Misleading reporting - Failure to delete

  • Thread starter Thread starter Guest
  • Start date Start date
G

Guest

Apparently the Beta of MS Antispyware (downloaded 11/08/2005) omits some
error checking. It reported some serious threats with registry entries and
claimed to have deleted them when it was instructed to do so. However, the
entries kept reappearing each time that I ran MS Antispyware (even in safe
mode.) I ran regmon while MS Antispyware claimed to be performing those
deletes and noted that MS Antispyware was receiving access denials on the
attempts to remove those entries. Hence the entries were not in fact being
deleted despite the fact that the program claimed that it had successfully
deleted them. (I manually deleted the entries when I changed the registry
access permissions on the entries.)
 
I recently downloaded the beta version but NEVER get any hits on my computer.
However, running AD-Aware I found and delete many:
ArchiveData(auto-quarantine- 2005-11-11 19-40-57.bckp)
Referencefile : SE1R72 26.10.2005
======================================================

MRU LIST
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
obj[0]=MRU FileReference : C:\Documents and Settings\Lance L
Oakley\recent\10-30-2005 06;29;06PM.lnk
obj[1]=MRU FileReference : C:\Documents and Settings\Lance L
Oakley\recent\11-01-2005 07;21;14AM.lnk
obj[2]=MRU FileReference : C:\Documents and Settings\Lance L
Oakley\recent\2005 worksheet 080205.lnk
obj[3]=MRU FileReference : C:\Documents and Settings\Lance L
Oakley\recent\2005 worksheet.lnk
obj[4]=MRU FileReference : C:\Documents and Settings\Lance L
Oakley\recent\ABS Fax.lnk
obj[5]=MRU FileReference : C:\Documents and Settings\Lance L
Oakley\recent\Fax Coversheet - Withdrawal Revised.lnk
obj[6]=MRU FileReference : C:\Documents and Settings\Lance L
Oakley\recent\North Bay Manor mailing address.lnk
obj[7]=MRU FileReference : C:\Documents and Settings\Lance L
Oakley\recent\NorthBayPlan.lnk
obj[9]=MRU RegReference : software\microsoft\direct3d\mostrecentapplication
name
obj[10]=MRU RegReference : software\microsoft\direct3d\mostrecentapplication
name
obj[11]=MRU RegReference :
software\microsoft\directdraw\mostrecentapplication name
obj[12]=MRU RegReference :
S-1-5-21-709704144-2223876160-4089743662-1007\software\microsoft\internet
explorer download directory
obj[13]=MRU RegReference :
S-1-5-21-709704144-2223876160-4089743662-1007\software\microsoft\windows\currentversion\explorer\comdlg32\opensavemru\*
obj[14]=MRU RegReference :
S-1-5-21-709704144-2223876160-4089743662-1007\software\microsoft\windows\currentversion\explorer\recentdocs\.doc
obj[15]=MRU RegReference :
S-1-5-21-709704144-2223876160-4089743662-1007\software\microsoft\windows\currentversion\explorer\recentdocs\.RTF
obj[16]=MRU RegReference :
S-1-5-21-709704144-2223876160-4089743662-1007\software\microsoft\windows\currentversion\explorer\recentdocs\.xls
obj[17]=MRU RegReference :
S-1-5-21-709704144-2223876160-4089743662-1007\software\microsoft\office\8.0\common\open find\microsoft word\settings\open\file name mru value
obj[18]=MRU RegReference :
S-1-5-21-709704144-2223876160-4089743662-1007\software\microsoft\windows
media\wmsdk\general computername
obj[19]=MRU RegReference :
S-1-5-21-709704144-2223876160-4089743662-1007\software\microsoft\office\8.0\excel\recent file list
obj[20]=MRU RegReference :
S-1-5-21-709704144-2223876160-4089743662-1007\software\microsoft\windows\currentversion\explorer\comdlg32\lastvisitedmru

TRACKING COOKIE
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
obj[16]=IECache Entry : Cookie:lance l (e-mail address removed)/
obj[17]=IECache Entry : Cookie:lance l (e-mail address removed)/
obj[18]=IECache Entry : Cookie:lance l (e-mail address removed)/
obj[19]=IECache Entry : Cookie:lance l (e-mail address removed)/
obj[20]=IECache Entry : Cookie:lance l (e-mail address removed)4.com/
obj[21]=IECache Entry : Cookie:lance l (e-mail address removed)/
obj[22]=IECache Entry : Cookie:lance l (e-mail address removed)/
obj[23]=IECache Entry : Cookie:lance l (e-mail address removed)/
obj[24]=IECache Entry : Cookie:lance l (e-mail address removed)/
obj[25]=IECache Entry : Cookie:lance l (e-mail address removed)/

I dont think this beta version works and if folks are counting on this
product they may have a false sence of secutiry...
Lance
 
First off, I don't think you have a clue about what an MRU List is. It is
the Most Recently Used object List, and in NO WAY can compromise your
security. No one in the outside world can tell what programs you have run or
are currently running unles they have hacked into your system. This means
that your system MUST be compromised for this to even be an issue, a small
one at that.

Second, in no way can tracking cookies harm you, or your system. They are
used by web site advertisers to track what sites you visit and suggest
products specifically for you, as long as they are also the advertiser for
the other sites. These advertisers can only view the cookies they stored on
your system, and no one else can read these cookies. And I mean NO ONE else!
The cookies you need to be conserned about are the ones that store
personally identifiable information. The host domain that stored this type
of cookie on your system can then use that information as they see fit, which
can lead to identity theft. So basically, tracking cookies track your
browsing habits, but don't put your security at risk in any way.

Both of these issues are really privacy issues, not security issues.
Antispyware apps should focus on security, not privacy since securing your
system from spying is far more important than someone knowing that your
system, not you personally (they only know the user account, not the person
using that account), visited so-and-so's web site.

Lance said:
I recently downloaded the beta version but NEVER get any hits on my computer.
However, running AD-Aware I found and delete many:
ArchiveData(auto-quarantine- 2005-11-11 19-40-57.bckp)
Referencefile : SE1R72 26.10.2005
======================================================

MRU LIST
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
obj[0]=MRU FileReference : C:\Documents and Settings\Lance L
Oakley\recent\10-30-2005 06;29;06PM.lnk
obj[1]=MRU FileReference : C:\Documents and Settings\Lance L
Oakley\recent\11-01-2005 07;21;14AM.lnk
obj[2]=MRU FileReference : C:\Documents and Settings\Lance L
Oakley\recent\2005 worksheet 080205.lnk
obj[3]=MRU FileReference : C:\Documents and Settings\Lance L
Oakley\recent\2005 worksheet.lnk
obj[4]=MRU FileReference : C:\Documents and Settings\Lance L
Oakley\recent\ABS Fax.lnk
obj[5]=MRU FileReference : C:\Documents and Settings\Lance L
Oakley\recent\Fax Coversheet - Withdrawal Revised.lnk
obj[6]=MRU FileReference : C:\Documents and Settings\Lance L
Oakley\recent\North Bay Manor mailing address.lnk
obj[7]=MRU FileReference : C:\Documents and Settings\Lance L
Oakley\recent\NorthBayPlan.lnk
obj[9]=MRU RegReference : software\microsoft\direct3d\mostrecentapplication
name
obj[10]=MRU RegReference : software\microsoft\direct3d\mostrecentapplication
name
obj[11]=MRU RegReference :
software\microsoft\directdraw\mostrecentapplication name
obj[12]=MRU RegReference :
S-1-5-21-709704144-2223876160-4089743662-1007\software\microsoft\internet
explorer download directory
obj[13]=MRU RegReference :
S-1-5-21-709704144-2223876160-4089743662-1007\software\microsoft\windows\currentversion\explorer\comdlg32\opensavemru\*
obj[14]=MRU RegReference :
S-1-5-21-709704144-2223876160-4089743662-1007\software\microsoft\windows\currentversion\explorer\recentdocs\.doc
obj[15]=MRU RegReference :
S-1-5-21-709704144-2223876160-4089743662-1007\software\microsoft\windows\currentversion\explorer\recentdocs\.RTF
obj[16]=MRU RegReference :
S-1-5-21-709704144-2223876160-4089743662-1007\software\microsoft\windows\currentversion\explorer\recentdocs\.xls
obj[17]=MRU RegReference :
S-1-5-21-709704144-2223876160-4089743662-1007\software\microsoft\office\8.0\common\open find\microsoft word\settings\open\file name mru value
obj[18]=MRU RegReference :
S-1-5-21-709704144-2223876160-4089743662-1007\software\microsoft\windows
media\wmsdk\general computername
obj[19]=MRU RegReference :
S-1-5-21-709704144-2223876160-4089743662-1007\software\microsoft\office\8.0\excel\recent file list
obj[20]=MRU RegReference :
S-1-5-21-709704144-2223876160-4089743662-1007\software\microsoft\windows\currentversion\explorer\comdlg32\lastvisitedmru

TRACKING COOKIE
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
obj[16]=IECache Entry : Cookie:lance l (e-mail address removed)/
obj[17]=IECache Entry : Cookie:lance l (e-mail address removed)/
obj[18]=IECache Entry : Cookie:lance l (e-mail address removed)/
obj[19]=IECache Entry : Cookie:lance l (e-mail address removed)/
obj[20]=IECache Entry : Cookie:lance l (e-mail address removed)4.com/
obj[21]=IECache Entry : Cookie:lance l (e-mail address removed)/
obj[22]=IECache Entry : Cookie:lance l (e-mail address removed)/
obj[23]=IECache Entry : Cookie:lance l (e-mail address removed)/
obj[24]=IECache Entry : Cookie:lance l (e-mail address removed)/
obj[25]=IECache Entry : Cookie:lance l (e-mail address removed)/

I dont think this beta version works and if folks are counting on this
product they may have a false sence of secutiry...
Lance


Jerry M. said:
Apparently the Beta of MS Antispyware (downloaded 11/08/2005) omits some
error checking. It reported some serious threats with registry entries and
claimed to have deleted them when it was instructed to do so. However, the
entries kept reappearing each time that I ran MS Antispyware (even in safe
mode.) I ran regmon while MS Antispyware claimed to be performing those
deletes and noted that MS Antispyware was receiving access denials on the
attempts to remove those entries. Hence the entries were not in fact being
deleted despite the fact that the program claimed that it had successfully
deleted them. (I manually deleted the entries when I changed the registry
access permissions on the entries.)
Click to expand...
Click to expand...
 
Without making any implications about the correctness of Alan's response to
Lance, I find it necessary to respond to his message to refocus on the
original topic. Unfortunately some forum readers start from the deepest
thread entry and work back. Alan's response could cause them to miss the
information in the original posting.

The purpose of the original message was to point out that MS Antispyware
incorrectly informed users that it had deleted potential spyware when it had
in fact failed to perform the deletion. Such is the nature of beta products.
In fact, it is not the only antispyware product that exhibits this behaviour.

Any such product will give the user a false sense of security ---- until
they run it again and the problem reappears. Then they will have a
potentially false sense of insecurity for it then looks like there is
something truely sinister going on within their system.


Alan said:
First off, I don't think you have a clue about what an MRU List is. It is
the Most Recently Used object List, and in NO WAY can compromise your
security. No one in the outside world can tell what programs you have run or
are currently running unles they have hacked into your system. This means
that your system MUST be compromised for this to even be an issue, a small
one at that.

Second, in no way can tracking cookies harm you, or your system. They are
used by web site advertisers to track what sites you visit and suggest
products specifically for you, as long as they are also the advertiser for
the other sites. These advertisers can only view the cookies they stored on
your system, and no one else can read these cookies. And I mean NO ONE else!
The cookies you need to be conserned about are the ones that store
personally identifiable information. The host domain that stored this type
of cookie on your system can then use that information as they see fit, which
can lead to identity theft. So basically, tracking cookies track your
browsing habits, but don't put your security at risk in any way.

Both of these issues are really privacy issues, not security issues.
Antispyware apps should focus on security, not privacy since securing your
system from spying is far more important than someone knowing that your
system, not you personally (they only know the user account, not the person
using that account), visited so-and-so's web site.

Lance said:
I recently downloaded the beta version but NEVER get any hits on my computer.
However, running AD-Aware I found and delete many:
ArchiveData(auto-quarantine- 2005-11-11 19-40-57.bckp)
Referencefile : SE1R72 26.10.2005
======================================================

MRU LIST
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
obj[0]=MRU FileReference : C:\Documents and Settings\Lance L
Oakley\recent\10-30-2005 06;29;06PM.lnk
obj[1]=MRU FileReference : C:\Documents and Settings\Lance L
Oakley\recent\11-01-2005 07;21;14AM.lnk
obj[2]=MRU FileReference : C:\Documents and Settings\Lance L
Oakley\recent\2005 worksheet 080205.lnk
obj[3]=MRU FileReference : C:\Documents and Settings\Lance L
Oakley\recent\2005 worksheet.lnk
obj[4]=MRU FileReference : C:\Documents and Settings\Lance L
Oakley\recent\ABS Fax.lnk
obj[5]=MRU FileReference : C:\Documents and Settings\Lance L
Oakley\recent\Fax Coversheet - Withdrawal Revised.lnk
obj[6]=MRU FileReference : C:\Documents and Settings\Lance L
Oakley\recent\North Bay Manor mailing address.lnk
obj[7]=MRU FileReference : C:\Documents and Settings\Lance L
Oakley\recent\NorthBayPlan.lnk
obj[9]=MRU RegReference : software\microsoft\direct3d\mostrecentapplication
name
obj[10]=MRU RegReference : software\microsoft\direct3d\mostrecentapplication
name
obj[11]=MRU RegReference :
software\microsoft\directdraw\mostrecentapplication name
obj[12]=MRU RegReference :
S-1-5-21-709704144-2223876160-4089743662-1007\software\microsoft\internet
explorer download directory
obj[13]=MRU RegReference :
S-1-5-21-709704144-2223876160-4089743662-1007\software\microsoft\windows\currentversion\explorer\comdlg32\opensavemru\*
obj[14]=MRU RegReference :
S-1-5-21-709704144-2223876160-4089743662-1007\software\microsoft\windows\currentversion\explorer\recentdocs\.doc
obj[15]=MRU RegReference :
S-1-5-21-709704144-2223876160-4089743662-1007\software\microsoft\windows\currentversion\explorer\recentdocs\.RTF
obj[16]=MRU RegReference :
S-1-5-21-709704144-2223876160-4089743662-1007\software\microsoft\windows\currentversion\explorer\recentdocs\.xls
obj[17]=MRU RegReference :
S-1-5-21-709704144-2223876160-4089743662-1007\software\microsoft\office\8.0\common\open find\microsoft word\settings\open\file name mru value
obj[18]=MRU RegReference :
S-1-5-21-709704144-2223876160-4089743662-1007\software\microsoft\windows
media\wmsdk\general computername
obj[19]=MRU RegReference :
S-1-5-21-709704144-2223876160-4089743662-1007\software\microsoft\office\8.0\excel\recent file list
obj[20]=MRU RegReference :
S-1-5-21-709704144-2223876160-4089743662-1007\software\microsoft\windows\currentversion\explorer\comdlg32\lastvisitedmru

TRACKING COOKIE
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
obj[16]=IECache Entry : Cookie:lance l (e-mail address removed)/
obj[17]=IECache Entry : Cookie:lance l (e-mail address removed)/
obj[18]=IECache Entry : Cookie:lance l (e-mail address removed)/
obj[19]=IECache Entry : Cookie:lance l (e-mail address removed)/
obj[20]=IECache Entry : Cookie:lance l (e-mail address removed)4.com/
obj[21]=IECache Entry : Cookie:lance l (e-mail address removed)/
obj[22]=IECache Entry : Cookie:lance l (e-mail address removed)/
obj[23]=IECache Entry : Cookie:lance l (e-mail address removed)/
obj[24]=IECache Entry : Cookie:lance l (e-mail address removed)/
obj[25]=IECache Entry : Cookie:lance l (e-mail address removed)/

I dont think this beta version works and if folks are counting on this
product they may have a false sence of secutiry...
Lance


Jerry M. said:
Apparently the Beta of MS Antispyware (downloaded 11/08/2005) omits some
error checking. It reported some serious threats with registry entries and
claimed to have deleted them when it was instructed to do so. However, the
entries kept reappearing each time that I ran MS Antispyware (even in safe
mode.) I ran regmon while MS Antispyware claimed to be performing those
deletes and noted that MS Antispyware was receiving access denials on the
attempts to remove those entries. Hence the entries were not in fact being
deleted despite the fact that the program claimed that it had successfully
deleted them. (I manually deleted the entries when I changed the registry
access permissions on the entries.)
Click to expand...
Click to expand...
Click to expand...
 
I understand the problem, but Lance's reply showed that he doesn't truely
know what's a problem and what isn't. His reply misinforms the average user
that MRUs are a bad thing, when they aren't. MRUs are used by Windows to
help hide certain items in the Start Menu based upon how long ago they have
been used. They in no way can affect, nor compromise the security of the
system in any way. Most people who don't know much about computers would
have been led to believe that there system's security had been compromised
because of his reply. If he would have removed the checkmark in Ad-Aware to
not search for negligable objects (i.e., objects with a TAC of zero, which an
MRU is one of these types of objects), then he would never have seen this on
his report from Ad-Aware.

As for the problem with items being removed when they aren't, there are many
possiblities. I'm going to separate each into a separate paragraph since the
paragraph would be way too long to read if I didn't do so.

The biggest cause of this issue is that the user is not using the correct
account to deal with these infections. Since the current release of the app
is only single-user, as was Giant AntiSpyware (now MSAS once MS bought out
Giant Company), you MUST use the administrator account that installed MSAS.
Otherwise the removal WILL fail. This failure can't be blamed on MSAS, even
if it says it removed the infection, since the user is not using the correct
account. When Beta 2 is released later this year, this issue should be moot
since the app will likely be multi-user.

One big problem is that the particular item has files that are currently in
use. If this is the case, then no matter how you try to remove this
particular item, it will not be removed. The only way to deal with these
types of issues are to boot into Safe Mode.

Another possible cause is the item was removed, but you inadvertantly
reinfected the system without knowing that you did so. By that, I mean you
launched an app that the infection has linked code to in the prefetch folder
(c:\windows\prefetch). When the app is launched, the computer is reinfected
from the inside, causing the real-time protection to fail to catch it because
the threat is from the inside not the outside. The best way to deal with this
is to delete the entire content of the prefetch folder. NOTE: This is only
an issue with XP, as no other version of Windows uses the prefetch (code used
to launch apps quicker) folder. I'd suggest booting into Safe Mode to do
this type of deletion since the files will not be in use in Safe Mode.

Yet another possible cause is the infection is a new variant, and using the
old definition fileset to remove it will cause the app to think it's removed
it when it hasn't. This isn't a fault of the program since it truely thinks
it's removed it given the definiton fileset it is using. To correct this
type of issue, make certain you have the latest definitions before trying to
remove anything.

One other cause is you are trying to remove an item that uses registered
components (i.e., a toolbar, deskbar, and other infections that use these to
make it nearly impossible to remove the infection). When trying to deal with
these items, it becomes neccessary to manually remove them, or use the
unistaller that came with the app since it can remove the registered
component.

The last possible issue is that you are trying to remove an item, such as
SpySheriff, that randomly creates different keys and installation folders
when it's installed, making it impoosible to remove it by any means other
than manual removal.

Alan

Jerry M. said:
Without making any implications about the correctness of Alan's response to
Lance, I find it necessary to respond to his message to refocus on the
original topic. Unfortunately some forum readers start from the deepest
thread entry and work back. Alan's response could cause them to miss the
information in the original posting.

The purpose of the original message was to point out that MS Antispyware
incorrectly informed users that it had deleted potential spyware when it had
in fact failed to perform the deletion. Such is the nature of beta products.
In fact, it is not the only antispyware product that exhibits this behaviour.

Any such product will give the user a false sense of security ---- until
they run it again and the problem reappears. Then they will have a
potentially false sense of insecurity for it then looks like there is
something truely sinister going on within their system.


Alan said:
First off, I don't think you have a clue about what an MRU List is. It is
the Most Recently Used object List, and in NO WAY can compromise your
security. No one in the outside world can tell what programs you have run or
are currently running unles they have hacked into your system. This means
that your system MUST be compromised for this to even be an issue, a small
one at that.

Second, in no way can tracking cookies harm you, or your system. They are
used by web site advertisers to track what sites you visit and suggest
products specifically for you, as long as they are also the advertiser for
the other sites. These advertisers can only view the cookies they stored on
your system, and no one else can read these cookies. And I mean NO ONE else!
The cookies you need to be conserned about are the ones that store
personally identifiable information. The host domain that stored this type
of cookie on your system can then use that information as they see fit, which
can lead to identity theft. So basically, tracking cookies track your
browsing habits, but don't put your security at risk in any way.

Both of these issues are really privacy issues, not security issues.
Antispyware apps should focus on security, not privacy since securing your
system from spying is far more important than someone knowing that your
system, not you personally (they only know the user account, not the person
using that account), visited so-and-so's web site.

Lance said:
I recently downloaded the beta version but NEVER get any hits on my computer.
However, running AD-Aware I found and delete many:
ArchiveData(auto-quarantine- 2005-11-11 19-40-57.bckp)
Referencefile : SE1R72 26.10.2005
======================================================

MRU LIST
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
obj[0]=MRU FileReference : C:\Documents and Settings\Lance L
Oakley\recent\10-30-2005 06;29;06PM.lnk
obj[1]=MRU FileReference : C:\Documents and Settings\Lance L
Oakley\recent\11-01-2005 07;21;14AM.lnk
obj[2]=MRU FileReference : C:\Documents and Settings\Lance L
Oakley\recent\2005 worksheet 080205.lnk
obj[3]=MRU FileReference : C:\Documents and Settings\Lance L
Oakley\recent\2005 worksheet.lnk
obj[4]=MRU FileReference : C:\Documents and Settings\Lance L
Oakley\recent\ABS Fax.lnk
obj[5]=MRU FileReference : C:\Documents and Settings\Lance L
Oakley\recent\Fax Coversheet - Withdrawal Revised.lnk
obj[6]=MRU FileReference : C:\Documents and Settings\Lance L
Oakley\recent\North Bay Manor mailing address.lnk
obj[7]=MRU FileReference : C:\Documents and Settings\Lance L
Oakley\recent\NorthBayPlan.lnk
obj[9]=MRU RegReference : software\microsoft\direct3d\mostrecentapplication
name
obj[10]=MRU RegReference : software\microsoft\direct3d\mostrecentapplication
name
obj[11]=MRU RegReference :
software\microsoft\directdraw\mostrecentapplication name
obj[12]=MRU RegReference :
S-1-5-21-709704144-2223876160-4089743662-1007\software\microsoft\internet
explorer download directory
obj[13]=MRU RegReference :
S-1-5-21-709704144-2223876160-4089743662-1007\software\microsoft\windows\currentversion\explorer\comdlg32\opensavemru\*
obj[14]=MRU RegReference :
S-1-5-21-709704144-2223876160-4089743662-1007\software\microsoft\windows\currentversion\explorer\recentdocs\.doc
obj[15]=MRU RegReference :
S-1-5-21-709704144-2223876160-4089743662-1007\software\microsoft\windows\currentversion\explorer\recentdocs\.RTF
obj[16]=MRU RegReference :
S-1-5-21-709704144-2223876160-4089743662-1007\software\microsoft\windows\currentversion\explorer\recentdocs\.xls
obj[17]=MRU RegReference :
S-1-5-21-709704144-2223876160-4089743662-1007\software\microsoft\office\8.0\common\open find\microsoft word\settings\open\file name mru value
obj[18]=MRU RegReference :
S-1-5-21-709704144-2223876160-4089743662-1007\software\microsoft\windows
media\wmsdk\general computername
obj[19]=MRU RegReference :
S-1-5-21-709704144-2223876160-4089743662-1007\software\microsoft\office\8.0\excel\recent file list
obj[20]=MRU RegReference :
S-1-5-21-709704144-2223876160-4089743662-1007\software\microsoft\windows\currentversion\explorer\comdlg32\lastvisitedmru

TRACKING COOKIE
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
obj[16]=IECache Entry : Cookie:lance l (e-mail address removed)/
obj[17]=IECache Entry : Cookie:lance l (e-mail address removed)/
obj[18]=IECache Entry : Cookie:lance l (e-mail address removed)/
obj[19]=IECache Entry : Cookie:lance l (e-mail address removed)/
obj[20]=IECache Entry : Cookie:lance l (e-mail address removed)4.com/
obj[21]=IECache Entry : Cookie:lance l (e-mail address removed)/
obj[22]=IECache Entry : Cookie:lance l (e-mail address removed)/
obj[23]=IECache Entry : Cookie:lance l (e-mail address removed)/
obj[24]=IECache Entry : Cookie:lance l (e-mail address removed)/
obj[25]=IECache Entry : Cookie:lance l (e-mail address removed)/

I dont think this beta version works and if folks are counting on this
product they may have a false sence of secutiry...
Lance


:

Apparently the Beta of MS Antispyware (downloaded 11/08/2005) omits some
error checking. It reported some serious threats with registry entries and
claimed to have deleted them when it was instructed to do so. However, the
entries kept reappearing each time that I ran MS Antispyware (even in safe
mode.) I ran regmon while MS Antispyware claimed to be performing those
deletes and noted that MS Antispyware was receiving access denials on the
attempts to remove those entries. Hence the entries were not in fact being
deleted despite the fact that the program claimed that it had successfully
deleted them. (I manually deleted the entries when I changed the registry
access permissions on the entries.)
Click to expand...
Click to expand...
Click to expand...
 
Back
Top