A PestPatrol False Positive

[jld123]

What I have to say is explained in the following service request I sent to PestPatrol:

CWSGoogleMS.3 - False Positive - Former Ticket# xxxxx

In Reference to Former Ticket# xxxxx about the CWSGoogleMS.3/xxxtoolbar.com False Positive:

PestPatrol finds xxxtoolbar.com in the Registry at:
HKEY_CURRENT_USER\software\microsoft\windows\current version\internet
settings\zonemap\domains\...

This location IS the Microsoft Internet Explorer Security/Restricted Sites list!

xxxtoolbar.com Belongs in this Restricted Sites list! It should NOT be removed! Removing xxxtoolbar.com from IE's Restricted Sites List, like Pest Patrol wants to do, would put my computer in MUCH DANGER!!! Pest Patrol should be protecting my computer!!! NOT putting it at Risk!!! PestPatrol finding it there as some sort of spyware site IS a FALSE POSITIVE!!!...

When I told you about it on April 9th, (Ticket# xxxxx), and 10th, (Ticket# xxxxx), you said you were going to have it looked into...It seems like an extremely simple fix!...I was hoping that your next update would contain the correction. That update came several days ago...It is now May17th and PestPatrol STILL finds this False Positive CWSGoogleMS.3/xxxtoolbar.com in the IE Restricted Sites list!

Spybot Search & Destroy does NOT find it!
Adaware does NOT find it!
NONE of my other Pest Tools find it!
SpywareBlaster always wants to put it back after PestPatrol deletes it!
Several friends and folks at user security forums are experiencing the same problem with PestPatrol!

You have been notified about the problem over a month ago!
Why does PestPatrol still have this False Positive!!!

Please Fix this problem right away!!! I've paid good MONEY for your PestPatrol to PROTECT my computer!!! Please give me the protection I PAID FOR!!!

Note: As of today, Pest Patrol has come out with other updates and acknowkedges the problem, but won't fix it! They say I should just use their "Exclude" option when I search.

How hard could this be to fix?

Months ago I too made them aware of it and posted here about it.
It seems indeed hard for them to fix it......

Here is the other thread:

PestPatrol false alarm CWS.GoogleMS.3 xxxtoolbar.com

Well if Pest Patrol doesn't improve after their so-called move is taken care of, they may just head down the tubes. Updates once a month. Not responding to multiple customer complaints. Many false positives(that they never fix). I wouldn't think they will attract many customers acting like this. And all that for $40. US dollars. Just doesn't seem worth it to me. They should at least lower their price some, considering it's not very good at detecting trojans anyway. I'm looking into TDS-3 a company who seems to care about customer concerns and problems. I'm giving them(PP) another 2 months to make some huge improvements or i'm defecting to the DCS camp!!!

A strictly personal advice:
Don't rely on PestPatrol for detecting Trojans !!!
If only for the fact that it doesn't update its definitions frequently enough...
But everyone has to make his/her own decision.

Hi Fanj, Thanks for the tip. Any programs that you would recommend besides Pest Patrol for detecting trojans?

Originally Posted by tiredofthebs

Hi Fanj, Thanks for the tip. Any programs that you would recommend besides Pest Patrol for detecting trojans?

Hi tiredofthebs,

Sorry:
No offence intended, but maybe it would be better to start a new thread about that

[MCT]

Well if Pest Patrol doesn't improve after their so-called move is taken care of, they may just head down the tubes. Updates once a month. Not responding to multiple customer complaints. Many false positives(that they never fix). I wouldn't think they will attract many customers acting like this. And all that for $40. US dollars. Just doesn't seem worth it to me. They should at least lower their price some, considering it's not very good at detecting trojans anyway. I'm looking into TDS-3 a company who seems to care about customer concerns and problems. I'm giving them(PP) another 2 months to make some huge improvements or i'm defecting to the DCS camp!!!

I currently own pestpatrol aswell, adaware is a MUCH better choice i believe, and its free for home users, and they update about every 3 days..

PestPatrol said in their monthly newsletter they would have version 5 up at the end of April/Beginning of may, we're almost in june and no show yet, or even an update..

[jld123]

I'm getting scared to update any new security update. What if, when PestPatrol comes out with ver 5, it reacts the same as ZoneAlarm's new ver 5?

[jld123]

I just received the following from the PP Support in response to my last request for the above problem to be fixed:

"Entered on 05/28/2004 at 10:23:56 by Rossano Ferraris:
Dear xxxxxx,

This case is under analysis and we have already informed Develop Team about. The possibility to fix this will be taken in consideration and put in place in the next future release of PestPatrol.

Thanks again for your comments and for your interest in PestPatrol. I hope your difficulties with PestPatrol have been satisfactorily resolved.


Best regards

- Rossano Ferraris
PestPatrol Research and Support Engineer"

Sounds hopeful...I guess we'll see?

[jld123]

I guess the update of 5/29/04 is not the future release PP Support was talking about.

No PP my "difficulties with PestPatrol have" NOT "been satisfactorily resolved."...yet...

I guess they are talking about the upcoming ver 5?

i only used PestPatrol's online scan
and it found nothing BUT false positives
it pointed a lot of non existing files

[jld123]

Yeah YAIR!

Here's their latest FALSE Positive, straight from the horses mouth!

"Hi xxxxxx xxxxx

Entered on 30/05/2004 at 17:06:10 by Paul Hallas:
Hi

The PestPatrol Research Team is investigating an explosive growth of new and changed malware programs, and a large number of new pests are added to our database each week. We continue to develop our PestPatrol technology to defeat these newly created pests and ensure you are protected from their harmful effects.

Due to this growth in pest activity. Please be aware that our research department has just moved and quadrupled in size to provide better and more detections on a weekly basis. I am confident you will see positive results of this growth in the near future.

Thank you for your patience while we endure this growth cycle. I know this will further strengthen our position as the Authority in Spyware Detection and Removal.

Regards,
Paul Hallas"

We'll See...

[jld123]

Well another ver 4: ver 4.4.3.2 dated: 6/01/2004 and still no fix for this xxxtoolbar.com False Positive. (Sigh!...)

Originally Posted by jld123

Well another ver 4: ver 4.4.3.2 dated: 6/01/2004 and still no fix for this xxxtoolbar.com False Positive. (Sigh!...)

Hi jld123,

Are you running Windows 98 SE ?
I think it only occurs on W 98 and not on W XP.
So I guess that the PP-company might have other priorities....

As for false positives:
I myself get warnings for for example my NetScanTools and AtelierWeb AWSPS.
I do not consider those warnings as false positives.
It is the way PP was developped in the first place: as a tool for system-admins.

[jld123]

Hi FanJ,

I'm running Windows XP.

When PP tells me that a site in my IE Restricted Sites list, where it belongs, is a Pest, there's something wrong with PP! It's a FALSE POSITIVE! And IF I let PP remove a restricted site from the IE Restricted Sites list, it's a DANGEROUS False Positive!!! They've acknowledged the problem but just can't seem to get around to fixing it...They said something about the next Upgrade...I think they mean 5.0, because these intermediate Updates are NOT fixing the problem!

Originally Posted by jld123

Hi FanJ,

I'm running Windows XP.

When PP tells me that a site in my IE Restricted Sites list, where it belongs, is a Pest, there's something wrong with PP! It's a FALSE POSITIVE! And IF I let PP remove a restricted site from the IE Restricted Sites list, it's a DANGEROUS False Positive!!! They've acknowledged the problem but just can't seem to get around to fixing it...They said something about the next Upgrade...I think they mean 5.0, because these intermediate Updates are NOT fixing the problem!

Hi jld123,

Thanks for your info !
I didn't know that false positive was also happening on Win XP
I'm still running W 98 SE ..........
So thanks for your info !!!
I agree with you: they definitely have to fix this !!!
PP has to check for the D-Word in the registry......

Cheers, Jan.

[jld123]

They, (PP), fixed it!!! The latest update on 6/9/04 FIXED the xxxtoolbar.com, (CWSGoogleMS.3), false positive! It No longer removes xxxtoolbar.com from IE's restricted sites list!...They actually FIXED it!

WOW!!! Thankyou PP for fixing what was a dangerous problem!

Now I can relax. Till next time.

congrats

[dread]

Everyone might to check out thier new page, has some new stuff well stuff I have not seen before. http://research.pestpatrol.com/ And look here http://research.pestpatrol.com/Analyses/FalseAlarms.asp I think in this post or another someone siad they quadrupled one of thier teams. I like pestpatrol and from what I see they actually do try to fix the problems and actually try to help solve problems and errors. They are not a huge company like mcafee or norton as with most of the spy/ad ware companies trying to fight back at spy/adware and it just takes time. I just cant wiat for the home addition of pestpatrol 5.

[jld123]

Hi dread,
Thankyou for reminding us of the other "Positive" side of PP. I actually agree with you as I've noticed that they have made several adjustments to PP from past complaints, albeit several months sometimes pass before even a simple fix to one of them shows up. I'm looking forward to seeing how their new, larger teams will affect their response time. Meanwhile, Though I often complain on the outside when something isn't quite right, inside I too, am rooting for PP all the way.

Let's hope PP ver 5 doesn't trip up the way ZoneAlarm did with their ver 5!

[TAG97]

I tried PestPatrol's online scan right after the merge with Computer Associates
and found 12 warnings which I ignored. Today I tried it again and no warnings. Has any users found a big improvement with the False Positives and Updates since the merge?
Tim

[dread]

It seems like they going back to put out updates like they use to. Dont know about the fp's only time will tell. I dont think ca is really doing to much with pp right now from what I have seen. But if they are gonna change the program around to thier likeings which most compainies do when they so called acquire another compainy and its products, it might take them a bit and reckon people have to wiat and see. I just hope they dont trash the product and combine it in some sort of a security suite, or add all the stuff pp detects to thier av product. I renewed now I got a another year to see what they are going to do with pp. I hope they keep it as a standalone product and dont bundle it with anything and just try to fix the false positives and come out with newer,better versions.