McAfee Site Advisor versus Trend Micro's TrendProtect..
I have just finished reading the latest entry on the McAfee Site Advisor blog that says, as introduction:
"For the past couple of weeks, we've been seeing an increase in spam advertising a fake application called WinFixer."
Yay them. I've been noticing a massive increase in spamming, especially via blog comments, for several months.
McAfee then go on to say:
"Another variant of the same application goes under the name of PrivacyProtector. The PrivacyProtector website is currently rated green by SiteAdvisor, because it hasn't had any downloads for us to test. However, we'll be overriding that to red shortly, based on its association with WinFixer."
Ok, so here's a problem with McAfee's Site Advisor, something that has bothered me for a long time. Site Advisor's reputation tests suffer from a very basic flaw if a rip-off site like PrivacyProtector is not listed simply because it has no downloads available for testing. What about the fact that PrivacyProtector shares an IP address with some very shonky sites? Check this out:
Pinging www.errorsafe.com [126.96.36.199]
Pinging www.winantispyware.com [188.8.131.52]
Pinging www.winantivirus.com [184.108.40.206]
Pinging www.privacyprotector.com [220.127.116.11]
At the time of writing, McAfee Site Advisor is *still* listing PrivacyProtector as green, whereas Trend's competitor product, TrendProtect, is listing the site as red.
So why is Trend ahead of the game on this one? Because Trend is a "real time" service, and it uses additional checks not included by McAfee when assessing a site's reputation.
When people ask me what service I advise be used as an additional layer of reputation information to compliment to IE7's phishing filter and extended validation certificate support, I direct them to TrendProtect (available at http://www.trendsecure.com/portal/en-US/free_security_tools/trendprotect.php?page=download)