|
SwiftVets.com Service to Country
|
View previous topic :: View next topic |
Author |
Message |
Me#1You#10 Site Admin
Joined: 06 May 2004 Posts: 6503
|
Posted: Wed Feb 16, 2005 6:16 pm Post subject: Microsoft Spyware Beta 1 |
|
|
I recently installed and ran a scan of my system using Microsoft's recently obtained spyware program from Giant software.
I'm pretty paranoid when it comes to PC security (software and hardware firewalls, Ad-Aware, Spybot, Norton Anti-virus) and try to keep my system as secure as I can. However, the MS Spyware beta recognized 5 villains that were not caught by ad-aware or spybot (perhaps they were residuals and I don't believe were active).
Nevertheless, I was somewhat impressed that it managed to catch them and thought others here might like to give it a try...nice GUI as well.
You can check it out at Microsoft Windows Antispyware Beta.
Just as an FYI, here's what it caught on my system....
Quote: | Spyware Scan Details
Start Date: 2/15/2005 11:00:38 PM
End Date: 2/15/2005 11:15:02 PM
Total Time: 14 mins 24 secs
Detected Threats
BroadcastURBAN tuner Browser Plug-in more information...
Details: BroadcastURBAN tuner is an Internet Explorer browser helper object adware browser redirector.
Status: Removed
Severe threat - Severe threats typically are remotely exploitable vulnerabilities, which can lead to system compromise. Successful exploitation does not normally require any interaction and exploits are in the wild. There exists a high possibility of potential system damage or security flaw. Attacker has complete control over your computer or install new software on your machine.
Infected files detected
c:\windows\downloaded program files\hiwire.inf
c:\windows\downloaded program files\hwreal.exe
Private Access Plugin Dialer more information...
Details: Private Access Plugin is a premium-rate dialer that may be installed through pop-up advertisements, browser exploits and others.
Status: Removed
Severe threat - Severe threats typically are remotely exploitable vulnerabilities, which can lead to system compromise. Successful exploitation does not normally require any interaction and exploits are in the wild. There exists a high possibility of potential system damage or security flaw. Attacker has complete control over your computer or install new software on your machine.
Infected files detected
c:\windows\downloaded program files\installer.inf
GonnaSearch Toolbar Adware more information...
Details: GonnaSearch Toolbar changes your search page and other search elements to its own site.
Status: Removed
High threat - High risk threats typically are remotely exploitable vulnerabilities, which can lead to system compromise. Successful exploitation does not normally require any interaction. May open up communication ports, use polymorphic tactics, stealth installations, and/or anti-spy counter measures. May us a security flaw in the operating system to gain access to your computer.
Infected files detectedc:\program files\internet explorer\toolbar\toolbar.hta
c:\program files\internet explorer\toolbar\paint.gif
c:\program files\internet explorer\toolbar\toolbar.gif
c:\program files\internet explorer\toolbar\tbwallpaper.ico
c:\program files\internet explorer\toolbar\none.gif
c:\program files\internet explorer\toolbar\twpicon.gif
c:\program files\internet explorer\toolbar\tbwallcr.ico
c:\program files\internet explorer\toolbar\tbwallbw.ico
c:\program files\internet explorer\toolbar\thumbs.db
Infected folders detected
c:\program files\internet explorer\toolbar
IETray Browser Hijacker more information...
Details: IETray is an Internet Explorer browser helper object that includes a side search bar.
Status: Quarantined
High threat - High risk threats typically are remotely exploitable vulnerabilities, which can lead to system compromise. Successful exploitation does not normally require any interaction. May open up communication ports, use polymorphic tactics, stealth installations, and/or anti-spy counter measures. May us a security flaw in the operating system to gain access to your computer.
Infected registry keys/values detected
HKEY_CURRENT_USER\software\microsoft\internet explorer\menuext\&define
HKEY_CURRENT_USER\software\microsoft\internet explorer\menuext\&define contexts 17
HKEY_CURRENT_USER\software\microsoft\internet explorer\menuext\&define C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM
PowerReg Scheduler Spyware more information...
Details: PowerReg Scheduler is a registration system used by some legitimate software programs.
Status: Quarantined
Moderate threat - Moderate threats may profile users online habits or broadcast data back to a server with 'opt-out' permission. In most cases this type of threat is more along the lines of commercial type adware that offer a premium service in exchange for tracking your user online performance.
Infected files detected
c:\system volume information\_restore{dd43356c-460d-4201-833f-bb0831991c97}\rp166\a0021149.exe
c:\recycled\dc42.exe
Detected Spyware Cookies
No spyware cookies were found during this scan. |
|
|
Back to top |
|
|
1991932 Lance Corporal
Joined: 02 Oct 2004 Posts: 381 Location: Massachusetts
|
Posted: Thu Feb 17, 2005 2:55 pm Post subject: doubting Thomas |
|
|
It's free.
What's the catch? _________________ Former "War Criminal" |
|
Back to top |
|
|
GoophyDog PO1
Joined: 10 Jun 2004 Posts: 480 Location: Washington - The Evergreen State
|
Posted: Thu Feb 17, 2005 8:36 pm Post subject: |
|
|
The catch, if you will, is that if you do not pay attention to the install prompts you can inadvertantly start up automatic updates (if not already there), and you can "subscribe" to an anti-spyware network which in itself is sort of a spyware when you think about it.
Not to mention you are required to "register" or validate your microsoft installation.
Is it a good product? Time will tell.
I simply have a bit of heartburn when it comes to Microsoft having this type of power. The cynical in me says that if M$oft doesn't like an application or add-on, they could easily slam a spyware tag to it. M$oft's track record, in my opinion, is just plain terrible.
As I said, time will tell. _________________ Why ask? Because it needs asking. |
|
Back to top |
|
|
Me#1You#10 Site Admin
Joined: 06 May 2004 Posts: 6503
|
Posted: Thu Feb 17, 2005 9:20 pm Post subject: |
|
|
GoophyDog wrote: | The catch, if you will, is that if you do not pay attention to the install prompts you can inadvertantly start up automatic updates (if not already there), and you can "subscribe" to an anti-spyware network which in itself is sort of a spyware when you think about it.
Not to mention you are required to "register" or validate your microsoft installation. |
All correct Gooph, and I DO pay particular attention to "prompts" during the installation of ANY software, to include, perhaps especially, MS...and I share your cynicism as a healthy approach to operating these days.
I did, in fact, reject the "automatic" updates and "membership" in the "anti-spy network" as I do with most programs that offer to "help" me in those regards...but I did appreciate the fact that it caught vestiges of 5 bad guys that 2 notable anti-spyware programs appear to have overlooked. |
|
Back to top |
|
|
DaveS Ensign
Joined: 19 Sep 2004 Posts: 61
|
Posted: Thu Feb 17, 2005 11:45 pm Post subject: I downloaded it based on your post and have run it several |
|
|
times. So far it has no founc a single known piece of spyware. I find that strange. |
|
Back to top |
|
|
DaveS Ensign
Joined: 19 Sep 2004 Posts: 61
|
Posted: Thu Feb 17, 2005 11:49 pm Post subject: Let me try that in english. |
|
|
It has not found a single piece of known spyware. |
|
Back to top |
|
|
Navy wife Research Director
Joined: 09 Aug 2004 Posts: 353 Location: Arlington, VA & Ft. Worth, TX
|
Posted: Fri Feb 18, 2005 4:46 am Post subject: |
|
|
The Microsoft program has not found anything on my machine either. I'm like you all and do not sign up for automatic updates etc.
However, I do run spybot and spyware blaster, and one of these always alerts me when something is detected when I get on a commercial website that is labeled a threat. I always tell it not to download. Don't know if that is what has helped, but my machine seems to be clean lately! I also run lavasoft's ad-aware, winpatrol, and cleanup! Good little programs. |
|
Back to top |
|
|
SBD Admiral
Joined: 19 Aug 2004 Posts: 1022
|
Posted: Fri Feb 18, 2005 5:00 am Post subject: |
|
|
It's still in Beta and is already a target for virus writers.
Virus Writers Target Microsoft Anti-Spyware
Malware aimed at disabling Microsoft Corp.'s anti-spyware product has been discovered by security experts who expect the virus to be the first of many to follow.
By Antone Gonsalves, TechWeb News
Feb. 10, 2005
http://www.informationweek.com/story/showArticle.jhtml?articleID=60300219
Malware aimed at disabling Microsoft Corp.'s anti-spyware product has been discovered by security experts who expect the virus to be the first of many to follow.
The Trojan horse, which is also designed to steal online banking passwords from Windows computers, was discovered by security experts at Sophos Plc and Symantec Corp.
The virus, called Troj/BankAsh-A and PWSteal.Bankash.A, disables Microsoft AntiSpyware, which is available only as a beta download from the company's website. The malicious code attempts to suppress warning messages displayed by the product and to delete all files within the program's folder.
Experts believe this virus is only the beginning of what will be a salvo of malware attacks on Microsoft security products.
"It's likely that these attacks will continue," Gregg Mastoras, senior security analyst for Sophos, said Thursday. "This is the beginning of a wave of attempts to undermine the effectiveness of this new product."
Beyond targeting Microsoft, the latest trojan also targets users of online banks in the United Kingdom, such as Barclays, Cahoot, Halifax, HSBC, Lloyds TSB, Nationwide, NatWest and Smile. Stealing online banking passwords has become a priority target for criminals.
The British banking industry has responded to the threat by posting on the web information on how online banking customers can secure their computers.
Microsoft AntiSpyware 1.0 Beta, released in January, is the company's first version of the anti-spyware program it acquired through the purchase in December of Giant Company Software of New York.
Earlier this week, Microsoft announced that it was buying Sybari Software, a maker of antivirus, antispam and content-filtering technologies. Sybari, East Northport, N.Y., is a longtime Microsoft ISV partner that makes security add-ons for Exchange Server and other products.
In an odd twist, security companies that are partners with Microsoft in selling software for Windows computers now find themselves becoming competitors with the Redmond, Wash., software maker. In addition, in related news, anti-virus vendors' stock prices have taken a beating since Tuesday, when Microsoft announced the purchase of Sybari.
In security, however, Microsoft is seen by competitors as the new kid on the block.
"We believe that we have a certain expertise that we've built up for a number of years," Mastoras said. "It's going to be difficult for anyone to come in new and duplicate the level of security that we'll be able to offer."
Copyright © 2004 CMP Media LLC
SBD |
|
Back to top |
|
|
Me#1You#10 Site Admin
Joined: 06 May 2004 Posts: 6503
|
Posted: Fri Feb 18, 2005 5:28 am Post subject: |
|
|
Thanks SBD...good info. |
|
Back to top |
|
|
|
|
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum
|
Powered by phpBB © 2001, 2005 phpBB Group
|