Printable View
You want to test Microsoft Windows Anti-Spyware, it go here.
Link : http://www.microsoft.com/downloads/d...DisplayLang=en
If you want to pass the Genuine Program thing, here a direct download link.
http://download.microsoft.com/downlo...areInstall.exe
Thanks SDK. I think'll I'll give it a shot, to see how well it works. It's not like this is *MY* pc or anything...I'll have desktop support re-image this thing if it gets hosed.
I like this thing :)
Doesn't look/feel like a beta at all!
I checked my box (XP Pro SP2) with Ad-Aware and Spybot, and it came up clean. I then ran MS's application.
It uses the recently acquired SpyNet technology, and provides "a revolutionary network community that connects hundreds of thousands users to quickly share and identify unknown applications, blocking spyware almost as quickly as it is released". It's optional, but if you enable it, it will send signatures of all spyware detected on your computer to SpyNet's central server.
It comes with real-time protection (9 Internet Agent checkpoints, 25 system checkpoints, and 25 application agent checkpoints), and some "advanced tools" (system explorers and "browser hijack restore", and a nice "tracks eraser" function which lets you, for example, delete the Google toolbar history).
The scan results are extremely detailed (application, location, instances, extended information on the threath,...). It marked Kazaa as spyware, although I'm using the Lite version (as far as I know, it only detected the installation of Kazaa, not actual spyware), but advised to ignore it (same for WinPCap). Deletion of actual spyware is painless.
Anyone else have an opinion?
Very cool, found 2 spyware and SDbot worm after Spybot, Adware and AVG showed a clean system. Easy to use. Looks like it has alot of interesting advanced features.
Well
I have just run this on a W2k system...
On this system I have been recently testing several anti spyware programs as I have been looking for a corporate solution to the spyware problem....I had heard that MS was maybe working on a solution so I have held off on the purchase as the cost per desktop was more than AV.....I was also looking at an integrated AV\ASW solution willing to toss Norton AV...but that is another issue.
Anyway
I must say I am very impressed as this beta ran well...and found a piece of spyware sitting on my machine...that nothing else has found!!!
I opened explorer (thought it maybe a false positive....regular norton issue :rolleyes: )and sure enough it was there in the system32 directory
winsys.exe
Nothing else has found this...properties show it was created in May 2004...and I have tested SEVERAL antispyware programs on this machine.
Good job MS.... :D
My .02 cdn
MLF
BTW: This is a microsoft "beta". The program or engine itself has been around for a while. It used to be Giant's. Giants antispyware has been rated in the top 10 for quite a while. No reason to reinvent the wheel...
Ran adaware and spybot (both updated) prior to scanning with ms anti-spyware.
I do like the look and feel though. I also like the realtime protection.
I got a couple of false positives though...
Not really installed on my machine. Just that file was found.Quote:
Detected Threats
Timbuktu Pro Commercial Remote Control more information...
Status: Ignored
High threat - High risk threats typically are remotely exploitable vulnerabilities, which can lead to system compromise. Successful exploitation does not normally require any interaction. May open up communication ports, use polymorphic tactics, stealth installations, and/or anti-spy counter measures. May us a security flaw in the operating system to gain access to your computer.
Infected files detected
C:\WINNT\system32\nsldapssl32v30.dll
http://www.betrusted.com/downloads/p...alc-7.1.3.htmlQuote:
Netscape nsldapssl32v30.dll
The nsldapssl32v30.dll file is required for any LDAP functionality that may be used in your application. We recommended that you install this into the Window's System32 directory.
It *can* be used to install a trojan as a service, but it is not a trojan in itself.Quote:
InstSrv Trojan more information...
Status: Ignored
High threat - High risk threats typically are remotely exploitable vulnerabilities, which can lead to system compromise. Successful exploitation does not normally require any interaction. May open up communication ports, use polymorphic tactics, stealth installations, and/or anti-spy counter measures. May us a security flaw in the operating system to gain access to your computer.
Infected files detected
C:\Program Files\Resource Pro Kit\instsrv.exe
Got me there... not legitimate but easily removed. adaware and spybot didn't find this.Quote:
SearchSquire Adware more information...
Details: SearchSquire is an Internet Explorer sidebar containing paid links that open when you use search engines.
Status: Removed
Elevated threat - Elevated threats are usually threats that fall into the range of adware in which data about a user's habits are tracked and sent back to a server for analysis without your consent or knowledge.
Infected registry keys/values detected
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\searchsquire.com
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\searchsquire.com * 4
EDIT: Actually, this is also a false positive. According to a post on slashdot, this is party of spybot's immunizitation feature... which I use.
Again, false positive.Quote:
WinPCap Enabler more information...
Details: WinPCap is an Open Source Windows Packet Filtering Library. It provides low level internet & system traffic data to other applications that leverage its utilities.
Status: Ignored
Low threat - Low risk threats pose a very low risk or no immediate danger to your computer or your privacy, however these types of applications may profile user online habits, but only according to specific privacy policies stated in the applications End-User License. These types of threats generally borderline on being a threat to being a standard application that has a complex license agreement that you knowingly installed.
Infected files detected
C:\Program Files\WinPcap\daemon_mgm.exe
C:\Program Files\WinPcap\rpcapd.exe
C:\WINNT\system32\wanpacket.dll
C:\WINNT\system32\wpcap.dll
c:\program files\winpcap\install.log
c:\program files\winpcap\uninstall.exe
C:\Program Files\WinPcap\NetMonInstaller.exe
C:\WINNT\system32\drivers\npf.sys
C:\Program Files\WinPcap\npf_mgm.exe
C:\libnetnt\LibnetNT\DRIVERS\Packet2K\Packet.dll
C:\libnetnt\LibnetNT\DRIVERS\PacketNT\Packet.dll
C:\WINNT\system32\packet.dll
C:\Documents and Settings\Administrator\Local Settings\Temp\packet.sys
C:\WINNT\system32\pthreadVC.dll
Infected folders detected
c:\program files\winpcap
Well... kinda. I guess this could be offending software depending on who has installed it and for what purpose.
Thus far, I'm inpressed. But this was someone elses product. Lets see what comes of it.
Does anyone know about pricing? If any? I didn't find much on that. Hopefully it'll be free?!
From the "help about"
Now... I want a console from which I can manage all of this on different computers.Quote:
Microsoft AntiSpyware Version: 1.0.501
This version expires on: 7/31/2005
Current User: user
Spyware Definition Version: 5678 (1/5/2005 11:44:42 AM)
I also got a few very minor easily spoted false positives and also found a little peice of spyware niether spybot od adaware pro found. All in all for a microsoft product and especialy a beta I am impressed. I hate to think what its going to cost when it is released a final rlease is developed.
If m$ were to release a pay version, woudln't fixing known bugs that can be exploited by adware/spyware be a conflict of interest? If they fix the bugs and people apply the paches... people don't get infected and they can't sell the software.
But we all know that m$ would *never* do something like that... right?... right? :rolleyes:
Hey they gave out the Firewall and packet sniffer for free. ;)
Just like everyone else, I had a false positive (but I can see why it picks up the program) but it didn't find anything "extra". The interface is slick and it's a good program. This is what I learned playing with it:
There are three categories of "agents" that load on startup if you desire. They are Application, System, and Internet settings. These can be like a local security tool because they each seek out and monitor changes to various properties.
Application Agent: monitor changes in IE settings and Active X controls as they are processed
System Agent: Monitor changes in security settings such as privilege escalation and also system properties of the OS.
Internet Agent: Monitors changes in the settings for either the dial-up or Ethernet/USB for the internet connection in Network Properties.
In addition you can enable your system (I chose not too) to participate in a network "spy-net" to report system changes detected by the agents. They will use that data to update signatures.
Very Nice. Kind of shocked really.
Oh and the license expires in July 2005. Since it is MS and there are agents running I would imagine a whole slew of command line abilities are there along with a console to plug into MS Management or Active Directory integration. But that ability to control clients via remote will make or break this in the enterprise. Home users should down load it.
//EDIT Ooops it picked up WinPCap like with Phish while I was typing. Another falsie, unless you don't know what that is and it pops up on your PC. ;)
Well NOW, I am even more impressed the “Tracks Erraser” module automatically detected the installation of several programs and with one click enables you to ERASE the history files of them. Sure there are other programs that do that but this is an added benefit to an already seemingly excellent product. Mine detected:
Adobe
MS Common Dialog (used by programs to list files etc)
Google Toolbar History (very nice)
ICQ
IE (history, cookies, Form entries
Kazaa
And it goes on and on to include the history files of just about every piece of software I have, including MS Office files and Paint etc.
In addition there is a system explorer that lets you look at extreme details of system function, a change or trace events. Sweet
It found RadLight on my machine, which neither SpyBot or Ad-Aware found.
I guess RadLight can be pretty nasty, but it's been on my machine since 10/03 and didn't seem to be doing anything. Got it with a download from CNET it seems.
I think the MS product worked well. I think it's biggest contribution will be its ease of use, and the fact that it's an MS product. The more spyware protection and removal software that gets used by casual/home computer users, the better off we'll all be.
And we know that MS has the channels and enough clout to get the software out there. Like it or not, I think that's a fact.
__________________
Intranet Journal's Spyware Guide
http://www.intranetjournal.com/spyware/
Thanks, SDK, and thanks to all you who tried and posted. I downloaded and tried it, based on the positive response. Yeah, it doesn't look much like a beta, but then it is pretty much a repackaged commercial scanner (Giant) with the Microsoft installer wrapper. I think it will be interesting to see how this is folded into the MS suite for the desktop.
I expect as we get close to production release, we'll see some AD extensions so that the tool can be managed much like the firewall and other features of the managed network client. I'd like to see a central repository for a network, so that just one machine is sending out updates to the anti-spyware community, rather than all of the nodes on the network.
My scan turned up SearchSquire, which has evidently been ignored or missed by Spybot and Adaware SE. I've run scans by each just before this.
I've wanted a good, enterprise-level spykiller that didn't break the budget, and this looks like it might be it. I suppose that MS will put a price on the network version, but may give away the private user version. My Symantec will scan and either notify or delete known spyware/adware, but it can't get to the registries to clean up the messes.
Looks like this is a false positive that has been around a bit.Quote:
Originally posted here by rapier57
My scan turned up SearchSquire, which has evidently been ignored or missed by Spybot and Adaware SE. I've run scans by each just before this.
http://www.wilderssecurity.com/showthread.php?p=333826
That thread says that Giant turned up this false positive too. We can guess that ms didn't fix the false positive when they aquired Giant.
Ran it and am decently impressed - the advanced tools were really powerful.
Quote:
Spyware Scan Details
Start Date: 1/6/2005 2:08:50 PM
End Date: 1/6/2005 2:12:57 PM
Total Time: 4 mins 7 secs
Detected Threats
WhenU.SaveNow Adware more information...
Details: SaveNow is an adware program used to display advertisements in various forms, usually in the form of pop-ups. SaveNow runs as a process at startup which monitors open IE windows and opens adverts when it sees targeted URLs.
Status: Removed
High threat - High risk threats typically are remotely exploitable vulnerabilities, which can lead to system compromise. Successful exploitation does not normally require any interaction. May open up communication ports, use polymorphic tactics, stealth installations, and/or anti-spy counter measures. May us a security flaw in the operating system to gain access to your computer.
Infected files detected
C:\WINDOWS\lhsp\tv\tvenuax.dll
Infected registry keys/values detected
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B8F2846E-CE36-11D0-AC83-00C04FD97575}
eDonkey2000 Adware Bundler more information...
Details: eDonkey2000 is a P2P file sharing program that bundles adware/spyware such as Webhancer, Web Search Toolbar and New.Net.
Status: Removed
Low threat - Low risk threats pose a very low risk or no immediate danger to your computer or your privacy, however these types of applications may profile user online habits, but only according to specific privacy policies stated in the applications End-User License. These types of threats generally borderline on being a threat to being a standard application that has a complex license agreement that you knowingly installed.
Infected registry keys/values detected
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ed2k
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ed2k\DefaultIcon C:\Documents and Settings\Owner\Desktop\eMule0.44d\emule.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ed2k\shell\open\command "C:\Documents and Settings\Owner\Desktop\eMule0.44d\emule.exe" "%1"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ed2k URL: ed2k Protocol
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ed2k URL Protocol
MiniBug Potential Privacy Risk more information...
Details: Minibug is an adware that displays ads on to your computer.
Status: Removed
Low threat - Low risk threats pose a very low risk or no immediate danger to your computer or your privacy, however these types of applications may profile user online habits, but only according to specific privacy policies stated in the applications End-User License. These types of threats generally borderline on being a threat to being a standard application that has a complex license agreement that you knowingly installed.
Infected registry keys/values detected
HKEY_CLASSES_ROOT\clsid\{2b96d5cc-c5b5-49a5-a69d-cc0a30f9028c}
HKEY_CLASSES_ROOT\clsid\{2b96d5cc-c5b5-49a5-a69d-cc0a30f9028c}\VersionIndependentProgID MiniBugTransporter.MiniBugTransporterX
HKEY_CLASSES_ROOT\clsid\{2b96d5cc-c5b5-49a5-a69d-cc0a30f9028c} MiniBugTransporterX Class
HKEY_CLASSES_ROOT\interface\{04a38f6b-006f-4247-ba4c-02a139d5531c}
HKEY_CLASSES_ROOT\interface\{04a38f6b-006f-4247-ba4c-02a139d5531c}\ProxyStubClsid {00020424-0000-0000-C000-000000000046}
HKEY_CLASSES_ROOT\interface\{04a38f6b-006f-4247-ba4c-02a139d5531c}\ProxyStubClsid32 {00020424-0000-0000-C000-000000000046}
HKEY_CLASSES_ROOT\interface\{04a38f6b-006f-4247-ba4c-02a139d5531c}\TypeLib {3C2D2A1E-031F-4397-9614-87C932A848E0}
HKEY_CLASSES_ROOT\interface\{04a38f6b-006f-4247-ba4c-02a139d5531c}\TypeLib Version 1.0
HKEY_CLASSES_ROOT\interface\{04a38f6b-006f-4247-ba4c-02a139d5531c} IMiniBugTransporterX
HKEY_CLASSES_ROOT\minibugtransporter.minibugtransporterx.1
HKEY_CLASSES_ROOT\minibugtransporter.minibugtransporterx.1\CLSID {2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C}
HKEY_CLASSES_ROOT\clsid\{2b96d5cc-c5b5-49a5-a69d-cc0a30f9028c}\InprocServer32 C:\PROGRA~1\AWS\WEATHE~1\MINIBU~1.DLL
HKEY_CLASSES_ROOT\minibugtransporter.minibugtransporterx.1 MiniBugTransporterX Class
HKEY_CLASSES_ROOT\minibugtransporter.minibugtransporterx
HKEY_CLASSES_ROOT\minibugtransporter.minibugtransporterx\CLSID {2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C}
HKEY_CLASSES_ROOT\minibugtransporter.minibugtransporterx\CurVer MiniBugTransporter.MiniBugTransporterX.1
HKEY_CLASSES_ROOT\minibugtransporter.minibugtransporterx MiniBugTransporterX Class
HKEY_CLASSES_ROOT\typelib\{3c2d2a1e-031f-4397-9614-87c932a848e0}
HKEY_CLASSES_ROOT\typelib\{3c2d2a1e-031f-4397-9614-87c932a848e0}\1.0\0\win32 C:\Program Files\AWS\WeatherBug\MiniBugTransporter.dll
HKEY_CLASSES_ROOT\typelib\{3c2d2a1e-031f-4397-9614-87c932a848e0}\1.0\FLAGS 0
HKEY_CLASSES_ROOT\typelib\{3c2d2a1e-031f-4397-9614-87c932a848e0}\1.0\HELPDIR C:\Program Files\AWS\WeatherBug\
HKEY_CLASSES_ROOT\typelib\{3c2d2a1e-031f-4397-9614-87c932a848e0}\1.0 MiniBugTransporter 1.0 Type Library
HKEY_CLASSES_ROOT\clsid\{2b96d5cc-c5b5-49a5-a69d-cc0a30f9028c}\InprocServer32 ThreadingModel Apartment
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C}\InprocServer32 C:\PROGRA~1\AWS\WEATHE~1\MINIBU~1.DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C}\InprocServer32 ThreadingModel Apartment
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C}\MiscStatus\1 132497
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C}\MiscStatus 0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C}\ProgID MiniBugTransporter.MiniBugTransporterX.1
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C}\ToolboxBitmap32 C:\PROGRA~1\AWS\WEATHE~1\MINIBU~1.DLL, 101
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C}\TypeLib {3C2D2A1E-031F-4397-9614-87C932A848E0}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C}\Version 1.0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C}\VersionIndependentProgID MiniBugTransporter.MiniBugTransporterX
HKEY_CLASSES_ROOT\clsid\{2b96d5cc-c5b5-49a5-a69d-cc0a30f9028c}\MiscStatus\1 132497
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} MiniBugTransporterX Class
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MiniBugTransporter.MiniBugTransporterX.1
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MiniBugTransporter.MiniBugTransporterX.1\CLSID {2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MiniBugTransporter.MiniBugTransporterX.1 MiniBugTransporterX Class
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MiniBugTransporter.MiniBugTransporterX
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MiniBugTransporter.MiniBugTransporterX\CLSID {2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MiniBugTransporter.MiniBugTransporterX\CurVer MiniBugTransporter.MiniBugTransporterX.1
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MiniBugTransporter.MiniBugTransporterX MiniBugTransporterX Class
HKEY_CLASSES_ROOT\clsid\{2b96d5cc-c5b5-49a5-a69d-cc0a30f9028c}\MiscStatus 0
HKEY_CLASSES_ROOT\clsid\{2b96d5cc-c5b5-49a5-a69d-cc0a30f9028c}\ProgID MiniBugTransporter.MiniBugTransporterX.1
HKEY_CLASSES_ROOT\clsid\{2b96d5cc-c5b5-49a5-a69d-cc0a30f9028c}\ToolboxBitmap32 C:\PROGRA~1\AWS\WEATHE~1\MINIBU~1.DLL, 101
HKEY_CLASSES_ROOT\clsid\{2b96d5cc-c5b5-49a5-a69d-cc0a30f9028c}\TypeLib {3C2D2A1E-031F-4397-9614-87C932A848E0}
HKEY_CLASSES_ROOT\clsid\{2b96d5cc-c5b5-49a5-a69d-cc0a30f9028c}\Version 1.0
Detected Spyware Cookies
No spyware cookies were found during this scan.
O.K. Where did microsoft get this software from? Pretty Nice
WinPCap
Type: Enabler
Threat Level: Low
Author: WinPCap Team including = Loris Degioanni
Description: WinPCap is an Open Source Windows Packet Filtering Library. It provides low level internet & system traffic data to other applications that leverage its utilities.
Advice: This software is not necessarily hazardous unless it is used by a particular spyware threat. If you quarantine or remove all of the spyware threats from your computer you do not necessarily need to remove this program. Please note: if a legitimate application is using functionality contained in an enabler application, removing the enabler may cause that application to cease functioning properly.
This application is okay to have running on your computer, as they are only dangerous if a Spyware application is also installed on your machine and exploiting it. However if you did not install this, or know of a legitimate application that did, you may consider quarantining or removing it. Please note: if a legitimate application is using functionality contained in an enabler application, it may cause that application to cease functioning properly.
About Enabler: While not spyware, it provides functionality that spyware products have been known to exploit. Normally, these applications are okay to have running on your machine, as they are only dangerous
winpcap is a nescecary part of nmap for windows. Cain and Able also use it. Im not sure what else uses it. Like has allready been stated its not a threat unless you didnt install it.
Thank you for the link! This thing is great. I scanned my system with Ad-awareSE,Spybot, and Webroots SpySweeper. MS Antispyware still found a few items. Wow!
Ok, here are my initial thoughts...
Great install, great interface. Scan was quick and simple, the results were grouped nicely instead of showing every little thing it finds just to show off. It also found winpcap and instances of VNC, which are false positives but only because I use them. I want it to find them on client boxes, because they could be the reason I'm there ;).
One big deal, however. How many of you have used the BitDefender Online scan? It installs c:\windows\bdonlinescan\bdupd.dll. AntiSpyware found it as "Brilliant Digital" (notice the BD)
This tells me that the signature was based on a filename? Thats really, really bad. I doubt BitDefender uses code from Brilliant Digital. I'm about to change that filename and test if it shows up again. If it uses filenames as a sole reason to delete a file, thats a huge problem that needs to be changed.
Things I would change:
- Filename bug (if others can confirm it)
- Individual file scanning
- Better UI for Ignoring / Removing files, right now it's dropdowns which is hard to glance through and see which were default remove/ignore.
edit
update
Yeah... it uses filename based signatures.
Well it did seem to work pretty well for me the immuzine functions could prove to be priceless. And yes everyone is right, there are still bugs!!! ...hmm must be a beta like beta1 or something :)
well you said it could not be more correct .Quote:
winpcap is a nescecary part of nmap for windows. Cain and Able also use it. Im not sure what else uses it. Like has allready been stated its not a threat unless you didnt install it.
winpcap is a important part of nmap , i removed it and afterwards nmap stoped functioning along with cain
well what do you know i kinda like it ,smart ,fast and accurate.Quote:
Great install, great interface. Scan was quick and simple, the results were grouped nicely instead of showing every little thing it finds just to show off.
:( Oh whoas me, sad days have arrived. MS has said all but goodbye to the support of Win98 SE. I had a love affair with the simplistic ‘ole 98’ (for home use), but alas, we must boot to XP to try Billy’s new beta toy. :D
Not an issue with my computers because I purchased XP, but for others…
(They will let you download the beta w/o the validation though).Quote:
What is genuine Windows validation?
After successful validation, a Microsoft Windows Download Key will be stored on your system for future use.
The validation process also determines if you have activated your copy of Windows.
A couple of other things I have noticed since yesterday, as I have installed on a brand new install and am now configuring to add to the network...
is it informs you of software adding itself to the startup directory and also the redirection of the My Documents Folder (which is used in a W2003 Server)
I am sure there will be bugs...but I am also looking into what "legit" software we currently use that installs spyware....or is all just user clicking on stuff they shouldnt :rolleyes:
MLF
YEP, this happened to me too Soda and I puzzled at first...and a little worried because it was on a test machine I had built with a bunch of spyware blockers I couldnt understand how it got there. Not to mention none of the other spyware detection software found it: not Spybot, Ad-aware, CounterSpy, or Spy Sweeper.Quote:
Originally posted here by Soda_Popinsky
One big deal, however. How many of you have used the BitDefender Online scan? It installs c:\windows\bdonlinescan\bdupd.dll. AntiSpyware found it as "Brilliant Digital" (notice the BD)
This tells me that the signature was based on a filename? Thats really, really bad. I doubt BitDefender uses code from Brilliant Digital. I'm about to change that filename and test if it shows up again. If it uses filenames as a sole reason to delete a file, thats a huge problem that needs to be changed.
edit
update
Yeah... it uses filename based signatures.
So thanks for the info, I didn't know how it got there and now understand it's false. You're right, that is a very bad way to detect spyware and would anticipate that many non-technical home users will end up crippling good/legit applications.
My take on this software is that it's a little too aggressive for the average/non-tech user who may end up removing everything found including legit stuff but the software does look good and like others said it's basically Giant's anti-spyware software which was highly rated.
I personally have tested and use the following spyware detectors:
* Spy Sweeper by Webroot: very good
* Spybot Search & Destroy
* Ad-aware
* CounterSpy by Sunbelt Software: this is basically Giant's software since Sunbelt licensed it from them; don't know what the future holds for them given the M$ purchase
Webroot has an enterprise version of Spy Sweeper and Sunbelt Software has an enterprise version of CounterSpy. Havent tried the enterprise versions, yet, but thought would mention them to ya.Quote:
Originally posted here by phishphreek80
Now... I want a console from which I can manage all of this on different computers.
I like the look and feel. Like so many others have testified it found things missed by others (nothing running just things that could in theory run/be installed). I had to run it twice before it came back clean (3rd run no spyware detected).
Cheers,
-D
Thread is so good, I made it this week's spotlight. Thank you all for your valuable insight!
http://www.enterpriseitplanet.com/se...le.php/3456221