Microsoft AntiSpyware 1.0 Beta!

[Elliot]

Try this:

~link to direct download removed and replaced with Overview page~

Microsoft Windows AntiSpyware (Beta) (http://www.microsoft.com/downloads/details.aspx?FamilyID=321cd7a2-6a57-4c57-a8bd-dbf62eda9671&DisplayLang=en)

I've just installed it.

Mod Note: Elliot, as far as we know this beta is not available yet, or it has been temorarily withdrawn. Until we hear otherwise, the link has been removed. - snap. Beta is now available on the Microsoft Download Site.

[Elliot]

This process name was still GIANTAntiSpywareMain.exe!

[mad_dawgz]

What the??????? Im using giant its the same??? Microsoft plz explain?

[Elliot]

-{ Quote: "What the??????? Im using giant its the same??? Microsoft plz explain?" }-
Yeah, of course, M$ bought the Giant company.

[Infinity]

I will just continue as long as I can with the giant product. they will release sp3 mid 2005 and hopefully it is included automatically:)

[dvk01]

Be a little bit careful with it as I think it has a couple of false positives I'm checking out at the moment

[Notok]

Same here, although not as many FPs as I was getting the last time I trialed GIANT.

Last time I trialed GIANT I don't remember these real-time protection settings being available.. are these new or did I just miss them before? The CPU usage will keep me from using that for the time being, however..

[nadirah]

Might as well stick with spybot S&D and ad-aware SE at the moment.

[dread]

http://www.microsoft.com/downloads/details.aspx?FamilyID=321cd7a2-6a57-4c57-a8bd-dbf62eda9671&DisplayLang=en

[gottadoit]

Looks like a legit link to me... go to the download center and do a search for spyware and that link shows up

This is not a link to the download, it is a link to do the search
http://www.microsoft.com/downloads/results.aspx?freetext=spyware&productID=&DisplayLang=en

The download page has the familiar validation message :-{ Quote: "This download is available to customers running genuine Microsoft Windows. Please click Continue to begin Windows validation" }-
There are some private newsgroups for it as well at communities.microsoft.com/newsgroups (http://communities.microsoft.com/newsgroups/default.asp?ICP=spyware&sLCID=us)

[dread]

Of couse its legit, I posted it ;D I got it from http://neowin.net/ if you care to look at what they are saying.

[gottadoit]

-{ Quote: "Of couse its legit, I posted it ;D I got it from http://neowin.net/ if you care to look at what they are saying." }-

My comment was really directed to snapdragin, who removed the link from the original post (possibly without doing a search on the downloads site...)

For that matter its also the newest entry on the MrTech software list
http://www.mrtech.com/news/

[snapdragin]

Hi gottadoit,
-{ Quote: "My comment was really directed to snapdragin, who removed the link from the original post (possibly without doing a search on the downloads site...)" }-At the time Elliot posted the direct download link (first post in this thread) I did do a full search of the Microsoft site and the download was not available.

Since this download does require validation, the link dread posted will suffice.

Regards,

snap

[gottadoit]

-{ Quote: "Hi gottadoit,
At the time Elliot posted the direct download link (first post in this thread) I did do a full search of the Microsoft site and the download was not available.

Since this download does require validation, the link dread posted will suffice.

Regards,

snap" }-

Strictly speaking it doesn't *require* validation, it prompts for validation and allows you to download without validation if you choose....

Edit:
Just thought I'd give your search a try as well, to see how badly M$ index their site
Doing a search from the front page still doesn't bring it up
Using the advanced search for "all the words: antispyware; category: All Results; site: All of Microsoft.com;" still doesn't bring up the link
It looks like you need to actually search in the download center

[snapdragin]

-{ Quote: "Strictly speaking it doesn't *require* validation, it prompts for validation and allows you to download without validation if you choose...." }-

Very good, then there is no need for a direct download link, and the link dread posted will be good enough. ;)

-{ Quote: "Edit:
Just thought I'd give your search a try as well, to see how badly M$ index their site
Doing a search from the front page still doesn't bring it up
Using the advanced search for "all the words: antispyware; category: All Results; site: All of Microsoft.com;" still doesn't bring up the link
It looks like you need to actually search in the download center" }-Download centre was searched thoroughly at the time I searched it, which was a li'l over 4 hour's prior to your searching it now.

Just a reminder, since this is still a beta version, please do heed dvk01's warning in Post #6 to be careful with false positives.

Regards,

snap

[gottadoit]

-{ Quote: "Just a reminder, since this is still a beta version, please do heed dvk01's warning in Post #6 to be careful with false positives." }-

Snap,
I'm not disagreeing about being careful with false positives, but have a read of this posting (http://communities.microsoft.com/newsgroups/previewFrame.asp?ICP=spyware&sLCID=us&sgroupURL=microsoft.private.security.spyware.general&sMessageID=%253CulBFIt78EHA.2412@cpmsftngsa05.privatenews.microsoft.com%253E) from a microsoft employee

Giant don't seem to be making a big distinction between the purchased version and the MSoft Beta version, see here (http://www.giantcompany.com/commonQuestions.htm#gen_beta) for Giants answer to "How is the GIANT AntiSpyware product that I purchased different from the free beta version that Microsoft will be introducing?"

[steverio]

Installation of Microsoft AntiSpyware 1.0 Beta went smooth on my XP Pro SP2. A full scan detection found remnants of a WeatherBug Adware in the registry. Other than that no false positives and a clean report.

Having already Spybot S&D, Spyware Guard, AdAware SE Personal, Spyware Blaster, MRU-Blaster, RegWatcher, ASE, WG3, PG3, Script Defender, and all the plugin security features of OutPost Pro, I wonder if this MS AntiSpyware program gives anymore protection than I already have?

The "Real Time Protection" system resource usage might be a bit too accumulative considering what apps are already running.

[Caratacus]

I still have Giant installed (while waiting for refund), so have disabled everything in giant (including gcaserv.exe from registry startup). I'll install Microsoft beta & see if it runs ok.

[Elliot]

I have to say Sorry for post at wrong place. :)

[polyglory]

-{ Quote: "I still have Giant installed (while waiting for refund), so have disabled everything in giant (including gcaserv.exe from registry startup). I'll install Microsoft beta & see if it runs ok." }-

Refund, bought Giant 5 weeks ago.I'll not hold my breath.

Even if I get my full years worth, its the exit door for the program, now that Gates owns it.

Will select the best program at the time, when re-newal comes due, only way to go with all programs, best one on the day.

[bigc73542]

I downloaded the microsoft beta and so far it seems fine, but we will wait and see. It can only be used free until a commercial release or july 15th 2005 which ever comes first.

bigc

[Terryala]

Just a side note. People that are starting to use it are running into problems with False Postitives.

I had no problem with the download and install but did have 3 FP's when I did a scan. So I uninstalled it until it is checked out more or it becomes final.

Grand Dad

[bigc73542]

I have run a full scan twice since install and no FP's yet, crossing fingers

bigc

[ronjor]

I tried it this morning with no false positives. Hard to get infected on Wilders. ;D
I don't know what part of the program is beta. It looks like Giant with a few Microsoft options thrown in.

[Michael V.]

Oh boy....

I downloaded and ran the new Microsoft AntiSpyWare....

First I could not get back on the internet.... thank God my ISP helped me repair my config sys... area in DOS.. I would have never been able to do that on my own..

It took a component out of McAfee Privacy Service, and it has not worked since. I keep getting a message to reinstall.... I have, and it still does not work. Seems to be some sort of incompatibility error.

I was getting Spybot S&D errors as well.... those seem to have gone away on their own.

In one part of the program, the system lists the various running processes.... it does not recognize itself... says that itself is "unknown.."... kind of funny.

Looks to be a good program in the future... I just wish I would have waited. I liked the McAfee Privacy Service.

[Caratacus]

MS AS Beta refused to install while Giant was still installed, so I'll leave Giant on till the refund situation becomes clearer.

I put MS AS Beta on my wife's computer (running XP pro, all updates) - seems to be working OK. I'm not sure but at a quick glance MSAS sems to be lacking Giant's "system innoculation" option.,

[bigc73542]

-{ Quote: "I still have Giant installed (while waiting for refund), so have disabled everything in giant (including gcaserv.exe from registry startup). I'll install Microsoft beta & see if it runs ok." }-



A little giant info,

[Caratacus]

Thanks, bigc73542. What's the url for that info?

[Caratacus]

OK - found it at http://www.spynet.com/. Cheers!

[bigc73542]

the link is here (http://www.microsoft.com/downloads/details.aspx?FamilyID=321cd7a2-6a57-4c57-a8bd-dbf62eda9671&DisplayLang=en)

it is right under "overview" at the top of the page

[Caratacus]

Also here (http://www.microsoft.com/athome/security/spyware/software/currentcustomers.mspx) -

"As part of your paid subscription, there are platform, support, and functionality features in GIANT AntiSpyware that are not included in the Microsoft Windows AntiSpyware (Beta) software."

[bigbuck]

Well......DL'd and ran a full scan and got a few FP's.
* An Acer screensaver (Acer Computer!)
* A PCDSS screensaver a friend sent me from Canada.
* searchsquire sidebar/toolbar?.....Think this was the same FP that Giant was getting some months ago? I assume it's finding a reg key put there by Spybot S&D when immunising, because all of a sudden (after q'tining), Spybot has 1 object not immunised. Re-immunise and quick scan again and there it is again. Doesn't look like M$ have done too much homework with their Giant aquisition!!
Buck.

[Infinity]

Hi Buck I have that F/P too. I checked it (as I didn't have any toolbar at all) I deleted it.

everything running smooth...:D

[bigbuck]

-{ Quote: "Hi Buck I have that F/P too. I checked it (as I didn't have any toolbar at all) I deleted it.

everything running smooth...:D" }- Be careful!! If you remove the reg key, you remove the SB&D protection!.....or maybe I'm misunderstanding what you are saying??

[dog]

Hi Buck, ;)

If the details in M$'s AS are ... (re:searchsquire)

HKEY_Current_User\Software\Microsoft\Windows\Current Version\Internet Settings\Zone Map\Domains\Searchsquire.com

If you type regedit in the run box ... & navigate to this ... in the right pane you will see a Dword Value. The Value should be 4. Which is right. (See screen shot)

A value of 4 means searchsquire is set as a restricted zone. A value of 2 indicates a trusted zone.

If the value you find for the Dword Value is 4 ... it's a False Positive from M$ AS ... it's only finding the key ... and not the Dword Value. Which is incorrect ... you can add it to the ignore list for now. And see if it gets corrected with the next DB Update. ;)

Steve

Ps. And Yes ... Giant had this very same F/P ... ::) Looks like we've taken a few steps back. :-\

[bigbuck]

Thanks Steve,
I'd found exactly that info in a post by you in mid-Dec here (http://www.wilderssecurity.com/showthread.php?t=58490&highlight=searchsquire) , but thanks for popping in anyway (you are very reliable!). It's definitely an FP. I'll just ignore it.
Cheers mate,
Brad.

[dog]

LOL ... See Good Post ~verbatem~ Never go to waste. ;D ... Now that I know you can search ... you're only getting search "keywords" from now on. ;) ;D

Oh yeah ... Just like a Mod. :-X Typing it all out again sucks :P Copy 'n Paste I say ... :lurking:

[bigbuck]

-{ Quote: "LOL ... See Good Post ~verbatem~ Never go to waste. ;D ... Now that I know you can search ... you're only getting search "keywords" from now on. ;) ;D

Oh yeah ... Just like a Mod. :-X Typing it all out again sucks :P Copy 'n Paste I say ... :lurking:" }- Now hang on!!! I'm still a dumb Aussie...remember! I'll just have to PM you instead! ;D ;D
Brad.

[bigbuck]

PS> It's still a shame that M$ couldn't fix a simple bug that has clearly existed for a while now!!

[spy1]

Does anyone know if the resident protection portion is listening on port 80? I've d/l'ed the beta but not installed it yet because I don't want an instant conflict with SpyBlocker, whichs owns port 80. Pete

[dog]

-{ Quote: "PS> It's still a shame that M$ couldn't fix a simple bug that has clearly existed for a while now!!" }-

Actually Giant Had corrected it with Def's # 5677 ... See a few steps back ... How typically M$ ... I wonder what the future holds. ::)

[Infinity]

Hi Pete, I am using SB 8.2 (really???:)) and doesn't conflict at all with giant. it is a great team!!

p.s. Thanx dog for clarifying, I see no strange things in my immunization, nothing ignored...

so I am good to go I guess...

cheers

[spy1]

Thanks Infinity. I might give it whirl when I get some time, then. Pete

[Infinity]

No prb, there will be an update soon regarding sb...

keep you informed

btw thanx for p.m.'ing me the other day regarding deep freeze, works good so far.

[spy1]

You're quite welcome.

[bigbuck]

Interestingly......looky what M$ Antispy is called in task manager!

[Infinity]

is m$ AS calling itself Brad??? funny:D

as far as the mem usage: with the mainscreen on top it consumes a little more and the less guards you use: the less cpu it will consume...

that is how I interprete this issue which I have to with Giant.

[spy1]

What kind of resource-usage are we talking about here, guys? Can anyone put up some screenshots from WTM? Pete

[bigbuck]

My previous post is about right for the scanner 25000k
couple of other tasks (assume related to real time) at 6-7000k

[PhiloVance]

Well, I d/l and installed and ran last night (Win XP Home Sp2) and it found 5. I like the explanation for each one given when you highlite the adware/spyware/trojanware product. I also like the fact that you can create a restore point within the software so you can go back if you need. I then ran Adaware after that and it found one more. I'm running Spybot now at home (I'm at work), so will see the results when I get home.

Looks good to me. I'd never heard of Giant before. ???

In addition I have Spyware Blaster MRU Blaster and Spycop. I don't think the software can hurt, but you need to check out the false positives and if it messes up spybot that needs to be fixed too.

Anyway so far I'm pleased.

[muf]

Not trying to be cynical here, but the comments about it messing up Spybot. Well lets just review the situation here - Microsoft ANTISPYWARE breaks Spybot, which just happens to be an ANTISPYWARE application. Very convenient don't you think?

[puff-m-d]

Here are the memory usages on my system using ProcessExplorer.....

Also, I got a definition update today and the FP for searchsquire has been fixed....

[maddawgz]

anyone has ever wonder WHY MS would BUY Giant?
to cover its own spyware

I'm not letting wolf to guard hens house

[shoe]

scheduler does not work

[Mele20]

-{ Quote: "Hi Buck, ;)

If the details in M$'s AS are ... (re:searchsquire)

HKEY_Current_User\Software\Microsoft\Windows\Current Version\Internet Settings\Zone Map\Domains\Searchsquire.com

If you type regedit in the run box ... & navigate to this ... in the right pane you will see a Dword Value. The Value should be 4. Which is right. (See screen shot)

A value of 4 means searchsquire is set as a restricted zone. A value of 2 indicates a trusted zone.

If the value you find for the Dword Value is 4 ... it's a False Positive from M$ AS ... it's only finding the key ... and not the Dword Value. Which is incorrect ... you can add it to the ignore list for now. And see if it gets corrected with the next DB Update. ;)

Steve

Ps. And Yes ... Giant had this very same F/P ... ::) Looks like we've taken a few steps back. :-\" }-

Could you explain to me how it found this supposed "elevated threat" spyware when I have no DWord value at all for that registry key? I use Spybot and immunize feature.

I would recommend extreme caution in using this software. It destroyed my Conexant V92 PCI modem. I spent 4 hours on the phone with Dell yesterday troubleshooting this. When I installed the software it immediately crashed my XP Pro Del Dimension 8300. I finally got it to work, ran one scan and all it found was the one false positive. I was unable to stop the real time scanner and it also phoned home immediately even though I told it not to do so during installation. I had also said for real time scanner to not run during installation. It ignored this. So, I uninstalled it after having it 20 minutes about. I was appalled when I looked at all of it closely and saw how very deep it hooks into the system. That is dangerous as it just begs for problems.

Immediately upon uninstall, I got first a frozen Process Guard when I tried to open it from the systray. It opened then froze. I had to reboot. Upon reboot, I immediately was greeted with two error boxes having to do with software installation for my dial up modem which said the software was not digitally signed so I should stop it. I clicked cancel and got an error box that said the new hardware had not installed successfully due to the non-digitally signed software. I clicked off of that and up popped the first error box. I hadn't installed any new hardware so these errors were a mystery. I could not get rid of them.

Everything got rapidly worse from this point. Device manager showed the Conexant modem working properly but also showed 70 instances of another modem improperly installed. Dell CD for the modem when inserted, ran a wizard and then announced that I had "illegally" installed a second non Dell approved hardware modem and that it had to be removed immediately before the wizard would do anything further. I hadn't installed any modem ever. I was also seeing "error allocating for PCI device" at every POST.

After, four hours of troubleshooting, the modem is removed as the computer will not boot now with the modem card installed in any slot. Dell is sending me a new modem and a tech will be flying over from Honolulu to install it. Thank goodness I mostly use my external cable modem as the part will be here Tuesday but the Dell tech probably won't be able to fly over for another week as they are kept very busy.

Dell thinks, as do I, that it is almost certain that the uninstalling of the MS antispyware application is what what caused this problem. A friend who is very hardware knowledgeable said he looked at the MS application after I had this problem and says that I am "experiencing the end result of what happens with a badly intergrated ASPI hook and one would think MS would NOT hook anything, but build the progo in via a patch." I am not knowledgeable enough to know how correct this observation may or may not be but I am convinced it was the application uninstallation that caused this mess. My computer was working beautifully up until I installed the software. The Conexant modem had never given any problems before. I tried system restore (the point I made before installing the software and later one a week earlier). Both worked but the problem remained.

So, I suggest extreme caution with this application at this time. Dell said I wasn't even the first to call in with major problems stemming from the MS software.

[bigbuck]

-{ Quote: "Could you explain to me how it found this supposed "elevated threat" spyware when I have no DWord value at all for that registry key? I use Spybot and immunize feature.

I would recommend extreme caution in using this software. It destroyed my Conexant V92 PCI modem. I spent 4 hours on the phone with Dell yesterday troubleshooting this. When I installed the software it immediately crashed my XP Pro Del Dimension 8300. I finally got it to work, ran one scan and all it found was the one false positive. I was unable to stop the real time scanner and it also phoned home immediately even though I told it not to do so during installation. I had also said for real time scanner to not run during installation. It ignored this. So, I uninstalled it after having it 20 minutes about. I was appalled when I looked at all of it closely and saw how very deep it hooks into the system. That is dangerous as it just begs for problems.

Immediately upon uninstall, I got first a frozen Process Guard when I tried to open it from the systray. It opened then froze. I had to reboot. Upon reboot, I immediately was greeted with two error boxes having to do with software installation for my dial up modem which said the software was not digitally signed so I should stop it. I clicked cancel and got an error box that said the new hardware had not installed successfully due to the non-digitally signed software. I clicked off of that and up popped the first error box. I hadn't installed any new hardware so these errors were a mystery. I could not get rid of them.

Everything got rapidly worse from this point. Device manager showed the Conexant modem working properly but also showed 70 instances of another modem improperly installed. Dell CD for the modem when inserted, ran a wizard and then announced that I had "illegally" installed a second non Dell approved hardware modem and that it had to be removed immediately before the wizard would do anything further. I hadn't installed any modem ever. I was also seeing "error allocating for PCI device" at every POST.

After, four hours of troubleshooting, the modem is removed as the computer will not boot now with the modem card installed in any slot. Dell is sending me a new modem and a tech will be flying over from Honolulu to install it. Thank goodness I mostly use my external cable modem as the part will be here Tuesday but the Dell tech probably won't be able to fly over for another week as they are kept very busy.

Dell thinks, as do I, that it is almost certain that the uninstalling of the MS antispyware application is what what caused this problem. A friend who is very hardware knowledgeable said he looked at the MS application after I had this problem and says that I am "experiencing the end result of what happens with a badly intergrated ASPI hook and one would think MS would NOT hook anything, but build the progo in via a patch." I am not knowledgeable enough to know how correct this observation may or may not be but I am convinced it was the application uninstallation that caused this mess. My computer was working beautifully up until I installed the software. The Conexant modem had never given any problems before. I tried system restore (the point I made before installing the software and later one a week earlier). Both worked but the problem remained.

So, I suggest extreme caution with this application at this time. Dell said I wasn't even the first to call in with major problems stemming from the MS software." }-
Yep!...I had some glitches last night too. This app froze on the show results screen nearly every time.....It was throwing up boxes about registry changes quite often which I didn't know how to answer......and I had several errors shutting down and rebooting my machine. So this morning I simply Ghosted back from my external HDD thereby getting rid of it without a messy uninstall....That'll teach me for trying beta! It doesn't engender a lot of faith in M$ though, does it?
Buck.

[Edwin024]

I don't know what MS did with this software... Giant did not have these problems. And I use now Counter Spy which also is a Giant clone. No problems there too. Or it must that be that at my pc the automatic update doesn't work. It seems that they are working on that looking at an email that I got from Sunbelt.

[dog]

-{ Quote: "Could you explain to me how it found this supposed "elevated threat" spyware when I have no DWord value at all for that registry key? I use Spybot and immunize feature.
" }-

Hi Mele, ;)

That is the whole issue ... it is only finding and reporting the searchsquire Key, regardless of the Dword Value. If there is no Dword Value set ... something has already removed it. The Dword Value should be 4. I believe both Spybot and Spyware Blaster make this entry ... run them again to re-write the Dword Value, Or you can manually do it.

A value of 4 means searchsquire is set as a restricted zone. A value of 2 indicates it is set as a trusted zone.

Sorry, to hear of your problems with Microsoft Antispy ... I don't run it, and probably never will, I have almost Zero trust for anything M$ does, right or wrong. I do however run Giant and haven't had any issues ... but things seem to have changed with the product after the takeover.

HTH,

Steve

[controler]

And I am sure all of you are using the SPynet feature?
The one that securly links all users of AntiSpyware to each other.
Um which port was that again?

Bruce

[spy1]

-{ Quote: "And I am sure all of you are using the SPynet feature?
The one that securly links all users of AntiSpyware to each other.
Um which port was that again?

Bruce" }-

I hear ya', Bruce. I think I'll just give this thing a miss entirely - especially after having read everything here and in the newsgroup.

I don't need problems and I really don't think it's providing anything that I don't already have anyway. (D/L erased). Pete

[Mele20]

-{ Quote: "Hi Mele, ;)

That is the whole issue ... it is only finding and reporting the searchsquire Key, regardless of the Dword Value. If there is no Dword Value set ... something has already removed it. The Dword Value should be 4. I believe both Spybot and Spyware Blaster make this entry ... run them again to re-write the Dword Value, Or you can manually do it.

A value of 4 means searchsquire is set as a restricted zone. A value of 2 indicates it is set as a trusted zone.

Steve" }-

Ahhh...now I understand. So some nasty removed the value which either Spyware Blaster or Spybot set as 4? Hmmmm...I ran Spybot last night and had trouble getting immunize to take (there were 30+ new ones) but it was finally successful and after reading your post just now, I checked the registry Searchsquire key and Spybot put in a DWord value of 4. I also checked the restricted zone in IE and it is listed there either from Spyware Blaster or Spybot. I seldom use IE (I am a FF fan) so I haven't paid a lot of attention to exactly what Spybot and SWB put in the restricted zone.

Thanks for the help and explanation. :)

[zcv]

AntiSpay has two components:

GIANTAntiSpywareMain.exe 2068 /NA
gcasDtServ.exe 4052 N/A

gcasDtServ.exe is the one that runs in the tray after ending the main module and has to be right clicked to end it. This is the realtime protection component and doesn't like to take no for an answer.

Question for you Giant people, is gcasDtServ.exe from Giant, or is this an add-on by MS?

Regards - Charles

[BlueZannetti]

-{ Quote: "Question for you Giant people, is gcasDtServ.exe from Giant, or is this an add-on by MS?" }-It's been there from the start. Don't know if it's been modified by MS, however.

Blue

[ricari]

I am trying it. First scan ok.

On the 7th got an update. Second scan it Freeze's here after scanning 22225 files:

Scanning for hidden spyware threats...
Scanning memory: Polymorphic Browser Hijack Scan

On top of the program, on the blue bar, it is marked:

Microsoft antispyware (Beta) (does not answer)

So now what do I do? It can't complete a scan.

XP Pro SP2

Thank's

[RAV]

Working great on 2 WinXP machines here. Removed spyware/adware that I could never get removed with other apps on my kids computer. Also discovered 2 spyware apps that was slowing my machine down that were not discovered by Sybot S/D.

[hojtsy]

Although MS Antispyware monitors several registry locations, it fails to monitor several other locations which are also used by spywares to auto-start. Just some examples for those (not covered) locations:

HKLM\System\CurrentControlSet\Control\Session Manager\BootExecute link (http://www.sophos.com/virusinfo/analyses/trojthemousea.html)
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\Run link (http://www.sophos.com/virusinfo/analyses/w32kullana.html)
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\Load link (http://us.mcafee.com/virusInfo/default.asp?id=description&virus_k=100442)
HKCU\Control Panel\Desktop\scrnsave.exe link (http://www.symantec.com/avcenter/venc/data/w32.petch.b.html)
HKCU\Software\Microsoft\Command Processor\AutoRun link (http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_HITON.A)

This is not the full list. I also inserted links to reports about the malwares which are using these keys.
-hojtsy-

[Longboard]

Wow.
Good post Hojtsy. Thanks.
The MJRW team strikes :)
If knowledgable users are reporting these problems with well tested and reputable antispyware apps, where does it leave the greater public?
M$ takes a potentially great app that was rapidly evolving into an important part of the armament...and breaks it?

Already seeing signs that the M$ antispyware app will pick out competing antispy apps. Any ideas about what M$ might regard as "safe" malware!!

Not to be too paranoid, but, I wonder when it will unhook FF?

[slammer_JvA]

-{ Quote: "anyone has ever wonder WHY MS would BUY Giant?
to cover its own spyware

I'm not letting wolf to guard hens house" }-

This OZ has got a point here....

[Longboard]

LOL
we try and watch our wolves DU.

[iceni60]

i had a quick look through the thread and didnt see this link posted. it's a test against adaware and spybot.
http://www.flexbeta.net/main/articles.php?action=show&id=84

[Infinity]

this aussi has got a major point. I wish I never purchased giant. and I am too late to get my refund lol, just since four days I see that my subscription ends in three days and it was ok from the moment I purchased it. I have sent them three emails, none of them are answered.

what do I do? I think at the end need to uninstall the licenced version and install the beta... this is beginning to frustrate me while I'm typing this so I'll stop...and see:D

cheers

[LockBox]

If Microsoft ends up (like most believe) and offering this at cost, what an injustice! For Microsoft to sell a tool to notify you that you're infected because of their failure to fix their major exploits, what an irony!!!!

[zcv]

Would be interested in any comments by Giant users on this.

The problem in a nutshell is that the Real Time protect feature can't be shut down - this seems to be true for most users.

My twist on that is once I intially disabled it, can't turn it back on - admittedly haven't tried very hard because I have no interest in having it run.

The question basically is if this is the beta or has Giant always had this problem?

The situation is pretty well summed up in the quote below.

-{ Quote: "Hi Charles!

What bothers me is that we get different behaviour.

Some of us have it in msconfig > autostart, others don't.

Some of us have it running from boot time, no matter what, others don't. (Probably related to the one above.)

Some of us get the temp-files in C:\Windows\Temp, others get them in C:\Documents and Settings\UserName\Local settings\Temp.

Some of us can't reenable Real-time Protection, others can turn it off and on at will.

I could go on ...... :confused: ......

Could this be system specific or maybe the way MSAS was installed? I downloaded the setup file to the local HDD and installed from there.

Christer" }-

http://www.windowsbbs.com/showthread.php?t=39560&page=4&pp=15

This subject starts at Post#50

Regards - Charles

[ricari]

-{ Quote: "I am trying it. First scan ok.

On the 7th got an update. Second scan it Freeze's here after scanning 22225 files:

Scanning for hidden spyware threats...
Scanning memory: Polymorphic Browser Hijack Scan

On top of the program, on the blue bar, it is marked:

Microsoft antispyware (Beta) (does not answer)

So now what do I do? It can't complete a scan.

XP Pro SP2

Thank's" }-

It block's in the registry.

Found out why this happen's:

Go to where Microsoft antispyware is located, for me it's in "c:\program files\microsoft antispyware" and look "errors.log". Open it with word pad and it will tell you your problem. For me "not anough memory". Impossible but I close'd many programs of my "startup" then tried "Micosoft AntiSpyware" and it work's like a charm.

[no13]

My error messages are more cryptic.
I can't decipher them
Any help?
Method '~' of object '~'
failed::gcasDtServ:modData:InitializeFriendlyFilesData::
17/1/05 7:06:17 PM:1.0.501
91::ln 0:Object variable or With block variable not
set::gcasDtServ:FriendlyFiles:ExistsSysData::
17/1/05 7:06:17 PM:1.0.501

[-JPK-]

-{ Quote: "I am trying it. First scan ok.

On the 7th got an update. Second scan it Freeze's here after scanning 22225 files:

Scanning for hidden spyware threats...
Scanning memory: Polymorphic Browser Hijack Scan

On top of the program, on the blue bar, it is marked:

Microsoft antispyware (Beta) (does not answer)

So now what do I do? It can't complete a scan.

XP Pro SP2


Thank's" }-
Hi,
I had the same problem than you. I have a big hosts file (VERY BIG) and It always freezed to Polymorphic Browser Hijack Scan.Then I tried scanning with a small hosts file ---> Works fine now.

[scott lang]

well, ive had the m$ antispyware prg on here for 2 weeks or so. since i never had giant on here and i run NIS2005 with spywareblaster,spybot, and adaware SE ive had no probs. as a matter of fact every scan with M$ comes up clean. i dont know if this is good or not. but i was planning on dumping it once M$ decides to charge for it later.

[siliconman01]

-{ Quote: "I had the same problem than you. I have a big hosts file (VERY BIG) and It always freezed to Polymorphic Browser Hijack Scan.Then I tried scanning with a small hosts file ---> Works fine now." }-

I have a HOSTS file that contains almost 33000 entries. Using the original GIANT software, it takes 6-7 minutes to run the polymorphic scan on a P4 2.6 ghertz CPU. It appears to "freeze" but it is does complete the check and then proceeds onto the Registry scan. I suspect the time for the Polymorphic check varies significantly based on the CPU and the size of the HOSTS file. My point is that the "freeze" may really just be "patience". :D My entire scan takes 10-11 minutes with GIANT.

[Beefcarver]

I wouldnt trust that. I tried Giant and hated it. That spy Net thing is garbage if you ask me. And adaware SE is doing nothing for me it dont find nothing and it never updates. How is Bill Gates going to Patch up all his mistakes???
Microsofts windows is a joke and is virus prone and the hackers love it.
Do you really believe he can fix all those security holes in his software???

I trust Donald Trump more and hes a bigger jerk than Gates........... :o