Microsoft AntiSpyware (Beta)

  • Thread starter Thread starter Ionizer
  • Start date Start date
Thagor said:
Yep, that ought to just about do it. Nuttin left but the Micro
smoke and Soft residue.
Click to expand...

<lol> Micro smoke and Soft residue... that could almost be a sig line.
 
You must be very careful when MS puts out beta software. It's usually full
of bugs, more so than their normal release, and many times, removing the
trash requires formatting and re-installing.
Click to expand...

Normally, I would agree wholeheartedly with that sentiment, but since this
isn't "their" software, and they have had very little time to mess with the
code of what was already a prertty good product (Giant), I may take a
chance and try it.


Bob
 
I generally don't like to install beta software, but Microsoft
AntiSpyware has gotten very good reviews so I thought I'd go ahead and try
it. Installation went fine. I immediately performed a quick scan, and this
was found:

<<Details: SearchSquire is an Internet Explorer sidebar containing paid
links that open when you use search engines.>>


SearchSquire was rated "high risk" so I let MAS (Microsoft AntiSpyware)
remove it. Neither Spybot, Spyware-Blaster or Ad-Aware SE 1.05 had
previously found this file.
 
History Fan wrote:
....
<<Details: SearchSquire is an Internet Explorer sidebar containing
paid links that open when you use search engines.>>

SearchSquire was rated "high risk" so I let MAS (Microsoft
AntiSpyware) remove it. Neither Spybot, Spyware-Blaster or
Ad-Aware SE 1.05 had previously found this file.
Click to expand...

http://www.doxdesk.com/parasite/SearchSquire.html
says AdAware will remove it. Several other pages I found said it's
been in the AdAware list since 2003.

Symantec posted this page last month:
http://sarc.com/avcenter/venc/data/adware.searchsquire.html
 
Beauregard T. Shagnasty said:
History Fan wrote:
...

http://www.doxdesk.com/parasite/SearchSquire.html
says AdAware will remove it. Several other pages I found said it's been in
the AdAware list since 2003.

Symantec posted this page last month:
http://sarc.com/avcenter/venc/data/adware.searchsquire.html
Click to expand...

I have had Ad-Aware for a long time, and it never found it. However the MS
AntiSpyware found it, and I put it in quarantine until I learn more.

SearchSquire
Type: Adware
Author: New Media Properties, LLC
Description: SearchSquire is an Internet Explorer sidebar containing paid
links that open when you use search engines.
Advice: This is a high risk threat and should be removed or quarantined as
to prevent harm to your computer or your privacy.
Registry Keys:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet
Settings\ZoneMap\Domains\searchsquire.com
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet
Settings\ZoneMap\Domains\searchsquire.com *

It also found this...

Possible Hosts File Hijack
Type: Spyware
Description: A possible hosts file hijack involves a malware program
changing your Windows hosts file.
Advice: This is a very high risk threat and should be removed immediately as
to prevent harm to your computer or your privacy.

For unknown reasons more details were not retained in the antispyware log. I
could reactivate it and run the antispyware again to find out, if needed,
but remember that it related to one of my ad-related "0.0.0.0 google"
entries in HOSTS file.

While playing around with the settings on the new MS AntiSpyware beta, I had
one fatal exception, but it seems to work generally OK. Of course I made a
System Restore point before installing, but looks like it won't be needed. I
was able to turn off all startup & automatic/scheduled tasks in MS
AntiSpyware and will probably only use it as an on-demand scanner.
 
History Fan said:
I generally don't like to install beta software, but Microsoft
AntiSpyware has gotten very good reviews so I thought I'd go ahead and try
it. Installation went fine. I immediately performed a quick scan, and this
was found:

<<Details: SearchSquire is an Internet Explorer sidebar containing paid
links that open when you use search engines.>>


SearchSquire was rated "high risk" so I let MAS (Microsoft AntiSpyware)
remove it. Neither Spybot, Spyware-Blaster or Ad-Aware SE 1.05 had
previously found this file.
Click to expand...

According to some of the folks in the grc newsgroups, this may be a false
positive related to Spybot S&D's immunization feature. Because I don't
use Spybot S&D and have yet to install Microsoft AntiSpyware, I'll just
quote the relevant parts of that thread:

"TJ"
: Only thing it found on my machine was SearchSquire. I am pretty well
: fortified here and I'm not sure where that came from.

That could be a false positive. If you're running Spybot & you deleted the
SearchSquire, you may have deleted Spybot's immunization against
SearchSquire. Rerun Spybot's immunization & it will say you're missing
Click to expand...
one.
 
SearchSquire was rated "high risk" so I let MAS (Microsoft
AntiSpyware)

According to some of the folks in the grc newsgroups, this may be a false
positive related to Spybot S&D's immunization feature.
Click to expand...

I think you're right.
 
rjdriver said:
Normally, I would agree wholeheartedly with that sentiment, but since this
isn't "their" software, and they have had very little time to mess with the
code of what was already a prertty good product (Giant), I may take a
chance and try it.
Click to expand...

Hmmm, it really doesn't take much time to put in a trapdoor.
 
"History Fan" <[email protected]> squirted these
wordjisms deep inside the bumtube of the newstwat in
I think you're right.
Click to expand...


I agree. Some anti-spyware software applications will write dummy entries
into your registry for the purpose of fooling malware that you come into
contact with into thinking its already installed.

Spywareblaster does this. I use that and my registry is full of entries
that various known malware apps write to, and yet I am as sure as I can
be that I have no spyware on my machine whatsoever.

--
*********************************
David Qunt
Click to expand...
****************************************************
 
The SearchSquire/Spybot glitch has convinced me to uninstall Microsoft
AntiSpyware and just stick with the three programs I'm currently using:
Spybot 1.3, Ad-Aware SE 1.05, and SpywareBlaster 3.2. I think that's enough
anti-spyware applications for one computer.
 
"History Fan" <[email protected]> squirted these
wordjisms deep inside the bumtube of the newstwat in
The SearchSquire/Spybot glitch has convinced me to uninstall
Microsoft
AntiSpyware and just stick with the three programs I'm currently
using: Spybot 1.3, Ad-Aware SE 1.05, and SpywareBlaster 3.2. I think
that's enough anti-spyware applications for one computer.
Click to expand...

I agree completely, and have uninstalled it myself That's almost exactly
the same combination of three that I use (except I'm on Spybot 1.4 Beta
2) and since using those together with Firefox instead of IE, I have yet
to find any spyware on my machine.

I now only use IE for Windows updates, and even then I have to turn on
several services (Automatic updates and Background Intelligent Transfer
Service) and features (ActiveX, Javascript) that I normally leave
disabled because some components of IE get used by other programs.

With the ever-increasing number of vulnerabilities found in IE, it would
be much better all round if it was rebuilt from scratch, without the
ability to run code on the local machine at all, never mind inside these
supposed 'zones' that are not properly protected even when you think
they're supposed to be.

And as far as I'm concerned, if doing so breaks functionality in poorly
coded websites, or if companies are forced to re-design their non-
standards compliant web applications, then so be it - that is what should
be done. Preferrably before the situation worsens.


--
*********************************
David Qunt
Click to expand...
****************************************************
 
Back
Top