SwiftVets.com Forum Index SwiftVets.com
Service to Country
 
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 

Microsoft Spyware Beta 1

 
Post new topic   Reply to topic    SwiftVets.com Forum Index -> Geedunk & Scuttlebutt
View previous topic :: View next topic  
Author Message
Me#1You#10
Site Admin


Joined: 06 May 2004
Posts: 6503

PostPosted: Wed Feb 16, 2005 6:16 pm    Post subject: Microsoft Spyware Beta 1 Reply with quote

I recently installed and ran a scan of my system using Microsoft's recently obtained spyware program from Giant software.

I'm pretty paranoid when it comes to PC security (software and hardware firewalls, Ad-Aware, Spybot, Norton Anti-virus) and try to keep my system as secure as I can. However, the MS Spyware beta recognized 5 villains that were not caught by ad-aware or spybot (perhaps they were residuals and I don't believe were active).

Nevertheless, I was somewhat impressed that it managed to catch them and thought others here might like to give it a try...nice GUI as well.

You can check it out at Microsoft Windows Antispyware Beta.

Just as an FYI, here's what it caught on my system....

Quote:
Spyware Scan Details
Start Date: 2/15/2005 11:00:38 PM
End Date: 2/15/2005 11:15:02 PM
Total Time: 14 mins 24 secs

Detected Threats

BroadcastURBAN tuner Browser Plug-in more information...
Details: BroadcastURBAN tuner is an Internet Explorer browser helper object adware browser redirector.
Status: Removed
Severe threat - Severe threats typically are remotely exploitable vulnerabilities, which can lead to system compromise. Successful exploitation does not normally require any interaction and exploits are in the wild. There exists a high possibility of potential system damage or security flaw. Attacker has complete control over your computer or install new software on your machine.

    Infected files detected
    c:\windows\downloaded program files\hiwire.inf
    c:\windows\downloaded program files\hwreal.exe


Private Access Plugin Dialer more information...
Details: Private Access Plugin is a premium-rate dialer that may be installed through pop-up advertisements, browser exploits and others.
Status: Removed
Severe threat - Severe threats typically are remotely exploitable vulnerabilities, which can lead to system compromise. Successful exploitation does not normally require any interaction and exploits are in the wild. There exists a high possibility of potential system damage or security flaw. Attacker has complete control over your computer or install new software on your machine.

    Infected files detected
    c:\windows\downloaded program files\installer.inf


GonnaSearch Toolbar Adware more information...
Details: GonnaSearch Toolbar changes your search page and other search elements to its own site.
Status: Removed
High threat - High risk threats typically are remotely exploitable vulnerabilities, which can lead to system compromise. Successful exploitation does not normally require any interaction. May open up communication ports, use polymorphic tactics, stealth installations, and/or anti-spy counter measures. May us a security flaw in the operating system to gain access to your computer.

    Infected files detectedc:\program files\internet explorer\toolbar\toolbar.hta
    c:\program files\internet explorer\toolbar\paint.gif
    c:\program files\internet explorer\toolbar\toolbar.gif
    c:\program files\internet explorer\toolbar\tbwallpaper.ico
    c:\program files\internet explorer\toolbar\none.gif
    c:\program files\internet explorer\toolbar\twpicon.gif
    c:\program files\internet explorer\toolbar\tbwallcr.ico
    c:\program files\internet explorer\toolbar\tbwallbw.ico
    c:\program files\internet explorer\toolbar\thumbs.db

    Infected folders detected
    c:\program files\internet explorer\toolbar



IETray Browser Hijacker more information...
Details: IETray is an Internet Explorer browser helper object that includes a side search bar.
Status: Quarantined
High threat - High risk threats typically are remotely exploitable vulnerabilities, which can lead to system compromise. Successful exploitation does not normally require any interaction. May open up communication ports, use polymorphic tactics, stealth installations, and/or anti-spy counter measures. May us a security flaw in the operating system to gain access to your computer.

    Infected registry keys/values detected
    HKEY_CURRENT_USER\software\microsoft\internet explorer\menuext\&define
    HKEY_CURRENT_USER\software\microsoft\internet explorer\menuext\&define contexts 17
    HKEY_CURRENT_USER\software\microsoft\internet explorer\menuext\&define C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM


PowerReg Scheduler Spyware more information...
Details: PowerReg Scheduler is a registration system used by some legitimate software programs.
Status: Quarantined
Moderate threat - Moderate threats may profile users online habits or broadcast data back to a server with 'opt-out' permission. In most cases this type of threat is more along the lines of commercial type adware that offer a premium service in exchange for tracking your user online performance.

    Infected files detected
    c:\system volume information\_restore{dd43356c-460d-4201-833f-bb0831991c97}\rp166\a0021149.exe
    c:\recycled\dc42.exe


Detected Spyware Cookies
No spyware cookies were found during this scan.
Back to top
View user's profile Send private message
1991932
Lance Corporal


Joined: 02 Oct 2004
Posts: 381
Location: Massachusetts

PostPosted: Thu Feb 17, 2005 2:55 pm    Post subject: doubting Thomas Reply with quote

It's free.

What's the catch?
_________________
Former "War Criminal"
Back to top
View user's profile Send private message
GoophyDog
PO1


Joined: 10 Jun 2004
Posts: 480
Location: Washington - The Evergreen State

PostPosted: Thu Feb 17, 2005 8:36 pm    Post subject: Reply with quote

The catch, if you will, is that if you do not pay attention to the install prompts you can inadvertantly start up automatic updates (if not already there), and you can "subscribe" to an anti-spyware network which in itself is sort of a spyware when you think about it.

Not to mention you are required to "register" or validate your microsoft installation.

Is it a good product? Time will tell.

I simply have a bit of heartburn when it comes to Microsoft having this type of power. The cynical in me says that if M$oft doesn't like an application or add-on, they could easily slam a spyware tag to it. M$oft's track record, in my opinion, is just plain terrible.

As I said, time will tell.
_________________
Why ask? Because it needs asking.
Back to top
View user's profile Send private message
Me#1You#10
Site Admin


Joined: 06 May 2004
Posts: 6503

PostPosted: Thu Feb 17, 2005 9:20 pm    Post subject: Reply with quote

GoophyDog wrote:
The catch, if you will, is that if you do not pay attention to the install prompts you can inadvertantly start up automatic updates (if not already there), and you can "subscribe" to an anti-spyware network which in itself is sort of a spyware when you think about it.

Not to mention you are required to "register" or validate your microsoft installation.


All correct Gooph, and I DO pay particular attention to "prompts" during the installation of ANY software, to include, perhaps especially, MS...and I share your cynicism as a healthy approach to operating these days. Wink

I did, in fact, reject the "automatic" updates and "membership" in the "anti-spy network" as I do with most programs that offer to "help" me in those regards...but I did appreciate the fact that it caught vestiges of 5 bad guys that 2 notable anti-spyware programs appear to have overlooked. Wink
Back to top
View user's profile Send private message
DaveS
Ensign


Joined: 19 Sep 2004
Posts: 61

PostPosted: Thu Feb 17, 2005 11:45 pm    Post subject: I downloaded it based on your post and have run it several Reply with quote

times. So far it has no founc a single known piece of spyware. I find that strange.
Back to top
View user's profile Send private message
DaveS
Ensign


Joined: 19 Sep 2004
Posts: 61

PostPosted: Thu Feb 17, 2005 11:49 pm    Post subject: Let me try that in english. Reply with quote

It has not found a single piece of known spyware.
Back to top
View user's profile Send private message
Navy wife
Research Director


Joined: 09 Aug 2004
Posts: 353
Location: Arlington, VA & Ft. Worth, TX

PostPosted: Fri Feb 18, 2005 4:46 am    Post subject: Reply with quote

The Microsoft program has not found anything on my machine either. I'm like you all and do not sign up for automatic updates etc.

However, I do run spybot and spyware blaster, and one of these always alerts me when something is detected when I get on a commercial website that is labeled a threat. I always tell it not to download. Don't know if that is what has helped, but my machine seems to be clean lately! I also run lavasoft's ad-aware, winpatrol, and cleanup! Good little programs.
Back to top
View user's profile Send private message
SBD
Admiral


Joined: 19 Aug 2004
Posts: 1022

PostPosted: Fri Feb 18, 2005 5:00 am    Post subject: Reply with quote

It's still in Beta and is already a target for virus writers.

Virus Writers Target Microsoft Anti-Spyware

Malware aimed at disabling Microsoft Corp.'s anti-spyware product has been discovered by security experts who expect the virus to be the first of many to follow.


By Antone Gonsalves, TechWeb News
Feb. 10, 2005
http://www.informationweek.com/story/showArticle.jhtml?articleID=60300219

Malware aimed at disabling Microsoft Corp.'s anti-spyware product has been discovered by security experts who expect the virus to be the first of many to follow.

The Trojan horse, which is also designed to steal online banking passwords from Windows computers, was discovered by security experts at Sophos Plc and Symantec Corp.

The virus, called Troj/BankAsh-A and PWSteal.Bankash.A, disables Microsoft AntiSpyware, which is available only as a beta download from the company's website. The malicious code attempts to suppress warning messages displayed by the product and to delete all files within the program's folder.

Experts believe this virus is only the beginning of what will be a salvo of malware attacks on Microsoft security products.

"It's likely that these attacks will continue," Gregg Mastoras, senior security analyst for Sophos, said Thursday. "This is the beginning of a wave of attempts to undermine the effectiveness of this new product."

Beyond targeting Microsoft, the latest trojan also targets users of online banks in the United Kingdom, such as Barclays, Cahoot, Halifax, HSBC, Lloyds TSB, Nationwide, NatWest and Smile. Stealing online banking passwords has become a priority target for criminals.

The British banking industry has responded to the threat by posting on the web information on how online banking customers can secure their computers.

Microsoft AntiSpyware 1.0 Beta, released in January, is the company's first version of the anti-spyware program it acquired through the purchase in December of Giant Company Software of New York.

Earlier this week, Microsoft announced that it was buying Sybari Software, a maker of antivirus, antispam and content-filtering technologies. Sybari, East Northport, N.Y., is a longtime Microsoft ISV partner that makes security add-ons for Exchange Server and other products.

In an odd twist, security companies that are partners with Microsoft in selling software for Windows computers now find themselves becoming competitors with the Redmond, Wash., software maker. In addition, in related news, anti-virus vendors' stock prices have taken a beating since Tuesday, when Microsoft announced the purchase of Sybari.

In security, however, Microsoft is seen by competitors as the new kid on the block.

"We believe that we have a certain expertise that we've built up for a number of years," Mastoras said. "It's going to be difficult for anyone to come in new and duplicate the level of security that we'll be able to offer."

Copyright © 2004 CMP Media LLC

SBD
Back to top
View user's profile Send private message
Me#1You#10
Site Admin


Joined: 06 May 2004
Posts: 6503

PostPosted: Fri Feb 18, 2005 5:28 am    Post subject: Reply with quote

Thanks SBD...good info.
Back to top
View user's profile Send private message
Display posts from previous:   
Post new topic   Reply to topic    SwiftVets.com Forum Index -> Geedunk & Scuttlebutt All times are GMT
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum


Powered by phpBB © 2001, 2005 phpBB Group