The Spycar Project, Test Your Security Apps

deary65

According to PC World:
QUOTE
Spycar "is a suite of utilities that probe how your antispyware or antivirus app reacts to the behaviors spyware engages in: Changing the Windows Hosts file (which could redirect your browser to malicious sites), adding favorites to the Internet Explorer menu, or changing parts of the Windows Registry. Any worthwhile security scanner should watch for these warning signs and prevent these actions."


That sounded interesting so I gave it a try. My report (issued by Spycar):

Spycar Scoring
HKCU_Run : Spycar change blocked
HKCU_RunOnce : Spycar change allowed
HKCU_RunOnceEx : Spycar change allowed
HKLM_Run : Spycar change blocked
HKLM_RunOnce : Spycar change blocked
HKLM_RunOnceEx : Spycar change allowed
IE-HomePageLock : Spycar change allowed
IE-KillAdvancedTab : Spycar change allowed
IE-KillConnectionsTab : Spycar change allowed
IE-KillContentTab : Spycar change allowed
IE-KillGeneralTab : Spycar change allowed
IE-KillPrivacyTab : Spycar change allowed
IE-KillProgramsTab : Spycar change allowed
IE-KillSecurityTab : Spycar change allowed
IE-SetHomePage : Spycar change allowed
IE-SetSearchPage : Spycar change allowed
AlterHostsFile : Spycar change allowed
Doesn't look good, does it? I run more or less the same apps as everybody else here. Ad-Aware, a², AVG, ewido, Spybot, Spyware Blaster, and Windows Defender.All up to date.

Particularly annoying is the claim, presumably accurate, that Spycar was able to change my hosts file.
http://www.spycar.org/Welcome%20to%20Spycar.html
http://blog.washingtonpost.com/securityfix/2006/05/your_spycar_ran_over_my_dogma.html

woo

odd that i run slightly less than you but get different results! mine blocks the runonce too.

Rex_Mundi

I failed on 8 tests (all IE related). Everything else was blocked by AdWatch (paid for realtime scanner addon to AdAware). This is on my old computer, I'll try the 64bit later.

I'm so glad I don't use IE.

IE-HomePageLock : Spycar change allowed
IE-KillAdvancedTab : Spycar change allowed
IE-KillConnectionsTab : Spycar change allowed
IE-KillContentTab : Spycar change allowed
IE-KillGeneralTab : Spycar change allowed
IE-KillPrivacyTab : Spycar change allowed
IE-KillProgramsTab : Spycar change allowed
IE-KillSecurityTab : Spycar change allowed

woo

had a poke around spybot and there is a setting to prevent the IE tab changes. switch it on and blocks the changes.

the host file changes test i'm not sure about - as my host file is read only and the protection in spybot is switched on. looking at the host file properties it hasn't changed in 2 weeks.