Antivirus: it's as bad as malware itself

Send to a friend Print

Help more people find out about this story

Del.icio.us
StumbleUpon

APC administrator24 July 2006, 10:16 AM

When I got my new Dell the other day I was staggered to discover that it was seemingly impossible to uninstall the bundled anti-virus package. This software was so deeply rooted into the PC that after a concerted effort, I had to reboot into safe mode. In my opinion, this is as bad as malware itself.


One of the things that I hate about Dell computers is the pre-installed software. Every Dell that ships is stacked with all sorts of garbage, from media players to broadband trial offers.

Unfortunately, I've never had the heart to tell Dell this, because allowing every vendor and their dog to stack trial software onto new systems no doubt helps put some money in Dell's pocket to allow them to provide the aspect of Dells that I really love - the low, low price.

So it was with some trepidation that I booted my new notebook for the first time. Entering Windows XP, I was greeted with a sight that looked astoundingly like when Homer Simpson makes a web page, and just stacks it with blink tags and animated gifs.

The spyware is clearly in control of this IE session (source: Wikipedia)

After some coaxing, I managed to remove almost all the unwanted applications. Except for the worst of the bunch: the all-encompassing security and antivirus package installed on the PC.

It's a personal computer, and personally I'd rather use Zonealarm and AVG Antivirus to protect it than go totally overboard with this whopping great big-brand package.

So, I hear you say, just uninstall it, and put Zonealarm and AVG on instead. Would that I could, gentle readers.

Attempts to uninstall the suite via the add/remove dialogue in the Windows control panel failed, with the system indicating that an executable belonging to it was still in memory and couldn't be deleted.

Okay. So I right click the system tray control and open the control centre of this suite. I disable all components of the suite, then run the uninstaller.

Same error.

Fine. CTRL + ALT + DEL, terminate process tree, run the uninstaller.

Same error.

A quick browse online, and I discovered many people in the same boat. The only solution available to the problem is to boot your PC into safe mode, and then run the uninstaller.

I contend that this is entirely unreasonable. How dare a program, which I didn't ask to have installed in the first place, embed itself so deeply into my system that it requires safe mode to uninstall?

Isn't that the definition of malware?

Someone seems to think so. Recently, a second class-action has been started against Microsoft because of WGA, and the primary claim of the complainants revolves around the idea that, regardless of what it is used for, the phoning home aspect of WGA makes it spyware. Interestingly, it's a claim that appears to be gaining traction around the web.

It's a good point. Go to the FAQ page for Windows Defender, and you'll find this definition (bolding added for drama):

"Spyware is software that can display advertisements (such as pop-up ads), collect information about you, or change settings on your computer, generally without appropriately obtaining your consent."

So according to Microsoft, WGA is spyware. That page may need to be removed before the lawyers find it, especially as the question of whether WGA is spyware is arguably the fact upon which the case will be decided.

Forgetting all of that for a second, the question I have is: why do vendors feel the need to do this?

I'm primarily a Linux user, and I've honestly never come across a program that can monopolise my system the way that Windows applications can. Install Aptitude, YaST, RPM and YUM all at once if you want, and they're complete software management solutions in themselves.

In the case of the vendor of this trial internet security suite, I can't help thinking the difficulty in uninstalling it was an attempt to push me into buying a subscription from them. Putting aside the fact that I think it's immoral to charge people for updates which they require in order for your software to remain effective, those kind of strong-arm tactics usually result in me boycotting any and all of a company's products.

Sure, it's a dog-eat-dog world in internet security: it's such a crowded market, and there's only so much FUD people can bear before the become suspicious of what you're up to.
Hopefully Vista will help. LUA should mean that applications are never operating in a place where they can take such an unwelcome level of control over your OS. However, with Microsoft jumping on the malware-creation bandwagon themselves, it may be a case of one step forward and two steps back.

And of course, no amount of LUA controls are going to stop mass-market PC builders from loading up their system images with all sorts of preinstalled crap.

Dear Big Vendor, it's a personal computer. Let me make it clearer for you. That means it's mine, not yours.


Post your comment



Comments

RSS feed Email alert

Tim Melgrave:

AAAAAAARGH this is so true. The worst bit is that the restore partitions on these systems are equally gummed up. So if you ever need to restore your system you get all the crud back again. And that is your official Windows licence... you don't get a plain install CD any more.

29 February 2008, 8:28 PM (1 year ago)report abuse Send to a friend reply

Dharmendra:

The world of computer is guiding or misguiding since the spyware has infilitrated into the PCs, there is flood of anti-virues and anti-spyware firms claiming to root out the nastiest stuffs, but most of the time the effect go quite revese by providing computer more and more probles that is why use your common sense instead of technical to choose any anti-virus or anti-spyware products in the hotchpotch world of computer where even the big buddies like Micro not trustable.

29 February 2008, 8:28 PM (1 year ago)report abuse Send to a friend reply

CogX:

AV software is not suppose to be easy to remove, since most malware first tries to disable security software which actually might prevent it from fully installing or point out it existence on the system.
As for Dell, having volume licensing which lets me install a fresh, clean copy of XP on every computer I support, I haven't used a Dell installation in probably 6 or 7 years now, for the very reason of their kludge.

However, the sentiment behind Dell's image is that of at least trying to help these poor non-IT Pro souls expecting to be able to use Windows without it going to pot on them. Seriously, I have come to conclusion that only IT Pros are qualified to use Windows at this point. Everyone else should be buying a Mac.

29 February 2008, 8:28 PM (1 year ago)report abuse Send to a friend reply

clippy:

I've got to say, antivirus packages have a long way to go in terms of user-friendliness. Until we get a self-managed system that automatically takes care of updates it's just a pain. I'd be interested to see how Microsoft's OneCare system works.

29 February 2008, 8:28 PM (1 year ago)report abuse Send to a friend reply

cyber_rigger:

Dell should sell desktop Linux like these companies.

http://snipurl.com/ttlq

29 February 2008, 8:28 PM (1 year ago)report abuse Send to a friend reply

fire_all:

While I also don't like buying new PCs with preinstalled software which are actually trials that you have to pay for, what I dislike most is the fact that my HP PC recently crashed. The Hard disk is totally mechanically dead. How can I recover my original Windows XP License / Installation now? The recover partition is gone and the warranty recently expired on my newish computer. How do I get my OEM Windows license back that I paid for originally? Any ideas?

29 February 2008, 8:28 PM (1 year ago)report abuse Send to a friend reply

DjLizard:

"How do I get my OEM Windows license back that I paid for originally? Any ideas?"

You don't. You have to order recovery discs from HP. 1-800-HP-INVENT

29 February 2008, 8:28 PM (1 year ago)report abuse Send to a friend reply

cyber_rigger:

"While I also don’t like buying new PCs with preinstalled software which are actually trials that you have to pay for"


Build you own from a no-OS machine.


Companies selling preinstalled Linux and no-OS

http://lxer.com/module/forums/t/23168/

29 February 2008, 8:28 PM (1 year ago)report abuse Send to a friend reply

RannXerox:

My corp got a deal with our AV software provider, one of these "big box" companies with their hunking packages that runs about 10 processes and such. The employees could get as many copies as they wanted for $10 each and get updates as long as the corp kept the contract (which is like, forever). Nope.

I stick with AVG on my home systems with ZoneAlarm.

29 February 2008, 8:28 PM (1 year ago)report abuse Send to a friend reply

DavidH:

My beef about AV software is that it breaks - and breaks it's system - more often than anything else (by a ration of about 6 to 1). That includes bugs that crashed the PC so badly a change of product was the next thing one did, malfunctions on version upgrade or OS upgrade, and simple corrupted AV files. The vendors seem happy to say "reinstall" or "upgrade" in this situation, when the thing that makes one want to spend more money a product is a good experience all round - and a bad experience when it's broken blows away any feel-good one gets when it goes as advertised. If the vendors can their fix AV when it's broken with same sort of 'run smoothly process' as happens when it installs, then it's good. Reviews of products should include assessments of this in their checklists.

Meanwhile, I'm voting with my money. Anyone know of an AV system that has a good recovery mechanism that actually works?

DavidH

29 February 2008, 8:28 PM (1 year ago)report abuse Send to a friend reply

Ian Rudge:

It's worse than that. Some OEMs are now removing the uninstall entries from the registry to prevent the preinstalls being removed, so (for example) if you want virus-protection, then you have NO choice but to use the foisted one.

It's time the Trading Standards people investigated this whole issue of preloading. If you've paid for Windows, then you are entitled to a *mint* copy of Windows.

29 February 2008, 8:29 PM (1 year ago)report abuse Send to a friend reply

Joe Schlabotnik:

Just say which software it is. It's McAfee Security Center, don't beat around the bush.

McAfee makes this deliberately difficult. They don't tell you anywhere in the software (Help/About tab for example) when the demo expires, so you'll be surprised when it does and have to make a snap decision about renewing an antivirus subscription. They make it almost impossible to remove for any novice (it was a pain in the rear for me, and I'm a systems administrator). They have designed this software to tie someone down to their product, and make it difficult to choose someone else. And to top it off, their product is bloatware and doesn't work as well as some other cheap or free products, IMO.

Let people know who makes this software, so that we know who to avoid. Don't leave us in the dark. At least when Dell used Symantec trialware by default, it was clear when it expired, and was uninstallable by the average user.

29 February 2008, 8:29 PM (1 year ago)report abuse Send to a friend reply

Fduch:

And now Symantec wants to sue MS for not letting them hack kernel any more in Vista...

29 February 2008, 8:29 PM (1 year ago)report abuse Send to a friend reply

ROBBob:

Definitions of Spy-ware include:
1. Unwanted pop-ups or ads,
2. Slowing down your computer while accessing
its own web sites, and by reinstalling its own
.exe programs,
3. Sending information about your computer,
your viewing history and preferences, and your
keystrokes for their own benefit.
4. Automatically updating its own programs so that
it do all of the above more completely for its own
benefit.
This is what Microsoft, Norton, Google, Yahoo do
all the time. They are the worst of the Spy-ware.
I have turned off all automatic updates, removed all
Run processes on startup from the Registry,
removed all Browser Helper Objects from the Registry,
remove any recent .exe files that didn't come
with the OS, and use Merijn's delete files on
startup to remove unneeded programs that can't be
removed while the application is running.
And I have a system that is Spyware free with no
help from any Spyware program (which can be spyware
themselves).



29 February 2008, 8:31 PM (1 year ago)report abuse Send to a friend reply

Anonymous222:

That's ridiculous. How can you be sure you don't have any spyware if you have no means of checking?

Disabling security updates will make your system more vulnerable to infection. Talk about flawed logic.

29 February 2008, 8:44 PM (1 year ago)report abuse Send to a friend reply

martyfmelb:

Any spyware which is on the system usually makes itself painfully obvious through pop-up ads, additional start menu items, and/or extra desktop icons.

Spyware tends to live in exe's which you can locate easily enough through the various startup areas on the system: Startup folder, HK(CU|LM)\Software\Microsoft\Windows\CurrentVersion\Run(Once)?
etc. Or as a browser toolbar dll. Very rare to find other forms.

Thus, if your registry is free of unwanted startup processes (of course, you need to establish this properly by looking at the nature of each program yourself) and you're not getting outward signs of infection, you should be ok.

There isn't much covert spyware out there. It's viruses you really need to be careful of.

29 February 2008, 8:44 PM (1 year ago)report abuse Send to a friend reply

martyfmelb:

Wait, no, there *is* covert spyware out there. I just found some on my system on the day it got there, thanks to habitual use of the Task Manager allowing me to notice some extra crap running in there.

So, I caught and removed the newly discovered ShipUp-F Spyware worm. It uses (downloads?) Google Desktop and indexes recently used files and dumps the index results onto portable disks, as well as a copy of itself.

Wow. Now we have to watch out for *everything* :(

29 February 2008, 8:47 PM (1 year ago)report abuse Send to a friend reply

Anony mous:

whats funny is this site itself contains threats to you by way of Javascript based spyware from Omniture and Nielson tracking , view-source and see the script calls yourself (at the bottom), look at the all the click tracking and for those who are code savvy read the Omniture code and see how much data they can extract from just your browser and javascript (even logs keystrokes and form contents) all for commercial exploitation just like bargain buddy, viruses and the like.

People think that for an application to be classed as spyware it has to be installed on your computer but with the advent of powerful javascript and a web browser thats no longer the case



29 February 2008, 8:32 PM (1 year ago)report abuse Send to a friend reply

anonymous user Anonymous user


Tags