PC AUDIT IS SPYWARE

  • Thread starter Thread starter Frank Bohan
  • Start date Start date
F

Frank Bohan

Please ignore my earlier post PC Audit.

PC AUDIT IS SPYWARE

===

Frank Bohan
¶ How to Serve Your Fellow Man -- A cookery course for cannibal chefs.
 
jo said:
Nonsense.

(fuller refutation in earlier post)
Click to expand...

Jo, you may be right. When I first posted about PC Audit I had no doubts
about it. However, the post by Tony Brezovski referring to Symantac's
findings made me doubtful. I was made even more doubtful on receipt of their
e-mail confirmation of results which implied that because they could
duplicate my Documents directory's filenames, they (or others) could have
accessed my actual files, when other leak tests failed to confirm this.

Jo, you may be right, but I tend to accept Symantac's findings until they
are proved wrong. In view of this, I felt obliged to warn anyone who may
have been led by my initial post to try it, to proceed with caution. I would
add that the report also mentioned several malware files on my computer
which were either non-existent or not a threat. The site is also heavily
geared to selling their payware program at $60 per annum.

Jo, you may be right, but the opinions of others would be appreciated, and
if and when they back you up accept my apologies.

===

Frank Bohan
¶ What foods these morsels be!
 
Tony said:
There's some considerable discussion about pcAudit in
comp.security.firewalls, such as
http://groups.google.com/groups?hl=en&lr=&client=firefox-a&threadm=m5W
L8.120452%24352.5775%40sccrnsc02&rnum=11&prev=/groups%3Fq%3DpcAudit%26
hl%3Den%26lr%3D%26client%3Dfirefox-a%26start%3D10%26sa%3DN

Symantec may be mistaken.

Tony
Click to expand...

Hmm, spyware (Symantec's DRM) reporting that a program is spyware...
where have I heard THAT before?

Frank, do you have a link to PC Audit... would love to have a look at
this, Symantec has a history of falso positives.

Dick
 
Please ignore my earlier post PC Audit.

PC AUDIT IS SPYWARE
Click to expand...

Ahem, as far as I can tell from a Google search and various reviews of
it (and I have it on my system quite safely NOT running), this is a
tool which demonstrates HOW spyware works (in one manner, that of DLL
injection, apparently.)

So I'd say it really HAS to be spyware to do its job.

And Symantec's report is based on an earlier version.

Go here and read this thread which discusses it, what it does, and how
to block it:
http://www.abxzone.com/forums/archive/index.php/t-80119.html

Basically, if you don't run it, it's not a threat. And after you run
it for testing, just delete the thing and it's no longer a threat.
It's a "trojan demo", as far as I can tell.
 
Jo, you may be right, but the opinions of others would be appreciated, and
if and when they back you up accept my apologies.

===

Frank Bohan
Click to expand...

The program says - "hey, I am going to try and spy on you - sure
that's OK with you"

How it does this I don't care, apart from trying to fix the loopholes.

The only issue for me is that I need to trust them that they will
delete any info they get.

The analogy here is that I ask a burglar friend to test out my house
security for me -just see if he can get in, and prove it by listing
the furniture in my bedroom. He does, then I report him to the police
:-)
 
Alastair Smeaton said:
The program says - "hey, I am going to try and spy on you - sure
that's OK with you"

How it does this I don't care, apart from trying to fix the loopholes.

The only issue for me is that I need to trust them that they will
delete any info they get.

The analogy here is that I ask a burglar friend to test out my house
security for me -just see if he can get in, and prove it by listing
the furniture in my bedroom. He does, then I report him to the police
:-)
Click to expand...

A nice analogy, but what if, unknown to you, he bugs your phone or copies
your bank details. The question seems to be whether the scan leaves anything
on your computer, malicious or not, or professes to find problems which do
not exist. To carry your analogy further, would you expect the burglar to
try to sell you an expensive burglar alarm. PCAudit tries to sell you
software priced at $60 per year.
:-)

===

Frank Bohan
¶ Jargon is an unsubstantiated empirical inexactitude.
 
A nice analogy, but what if, unknown to you, he bugs your phone or copies
your bank details. The question seems to be whether the scan leaves anything
on your computer, malicious or not, or professes to find problems which do
not exist. To carry your analogy further, would you expect the burglar to
try to sell you an expensive burglar alarm. PCAudit tries to sell you
software priced at $60 per year.
:-)
Click to expand...

Absolutely agree with you Frank - however, in this case, where is the
proof or even reasonable suggestion that PC Audit does leave anything
on your PC or professes to find problems which do not exist.

The symantec site has no detail I could see, and it seemed to me that
the OP was labeling this Spyware on the basis that it tries to see if
it can find info on your PC then tell you what it is. I had a quick
look at other links posted and saw no info which led me to believe
that PC Audit left any trojans. System Safety monitor reports PC audit
as a "demo trojan" - and furthermore, it was PC Audit which raised the
possibility with me of dll injections, following threads on this took
me to freeware SSM which can protect me - all freeware.

I realise that they offer this to try to get people to buy their
product - however, this is certainly not the worst offender (in terms
of scaremongering) this is a company - it needs to make money.
However, for those who know about freeware, their freeware product can
alert me to a problem which I then attempt to find a freeware solution
to. Some may certainly be scared into buying their product, but isn't
this the case for many companies ?

The burglar analogy ? I liked it :-) And yes, if I asked my friend to
burgle my house and he found it easy, I would be offended if he did
NOT offer me a solution - if he can fix it for $60 great - but I
would ask questions and make up my own mind about what I needed to do,
and could I do it myself for less or for nothing.

I just think that some folk jumped all over this product without doing
the research required. And while I am a little suspicious of PC audit
because they sell me, I extend this suspicion to Symantec who
blatantly label it spyware. If I ran the PC audit company I would
consider suing them - what would Symantec do if Microsoft put out an
alert that Norton antivirus was really a trojan ?

I think we really agree on this - your suspicion is warranted, but I
would cut them a little more slack until someone shows me evidence
that this is in fact spyware.

cheers
 
I just think that some folk jumped all over this product without doing
the research required. And while I am a little suspicious of PC audit
because they sell me, I extend this suspicion to Symantec who
blatantly label it spyware. If I ran the PC audit company I would
consider suing them - what would Symantec do if Microsoft put out an
alert that Norton antivirus was really a trojan ?

I think we really agree on this - your suspicion is warranted, but I
would cut them a little more slack until someone shows me evidence
that this is in fact spyware.
Click to expand...

Fully aware that it was a demo malicious trojan, I downloaded and ran PC
Audit. It was detected by my AV (Vet) and Kerio FP, but it still
managed to send to the PCInternet patrol site details of EVERY folder on
my desktop and my docs folder.

After a trial period, I actually purchased PCInternet Patrol. Since then
I've deleted PC Audit, scanned my computer with all available tools and
there are no nasties left on the computer. It is gone.

After following the threads here, I read the like to a Google thread
about PC Audit (sorry, cant find the reference), which led me on to this
page. http://keir.net/firehole.html

I'm not about to start preaching the merits of a piece of paid software,
but PCIP did the job when I tried to run Firehole. I also find it a lot
less hassle to use than Kerio. Forums for the product can be found here,
they seem to be quite happy to answer questions from anyone - not just
those who have purchased their software.
http://www.pcinternetpatrol.com/forums/index.php?

So, as one who has been there, done that.... I conclude:
PC Audit is indeed a trojan, but there are no secrets about that
It can be deleted safely and easily without leaving anything behind
It is a marketing tool for PCIP, a product I was happy to purchase.
 
Canetoad said:
I'm not about to start preaching the merits of a piece of paid software,
but PCIP did the job when I tried to run Firehole.
Click to expand...

if you are referring to Firehole written by the Foundstone coder, that's
pretty ancient. that technique was new for 2002, but not 2004.

michael
 
Phred said:
Jo, Any idea why they list 2 PC Audit tests?
Click to expand...

They do different things. IIRC PCAudit2 is a bit more difficult to block
in ordinary firewall terms. I forget why.
 
Nonsense.

(fuller refutation in earlier post)
Click to expand...

Jo, you may be right. When I first posted about PC Audit I had no doubts
about it. However, the post by Tony Brezovski referring to Symantac's
findings made me doubtful. [...]
Jo, you may be right, but the opinions of others would be appreciated, and
if and when they back you up accept my apologies.
Click to expand...

It doesn't matter if PC Audit is Spyware or not. I wouldn't touch this
program with a long pole, even if I had done a in-depth disassembly and
debug-trace of this program. (Which I neither have nor be willing to
do, because this program isn't worth the tiniest bit of effort.)

Security is a *very* sensitive area. If security-software bases its
analysis on (partially) sensitive data sent to a server with unknown
(to-be-trusted) security status over an insecure (not encrypted) line,
than the programmers of such software are either malevalent, careless,
or feckless. (Or all of these at the same time...)

The only acceptable approaches for such a scenario (I can currently think
of) would be:

a) An open source client and an open source server are provided to do
the whole test (after looking through the source) between two *trusted*
computers. - Preferably between computers of a separate network (not
connected to the internet). Using *non-sensitive* data *and* using a
high encryption during the transfer, if the transmission of low-level
sensitive data can't be totally omitted. (For which I *can't* think
of any acceptable cause, by the way...)

b) The software collects all needed data offline and shows a detailed
list of (possible) vulnerabilities. After that it writes all data
to a file (maybe a *.zip-archive if a couple of files and directories
needs to be addressed), and creates a Hash of this data using a
*well documented* algorithm, which *does not allow* any conclusion
about the original data. After that it requests the user to connect
to the internet and *only* sends this Hash, to prove the capability
to sent data. It is even questionable, whether it is necessary to
send a Hash at all. Even a simple text string would do... If (for
what reason ever) the data to be sent has to be a *file*, which
maybe even has to currently be inside a system folder, than a well
recognizable file provided (installed) by this security-program
will do.

Installation and deinstallation must be straight-forward. So it
*must not* be questionable, whether all components are removed. If
a program follows these rules it could be easily monitored on
(de)installation, execution, and (with a packet filter) on access
of the net.

To all readers/contributors of this group:
*Please*, don't let the standards of our security-awareness be lowered
by such software calling itself 'security'-tools! Even the 'tests',
some have posted here, show nothing then a *severe* lack of this
state of mind. Sorry, if this sounds rude. But this topic is too
sensitive to deal with it the smooth way... :-(

BeAr
 
b) The software collects all needed data offline and shows a detailed
list of (possible) vulnerabilities. After that it writes all data
to a file (maybe a *.zip-archive if a couple of files and directories
needs to be addressed), and creates a Hash of this data using a
*well documented* algorithm, which *does not allow* any conclusion
about the original data. After that it requests the user to connect
to the internet and *only* sends this Hash, to prove the capability
to sent data. It is even questionable, whether it is necessary to
send a Hash at all. Even a simple text string would do... If (for
what reason ever) the data to be sent has to be a *file*, which
maybe even has to currently be inside a system folder, than a well
recognizable file provided (installed) by this security-program
will do.
Click to expand...

how can it collect information offline ? ask you to supply it yourself
? Please take a snapshot of your desktop and type out a list of your
directories ? It shows whether a nasty program can do this without
your permission, whether you think you are secure or not.
Installation and deinstallation must be straight-forward. So it
*must not* be questionable, whether all components are removed. If
a program follows these rules it could be easily monitored on
(de)installation, execution, and (with a packet filter) on access
of the net.
Click to expand...

So show me where de-installation is difficult - I have run spybot, my
AV, the cleaner, and ad aware and none of them show anything left by
this programme - can you say what was left on your system - no-one
else has. As far as I see, there is no installation - it is a
standalone executable - if not, show me what it does and I will
readily apologise !

To all readers/contributors of this group:
*Please*, don't let the standards of our security-awareness be lowered
by such software calling itself 'security'-tools! Even the 'tests',
some have posted here, show nothing then a *severe* lack of this
state of mind. Sorry, if this sounds rude. But this topic is too
sensitive to deal with it the smooth way... :-(
Click to expand...

You have not been rude at all :-) Just have not shown why anyone
should be suspicious of this tool
 
B. R. 'BeAr' Ederson said:
To all readers/contributors of this group:
*Please*, don't let the standards of our security-awareness be lowered
by such software calling itself 'security'-tools! Even the 'tests',
some have posted here, show nothing then a *severe* lack of this
state of mind. Sorry, if this sounds rude. But this topic is too
sensitive to deal with it the smooth way... :-(
Click to expand...

What total, paranoid, nonsense.

People come to this and other groups looking for security apps to make
them feel safe. They go away with Kerio, Sygate, ZA...

And feel safe.

PCAudit and other leak tests exist in order to knock these people out of
their cosy feeling of security and force them to confront the fact that
security cannot necessarily come out of a box.

You appear to like the 'ignorance is bliss' approach. If it works for
you, fine; I see no reason why you should feel the need to tell others
that they should keep their heads in the sand.
 
Back
Top