe in anymore.. It seems every time I let my guard down, I wind up being disapointed... What can I say? Eric, this wouldn't be a 6 page thread for nothing... I think many people have made up their mind...

Spyware installations I have uninstalled... due to misttrust..

1. McAfee Antispyare.. Terrible detection (Paid for it)
2. Spybot S&D... Weak detection ...
3. Adaware... Mistrust it now...
4. MSAntispyware- Mistrusted it but now may flip back to it because it's free...
5. CounterSpy - Mistrust it now.. Thank God I only trialed it....

I may just as well stay with Norton AV with Antispyware... LOL
I wonder how PestPatrol and Spysweeper are.. ]]> http://www.dslreports.com/forum/remark,13965800 Sat, 23 Jul 2005 12:59:28 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13965726 anon : 
But it does mean that the job of making distinctions becomes much tougher -- at least 
for anti-spyware vendors ...

eric, its tough, because you are making it tough, at least in thecase of WhenU.
when the overwhelming majority of people, experts and novices alike , are asking you to reconsider your current classification of WhenU, you still choose to stick by what you think is right.
we, the potential consumers/buyers of your ANTI-spyware product, dont want you to go down this path.

and drawing comparisons between Zonealarm and AAR 7.0 with WhenU dosent help your case one bit.
]]> http://www.dslreports.com/forum/remark,13965726 Sat, 23 Jul 2005 12:48:37 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13965638 33591094 : Of course you can't apply the same rules to any software that has an auto-update. However, let's use some common sense please. Some of the software in your list has a "history" of shady practises - others don't. And until a company exhibits such behaviour it should be labelled safe. Has ZoneLabs ever done anything shady (privacy-wise) to warrant attention of anti-spyware software? (Making a crappy firewall doesn't count... :p )

Hell - why didn't you add XP's Automatic Updates service to your list. You never know... The point I was making is that you're comparing a legit company that has the ability to do something shady, to a shady company that has the ability to do something shady. See the difference?]]> http://www.dslreports.com/forum/remark,13965638 Sat, 23 Jul 2005 12:31:09 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13965532 fatdcuk : No I think he was trying to point out that auto-update is a feature amongst some software.
My AV has it(Avast 4.6) too:)

Dose that automatically make these two examples worthy of detection/removal by a bot killer since the core software can update automatically ?]]> http://www.dslreports.com/forum/remark,13965532 Sat, 23 Jul 2005 12:14:12 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13965522 eburger68 : Davebo:

You wrote:

said by 33591094 See Profile:

So you're comparing a creator of useful software to a known adware vendor??? This makes no sense at all. If ZoneLabs was a known spy/ad/malware vendor then of course your point would be valid. But they are not, are they? WhenU is, and who knows what they'll use that updater for down the road...
As a general rule, you can't decide in advance that some vendors are "OK" and others aren't and then start applying different rules to them -- that's arbitrary and capricious in the extreme.

Let's say we did start grouping vendors and applying different rules to them. You obviously think ZoneLabs ought to be in the "Legit" category and allowed to use such an auto-updater while WhenU shouldn't.

What if ZL starts using that auto-updater to drop a little ad program on your computer that pitches other ZL products in pop-ups on startup. Is ZL still on the good side of the fence?

How about if ZL drops the same ad program, only the ad program starts serving pop-ups pitching utilities from "trusted partners" of ZL. Is ZL then still on the good side of the fence?

How about if ZL drops a new module that starts displaying third-party advertising in a banner window within the ZA GUI to support the "free" use of ZA Free. Is ZL still on the good side of the fence?

Now let's expand our little vendor vetting procedure to others. Which of the following should be allowed to use an autoupdater with impunity and not be targeted for default removal by anti-spyware apps:

[ ] Yahoo Toolbar
[ ] MSN Toolbar
[ ] Accoona Toolbar
[ ] Hotbar
[ ] WhenUSearch
[ ] ChildSafeNetwork Toolbar
[ ] Adobe Acrobat Reader 7.0
[ ] Download Accelerator Plus
[ ] Real Player
[ ] Windows Media Player
[ ] AOL Instant Messenger
[ ] Weatherbug
(Check all that apply)

Now that you've checked all the boxes that you think are applicable, are you 100 percent sure that every single one of your decisions comports in every case with every other user of an anti-spyware app and that other users won't start screaming bloody murder once those anti-spyware apps start targeting the apps you personally think ought to be targeted for using an auto-updater that allows the user no control? Are you really, really sure?

The point that I've been attempting to make for some time now is that the software that many folks regard as "spyware" shares a lot of functionality with software considered "legitimate." That doesn't mean we can't distinguish between the two -- we must.

But it does mean that the job of making distinctions becomes much tougher -- at least for anti-spyware vendors who have to accommodate users with competing, incompatible expectations for what ought to be targeted and what shouldn't, as I discussed in an earlier post.

Eric L. Howes]]> http://www.dslreports.com/forum/remark,13965522 Sat, 23 Jul 2005 12:12:20 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13965349 33591094 :
said by eburger68 See Profile:

Sheiny:

Given as much, the auto-update mechanism is enough to justify a listing of at least "Low risk," but not enough to justify a "Moderate risk." If you think otherwise, I'll be interested to hear your thoughts the next time ZoneLabs thinks the ZA Free auto-update mechanism ought not be turned off by users.

So you're comparing a creator of useful software to a known adware vendor??? This makes no sense at all. If ZoneLabs was a known spy/ad/malware vendor then of course your point would be valid. But they are not, are they? WhenU is, and who knows what they'll use that updater for down the road...

That said, thanks for all your work Eric et al. I appreciate your coming here to let us know about this, because as others have said, this is more YOU letting us know what's up, rather than a disclosure by Sunbelt (that blog entry can't be classed as disclosure! lol)]]> http://www.dslreports.com/forum/remark,13965349 Sat, 23 Jul 2005 11:42:09 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13964914 Mele20 : You wouldn't? I sure would! I think that is an excellent suggestion for CS. Move offshore. Nithing of consequence is in this nation now anyway so if that would stop these assholes from trying to sue CS and thus forcing CS to water down their product then I say more power to them..move offshore! That would be a smart thing to do. As long as the federal government continues to bite its nails instead of going after these buggars, I say drastic measures are needed. Such action just might be the cattle prod necessary to get our legislators to do something worthwhile about spyware.
--
Around 2005 a sudden spark will catalyze a Crisis mood. The very survival of the nation will seem to be at stake.Sometime before 2025, America will pass through a great gate in history. The risk and promise will be very high. The Fourth Turning Wm. Straus]]> http://www.dslreports.com/forum/remark,13964914 Sat, 23 Jul 2005 10:21:34 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13964660 Marilla :
said by SpannerITWks See Profile:

Well it'd be interesting to see what the scumware etc merchants could do if one or more of the removal Apps peeps went offshore etc, just like some of the scammers do !!

Spanner
I sure as heck won't buy -anything- from a company that moves 'offshore' to protect itself from legal remedies, no matter what they are selling. Nor would I even use a FREE product from a company that did such a thing.
--
I am the sole arbiter of what is important enough to spend my time on - not anyone else here, or anywhere else. You take care of yourself, and leave me to me, got it?]]> http://www.dslreports.com/forum/remark,13964660 Sat, 23 Jul 2005 09:19:12 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13964408 SpannerITWks : Well it'd be interesting to see what the scumware etc merchants could do if one or more of the removal Apps peeps went offshore etc, just like some of the scammers do !!

Spanner
--
I Only Know What I Know But I'm Learning all The Time - Stay Safe - Spanner intheWorks /SpannerITWks]]> http://www.dslreports.com/forum/remark,13964408 Sat, 23 Jul 2005 07:41:37 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13964377 fatdcuk : With the amount of VC pouring into Adware its not a case of "what if" its a case of "when they".

Two schools of ideology appear now.
1)Do you run scared of legal action by dropping detections or
2)Make sure your as prepped as possible to win a legal battle by demonstrating a solid case for classification/detection and possible removal of a software.]]> http://www.dslreports.com/forum/remark,13964377 Sat, 23 Jul 2005 07:21:27 EDT Re: Disproving by counter-example http://www.dslreports.com/forum/remark,13964367 Mele20 :
said by jimkyle See Profile:

said by Mele20 See Profile:

Anything with ads is spyware. It is so simple. You are making it way too difficult.
I trust, then, that you refuse to use Google, since its search pages always have some ads...
I don't see ads at Google. Although I did see a couple of sponsored links at the top of a search result (not those on the right side...I NEVER see any of those) for CounterSpy. I just saw two day before yesterday and I was pissed. I went right over to the Proxo forums at Castlecops and complained. I have been having problems with Proxo recently and those ads ordinarly are not there. I still see none in the usual right column on Google unless I bypass Proxo and make a direct connection to Google. But I don't even want to see the two sponsored links at the top on a CounterSpy search. Plus, I saw a book link! That was really stupid.

The reason I was seeing the ads evidently has to do with my turning off the special filters for Google. I don't like those although a lot of Proxo users do. Evidently somehow the sponsored links at top are connected to the style sheet and since I turned off the three style sheets we Grypen Proxo users can choose from that's why those links were there. If I used one of those style sheets those would be GONE.

I VERY RARELY see ANY ads anywhere on the internet. I haven't seen any ads in many years. I got Ad/subtract when it was in beta years ago and when it finally went to paid only (no more free version) I moved to its parent the Proxomitron which blocks ads and does a zillion other things too to rewrite the web the way users want it to be. If I do see an ad, then a filter is written for it. I don't see that stupid, Fx ad here and I love Fx but this site shouldn't advertise it. I did see the ad until I got someone to write a filter for it.

Although what ads at Google have to do with Adware I don't know. When I said "anything with ads is spyware" I was speaking about any product that has ads and is offered to users bundled with ads is spyware. Google is a search engine . You don't download it onto your box. It is not an application.
--
Around 2005 a sudden spark will catalyze a Crisis mood. The very survival of the nation will seem to be at stake.Sometime before 2025, America will pass through a great gate in history. The risk and promise will be very high. The Fourth Turning Wm. Straus]]> http://www.dslreports.com/forum/remark,13964367 Sat, 23 Jul 2005 07:17:05 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13964324 Martinus :
said by fatdcuk See Profile:

When did you last hear of a virus writer sueing an AV vendor for targeting/removing his /her creation ?

Reality check needed.
Check!

So this is definitely the parameter used in "detection adjustments". The "what if they sue" thing.
--
From the GSV "Ethics Gradient"]]> http://www.dslreports.com/forum/remark,13964324 Sat, 23 Jul 2005 06:54:12 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13964263 fatdcuk : Time to dispel FUD being created by certain postee's on this discussion:(

Sunbelt Counterspy is still detecting all WhenU products,default action is based on the individual software characteristic's and not set to ignore by default across all WhenU products!

A Duck is still a Duck:D

Read the PDF on Sunbelt review of WhenU softwares.

This is reality:(

If a software is'nt spyware/adware you cannot label it as such reguardless of the Authors past malpractices&other software.

This will result in an expensive vist to the law courts and almost certainly damages being awarded to the software authors(more profits for the puke:().

Sunbelt still detect all branded components and still point out the dubious ones.They no longer target the less dubious softwares for removal.

This is more defendable in a court of law,which is where the malware battle is heading:(

For all the postee's that keep trying to link the treatment of virus's to the treatment of adware/spyware etc

One question-

When did you last hear of a virus writer sueing an AV vendor for targeting/removing his /her creation ?

Reality check needed.]]> http://www.dslreports.com/forum/remark,13964263 Sat, 23 Jul 2005 06:18:08 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13963973 hpguru :
said by DakAD:

My one sujjestion -- and I appologise if this is already the case, but I havent seen it refered to in this thread -- is that sunbelt should possibly give more information to the user as to what circumstances may warrant disreguarding sunbelts reccomendation of 'ignoor'.
A better move I think would be to not offer any recommendation at all. Show the user what was detected by the ad/spyware scan and ask the user what course of action should be taken out of set of options with no default option pre-selected. The AS app would still detect the ad/spyware and still offer a real-world risk assessment but it would place the decision to remove, quarantine or ignore squarely in the hands of the end-user where it belongs. It would also save the AS vendor from the bad PR that can result from offering controversial recommendations. I also think it would result in more ad and spyware being removed than would result from a mere ignore recommendation so the ad/spyware PUSHERS will no doubt disapprove, but they can ki... - well never mind. :D

A link to more info as "DakAD" mentioned is a good idea too so long as it is based in the real world and includes a short summary of the companys history and reputation.

Of course there will always be users who need hand-holding every step of the way who may need a recommendation in order to make a decision. For them you could offer a "recommendation wizard" which asks a few short questions and offers a recommendation based upon the answers. Questions like

"Did you know this software was on your computer?"
"Did you or a family member install it?"
"Have you tried to uninstall it and failed?"
"Does it meet a particular computing need?"
"Does its presence cause any software conflicts?"

and so on.
--
Get hpHOSTS! Member ASAP
Downing St. memo: BUSH LIED, YOUR SON DIED.
REMEMBER 1776! NEVER FORGET!]]> http://www.dslreports.com/forum/remark,13963973 Sat, 23 Jul 2005 03:05:34 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13963875 TeMerc : I have been trying to read thru this thread most of the day, being interrupted by one thing or another, so forgive me if I missed this:

Has anyone addressed how long WhenU needs to continue their newly found path towards legitimacy?

Lets face it, after years of deceitful, unethical and at best, in many cases, explanations which run counter to what is provided by users across security forums all over the net, who could possibly trust them after a few installs get tested?

33 out of how many? Even those which were lowered\downgraded\adjusted still leave a bad taste in my mouth.

I'm with many here in that if it says its from WhenU, I want it off my machine, and suggest to any users I help in security forums to do the same, regardless of whether its doing anything. They just cannot be trusted as far as I'm concerned.

Give them a year of clean installs, show us that they have tracked down every last known affiliate who has some old installs then come back and say 'hey, how we doing?' If they expend half the amount of money doing that, that they raked in doing the unwanted, sneaky unethical installs, that would show some real guts and dedication to turning the company around to be legit.

Maybe then, the security community will give them a more friendly response.

I do however appreciate that Sunbelt breaks the news as to what's being done with their database, this gives everyone a chance to see what they want to do with regards to the related bit of ad\mal\spy\grey\x(fill your own)-ware.

As usual, great work by the likes of Eric and Suzi.]]> http://www.dslreports.com/forum/remark,13963875 Sat, 23 Jul 2005 02:34:36 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13963780 eburger68 : DakAD:

Thanks for your post, which is not only most welcome but quite useful. In fact, you've essentially started to answer the questions that I raised in the post I put up just after yours.

Don't have time to address all your ideas quite yet, but they are intriguing and worth consideration.

Best regards,

Eric L. Howes]]> http://www.dslreports.com/forum/remark,13963780 Sat, 23 Jul 2005 02:03:50 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13963768 eburger68 : Aryan66:

You wrote:

said by Shriyash See Profile:

you asked if i think Adobe Reader should be classified as "spyware/Adware".....{yes there is a fine line between the two, but you cant expect millions around the world to really care , adware-companies = spyware-companiers = MUST DELETE AT ANY COST.}

my answer is: of course not!
why : because its my pdf file reader, i like it, and Adobe Acrobat has never been insuinuated as being a spyware-company, or a adware-company, by anyone, ever!

as for WhenU?
yes, delete absolutely anything {bundlers, what-have-you} from them
.
why? Because, its WhenU.

and that sums it up, for me and millions of people around the world, whose occupation isint computer-forensics related.

{people ARE emotional creatures, and anything to do with "adware'spyware" does bring up their defenses. its really a Zero_Tolerence policy, without a doubt.}
There are several problems here:

1) You, like so many, people are getting hung up on labels and names ("spyware") instead of looking at specific practices and functionality, which is the critical consideration in all cases. To some extent, that's understandable, esp. if haven't investigated applications in detail. It's dead end, though, for anti-spyware vendors. Let me explain.

When I ask about an application like Adobe Acrobat Reader 7.0, I want to know about your specific reaction to the behavior of the program, not your perception of what other people are saying about it or how they're labeling it. To do otherwise would leave me and Sunbelt chasing our own tails.

How do applications acquire the reputation of spyware or adware? By hosing people's computers, obviously, but also because anti-spyware apps happen to target and label them as such.

If a significant number of anti-spyware apps were to suddenly start targeting AAR 7.0, would you change your opinion? (Hint: the answer ought to be "no," based on your own independent experience with the application.)

So what should Sunbelt do? Not target the application because users haven't attached the label "spyware" to it, even knowing that were anti-spyware vendors to target it, users might start regarding it as "spyware"?

Do you see the problem with labels and why Sunbelt relies on detailed analyses of specific practices and functionality and not reputation-driven labels?

Vague labels have only a few real uses:

* To facilitate informal discussion and news reporting;

* To give advertising software vendors something to complain about.

Beyond that, labels are useless wastes of time.

2) Your reaction to my question does highlight a point I was making earlier about users and their differing reactions to certain types of software. You clearly think AAR 7.0 ought not be classified as "adware" or targeted by anti-spyware apps. I also take it (correct me if I'm wrong) that you would be a bit disconcerted if anti-spyware apps suddenly started targeting it for removal. Other users, I can assure you, wouldn't be nearly so charitable -- they'd freak out and cause all kinds of trouble for both Adobe as well as the anti-spyware vendors.

Yet here in this very thread we've had other users suggest that detection criteria ought to be black-and-white, inflexible, and unforgiving. More to the point, some users have even suggested, as Mele20 did earlier, that all apps that serve ads ought to be targeted with no exceptions:

said by Mele20:
The distinction that weatherbug, or something like it, "only" has ads contained in weatherbug and thus is not hurtful is spurious. They are ads! Therefore, weatherbug is adware and should be removed by default if I run CS. Anything that puts ANY sort of ads on my box, calls home in any fashion, sets permanent cookies on my box, is adware and I want it removed. I'm very unlikely to ever get adware on this box but if I did, I want it treated just like a virus is treated...no if, ands, buts...it is immediately removed by default. I have no interest in ever running any application that places ads on my box and/or spies on me. I think that is how most feel.


By the way, I've used AAR 7.0 as an example, but I could have used others: DAP, GoZilla, Weatherbug, Yahoo Toolbar, Real Player -- the list is a long one. What all of these applications have in common is that some users find them useful and like them, just as you do with AAR 7.0. They tend to get very upset when anti-spyware apps target them for detection and removal. (I've seen users get seriously angry when you tell them there might be a problem with FunWeb's/SmileyCentral's softare.)

By turns, anti-spyware vendors also have to deal with customers like Mele20 who are rather unforgiving and single-minded when they look at these kinds of applications.

So how would you suggest anti-spyware vendors like Sunbelt handle this situation? How should it handle these two groups of users with wildly different, even passionate, demands and expectations? If they target apps like AAR 7.0 and Weatherbug, they'll satisfy users like Mele20 but freak out other users. If they don't target these kinds of applications, they'll satisfy fans of those apps but piss off users like Mele20.

By the way, this same conundrum applies to the debate over whether anti-spyware applications ought to detect and remove cookies. (In fact, in the earlier "Informal Adware Risk Survey" thread that I started here at DSLR, I was more interested in how respondents would classify cookies than anything else.)

When anti-spyware applications start handling cookies differently or even drop them, you're likely to see serious outbreaks of cookie hysteria, with users loudly demanding that cookie detection be added back in and talking darkly of "betrayal" and "sellout." The mood can get real ugly, real fast.

But detecting and removing cookies also puts anti-spyware vendors in a very difficult position with other users, who see cookie detections as attempts by anti-spyware vendors to engage in "scare-mongering" to drum up sales from gullible users. These folks talk darkly of "fraud," "rip-offs," and "deception." They also begin emailing me to demand that I add such anti-spyware apps to the Rogue/Suspect Anti-Spwyare list. And, no, I'm not kidding -- see here for but one example:

»spywarewarrior.com/viewtopic.php?t=14963

said by bigbruva:
I have recommend TrendMicro in the past but the new online "Security Scan" for spyware that HouseCall does left me questioning their integrity.

I ran the security scan on a test system that I know is clean, after a short scan (less than 1 min) I was informed of "36 spyware programs detected"!
Looking at the report every "program" was in fact a cookie!

They where marked as "Low risk" with a default setting of "Pass" so it does not remove them unless the action is changed but at the end of the wizard I was left with a Page entitled "Danger! Potential threats detected!" in large red letters.

I know the debate on whether "cookies" are spyware but that is not the point here. They are reporting cookies as "spyware programs" which they are not! To me this is scaremongering and I think TrendMicro have over stepped the mark. This type of behavior borders on "Rogue Anti-Spyware" IMO

Has anyone else seen problems with this service?


Again, what would you suggest anti-spyware vendors do to accommodate both sets of users?

Folks, it's easy to sit here in a security forum and bitch loudly that anti-spyware vendors aren't conforming to your personal preferences, but anti-spyware vendors face real dilemmas with certain kinds of applications that even users themselves are divided over. And it simply won't do to insist that if anti-spyware vendors don't satisfy you and you alone, that they must have "sold out" or "gone over to the dark side," because there are going to be plenty of other users taking the opposite position. And once the anti-spyware vendors satisfy your peculiar whims, those other users will be screaming about "fraud," "scaremongering," and "stepping over the line," as well as threatening to file complaints with the FTC.

So what will it be folks?

Eric L. Howes]]> http://www.dslreports.com/forum/remark,13963768 Sat, 23 Jul 2005 02:01:21 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13963507 anon : PHEW! what alot of reading!

Well, first off my complements to sunbelt for being open about their descisione.

As I see it, there are a few circumstances (based on the white paper) in which the recently downgraded WhenU software could be objectionable to users:

#When it is installed in a bundle

#If the WhenU was installed prior to WhenU's recent reformation

#If they are having uninstalation problems ("must uninstal savenow before uninstalling savenow" made me laugh :D)

#If it was one of the instanses of poor disclosure on instalation

So, sunbelt still detects and offers the option of uninstallation for WhenU products, but reccomends ignoring them, thus offering the option of removal in the above cases but ignoring them in others.

On the one hand, this seems good to me -- after all, its no use critisising these software wrighters for being naughty, and then still critisising them when they start to behave themselfs; they need an insentive to reform.

On the other hand, unknowledgeble users, I would assume, have a tendancy to trust an anti-malware programs reccomendations, and so might, I suppose, ignore WhenUs products even if they don't want them on their system, maybe trusting sunbelts recomendation over their own suspicions that WhenU is responcible for the adverts they are getting.

My one sujjestion -- and I appologise if this is already the case, but I havent seen it refered to in this thread -- is that sunbelt should possibly give more information to the user as to what circumstances may warrant disreguarding sunbelts reccomendation of 'ignoor'.

for example:

-----------------

Scan results:
WhenU -- low risk adware -- [ignoor] -- more info

-----------------

and clicking 'more info' could bring up a box like this:

-----------------

"WhenU delivers text-based adverts to you*. Untill recently, sunbelts reccomendation was to remove WhenU. WhenU has made some progress towards reformation, and -- in the majority of cases -- is no longer objectionable, hence the 'ignor' reccomendation. In many cases, you will have installed it as a kind of 'payment' for another program such as BearShare.

However, there are some cases where you may wish to remove it. These include:

#if you did not knowingly install it

#if you no longer wish to use the program but are having problems uninstalling it

if so, simply change 'ignor' to 'quaranteen'.

--------------
*(possibly with a few screenshots to help the user recognise the product, so that they can tell if its the program that they wish to get rid of)

Thusly:

1)keeping their clasifications consistant and recognising WhenU's reformation

2)giving the user a choice of removing WhenU

3)helping to make that choice an informed one, and so

4)limiting the chance that they would blindly trust sunbelt and keep a program that they do not whish to keep.

also, maybe some kind of feed-back system could be used, so that the level of WhenU refusals to uninstall/failures to disclose etc could be monitored.

Just my 2c

DakAD]]> http://www.dslreports.com/forum/remark,13963507 Sat, 23 Jul 2005 01:07:50 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13963481 Shriyash : hi eburger68, yes i am nitpicking, and it is out of spite, but spite directed towards WhenU and the like.

i have great respect for esteemed researchers like yourself, and Daphne, you have done a lot to educate me on all things spyware related.
i probably sounded cheeky, but i didnt mean any disrespect toward Daphne or yourself, the good guys!(so sorry daphne :)

you asked if i think Adobe Reader should be classified as "spyware/Adware".....{yes there is a fine line between the two, but you cant expect millions around the world to really care , adware-companies = spyware-companiers = MUST DELETE AT ANY COST.}

my answer is: of course not!
why : because its my pdf file reader, i like it, and Adobe Acrobat has never been insuinuated as being a spyware-company, or a adware-company, by anyone, ever!

as for WhenU?
yes, delete absolutely anything {bundlers, what-have-you} from them
.
why? Because, its WhenU.

and that sums it up, for me and millions of people around the world, whose occupation isint computer-forensics related.

{people ARE emotional creatures, and anything to do with "adware'spyware" does bring up their defenses. its really a Zero_Tolerence policy, without a doubt.}]]> http://www.dslreports.com/forum/remark,13963481 Sat, 23 Jul 2005 01:03:04 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13963322 eburger68 : Aryan66:

said by Shriyash See Profile:

daphne:

then why call it "Low-risk Adware" ?
you have made it very clear, that you dont think it is of any risk whatsoever. or certainly not worth paying any attention to.
i suggest you do the right thing daphne, call it "Potentially No-risk Adware"
especially since you are comparing it with Adobe Reader!
This is truly petty. At this point you're nitpicking sheerly out of spite. Changing the label for the category wouldn't change the threat level ("Low risk"), because the threat assigned threat level is driven by an analysis of specific practices (see the Sunbelt Listing criteria), not labels that can be, at times, an uncomfortable fit.

said by Shriyash See Profile:

{btw, is Adobe reader also classified as "Low Risk Adware too?)
At the present time it isn't because Sunbelt has yet to analyze it. At present Sunbelt's researchers are more focused on keeping up with the explosion of CWS and Aurora variants, which seems to me a better use of their time.

The more interesting question, though, is do YOU think it ought to be listed and targeted? I would truly be interested in hearing your opinion on this.

said by Shriyash See Profile:

{oh, it contacts WhenU's servers? 3 times? im sure its no big deal, so what if it does ?
WhenU folks are really reliable, im sure those successful attempts at contacting them mean nothing. why? just look at their clean track record!)
See my response to Sheiny. Several people have analyzed packet logs of WhenU's data traffic, and none have found evidence of anything untoward or seriously (note the qualification, please) out of line with the claims made in WhenU's Privacy Policies.

If you have evidence to the contrary, let's see it. If you don't, could I kindly request that you spare us the snarky insinuations, which are baseless and useless.

Eric L. Howes]]> http://www.dslreports.com/forum/remark,13963322 Sat, 23 Jul 2005 00:42:05 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13963223 eburger68 : Sheiny:

Thanks for giving the white paper a read.

You asked:

said by sheiny See Profile:

This is where I would start. (from pg. 9 of your report)

WhenU's software does employ an auto-update mechanism over which users have no control,however, allowing WhenU to arbitrarily install new software

This requires a high degree of trust on the user's behalf. What has WhenU done to deserve this trust? My AV gives me a chance to opt out, as do my OS and AS. Why doesn't WhenU?
Yes, the auto-update mechanism is a concern -- that's why it's discussed in the white paper, and that's why it's included in the Sunbelt Listing Criteria:

»research.sunbelt-software.com/li···eria.cfm

See the "System Reconfiguration" section.

The auto-update mechanism is just one of the reasons why WhenU's software, including the new "Low risk" detections, are still included in Sunbelt's database.

The question becomes, is such an auto-update mechanism in and of itself a serious enough risk to justify a something other than "Low risk," especially when there's been no evidence in all the years WhenU's been around that it's been deliberately abused by WhenU. Sunbelt does have criteria to handle software that uses an auto-update mechanism to install other unwanted software. WhenU's software doesn't trip those other criteria because there's no evidence that it's been used for such purposes.

Given as much, the auto-update mechanism is enough to justify a listing of at least "Low risk," but not enough to justify a "Moderate risk." If you think otherwise, I'll be interested to hear your thoughts the next time ZoneLabs thinks the ZA Free auto-update mechanism ought not be turned off by users.

said by sheiny See Profile:

From,
"Data Collection, Transmission, & Sharing"
You state:

2. Data regarding users' surfing habit is transmitted to WhenU only in certain,limited contexts (for example, to identify the web page users were visiting when
they clicked on an ad) and is not tied to a personally identifiable profile or used to
build a profile history of their surfing habits.


How did you verify this? Do you have access to WhenU's database?
I had no direct access to WhenU's database, so I had to base my analysis on several sources:

1) Ben Edelman's several write-ups on WhenU, which include packet log excerpts.

»www.benedelman.org/

2) WhenU's own privacy policies:

»www.whenu.com/pc_product_policies.html

3) Esther Dyson's extensive write-up of WhenU in her Release 1.0 April newsletter (not available online except for purchase or subscription).

»release1.edventure.com/index.cfm

4) Andrew Clover's write-up of Save:

»www.doxdesk.com/parasite/SaveNow.html

5) A WhenU-commissioned privacy-audit:

»whenu.com/pc_role_audit.html

Several of the sources are of questionable quality, to be sure, but their conclusions generally agree with what we know from other sources.

Two other points:

1) Even if you regard the above sources as insufficient to support the claim of limited data collection, transmission, and use, there are no sources that I know of that prove that WhenU has done anything beyond what was claimed. Lacking such evidence, there are no solid grounds to establish that WhenU's ad software trips any of Sunbelt's more serious listing criteria. You can't base detections and classifications on non-existent evidence.

2) The data collection/transmission done to support WhenU's contextual advertising does not apply to ClockSync, which doesn't display ads itself.

Still later you write:

said by sheiny See Profile:

Re: Sunbelt Adjusts WhenU Detections

Everyone should read Mr. Burger's report. They shold also read,
"WhenU Violates Own Privacy Policy"
»www.benedelman.org/spyware/whenu-privacy/
Ben Edelman's piece is an excellent one and addresses an erroneous claim in WhenU's Save/SaveNow privacy policy. Several points:

1) This issue is fully addressed in the Sunbelt write-up and was incorporated into Sunbelt's conclusions.

2) The erroneous privacy policy has been replaced with the updated/corrected privacy policy in most installations. I know, because I specifically checked in each of the 33 installations that I tested.

3) Ben's write-up concerns WhenU's Save/SaveNow advertising application, which HAS NOT BEEN CHANGED IN SUNBELT'S DATABASE. In other words, the application in question remains classified as "Moderate Risk" with a Recommended Action of "Quarantine."

said by sheiny See Profile:

and,
"Eighty-Seven Percent of WhenU
Users Are Unaware They Are Using It"
»www.pcpitstop.com/spycheck/whenu.asp

and,
"WhenU Awareness, One Year Later"
»www.pcpitstop.com/spycheck/whenu2.aspp
Several points:

1) As with Ben's write-ups, these PC Pitstop surveys are also discussed in the Sunbelt write-up and they played a role in Sunbelt's conclusions and decisions.

2) PC Pitstop's first write-up is pre-Nov. 2004, when WhenU began ending its ActiveX installations. ActiveX installs are notoriously bad environments for good notice and disclosure, and that's exactly why Sunbelt frowns on them.

3) PC Pitstop's followup one year later pre-dates the large scale introduction of new notice screens, and their data don't reflect these newer installations with significantly improved notice, as PC Pitstop itself notes. PC Pitstop plans to do a followup survey, and I look forward to seeing it.

These are good questions, but they still don't provide me with any reason to think that WhenUSearch, ClockSync, or Weathercast are improperply classified as "Low risk adware." To convince me, you're going to have to do your own independent testing and analysis of those three applications, and that testing and analysis will have suggest serious ommissions or analytical problems in the Sunbelt write-up.

Regards,

Eric L. Howes]]> http://www.dslreports.com/forum/remark,13963223 Sat, 23 Jul 2005 00:29:45 EDT Re: Disproving by counter-example http://www.dslreports.com/forum/remark,13963054 jimkyle :
said by Mele20 See Profile:

Anything with ads is spyware. It is so simple. You are making it way too difficult.
I trust, then, that you refuse to use Google, since its search pages always have some ads...]]> http://www.dslreports.com/forum/remark,13963054 Sat, 23 Jul 2005 00:03:43 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13963049 norwegian : eric, daphne and alex and everyone else

if it wasnt for an article shown to me ABOUT erics work, i might never have known about this site, or half of the security issues i since put into practice, eric howes, has to be commended for what he does, as does daphne and alex for their contributions, as do alot of the people who spend lots of time here free, just to learn more and help more,

BUT,

we all know one wrong turn can affect the outcome, no threats in my first post nor none know, but was it wise coming forth with this news, as hackers get better and spyware programs back off on detection ratings, and so soon after MSAS, microsoft, etc have lowered their ratings,im not sure,
but for the balls out approach of sunbelts approach, the general consensus was yippee counterspy,i think this site gave more than enuff praise
now we find other software companies bringing antispy programs out, i just hope the damage hasnt been done,

it must have been a hard discussion behind closed doors on this, i just hope counterspy recovers,

what is next

good luck to all on their projects, may they stand tall and proud ]]> http://www.dslreports.com/forum/remark,13963049 Sat, 23 Jul 2005 00:03:10 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13962885 eburger68 : Anonymous:

You wrote:

said by Anonymous See Profile:

Also you quoted part of my post (I stated that was IMHO and no I'm not a moderator).
Please. Most of your post was devoted to telling various people that they ought not be posting. That's not only inappropriate, it's rude.

If you don't have the evidence to suggest that what people have argued is wrong, fine. But don't tell them to be quiet just because it makes you uncomfortable.

said by Anonymous See Profile:

Just be careful and don't let your reputation go down the drain together with Sunbelt' reputation.
The only thing I can do and have ever done here, at Spyware Warrior, or my own web site is to investigate carefully, reflect deeply, and call them as I see them. I haven't done anything differently here, and if my conclusions upset some people, then so be it.

Eric L. Howes]]> http://www.dslreports.com/forum/remark,13962885 Fri, 22 Jul 2005 23:40:52 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13962611 sheiny : Everyone should read Mr. Howes' report. They shold also read,
"WhenU Violates Own Privacy Policy"
»www.benedelman.org/spyware/whenu-privacy/

and,
"Eighty-Seven Percent of WhenU
Users Are Unaware They Are Using It"
»www.pcpitstop.com/spycheck/whenu.asp

and,
"WhenU Awareness, One Year Later"
»www.pcpitstop.com/spycheck/whenu2.asp]]> http://www.dslreports.com/forum/remark,13962611 Fri, 22 Jul 2005 23:00:18 EDT Re: Disproving by counter-example http://www.dslreports.com/forum/remark,13962549 B :
said by Mele20 See Profile:

Anything that installs ads on my computer is ADWARE and I want it gone immediately. It doesn't matter one whit if it is software supported by ads. It's ADWARE/SPYWARE and I want it GONE.
And my even more primitive corollary was that if it's from a known spyware producer (like WhenU or Claria/Gator) then I want it GONE too, regardless of the merits of the individual program in question. This may, or may not, fall into the moral, legal, or technical grounds of how a particular antispyware application defines itself. It is, however, the kind of unilateral control I seek on my own computer. If no commercial enterprises are willing to give people like me that kind of control, we will eventually find other means.

Here's an analogy. I don't like smoking or cigarette manufacturers. They approach corporate "evil". I therefore would not wish to knowingly purchase a T-Shirt from them, no matter how innocuous, or even beneficial, that T-Shirt might be to me. There's no need to evaluate on its own merits each T-Shirt or other product from the bad company. (Yes, I'm well aware of how the cigarette makers are all also in the food business, and yes it drives me crazy.) If a Sunbelt Antitobacco Scanner could tell me which products emanated from these malware (literally) producers, I'd want to use it.

-- B
--
In a realm outside causality and function]]> http://www.dslreports.com/forum/remark,13962549 Fri, 22 Jul 2005 22:54:34 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13962486 Shriyash : daphne:

then why call it "Low-risk Adware" ?
you have made it very clear, that you dont think it is of any risk whatsoever. or certainly not worth paying any attention to.
i suggest you do the right thing daphne, call it "Potentially No-risk Adware"
especially since you are comparing it with Adobe Reader!{btw, is Adobe reader also classified as "Low Risk Adware too?)

{oh, it contacts WhenU's servers? 3 times? im sure its no big deal, so what if it does ?
WhenU folks are really reliable, im sure those successful attempts at contacting them mean nothing. why? just look at their clean track record!)]]> http://www.dslreports.com/forum/remark,13962486 Fri, 22 Jul 2005 22:47:28 EDT Re: Disproving by counter-example http://www.dslreports.com/forum/remark,13962436 Mele20 : No,you have it all wrong. There is NO need to do testing like that. Anything that installs ads on my computer is ADWARE and I want it gone immediately. It doesn't matter one whit if it is software supported by ads. It's ADWARE/SPYWARE and I want it GONE. I expect my anti-adware/spyware software to, if running in real time, block my downloading this crap in the first place. But if the antispyware application is not being run in real time then, if somehow I was dumb enough to put this stuff that has ads to support it on my box, I want it gone. I wouldn't trust add/remove programs to remove it all. It's spyware. Anything with ads is spyware. It is so simple. You are making it way too difficult.
--
Around 2005 a sudden spark will catalyze a Crisis mood. The very survival of the nation will seem to be at stake.Sometime before 2025, America will pass through a great gate in history. The risk and promise will be very high. The Fourth Turning Wm. Straus]]> http://www.dslreports.com/forum/remark,13962436 Fri, 22 Jul 2005 22:42:17 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13962401 sheiny :
said by eburger68 See Profile:

I've been asking all day long for critics to offer specific reasons and good evidence for continuing to detect WhenUSearch, Weathercast, and ClockSync as something other than "Low risk adware." No one has yet been able to do it.
This is where I would start. (from pg. 9 of your report)

WhenU's software does employ an auto-update mechanism over which users have no control,however, allowing WhenU to arbitrarily install new software


This requires a high degree of trust on the user's behalf. What has WhenU done to deserve this trust? My AV gives me a chance to opt out, as do my OS and AS. Why doesn't WhenU?
From,
"Data Collection, Transmission, & Sharing"
You state:

2. Data regarding users' surfing habit is transmitted to WhenU only in certain,limited contexts (for example, to identify the web page users were visiting when
they clicked on an ad) and is not tied to a personally identifiable profile or used to
build a profile history of their surfing habits.


How did you verify this? Do you have access to WhenU's database?]]> http://www.dslreports.com/forum/remark,13962401 Fri, 22 Jul 2005 22:38:40 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13962329 WFO : Taken Back. LOL. :)]]> http://www.dslreports.com/forum/remark,13962329 Fri, 22 Jul 2005 22:29:28 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13962328 Anonymous : To eburger68 and daphne:

Read Mele20's post. I completely agree.

Adware is not a kind of software I'd like to have installed on my PC.

Lavasoft messed up and their reputation went down the drain.
Sunbelt is doing the same thing but they think if they make it public it will make some difference.

It will not.

Also you quoted part of my post (I stated that was IMHO and no I'm not a moderator).

Just be careful and don't let your reputation go down the drain together with Sunbelt' reputation.
--
Get Firefox!]]> http://www.dslreports.com/forum/remark,13962328 Fri, 22 Jul 2005 22:29:22 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13962311 Tsume : Well, I read the entire post, and I don't see anything wrong with this decision.]]> http://www.dslreports.com/forum/remark,13962311 Fri, 22 Jul 2005 22:27:50 EDT Disproving by counter-example http://www.dslreports.com/forum/remark,13962265 keith2468 :
quote:
I strongly suspect that much of the hue and cry here comes from people who have no direct experience with WhenU's software or only very limited experience with it. After I finish testing 33 installations of WhenU's software (to say nothing of the innumerable times I've tested WhenU's software in prior years), "because it's WhenU" begins looking more and more like a bogeyman argument.


I'm with Eric on this reasoning.

I think a lot of spyware labels are due to mis-steps by the vendor that have been corrected, due to guilt by association (being distributed by websites that also distribute malware -- but, to draw an analogy, just because one product that Sears sells is needlessly dangerous does not mean that all products that Sears sells are needlessly dangerous), and mistakes in software evaluation.

This is not to say that there isn't plenty of spyware and malware out there, just that there is also a lot of mis-identified legitimate advertising sponsored software. It will be a big job for the industry to straighten the mis-identification mess all out.

The only real way to defeat Eric's point above is to provide a counter example.

If a WhenU product (or anything else) is spyware/malware it is designed to get on computers. So getting yourself infected should be relatively easy. You get infected, and then you wait and see what the product really does. Then try the "uninstall" utility to see if it actually prevents the product from loading automatically on re-start.

I am thinking that these testing steps will be work, but some experts may want to contribute corrections.

It is simple enough. The only barrier is having the test PC, and having the time.

1. Be sure that nobody in the family relies upon the test computer for work or school. Make sure that it doesn't contain the only copies of photos of a wedding, a beloved puppy, etc.

2. Get the test computer ready.

Note that you must not connect to the internet until you have firewall protection in place. You want to make sure the infection is coming as a result of visiting the site concerned.

a) Re-format the computer.

b) Install the operating system of your choice.

c) Install the firewall or NAT router of your choice.

d) Do not update the operating system (in particular, do not install the updates that prevent drive-by downloads).

e) If you wish, install security scanning software (an AV, and ASW software). Disable any real-time monitoring.

f) Use a disk imaging utility to make an image back-up of your system in its clean state.

A clean image backup will allow you to repeat the tests quickly, without going through steps (a) thru (e) every time.

(The tests will be made invalid if some AV or ASW monitor leaps to life and tries to do a removal or disinfection. I know from experience that some of ASW products sometimes mess with the uninstall registry links.)

3. Visit sites with WhenU and see if you get any drive-by downloads.

4. If step 2 gets you infected, report the URLs to and infectious files to the various ASW vendors.

Clearly you have proof that one distributor of the products is doing drive-by downloads. The ASW vendors can then research if this is a rogue distributor or common practice.

5. If step 2 fails, go to a site and manually download WhenU.

6. Wait 6 hours to see if anything follows (i.e. whether other products are installed without permission).

7. Test the product's "uninstall" utility. For this test to be valid there must have been no AV or ASW product messing with the product being tested. You need to have your AV and ASW monitoring software disabled from the time you do the install until after you test the uninstall.

8. Re-start the computer to see if the un-install utility worked. There may be directories left, there may be modules left, but if the product no longer automatically starts the uninstall utility worked as adequately as your typical uninstall utility for generally accepted software like NAV.

If the "uninstall" utility didn't work, send your information to the ASW vendors.

Keep in mind that your test computer will be susceptible to infection from whatever worms and viruses are going around, because you have to have the AV monitor turned off for the testing to be valid, and because your operating system will be partially or fully unpatched (so that drive-by downloads can occur). So you will need to protect any other computers on the same LAN from infections that the test computer gets.

The proof that a product is malware/spyware/adware is that you yourself see behavior meets the definition of malware behavior, and others can duplicate your results by carrying out the same tests in the same way.

Everything else is just talk.
--
(Virus&Hijacking FAQ + Submit suspected malware + Backups FAQ + Security FAQ TOC)]]> http://www.dslreports.com/forum/remark,13962265 Fri, 22 Jul 2005 22:21:57 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13961974 feverfive : ^^^^^If nothing else, that'd do away w/ subjectivity.....That's what I worry about the most--who is actually making these decisions? I haven't, admittedly, thought this through as much as some of you...Though my visceral reaction is that I am concerned about the standards/views/methodology espoused or used by those who make these decisions. It's getting harder to know which vendor(s) to trust (& I am not making specific allusions about Sunbelt/CounterSpy).]]> http://www.dslreports.com/forum/remark,13961974 Fri, 22 Jul 2005 21:42:59 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13961973 B :
said by doormans See Profile:

Now Sunbelt does let us, the end user know and it seems it is even worse.
Well, yeah, although as Snowy pointed out they didn't really mention it to their users in their newsletter, but rather blogged an entry about it. Eric's notification here was presented as a semi-independent notification in keeping with his usual watchdog role, with "full disclosure" as to his consulting relationship. I don't know how orchestrated or not this non-announcement was, and I don't think I care.

I still respect and hold in awe all of Eric's tireless efforts to date. But he knows better than most that people follow the money and that assertions from "interested" parties are rightly viewed more suspiciously.

This thread started with "Sunbelt has announced the completion of a review of WhenU's software." But it doesn't seem they really announced as such. The actual blog entry, or what Eric referred to as a "short digest", is not really as commital as the phrase "completed a review" would imply to me.

Ah well. I'm not interested in casting suspicions about; I guess I just hope Eric and Suzi understand that however white-hatted and pure of heart they think they are, and in all likelihood and from most appearances they really ARE, that financial relationship colors EVERYTHING they say and do in this arena. I understand their indignation after all of their hard work, but it comes with the territory. I don't follow these issues closely, but I do recall being somewhat surprised about Eric's Sunbelt relationship when it was mentioned some months ago; I don't think it's always been tagged to his well-publicized and well-regarded postings. Sorry for the long dramatic monolog guys.

-- B
--
In a realm outside causality and function]]> http://www.dslreports.com/forum/remark,13961973 Fri, 22 Jul 2005 21:42:49 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13961941 suzi : Anonymous wrote:

quote:
I have a lot of respect for some people that contributed to this thread but if you're related in any way to this company IMHO you should not post.


So. are you advocating censorship?

quote:
Wow you guys are actually justifying this decision? Posting screenshots etc...

That's just wrong.


I take it you only want one side of the story told? Since when should both sides of the story not be told? I offer no apologies.

Perhaps *you* should show some concrete evidence to support your statements, particularly this one:

quote:
Why is it always WhenU? I mean we all know what they do...


Please tell us how you know what they do? Did you read the white paper? Have you downloaded their software? Please, *do* tell us. Eric has repeadedly asked for evidence of anything that might have been overlooked in Sunbelt's analysis. No one has offered anything except opinions based on bias and emotion.
--
aka Suzi, Spyware Warrior
Microsoft MVP Windows Security 2005]]> http://www.dslreports.com/forum/remark,13961941 Fri, 22 Jul 2005 21:39:51 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13961891 Mele20 : Spyware/adware is just that. There is no need for classifications. We don't classify viruses (at least not in terms of their degree of badness so that only the baddest are targeted for immediate removal). They are just viruses and we ask and expect our AV vendor to be very aggressive and get rid of all of them by default setting. I don't go around picking and choosing some viruses that I like and want running on my box. Same with adware. I want NO adware period ever on my box. If by some weird chance some piece of crap adware got on my box, I would have, until now, expected CS to remove it by default. (Of course, now I also know that CS doesn't currently remove any spyware that gets on Firefox because it is unaware of it).

The distinction that weatherbug, or something like it, "only" has ads contained in weatherbug and thus is not hurtful is spurious. They are ads! Therefore, weatherbug is adware and should be removed by default if I run CS. Anything that puts ANY sort of ads on my box, calls home in any fashion, sets permanent cookies on my box, is adware and I want it removed. I'm very unlikely to ever get adware on this box but if I did, I want it treated just like a virus is treated...no if, ands, buts...it is immediately removed by default. I have no interest in ever running any application that places ads on my box and/or spies on me. I think that is how most feel. So, the need for determining that some viruses are good for me and some spyware is good for me, or at least not evil, is absurd. Its ALL EVIL and I want it gone and I expect my anti-malware software to understand this and remove it all. I don't have to go through Bit Defender's av definitions to see which ones they think are "somewhat" ok so they won't remove them. I shouldn't need to do that with CS for spyware. If I do, then the application sucks because adware/spyware is just that. There are NO GRAY areas just as there are NO GRAY areas with viruses.

It may be true that vendors would drop detections if definitions were inflexible ones. All that means though is that the vendor has caved in. And it means we the users need some other way like B See Profile has suggested to deal with this kind of threat instead of depending on vendors that cave in. Because the vendor may drop detections in this instance doesn't make it right that "flexible" definitions are the answer. Not at all. What it means is that we have to find some other ways to combat this evil since it is now clear we can't depend on the vendors. The main thing we can do right now is never, ever use IE and even with Fx be very, very careful.

I have Adobe Reader 5.0 on this XP Pro box because I won't put up with ads, calling home, any of the crap that is on the later versions. When the time comes that 5.0 is too old to use, I'll look for free software, etc. that I can use as a substitute. If there isn't any then I simply will do without PDF files. As for Opera, yes I recently downloaded it. I almost never use it and when I do (only because it can help me figure out a problem because it has more information about what is going on with the browser than other browsers) I have to constantly click no to the steady stream of adware cookies it wants to set. I allow none of them and if I use Opera anymore I will strip the ads using Proxo.

And no, before you ask, I haven't read CS's white paper because it's irrelevant. I want all spyware immediately removed/quarantined (quarantine as default is safer because it could be an FP) and I see no reason for classification. Spyware is spyware just as a virus is a virus. Remove it/quarantine immediately ...no equivocation. No if, ands, or buts necessary.
--
Around 2005 a sudden spark will catalyze a Crisis mood. The very survival of the nation will seem to be at stake.Sometime before 2025, America will pass through a great gate in history. The risk and promise will be very high. The Fourth Turning Wm. Straus]]> http://www.dslreports.com/forum/remark,13961891 Fri, 22 Jul 2005 21:34:23 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13961811 doormans : I first must say that I have only posted in this forum on 2or 3 occassions to ask questions. I do however read this forum religously twice daily without fail and pretty much take as gospel what the everyday contributors say concerning security for the home computer user.This far and away the best forum for your security needs and issues.I am however quite shocked at the way this particular issue has turned to such a personal and venomous attack against Eric's credibility on this matter. I doubt any of us has worked as endlessly or tirelessly as he has to keep the entire computer users world as informed and secure from malware as he has. If in his professional opinion certain Whenu apps. are not as bad as they once were then I think we should consider the source, who has not ever as far as I know deliberately led anyone astray.

As far as sunbelt goes, I feel they are to be commended for coming straight out with this information on lowereing their risk standards for these particular products. When adaware delisted certain apps. and did not disclose it everyone swore to delete it from their machine. Now Sunbelt does let us, the end user know and it seems it is even worse. Can't have it both ways with out the bridge collapesing in the middle.

Buy the way, I don't use Sunbelt and have never meet or corresponded with Eric so lets put that to rest. Everyone should just relax and be calm. Thanks to everyone here for all their dedication and hard work keeping myself and others secure while cruising the net.
:)

]]> http://www.dslreports.com/forum/remark,13961811 Fri, 22 Jul 2005 21:23:53 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13961741 eburger68 : Anonymous:

said by Anonymous See Profile:

I have a lot of respect for some people that contributed to this thread but if you're related in any way to this company IMHO you should not post.
I'm sorry, but I didn't happen to notice that you'd been appointed moderator. And since when were vendors or those associated with them not allowed to explain and defend decisions? Isn't that exactly what users have been demanding from anti-spyware companies -- more transparency about vendors' decision-making processes?

said by Anonymous See Profile:

Why is it always WhenU? I mean we all know what they do...
No, I'm afraid that's not the case. I've been asking all day long for critics to offer specific reasons and good evidence for continuing to detect WhenUSearch, Weathercast, and ClockSync as something other than "Low risk adware." No one has yet been able to do it.

Perhaps you'd care to step up to the plate and tell us all what you apparently "know" but the rest of us don't? (And please don't skimp on verifiable evidence -- we're all dying to see it.)

said by Anonymous See Profile:

EDIT:

Wow you guys are actually justifying this decision? Posting screenshots etc...

That's just wrong. :huh:

Aluria, MS Spyware, Sunbelt who's next?
Gosh, I hadn't realized that well reasoned arguments supported with concrete evidence would come as such a shock to some folks. Please do accept my apologies. (Suzi can apologize for herself.)

Let me reiterate, if you've got the evidence to suggest that something has been overlooked in Sunbelt's analysis of certain WhenU products, I'd be happy to look at it.

Eric L. Howes]]> http://www.dslreports.com/forum/remark,13961741 Fri, 22 Jul 2005 21:14:48 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13961621 Anonymous : I just wonder who will be able to stand up to crapware makers?

I almost purchased their product but changed my mind after hearing about licencing of their spyware definitions.

I'm sure glad I did not waste any money on them.

I have a lot of respect for some people that contributed to this thread but if you're related in any way to this company IMHO you should not post.

Why is it always WhenU? I mean we all know what they do...

EDIT:

Wow you guys are actually justifying this decision? Posting screenshots etc...

That's just wrong. :huh:

Aluria, MS Spyware, Sunbelt who's next?

--
Get Firefox!]]> http://www.dslreports.com/forum/remark,13961621 Fri, 22 Jul 2005 20:56:36 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13961100 eburger68 : StraitShoot:

You wrote:

said by StraitShoot See Profile:

Well, uh... he'll have spyware on his computer.. and it's WhenU...LOL
But what is going to HAPPEN to the user as a result of having that "spyware" on their computers? What specific ills will befall that user? Labels don't us much of anything. We need a discussion of specific practices and effects.

If you really don't know because you're not familiar with the software, that's fine. There's no shame in having better things to do with your time than installing useless software and testing it -- like I do with so much of my day. In fact, that would make you completely normal. But let's not cloud the issue with vague labels like "spyware."

said by StraitShoot See Profile:

I do have to hand it to Sunbelt, though. They are handling it better than others...
Thank you. I'm sure the folks at Sunbelt appreciate the comment, because transparency is important to them, as Alex Eckelberry emphasized early on in this thread.

Best,

Eric L. Howes]]> http://www.dslreports.com/forum/remark,13961100 Fri, 22 Jul 2005 19:39:09 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13961008 StraitShoot :
said by eburger68 See Profile:

My question to you, Jim, is this: what will happen? Can you tell me what ills will befall the user who who leaves WhenUSearch installed?

Eric L. Howes
Well, uh... he'll have spyware on his computer.. and it's WhenU...LOL
I do have to hand it to Sunbelt, though. They are handling it better than others...]]> http://www.dslreports.com/forum/remark,13961008 Fri, 22 Jul 2005 19:27:24 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13960996 StraitShoot : Eric, from now on my answer to everything from now on is ... "Because it's WhenU"...LOL]]> http://www.dslreports.com/forum/remark,13960996 Fri, 22 Jul 2005 19:25:33 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13960992 eburger68 : Mers2:

You wrote:

said by mers2 See Profile:

I read the white paper before I posted my first post in this thread. My opinion is this: as long as a company has one program out there that is still moderate risk malware then all of their side programs - particularly those that are bundlers for the adware - should be kept listed as moderate risk. This company has not completely cleaned up it's act and should not be rewarded for partially changing it's behavior.
OK, this is a real argument over which reasonable people can have a legitimate disagreement. You seem to view reclassifications through the lens of "rewards" to adware vendors, and think that the "goodies" ought to be withheld until their act is 100 percent clean.

There's much to be said for the position, and I must admit it's tempting. Still further, I would point out that Sunbelt has not budged on its Save/SaveNow detection precisely because problems remain with the program and its installation/uninstallation practices.

That said, when I think of how programs are to be presented to users, I find it tough to justify presenting WhenUSearch or Weathercast or ClockSync to users in the same way as Save/SaveNow, simply because of what that pop-up advertising program does.

In fact, it borders on misleading to tell users "We assess this clock program as moderate risk, the same as the pop-up ad program, and recommend removal of the clock program," when that assessment is based NOT on the specific characteristics of the clock program itself or the practices associated with it, but rather on the characterisitcs of some OTHER pop-up program that you happen to have a problem with.

Put another way, I tend to view detection/presentation issues as a matter of making the most justifable assessment and recommendation to users based on the actual threat represented by the named program itself.

Best,

Eric L. Howes]]> http://www.dslreports.com/forum/remark,13960992 Fri, 22 Jul 2005 19:25:13 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13960941 suzi : I downloaded WhenU's WeatherCast to see for myself what it does (even though I've read the white paper several times). For those of you who haven't read the white paper and are protesting the reclassification, here are some screenshots. This is what comes up when you start the installer:



When you click on the link to read the License Agreement and Privacy Policy, this screen comes up:



Now tell me that is not an easy-to-read, clear agreement. It is actually larger than shown here because I re sized the screenshot to be 100 px smaller in width.

Once installed, the program looks like this:



The default location is New York City. It does not show the user's location unless you enter your city and state or zipcode. The text link ad is displayed in the lower portion of the window. This the actual size; I did not re size it.

When you close that window, and I don't mean minimize it, I mean close it completely, you continue to see the icon in the system tray, the one to the far left.



That's it -- that's all there is to it. Nothing more, nothing less. Yes, it puts itself in startup, but most any software does that now, even ones that don't need to be there.

During the installation process, it asks to connect to WhenU's servers 3 times. Since I don't have a packet sniffer, I can't say what is or isn't being transmitted. The text ads sometimes reflect the city or geographic area you enter, but some are very generic.Here's what WhenU says about it. (Yes, Whenu's domains are still in IE-SPYAD in case anyone is wondering. I had to remove whenu.com from restricted sites to download the app.)

»www.whenu.com/pc_weathercast.html

I fail to see how this app is any different from Adobe Reader which displays ads in the upper right corner and downloads the Yahoo toolbar on upgrading to version 7. I don't use Opera, but I understand the free version displays ads, too. I fail to see any reason why WeatherCast should be labeled anything more than Low Risk Adware. If someone has objective reasons and documentation to the contrary, let's see it.
--
aka Suzi, Spyware Warrior
Microsoft MVP Windows Security 2005]]> http://www.dslreports.com/forum/remark,13960941 Fri, 22 Jul 2005 19:18:40 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13960910 eburger68 : Bruce:

You wrote:

said by roamer_1 See Profile:

There is GREAT validity in B's assertion: "Because it's from WhenU".
Reputation can play an important and necessary role in an analysis of spyware/adware vendors and their software, especially when dealing with new or unknown software (for example, a 0-day file from CoolWebSearch), when dealing with software that already possesses characteristics that are ripe for misuse and exploitation (for example, being ActiveX-installable), or when dealing with companies who continue to engage in business practices that are known to produce bad results (for example, using multi-level, third-party affiliate networks, which WhenU stopped using but 180 continues to use).

But reputation can't be the only or primary criterion when dealing with software that's readily available for analysis and that's available through distribution methods that can be exhaustively researched. WhenU's software is not new or unknown; it's readily available for analysis; and its distribution channels are fairly well-known and easy to find. That's a far cry from CoolWebSearch or even 180solutions.

When I can test 33 different WhenU installations, pick apart their installation processes, examine their uninstallation processes, and observe very closely their advertising methods, reputation becomes much less important because I have more specific knowledge to base my assessments on.

I strongly suspect that much of the hue and cry here comes from people who have no direct experience with WhenU's software or only very limited experience with it. After I finish testing 33 installations of WhenU's software (to say nothing of the innumerable times I've tested WhenU's software in prior years), "because it's WhenU" begins looking more and more like a bogeyman argument.

By the way, it needs to emphasized that WhenU's main adware application remains classified as "Moderate risk"/"Quarantine," and a good part of the reason lies in the specific characteristics of the program (pop-ups outside of the context of the host program, distribution/execution independent of a host program) that make it much more troublesome than a simply desktop toolbar or weather program with text advertising embedded within it.

Finally, it also needs to be emphasized that while I don't completely discount WhenU's reputation or past practices, I can't ignore the changes they've made:

* ending ActiveX installs
* ending the use of third-party distribution networks
* revamping notice/disclosure screens to use straightforward, unvarnished language

As a result of the past nine months of changes, WhenU has a much better reputation with me and Sunbelt than, say, 180solutions. Where I don't have to look hard at all to find sleazy 180 installations or other obnoxious behavior, I have gone for months and months without seeing a single report of a bad WhenU install.

In the two cases that I have seen (Nov. 2004, June 2005 -- notice the significant gap), WhenU immediately got the installations shut down. Not so with 180 and other adware vendors, who shut down one problem installation only to see ten more take its place.

said by roamer_1 See Profile:

I can't help but believe that any wiggling or "gray area" can only be beneficial to adware and spyware companies- It is absurd to believe that these companies are trying to protect their "name", as their past practices have damaged their names FOREVER.
This seems to be a growing sentiment -- that hard and fast definitions grounded in pure, objectively defined functionality with no flexibility would lead to tougher detections. In fact, that sentiment is completely mistaken.

Tough, hard, inflexible, black-and-white definitions are brittle and easily broken. There's a reason why adware vendors themselves have been demanding such "objective," "black-and-white" definitions -- because they're ripe for being exploited with functionality and practices that aren't contemplated in such definitions.

In fact, to be truly strong, definitions need flexibility. Flexibility is what gives you the ability to handle borderline cases and address new functionality and practices from adware vendors that aren't strictly contemplated in "objective" criteria.

It's also wrong to assume that inflexible, black-and-white definitions would produce more detections. In fact, they would probably produce FEWER detections. Flexible definitions that allow for different levels of classification enable you to detect and present more types of software to users than otherwise.

Don't assume that that if vendors were to switch to black-and-white definitions, more software would be detected. My guess is that vendors would quietly drop detections that don't clearly fit their main detection criteria, whereas more flexible criteria would allow them to continue offering those detections while presenting them to users in a different way.

Doubt me? Let me give you an example. Take a look at this blog entry from Spyware Warrior:

»netrn.net/spywareblog/archives/2···-survey/

Look at comment 13, which is from a representative of Weatherbug. Notice that he's arguing for a strictly defined industry standard definition of "adware"? Why? It's no accident, really -- because he strongly suspects that such an inflexible definition or set of criteria would of necessity give Weatherbug the green light.

Now, Sunbelt CounterSpy does detect and present Weatherbug to users, but using the same "Low risk adware"/"Ignore" detection as is now being used for WhenUSearch and Weathercast.

Truth be told, if Sunbelt were forced to abide by a black-and-white detection scheme, Weatherbug would probably have to be de-listed, as it would be silly and indefensible to lump Weatherbug in with Aurora or CWS and present them to users as the same kind of threat. Most folks who responded to my informal adware risk survey appeared to agree, too:

»Informal Adware Risk Survey

That "Low risk adware" classification effectively allows Sunbelt to detect a program that it might not otherwise, because Sunbelt can present Weatherbug to users in a different way and with different advice than it does in the case of Aurora or CWS. That's the power of flexibility in detection and presentation.

said by roamer_1 See Profile:

A good point was made (sorry, forget who made it) that it is much simpler to set up a secondary company to sell legit software out of, or to reorganize under a different name to continue drive-bys with... as many have done (Claria is a good example).
WhenU doesn't perform drive-bys. And were they to start again, their software would be swiftly reassessed and reclassified.

said by roamer_1 See Profile:

When I use an anti-virus program I expect it to remove all viruses by default- not just the really, really bad ones.

In the same way all software is judged by it's performance "out-of-the-box", Anti-ad / anti-spy should work the same way, with the default stock installation ready to remove EVERYTHING from every classification.
But advertising software isn't like traditional malware. Advertising software (such as WhenU's) employs a whole host of functionality that has legitimate uses -- see my earlier response to ghost16825 for examples:

»Sunbelt Adjusts WhenU Detections

That's another reason why adware and spyware criteria need to be nimble and flexible enough to handle difficult, borderline cases where things aren't so clear.

said by roamer_1 See Profile:

If you wish to add an option for the user to ignore certain items or items under a class number of [1,2,3,etc], that would be fine- but the default should set to "whack 'em all!"
If "whack 'em all" becomes the default for all adware programs, then vendors are going to have much less leeway to present certain detections to users. Here's why:

Let's take the example of Download Accelerator Plus or Weatherbug, programs that display advertising within the context of their own ad windows. These programs are comparatively innocuous, but some anti-spyware vendors might still want to alert users or administrators to the presence of the programs on systems without necessarily suggesting that they represent the same kind of threat as Aurora or CWS.

In a black and white detection model, you're forced to present these to users in the same way as Aurora and CWS. And do you know what many users are going to do when they see you recommending to remove Weatherbug or DAP because they allegedly present the same kind of threat as CWS or Aurora?

Easy. They're going to absolutely *FREAK.* Some of them will then start emailing the vendors for Weatherbug and DAP, accusing them of planting "trojans" and "viruses" on their computers. Others are going to start emailing the anti-spyware vendor, pleading desperately for information about this horrible threat that the anti-spyware program detected on their drives. A small few are going to email or phone the anti-spyware vendor and accuse them of fraud and scaremongering.

Those are the kinds of results you get with black-and-white, whack-em-all detection criteria. And given the potential fallout, many an anti-spyware vendor is simply going to drop the detection or not offer it to begin with.

Vendors who have more flexible detection and presentation criteria can do better, though. They can present the detections as "Low risk," advise "Ignore" (because very little of consequence will befall users if the software remains), but still offer to remove the software if users affirmatively elect to do so by changing the action from "Ignore" to "Quarantine" or "Remove."

Sorry for the long-winded reply, but this is important stuff, and I hate to see people here coming to the same conclusions as the *adware vendors themselves*: that we need hard-and-fast, black-and-white, rigid, inflexible, objective criteria and definitions.

said by roamer_1 See Profile:

(I have marked your WhenU stuff fo later reading...)
Thank you. If you'd like even more to read, you might check this short discussion on Spyware Warrior about the ways in which anti-spyware vendors are incorporating flexibility into their presentation of detected software to users:

Presenting Anti-Spyware Scan Results
»www.spywarewarrior.com/anti-spyw···ults.htm

Best,

Eric L. Howes]]> http://www.dslreports.com/forum/remark,13960910 Fri, 22 Jul 2005 19:14:48 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13960909 SnowyOne : Eric,
This disclosure is starting to appear more as a disclosure by you rather than a "Sunbelt" disclosure.
In Sunbelt's newsletter of 07-22-05 (today as far as I can tell) I can only find a scant reference to the 'adjustment' that on it's own hardly qualifies as a disclosure of any sort.
I am only posting a portion of that newsletter even though it's requested that the newsletter be copied in it's entirety. I will post the entire contents if requested by Sunbelt.

"You might ask yourself: "Is Sunbelt also downgrading their threat
definitions to "ignore" for Claria and other adware like Microsoft
is doing in their Windows Antispyware?". The answer is NO, we ignore
Microsoft's threat scoring values. We only use their threat data
(the file names, and locations where malware is found, etc.). We
have not downgraded our Claria or other adware recommendations and
do not plan to, unless they shape up, get straight and behave like
decent Internet citizens, like WhenU recently did."

emphasis is mine, but even emphasised, I wouldn't call this disclosure by any stretch. This is the official newsletter sent to all CounterSpy" subscribers. Selectively full disclosing is not full disclosure.]]> http://www.dslreports.com/forum/remark,13960909 Fri, 22 Jul 2005 19:14:47 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13960903 BillPStudios :
quote:
I think Sunbelt should be applauded for calling a duck a duck,Don't you ?

I think Sunbelt should be applauded for many things. They're the only large vendor who I've seen actually get down in the fox holes with us. The white papers that have been created by Sunbelt show that they are serious and willing to put in the sweat it will take to create a fair and safe computing world.

quote:
Recently most Vendors are running scared from C&D's,One whiff of potential damages and they drop the whole detection.

Agreed which is why I've ignored any C&D's or threats we've received. We don't have a lot to lose and in Scotty's case we let the users make the decision. We've still been threatened just for alerting users to a change.

quote:
Were on a slippery slope to where adware is acceptable and legitimate software even if it is unwanted

What really annoys me that all legitimate companies now feel it's ok to include "Always-run" components with their software. CD Burners, Multimedia players, Adobe, Quicken, Printer Software, etc... All the typical "Run when I want you" programs now install Always-run programs or auto-updates.]]> http://www.dslreports.com/forum/remark,13960903 Fri, 22 Jul 2005 19:13:49 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13960702 Tekkanano :
said by WALL_E See Profile:

[Disclaimer] I'm 17 and work at the local supermarket. Not much of a bias, eh?
I'm 24 and I have no job...*cries*...

I don't see what the big deal is anyways. These spyware/adware software don't detect anything. ;) The scan always comes up zero, and it's been like that for over a year now.
--
Cox gave me the speed I wanted, so no more dreaming of DSL...humm, got fiber?]]> http://www.dslreports.com/forum/remark,13960702 Fri, 22 Jul 2005 18:42:03 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13960637 mers2 : I read the white paper before I posted my first post in this thread. My opinion is this: as long as a company has one program out there that is still moderate risk malware then all of their side programs - particularly those that are bundlers for the adware - should be kept listed as moderate risk. This company has not completely cleaned up it's act and should not be rewarded for partially changing it's behavior.

Having said that, I am pleased that Sunbelt was up front with the disclosure and that they retained the definitions for the programs with downgraded threat levels.

Thank you Eric for your continuing research and reporting.
--
God put me on this Earth to accomplish a certain number of things. Right now, I am so far behind I will never die. ]]> http://www.dslreports.com/forum/remark,13960637 Fri, 22 Jul 2005 18:31:22 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13960599 Martinus :
said by Mike_Healan:

But hey, at least they announced it publicly instead of having to be CAUGHT the way Lavasoft and Microsoft were.
Agree.

An out-of-the-closet spinned move is way better than getting caught with your pants down. At least it won't trigger an outrage as in »MS Downgrades Claria Detections, 'cos it's only an "adjustment".
--
From the GSV "Ethics Gradient"]]> http://www.dslreports.com/forum/remark,13960599 Fri, 22 Jul 2005 18:26:13 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13960546 anon : I think the one's who object to the downgrading just miss the good old days, when the only targeting criteria that really mattered was: "do our users want this thing gone?"

Personally, I don't care how you define the various terms we give to these programs or how some vendor assigns threat levels. I just want to be able to tell a person that "yes, XYZ Antispy will find whatever it is causing those pop-ups. Run it and remove whatever it detects" and not have to go through a HijackThis log afterward to clean up something that wasn't removed because it doesn't meet some targeting guideline written to satisfy the legal department.

But hey, at least they announced it publicly instead of having to be CAUGHT the way Lavasoft and Microsoft were. I can give them some points for that.]]> http://www.dslreports.com/forum/remark,13960546 Fri, 22 Jul 2005 18:21:03 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13960529 Martinus :
said by fatdcuk See Profile:

Not all WhenU software is adware/spyware...
Not all cancers are deadly, but you sure don't want them near you.
--
From the GSV "Ethics Gradient"]]> http://www.dslreports.com/forum/remark,13960529 Fri, 22 Jul 2005 18:18:40 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13960473 B :
said by fatdcuk See Profile:

Any ideas how you can target a brand name and not get ripped to shreds in court ?
Uh, yeah, as I just indicated, I've already presented some. See pages 1 and 2 of this thread as well as »MS Downgrades Claria Detections .

-- B
--
In a realm outside causality and function]]> http://www.dslreports.com/forum/remark,13960473 Fri, 22 Jul 2005 18:11:32 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13960443 Martinus :
said by John2g See Profile:

However, from reading this thread, it doesn't seem all the difficult to change the setting (once it is detected) from ignore to remove. It is not exactly rocket science.
Certainly not for you and not for the chaps in this forum, but there is quite a big market out there - the one that makes the bucks come in - the, dare I say, unsavvy users? who would be better served with more prudent out of the box settings like "this is definitely an unhealthy piece of shyte software. You don't want that to cripple your laptop or that high-end gaming rig you've invested in".

Let's compare it to those loved/loathed opt-in, opt-out schemes.

Edit: But, then again, you are using Boclean, so what do you care about spyware anyway?
--
From the GSV "Ethics Gradient"]]> http://www.dslreports.com/forum/remark,13960443 Fri, 22 Jul 2005 18:07:07 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13960316 fatdcuk :
said by Bill:
I respect Sunbelt's attempt to somehow classify functionality of programs user's might find on their computers. I fear however that by defining the guidelines, it provides the intruders what they need to side step rules and still intrude where they're not wanted.

A lot of companies that have spent years using the system to take advantage of users and cash in on their lack of expertise. While most of them claim a new more respectable approach, none of made amends for their previous behavior and I'm hard press to trust anything they offer.

"Adjusting" the classification can be dangerous and given the possibility of changes and/or embedded time bombs within software it's tough to determine the real threat of any unwanted software.

As they say, if it looks like a duck, smells like a duck and walks like a duck it's probably a duck.

Bill


Hi Bill,A huge thanks for Scotty the dog !

I think Sunbelt should be applauded for calling a duck a duck,Don't you ?

Recently most Vendors are running scared from C&D's,One whiff of potential damages and they drop the whole detection.They don't see any ducks at all from certain vendors.
At least Sunbelt continue to call a duck a duck and are prepared to see it through the courts if needed.

CJ got it bang on the money earliar on in this thread with "Times are a changin'" statement.

Were on a slippery slope to where adware is acceptable and legitimate software even if it is unwanted:(

PS Roamer 1

Not all WhenU software is adware/spyware that is the crux of the matter which some people have problems grasping.
I hope you find the PDF enlightening.
The truth of the matter is Sunbelt are looking after their customers interests and ahead of the their rivals with the way they do this.

Apologies B i did'nt see your last post:(
Any ideas how you can target a brand name and not get ripped to shreds in court ?]]> http://www.dslreports.com/forum/remark,13960316 Fri, 22 Jul 2005 17:50:55 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13960255 B :
said by fatdcuk See Profile:

Being of a brand name is not enough to warrant removal and would be indefensible in a court of law reguardless of past exploits.
Why is that so hard for you to grasp ?
Not hard at all; not only have I acknowledged it several times, but I've made two specific separate suggestions as to how to work around that reality. I could ask why it's so hard for you to acknowledge that truth and perhaps offer your own suggestions.

That said, it's somewhat of a mystery to me why Company A can sue Company B because Company B provided me tools that let ME identify and remove Company A's software.

I'm specifically NOT talking about cheating the spyware-using Company A by disabling ads (which would violate the EULA). I'm talking about identifying Company A's product as a spyware bundle, notifying the user, and allowing the user to choose not to install Company A's software.

Oh, you say, Company B's not allowed to say Company A is spyware; that's defamation or something. What a load of crap. I understand that's the litigious reality of it, that Company B will have to fight, but it's just crazy. It's as if movie reviewers were held legally accountable for saying Star Wars sucks.

Eric tried to explain all this to me once, but either it didn't really make sense or my skull was too thick.

-- B
--
In a realm outside causality and function]]> http://www.dslreports.com/forum/remark,13960255 Fri, 22 Jul 2005 17:43:33 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13960200 roamer_1 : Eric,

There is GREAT validity in B's assertion: "Because it's from WhenU".

I can't help but believe that any wiggling or "gray area" can only be beneficial to adware and spyware companies- It is absurd to believe that these companies are trying to protect their "name", as their past practices have damaged their names FOREVER.

A good point was made (sorry, forget who made it) that it is much simpler to set up a secondary company to sell legit software out of, or to reorganize under a different name to continue drive-bys with... as many have done (Claria is a good example).

The only readily apparent reason for classification is to allow a condition wherein adware software has a possibility to survive, and once instituted, one can easily see a slippery slope developing- Levels of complication in definition make tracking and "adjustments" harder to do in the long run... One can imagine anti-ad software makers eventually getting thousands of applications for adjustment of classification per month or per week, overwhelming the anti-ad people's ability to cope. Soon bloody well everything will be set to ignore until you can get around to re-determining class....

I really don't care about how you wish to classify anything, it is really the default action that matters..

When I use an anti-virus program I expect it to remove all viruses by default- not just the really, really bad ones.

In the same way all software is judged by it's performance "out-of-the-box", Anti-ad / anti-spy should work the same way, with the default stock installation ready to remove EVERYTHING from every classification.

If you wish to add an option for the user to ignore certain items or items under a class number of [1,2,3,etc], that would be fine- but the default should set to "whack 'em all!"

Then an installing adware would have to inform the user in no uncertain terms that it detects [Spybot S&D, AdAware, CounterSpy, MSAS, etc] installed on the box, and that the user must set it to ignore the offender or lower the ignore level to it's class... (Hey, we could call it the ignorance level :)) thus informing the user.

When in time the poor ill-informed user stuffs his box full of adware and is at a loss as to why it is so slow, He can pay me my $45 house call and I will crank up [Spybot S&D, AdAware, CounterSpy, MSAS, etc] and reset to "Whack 'em all", clean out all the crap, turn my collar around, and preach to him incessantly that he is never, never to lower the "allow classification" option...

That way I can trust you, ad\spyware will continue to prey on ill-informed users, and everything will be back to normal :)

(I have marked your WhenU stuff fo later reading...)
Bruce]]> http://www.dslreports.com/forum/remark,13960200 Fri, 22 Jul 2005 17:37:19 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13960066 eburger68 : Jim:

You wrote:

said by StraitShoot See Profile:

Eric, you're playing "solid evidence", where is the analysis flawed, or have you read the analysis...games now, eh?
It's not a "game" to request solid evidence or good reasons. Evidence and reasons are the minimum expected from folks who want to maintain that Sunbelt's wrong. If you can't provide it, then you don't have good grounds to maintain that Sunbelt has erred.

You still want to maintain Sunbelt has misanalyzed those three particular WhenU programs? Fine. Then tell me WHY.

said by StraitShoot See Profile:

Say what you wannna say, man, but a lot of people don't know better, and won't move it from "ignore" to remove... Wheras, by having it in "remove" Sunbelt was more protecting of the average user (not us exalted DSLR members, LOL) now that level of protection is not as strong.. If I have the brains to install WhenU, then in detection, I can choose to remove... or ignore...

B, I'm totally with you on this one..
So, let's suppose that some user picked up WhenUSearch along with a free screensaver or wallpaper. The thing's been on the desktop for a few days. Maybe this person finds it slightly annoying, maybe not.

This user then scans with CounterSpy and see sees the "Recommended Action" of "Ignore." And let's assume worst case scenario where the user places all faith in that, reads nothing of the additional descriptive text presented about WhenUSearch, and decides not to remove the WhenUSearch bar.

My question to you, Jim, is this: what will happen? Can you tell me what ills will befall the user who who leaves WhenUSearch installed?

Eric L. Howes]]> http://www.dslreports.com/forum/remark,13960066 Fri, 22 Jul 2005 17:21:31 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13960022 fatdcuk : Reality check for the dreamers and ideaologists here !

You cannot target a company because of past exploits especially if they have brought out new more compliant software even if they dispensed some majot SH*T in the past.

The Vendor will get ripped to shreds in legal action subsequently:(

Yes we all bear a grudge against Gator and such puke but if claria brings out software that is'nt adware/spyware you cannot target it like spyware/adware.End of story.

What part of that can you people not understand ?

Eric has challenged you to identify problems with certain software and all you can do is say well its from "WhenU" thats the problem.

Being of a brand name is not enough to warrant removal and would be indefensible in a court of law reguardless of past exploits.

Why is that so hard for you to grasp ?

:(]]> http://www.dslreports.com/forum/remark,13960022 Fri, 22 Jul 2005 17:15:11 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13959982 ctrip : Personally, this reclassification doesn't really bother me. The program still detects the stuff, right? So I can just change their recommended "ignore" to remove. No biggie.

This is the same attitude I had about 3 weeks ago when I first saw the thread started by the Sunbelt shill about Microsoft Antispyware "downgrading" Claria recommendations.

»MS Downgrades Claria Detections

I thought the same thing then. It still gets detected I just change their "ignore" to remove...No biggie.

But what I do find entertaining, is that during the course of that 8 page thread all the outrage directed at MS and all the praise heaped on Counterspy who would never do such a rotten and evil thing.
--
Spread Internet Explorer! - The browser you can trust to not have those annoying Firefox twits pushing it!]]> http://www.dslreports.com/forum/remark,13959982 Fri, 22 Jul 2005 17:11:03 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13959853 StraitShoot :
said by John2g See Profile:

I have never installed CounterSpy, so I doon't know exactly how it works.

However, from reading this thread, it doesn't seem all the difficult to change the setting (once it is detected) from ignore to remove. It is not exactly rocket science.
Eric, you're playing "solid evidence", where is the analysis flawed, or have you read the analysis...games now, eh?

Say what you wannna say, man, but a lot of people don't know better, and won't move it from "ignore" to remove... Wheras, by having it in "remove" Sunbelt was more protecting of the average user (not us exalted DSLR members, LOL) now that level of protection is not as strong.. If I have the brains to install WhenU, then in detection, I can choose to remove... or ignore...

B, I'm totally with you on this one..]]> http://www.dslreports.com/forum/remark,13959853 Fri, 22 Jul 2005 16:57:57 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13959773 John2g : I have never installed CounterSpy, so I doon't know exactly how it works.

However, from reading this thread, it doesn't seem all the difficult to change the setting (once it is detected) from ignore to remove. It is not exactly rocket science.
--
Better to remain silent and be thought a fool, than to speak and remove all doubt. ]]> http://www.dslreports.com/forum/remark,13959773 Fri, 22 Jul 2005 16:49:23 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13959769 eburger68 : Jim:

You wrote:

said by StraitShoot See Profile:

1. Okay, so Sunbelt is "Notifying" us users? We as users are notifying Sunbelt our opinion is that Sunbelt is wrong, and we do not think Sunbelt should classify WhenU as lowrisk...
Why? I've been asking this question all day now, and neither you nor anyone else has come up with a solid reason to continue classifying WhenUSearch, Weathercast, and ClockSync as something higher than "Low risk."

Also, would you please report Sunbelt's decisions accurately? Sunbelt did not "classify WhenU as low risk" -- it classified three specific programs as "Low risk," while leaving WhenU's main adware application as "Moderate risk."

said by StraitShoot See Profile:

2. It looks like no matter what, Sunblet should have left everything the way they were, now I, along with others, it seems, lost a little of that "trust" I previously had.. I trialed CounterSpy for two weeks, and I was close to buying it.. Now, I think I'll wait it out...
Again, WHY? Simply repeating ad nauseam that you don't like the decisions isn't going to be convincing, if you can't provide good reasons and solid evidence to believe you're right.

Have you read the Sunbelt analysis, Jim? Can you tell us point by point where that analysis is flawed or what evidence we've overlooked?

Eric L. Howes]]> http://www.dslreports.com/forum/remark,13959769 Fri, 22 Jul 2005 16:49:05 EDT Re: Sunbelt Adjusts WhenU Detections http://www.dslreports.com/forum/remark,13959734 hpguru : Thank