Spyware Sucks
“There is no magic fairy dust protecting Macs" – Dai Zovi, author of “The Mac Hacker’s Handbook"

McAfee Site Advisor versus Trend Micro’s TrendProtect..

April 28th 2007 in Uncategorized

I have just finished reading the latest entry on the McAfee Site Advisor blog that says, as introduction:


“For the past couple of weeks, we’ve been seeing an increase in spam advertising a fake application called WinFixer.”


Yay them. I’ve been noticing a massive increase in spamming, especially via blog comments, for several months.


McAfee then go on to say:


“Another variant of the same application goes under the name of PrivacyProtector. The PrivacyProtector website is currently rated green by SiteAdvisor, because it hasn’t had any downloads for us to test. However, we’ll be overriding that to red shortly, based on its association with WinFixer.”


Ok, so here’s a problem with McAfee’s Site Advisor, something that has bothered me for a long time.  Site Advisor’s reputation tests suffer from a very basic flaw if a rip-off site like PrivacyProtector is not listed simply because it has no downloads available for testing.  What about the fact that PrivacyProtector shares an IP address with some very shonky sites?  Check this out:


Pinging www.errorsafe.com [66.244.254.64]


Pinging www.winantispyware.com [66.244.254.64]


Pinging www.winantivirus.com [66.244.254.63]


Pinging www.privacyprotector.com [66.244.254.63]


At the time of writing, McAfee Site Advisor is *still* listing PrivacyProtector as green, whereas Trend’s competitor product, TrendProtect, is listing the site as red.



So why is Trend ahead of the game on this one?  Because Trend is a “real time” service, and it uses additional checks not included by McAfee when assessing a site’s reputation. 


When people ask me what service I advise be used as an additional layer of reputation information to compliment to IE7’s phishing filter and extended validation certificate support, I direct them to TrendProtect (available at http://www.trendsecure.com/portal/en-US/free_security_tools/trendprotect.php?page=download)



10 comments to...
“McAfee Site Advisor versus Trend Micro’s TrendProtect..”

Brian Madsen
wrote on April 29th, 2007      

Hey Sandi,

I just bought a Dell XPS M1710 laptop about 2 months ago or so (i think) and it came with a trial of McAfee. Prior to this i’d never used McAfee before so took the trial for a run.

Overall, i must say i’m terribly dissapointed with McAfee – the first thing i did was visit the sites which Trend notified me contained spyware/malware – even went so far as to click on some of the links we spoke about some time back on MSN – and McAfee just happily trolled over to the sites without so much as a notification that the site “may” contain malicious content.

So, regardless of the Vista support from Trend, i don’t think i’ll be going back to ever using McAfee again…



Lucas
wrote on April 30th, 2007      

What about Link Scanner of Exploit Labs?
It’s true that TrendProtect only relies on Google’s database?
Thanks.



sandi
wrote on April 30th, 2007      

Trend does NOT rely on Google’s database – it uses a series of checks (technical and reputational) when assessing a site’s safety.

I haven’t looked at Link Scanner, but will put that on my list of ‘to do’s’.



stevek
wrote on May 7th, 2007      

Hi Sandi. I run Site Advisor but was intrigued by your remarks about Trend Protect so I thought I’d give it a go. However unfortunately I find that Trend Protect will not highlight its findings in Searches with my Ad Muncher program activated, whereas Site Advisor will. Great shame as I can see that Site Advisor’s method is a little less tight than Trend Protect, but Ad Muncher is too good a program to dispense with.
Cheers



stevek
wrote on May 7th, 2007      

Just to follow up on my previous comment, I have just started trialling Link Scanner and it did flag up PrivacyProtector.com as a red no-no when I checked that site (and also Link Scanner works fine with Ad Muncher!).



sandi
wrote on May 7th, 2007      

Hi Stevek

That’s interesting feedback; I’ll pass it on to Trend.



trojan horse
wrote on June 10th, 2007      

siteadvisor say privacyprotector is a spyware website see on: http://www.siteadvisor.com/sites/privacyprotector.com



sandi
wrote on June 11th, 2007      

@ Trojan Horse.

I should jolly well hope so! It’s now June and this article went live in April.



Philippe
wrote on July 17th, 2007      

I like Site Advisor. I use the plus version and it works well blocking sites before I get to them. You can give feedback and improve the company’s database.

Correct me if I am wrong but for Trendprotect, I need to install the security suite to block sites that my PC shouldn’t go to. Since I use another security suite, this doesn’t work for me.



sandi
wrote on July 17th, 2007      

@Philippe,

The TrendProtect toolbar is a stand alone install:

http://www.trendsecure.com/portal/en-US/free_security_tools/trendprotect.php


Just what does this say about Japan’s education standards, at least when it comes to what is a sheep, and what is a dog…
Thousands of Japanese have been swindled in a scam in which they were sold Australian and British sheep and told they were poodles.
The scam was uncovered when Japanese film star Maiko […]

Previous Entry

Too funny:http://www.irintech.com/x1/blogarchive.php?id=954

Next Entry

Archives