Download Microsoft Anti-Spyware Beta1

Printable View

Show 40 post(s) from this thread on one page

January 6th, 2005, 09:03 PM
rapier57

Thanks, SDK, and thanks to all you who tried and posted. I downloaded and tried it, based on the positive response. Yeah, it doesn't look much like a beta, but then it is pretty much a repackaged commercial scanner (Giant) with the Microsoft installer wrapper. I think it will be interesting to see how this is folded into the MS suite for the desktop.

I expect as we get close to production release, we'll see some AD extensions so that the tool can be managed much like the firewall and other features of the managed network client. I'd like to see a central repository for a network, so that just one machine is sending out updates to the anti-spyware community, rather than all of the nodes on the network.

My scan turned up SearchSquire, which has evidently been ignored or missed by Spybot and Adaware SE. I've run scans by each just before this.

I've wanted a good, enterprise-level spykiller that didn't break the budget, and this looks like it might be it. I suppose that MS will put a price on the network version, but may give away the private user version. My Symantec will scan and either notify or delete known spyware/adware, but it can't get to the registries to clean up the messes.
January 6th, 2005, 09:13 PM
phishphreek

Quote:

Originally posted here by rapier57
My scan turned up SearchSquire, which has evidently been ignored or missed by Spybot and Adaware SE. I've run scans by each just before this.

Looks like this is a false positive that has been around a bit.

http://www.wilderssecurity.com/showthread.php?p=333826

That thread says that Giant turned up this false positive too. We can guess that ms didn't fix the false positive when they aquired Giant.
January 6th, 2005, 09:23 PM
;TT

Ran it and am decently impressed - the advanced tools were really powerful.

Quote:

Spyware Scan Details
Start Date: 1/6/2005 2:08:50 PM
End Date: 1/6/2005 2:12:57 PM
Total Time: 4 mins 7 secs

Detected Threats

WhenU.SaveNow Adware more information...
Details: SaveNow is an adware program used to display advertisements in various forms, usually in the form of pop-ups. SaveNow runs as a process at startup which monitors open IE windows and opens adverts when it sees targeted URLs.
Status: Removed
High threat - High risk threats typically are remotely exploitable vulnerabilities, which can lead to system compromise. Successful exploitation does not normally require any interaction. May open up communication ports, use polymorphic tactics, stealth installations, and/or anti-spy counter measures. May us a security flaw in the operating system to gain access to your computer.

Infected files detected
C:\WINDOWS\lhsp\tv\tvenuax.dll

Infected registry keys/values detected
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B8F2846E-CE36-11D0-AC83-00C04FD97575}

eDonkey2000 Adware Bundler more information...
Details: eDonkey2000 is a P2P file sharing program that bundles adware/spyware such as Webhancer, Web Search Toolbar and New.Net.
Status: Removed
Low threat - Low risk threats pose a very low risk or no immediate danger to your computer or your privacy, however these types of applications may profile user online habits, but only according to specific privacy policies stated in the applications End-User License. These types of threats generally borderline on being a threat to being a standard application that has a complex license agreement that you knowingly installed.

Infected registry keys/values detected
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ed2k
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ed2k\DefaultIcon C:\Documents and Settings\Owner\Desktop\eMule0.44d\emule.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ed2k\shell\open\command "C:\Documents and Settings\Owner\Desktop\eMule0.44d\emule.exe" "%1"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ed2k URL: ed2k Protocol
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ed2k URL Protocol

MiniBug Potential Privacy Risk more information...
Details: Minibug is an adware that displays ads on to your computer.
Status: Removed
Low threat - Low risk threats pose a very low risk or no immediate danger to your computer or your privacy, however these types of applications may profile user online habits, but only according to specific privacy policies stated in the applications End-User License. These types of threats generally borderline on being a threat to being a standard application that has a complex license agreement that you knowingly installed.

Infected registry keys/values detected
HKEY_CLASSES_ROOT\clsid\{2b96d5cc-c5b5-49a5-a69d-cc0a30f9028c}
HKEY_CLASSES_ROOT\clsid\{2b96d5cc-c5b5-49a5-a69d-cc0a30f9028c}\VersionIndependentProgID MiniBugTransporter.MiniBugTransporterX
HKEY_CLASSES_ROOT\clsid\{2b96d5cc-c5b5-49a5-a69d-cc0a30f9028c} MiniBugTransporterX Class
HKEY_CLASSES_ROOT\interface\{04a38f6b-006f-4247-ba4c-02a139d5531c}
HKEY_CLASSES_ROOT\interface\{04a38f6b-006f-4247-ba4c-02a139d5531c}\ProxyStubClsid {00020424-0000-0000-C000-000000000046}
HKEY_CLASSES_ROOT\interface\{04a38f6b-006f-4247-ba4c-02a139d5531c}\ProxyStubClsid32 {00020424-0000-0000-C000-000000000046}
HKEY_CLASSES_ROOT\interface\{04a38f6b-006f-4247-ba4c-02a139d5531c}\TypeLib {3C2D2A1E-031F-4397-9614-87C932A848E0}
HKEY_CLASSES_ROOT\interface\{04a38f6b-006f-4247-ba4c-02a139d5531c}\TypeLib Version 1.0
HKEY_CLASSES_ROOT\interface\{04a38f6b-006f-4247-ba4c-02a139d5531c} IMiniBugTransporterX
HKEY_CLASSES_ROOT\minibugtransporter.minibugtransporterx.1
HKEY_CLASSES_ROOT\minibugtransporter.minibugtransporterx.1\CLSID {2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C}
HKEY_CLASSES_ROOT\clsid\{2b96d5cc-c5b5-49a5-a69d-cc0a30f9028c}\InprocServer32 C:\PROGRA~1\AWS\WEATHE~1\MINIBU~1.DLL
HKEY_CLASSES_ROOT\minibugtransporter.minibugtransporterx.1 MiniBugTransporterX Class
HKEY_CLASSES_ROOT\minibugtransporter.minibugtransporterx
HKEY_CLASSES_ROOT\minibugtransporter.minibugtransporterx\CLSID {2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C}
HKEY_CLASSES_ROOT\minibugtransporter.minibugtransporterx\CurVer MiniBugTransporter.MiniBugTransporterX.1
HKEY_CLASSES_ROOT\minibugtransporter.minibugtransporterx MiniBugTransporterX Class
HKEY_CLASSES_ROOT\typelib\{3c2d2a1e-031f-4397-9614-87c932a848e0}
HKEY_CLASSES_ROOT\typelib\{3c2d2a1e-031f-4397-9614-87c932a848e0}\1.0\0\win32 C:\Program Files\AWS\WeatherBug\MiniBugTransporter.dll
HKEY_CLASSES_ROOT\typelib\{3c2d2a1e-031f-4397-9614-87c932a848e0}\1.0\FLAGS 0
HKEY_CLASSES_ROOT\typelib\{3c2d2a1e-031f-4397-9614-87c932a848e0}\1.0\HELPDIR C:\Program Files\AWS\WeatherBug\
HKEY_CLASSES_ROOT\typelib\{3c2d2a1e-031f-4397-9614-87c932a848e0}\1.0 MiniBugTransporter 1.0 Type Library
HKEY_CLASSES_ROOT\clsid\{2b96d5cc-c5b5-49a5-a69d-cc0a30f9028c}\InprocServer32 ThreadingModel Apartment
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C}\InprocServer32 C:\PROGRA~1\AWS\WEATHE~1\MINIBU~1.DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C}\InprocServer32 ThreadingModel Apartment
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C}\MiscStatus\1 132497
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C}\MiscStatus 0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C}\ProgID MiniBugTransporter.MiniBugTransporterX.1
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C}\ToolboxBitmap32 C:\PROGRA~1\AWS\WEATHE~1\MINIBU~1.DLL, 101
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C}\TypeLib {3C2D2A1E-031F-4397-9614-87C932A848E0}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C}\Version 1.0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C}\VersionIndependentProgID MiniBugTransporter.MiniBugTransporterX
HKEY_CLASSES_ROOT\clsid\{2b96d5cc-c5b5-49a5-a69d-cc0a30f9028c}\MiscStatus\1 132497
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} MiniBugTransporterX Class
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MiniBugTransporter.MiniBugTransporterX.1
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MiniBugTransporter.MiniBugTransporterX.1\CLSID {2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MiniBugTransporter.MiniBugTransporterX.1 MiniBugTransporterX Class
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MiniBugTransporter.MiniBugTransporterX
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MiniBugTransporter.MiniBugTransporterX\CLSID {2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MiniBugTransporter.MiniBugTransporterX\CurVer MiniBugTransporter.MiniBugTransporterX.1
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MiniBugTransporter.MiniBugTransporterX MiniBugTransporterX Class
HKEY_CLASSES_ROOT\clsid\{2b96d5cc-c5b5-49a5-a69d-cc0a30f9028c}\MiscStatus 0
HKEY_CLASSES_ROOT\clsid\{2b96d5cc-c5b5-49a5-a69d-cc0a30f9028c}\ProgID MiniBugTransporter.MiniBugTransporterX.1
HKEY_CLASSES_ROOT\clsid\{2b96d5cc-c5b5-49a5-a69d-cc0a30f9028c}\ToolboxBitmap32 C:\PROGRA~1\AWS\WEATHE~1\MINIBU~1.DLL, 101
HKEY_CLASSES_ROOT\clsid\{2b96d5cc-c5b5-49a5-a69d-cc0a30f9028c}\TypeLib {3C2D2A1E-031F-4397-9614-87C932A848E0}
HKEY_CLASSES_ROOT\clsid\{2b96d5cc-c5b5-49a5-a69d-cc0a30f9028c}\Version 1.0

Detected Spyware Cookies
No spyware cookies were found during this scan.
January 6th, 2005, 10:24 PM
dinowuff

O.K. Where did microsoft get this software from? Pretty Nice

WinPCap
Type: Enabler
Threat Level: Low
Author: WinPCap Team including = Loris Degioanni

Description: WinPCap is an Open Source Windows Packet Filtering Library. It provides low level internet & system traffic data to other applications that leverage its utilities.

Advice: This software is not necessarily hazardous unless it is used by a particular spyware threat. If you quarantine or remove all of the spyware threats from your computer you do not necessarily need to remove this program. Please note: if a legitimate application is using functionality contained in an enabler application, removing the enabler may cause that application to cease functioning properly.
This application is okay to have running on your computer, as they are only dangerous if a Spyware application is also installed on your machine and exploiting it. However if you did not install this, or know of a legitimate application that did, you may consider quarantining or removing it. Please note: if a legitimate application is using functionality contained in an enabler application, it may cause that application to cease functioning properly.

About Enabler: While not spyware, it provides functionality that spyware products have been known to exploit. Normally, these applications are okay to have running on your machine, as they are only dangerous
January 6th, 2005, 11:36 PM
ZomBieMann77

winpcap is a nescecary part of nmap for windows. Cain and Able also use it. Im not sure what else uses it. Like has allready been stated its not a threat unless you didnt install it.
January 7th, 2005, 12:01 AM
Clp727

Thank you for the link! This thing is great. I scanned my system with Ad-awareSE,Spybot, and Webroots SpySweeper. MS Antispyware still found a few items. Wow!
January 7th, 2005, 02:42 AM
Soda_Popinsky
Ok, here are my initial thoughts...

Great install, great interface. Scan was quick and simple, the results were grouped nicely instead of showing every little thing it finds just to show off. It also found winpcap and instances of VNC, which are false positives but only because I use them. I want it to find them on client boxes, because they could be the reason I'm there ;).

One big deal, however. How many of you have used the BitDefender Online scan? It installs c:\windows\bdonlinescan\bdupd.dll. AntiSpyware found it as "Brilliant Digital" (notice the BD)

This tells me that the signature was based on a filename? Thats really, really bad. I doubt BitDefender uses code from Brilliant Digital. I'm about to change that filename and test if it shows up again. If it uses filenames as a sole reason to delete a file, thats a huge problem that needs to be changed.

Things I would change:
- Filename bug (if others can confirm it)
- Individual file scanning
- Better UI for Ignoring / Removing files, right now it's dropdowns which is hard to glance through and see which were default remove/ignore.
edit
update
Yeah... it uses filename based signatures.
January 7th, 2005, 04:06 AM
oofki

Well it did seem to work pretty well for me the immuzine functions could prove to be priceless. And yes everyone is right, there are still bugs!!! ...hmm must be a beta like beta1 or something :)
January 7th, 2005, 04:47 AM
yourdeadin

Quote:

winpcap is a nescecary part of nmap for windows. Cain and Able also use it. Im not sure what else uses it. Like has allready been stated its not a threat unless you didnt install it.

well you said it could not be more correct .
winpcap is a important part of nmap , i removed it and afterwards nmap stoped functioning along with cain

Quote:

Great install, great interface. Scan was quick and simple, the results were grouped nicely instead of showing every little thing it finds just to show off.

well what do you know i kinda like it ,smart ,fast and accurate.
January 7th, 2005, 05:10 AM
Relyt

:( Oh whoas me, sad days have arrived. MS has said all but goodbye to the support of Win98 SE. I had a love affair with the simplistic ‘ole 98’ (for home use), but alas, we must boot to XP to try Billy’s new beta toy. :D

Not an issue with my computers because I purchased XP, but for others…

Quote:

What is genuine Windows validation?

After successful validation, a Microsoft Windows Download Key will be stored on your system for future use.

The validation process also determines if you have activated your copy of Windows.

(They will let you download the beta w/o the validation though).

Show 40 post(s) from this thread on one page