Please create an account to participate in the Slashdot moderation system

 


Forgot your password?
Close
typodupeerror
×
Security Bug IT

CA's 'Pest Scan' Results Mislead Users 37

Posted by timothy from the vested-interest dept.
FriedDuck writes "After reading E-Weeks' article about CA's ranking of spyware threats I went to their site to check it out and try their free spyware scan. I was stunned. CA reported that my machine is being terrorized by eleven 'pests' including some that are pretty serious (not just tracking cookies.) Unfortunately all of the serious threats were false positives. CA reported that I had a key logger, cracking tool, and various other nasties that all turned out to be common software (e.g. Flash, SourceSafe) that one wouldn't easily mistake for malware. In fact, without exception my system contained none of the registry keys, folders, or binaries that CA itself say should be there. A blatant attempt at scaring people into buying shoddy software." Read on for the details of what was found, and what was actually on the system.

"If it matters, here's what it reported, and what was there on my system:

  • System Spy - Key Logger. Mistook MSFT's SourceSafe executable for the keylogger. None of the other registry keys, folders or binaries were present
  • Fake CD .99 - Cracking Tool. Mistook the generically-named unins000.exe that InstallShield uses as the Cracking tool. None of the other binaries were present
  • Ezula TopText - Adware. Mistook the installation of Flash as the adware. Stupid.
  • BonziBuddy - Spyware. Mistook a common library intalled by Borland's CaliberRM (EZSMTP object) as the spyware.

None of the other binaries, folders or keys (of which there are many) were present."
This discussion has been archived. No new comments can be posted.

CA's 'Pest Scan' Results Mislead Users More

CA's 'Pest Scan' Results Mislead Users

Comments Filter:

  • FYI re: AVG Free Edition (Score:5, Informative)

    by Tumbleweed ( 3706 ) * on Sunday November 28, 2004 @03:49PM (#10938317)
    Speaking of virus scanners, I've got the new v7 of AVG's free edition on my newly-installed system, and found something odd. Some virus infections require Grisoft's "vcleaner.exe" program (from their website) to clean infections. Strangely, this also scans the entire system, and found (& fixed!) some things AVG itself didn't even find. Bizarre.

  • Help... file delete (Score:4, Interesting)

    by Davak ( 526912 ) on Sunday November 28, 2004 @03:53PM (#10938339) Homepage
    I was recently writing this article for tech-recipes where I was trying to describe how to remove spyware files that are "protected."

    http://www.tech-recipes.com/windows_tips778.html [tech-recipes.com]

    Isn't there a program out there that will tell you which services or programs are protecting a file?

    Davak

    • Re:Help... file delete (Score:4, Informative)

      by Johnno74 ( 252399 ) on Sunday November 28, 2004 @04:31PM (#10938526)
      Yes, there is a tool to tell you what process has is holding a lock on a file - you mentioned it in your article too!

      Use process explorer [sysinternals.com] from Sysinternals. (free download)

      If you use the "find handle" function, and enter the filename, or partial filename, it will list the processes that have this file opened. The find dll function is similar, but finds all processes that have loaded the specified DLL. Very handy for spyware that lives in a dll and has loaded itself with rundll.exe...

      Its an incredibly useful tool. Its one of the first apps I install after a rebuild.

  • From the scan: (Score:5, Funny)

    by shufler ( 262955 ) on Sunday November 28, 2004 @04:08PM (#10938417) Homepage
    You must be using Internet Explorer with your security settings set to allow ActiveX controls to use the Pest Scan.

    So, I must lower my security, so you can test my security? Well, I guess that means I win!
  • I ran this scan before and it said I had a keylogger. Turns out it was something to do with the registration wizard in the Sims 2. Have to say, was a little worried at first, when I saw this!
  • hah... that's one web page I wouldn't want working on my Linux box anyway... :)
  • Mistook the installation of Flash as the adware. Stupid.

    I don't know... maybe it just had the wrong name? :)
  • Would it kill the Slashdot editors to learn some proper editing skills? In the course of a story you should define all acronyms rather than assume all readers know every combination of letters and numbers.

    Get a book on Associated Press writing style and use it.
    • The only acronyms I saw were "CA" and "MSFT". CA is used by Computer Associates in the same way that General Motors uses GM. There may be reasons to yell at the Slashdot editors but surely, this isn't one of them.
      • CA also = California
        AC also = Alternating Current
        GM also = Genetically Modified
        IP = Internet Protocol, Intellectual Property, and hell, around here, even Indecent Proposal

        I agree with the parent. It is incumbent on the "editors" to instill some order; the term "editor" entails more than simply accepting or rejecting stories.
    • You're right. I should have provided references to CA and MSFT. I assumed in this context that it would be obvious--neglecting to consider the broader audience that this site reaches. Jeff
      • It's not you. Slashdot stories are mainly submitted by readers, not all of whom are writers, so it's Timothy this time who's not doing his job.

        I see this sort of thing almost every day on Slashdot. When a new protocol or language is discussed, the story does not make clear why this does or does not matter to most readers.

        Since this website is identified so closely with Linux users, it doesn't help the outside perception of us as elitists when we don't care to convey knowledge in a way that is clear.
    • I'm not going to disagree with you. The poster could have used the full name at the start of the post, especially for a two-letter acronym since they typically signify countries or states.

      But, to defend the poster, I would hope that a self-respecting news reading nerd would know CA as one of the 5 largest (by revenue) software vendors in the world, right after Microsoft, Oracle and SAP.

      The company is identified as simply "CA" more commonly than as "Computer Associates International". I guess a valid excus

      • Computer Associates is a very well known company, and most people will assume it is them being discussed in the Slashdot story. But assuming is different than knowing. The first time CA was used in the story it should have been 'Computer Associates (CA)'.

        If Slashdot aspires to be a news blog ("News for Nerds") they should follow proper editorial standards occasionally. The New York Times, Associated Press, LA Times, and numerous other newspapers publish writing style guidelines. Editors at countless newspa

  • Time to upgrade to the 20th century (Score:3, Interesting)

    by Safety Cap ( 253500 ) on Sunday November 28, 2004 @05:02PM (#10938649) Homepage Journal
    ~ MSFT's SourceSafe ~.

    I'm glad to see that one other devloper on the planet is using source control, but you really need to upgrade. Seriously, not even MS uses VSS anymore---it is the most unstable, feature-scarce, POS source control there is.

    May I suggest Subversion [tigris.org]/Tortoise? [tigris.org]

    The best part about SVN over VSS is that you don't need to worry about exclusive locks. If one programmer (or yourself) checks out something and makes changes, you can still check out a pristine copy, make changes, and then everyone can check back in (last one in has to do a merge) without worry.

    On a dev team of more than one, invariably someone will leave something checked out and then take a vacation. With VSS you're pretty much screwed, but with more advanced source control this is no longer an issue.

    • I presume that this is why Microsoft promises lots of 'Team productivity' enhancements in their next version of Dot Net. (Funny how it's always going to be great in the next version.)

      Our teams have been frustrated not just by SourceSafe, but all of Microsoft's tools. Each new iteration is more complex, unecessarily interdependent with other MSFT products, and buggy. (SourceSafe's penchant for corrupting the very thing it purports to protect comes to mind.)

      Thanks for the links to the other source contro

  • Unfortunately these tactics are too common (Score:5, Informative)

    by Mycroft_VIII ( 572950 ) on Sunday November 28, 2004 @05:20PM (#10938737) Journal

    Unfortunately lots of free/shareware 'anti-spyware' tools generate false postives and do other 'wrong' things to get you to buy the full version. Some only find the malware, but make you pay to clean them out, and some don't work so well and worst are the ones that install thier own spyware and only clean out 'competitors'.
    There is a site that tracks and lists quite a few 'rouge' anti-spyware programs:
    http://www.spywarewarrior.com/rogue_anti-spyware.h tm [spywarewarrior.com]
    One of the things they advise against is following any google add, seems buying adds on google is very popular with the bad anti-spyware makers.
    Personally I just stick with spybot S&D and adaware for most malware and avg for anti-virus.
    And the LAST thing I'd ever do is trust some website to scan my computer, no telling what info they are collecting along with the scan to provide 'marketing data' for thier 'bussiness partners'.

    Mycroft
    • There is a site that tracks and lists quite a few 'rouge' anti-spyware programs.

      I think you meant "noir" not "rouge", n'est pas?

      • LOL, actually I meant rogue, but I suspect that is known.
        I can sometimes type out of sync hand wise, this usually puts a letters reached by the right hand in front of a letters reached by the left which should instead follow, I usually catch this proofreading, but I guesse my brain recognized rouge as a real word, but not as the WRONG word.
        The scarry thing I sometimes do somthing simular verbally and use a simular, but not quite right contextually, word.

        Mycroft
    • Even commercial software sensationalizes every so often. Take BlackICE for example. Back when I was a netadm at a Unv I used to frequently get calls, emails and even some visits from students and campus faculty/staff about an "attack" on their computers. Inevitably they'd show me a BlackICE log file warning them about some hacking attempt that involved a ping. Yeah, a ping. Good old ICMP Echo. That's real dangerous. It wasn't even a ping flood; just a single damned ping. Then there were the warnings
      • Yeah, it doesn't suprise me. But some of these programs go past even that. Some are flat out ripoffs of other software (as in dissassemble code, change a few strings re-compile, sell) and some claim specific malware that only thier 'pro' version can fix, malware provably not on the machine (as fresh install of xp, no net connection, the free version of the scan software the ONLY software not on the xp disk installed, ect.). And in a few cases the software itself has installed malware.

        Mycroft

  • oh n0s!!!!11 my m3gahr7z h4v3 b33n st0l3d!!11
  • One thing I've noticed when using adware detecting programs is that they often by default include things like cookies in there set of warnings, along with things such as search engines built into Windows as well as messages about registry settings to 'fix' IE.

    While certainly there are a fair number of people who want to be warned about all this, this isn't generally what they are after, and probably shouldn't be detected by default. While for me personally I can tell the difference between what to worry a

  • Got to love CA (Score:3, Interesting)

    by MerlynEmrys67 ( 583469 ) on Sunday November 28, 2004 @08:07PM (#10939526)
    I remember WAY back in the Day - CA decided to give away free copies of their financial management software Simply Money.

    This was the first time that I ran across free software that I thought I paid too much money for. It was horible. Since then - I was working for a company that was aquired by CA. Everyone in the Lab I worked for was dying to get out - even went so far as to place bets on who would end up at the bottom of the R&R chart to guarantee a buyout package, rather than leaving CA with nothing.

Slashdot Top Deals

Top Ten Things Overheard At The ANSI C Draft Committee Meetings: (5) All right, who's the wiseguy who stuck this trigraph stuff in here?

Close