Microsoft Anti Spy glitch after updates

Discussion in 'other security issues & news' started by ashwin, Feb 17, 2005.

Thread Status:
Not open for further replies.
  1. ashwin

    ashwin Registered Member

    Joined:
    Feb 17, 2005
    Posts:
    66
    I downloaded the M$ Anti Spyware Beta in Jan, and it has been running well for the past month. When I downloaded the most recent slug of M$ security patches, the M$ Anti Spy could no longer connect with the internet. There were a few other strange things going on, so I used system restore to get back to the day B4 the updates.

    I’m also running Firefox Browser, Ewido, Outpost firewall, Spyware Blaster, Spyware Guard, Ad-Aware, Spybot, Win Patrol, Security Task Mgr. (Trial), and AVG free, on XP. All these had internet connection after the security updates….My system generally scans free and clear of malware…

    The reason I want to use the M$ Anti Spy is the performance rating by Eric Howes (Uof Illinois) giving it the best rating of anything in his tests.
    http://www.eweek.com/article2/0,1759,1731474,00.asp?kc=EWRSS03129TX1K0000614

    1) Would you suggest uninstalling the Anti Spyware, and re installing it, to get a version to access to the internet after doing the downloads again??

    2)It didn’t help to read that some versions of the M$ Anti Spyware wiped IE off the hard drive!! Anyone else having issues with the MS Anti Spyware software?

    3) Are there any suggestions for any product or combo to match the MS product? (prefer open source)

    I’m a novice, and considering: SpyCop, MJ Registry Watcher, Process Guard, Prevx, KarenWare Replicator for back-up…when I have some time to fiddle on the learning curves.

    4)Any other suggestions for this scenario? I’m assuming it is best to download the MS updates and deal with whatever comes up- Yes?

    Thanks Everyone for a great forum
    Thanks to Blackbear for the complete listings of security options...

    Ashwin
     
  2. Bubba

    Bubba Updates Team

    Joined:
    Apr 15, 2002
    Posts:
    11,271
    1) Would you suggest uninstalling the Anti Spyware, and re installing it, to get a version to access to the internet after doing the downloads again??

    I would definetly give it another go....since MAS is a very good program IMHO. After installation....reboot and if it will not connect to Internet for updates....attempt to note all error messages if any and other pertinent info.

    2)It didn’t help to read that some versions of the M$ Anti Spyware wiped IE off the hard drive!!

    That's a new one on me o_O
     
  3. meneer

    meneer Registered Member

    Joined:
    Nov 27, 2002
    Posts:
    1,132
    Location:
    The Netherlands
    Were you referring to this report? :D

    Please be gentle to MS, for MAS is beta software. Very good at it, but some trouble can be expected of course.
     
  4. ashwin

    ashwin Registered Member

    Joined:
    Feb 17, 2005
    Posts:
    66
    Thanks Bubba. On the second try of downloading the updates, the MAS was able to access for internet updates.

    Yes, Meneer posted the article I saw on MAS eating the IE...

    I took a look at some of the topics for the MS security updates. One of them was KB 890830, which is a one time scan to detect virus/worm infections, including "mydoom" variants. Then it erases, and you get to run it for next month's updates.

    By chance I had done an on line virus scan yesterday at http://www.ravantivirus.com/scan/indexie.php#
    (IE only) .

    It found the "mydoom" and "lovegate" viruses in 12 files (outlook exp and msn- mail...suprise!) . AVG free had not detected them.

    I know MAS is not marketed as anti virus, but I checked at the RAV site after the downloads because the MS updates said they would scan for the "my doom". The same 2 viruses are still in the 12 files (the RAV makes no claim to remove everything), so I know the MS scan did not remove some of the "my doom" viruses. I haven't used Outlook Express for over a year, so it is not a new virus.

    Should the removal of the viruses from the files be a priority? Are some AV software programs able to do it, or is it necessary to do it by hand?


    Many Thanks

    ashwin
     
  5. ashwin

    ashwin Registered Member

    Joined:
    Feb 17, 2005
    Posts:
    66
    "and you get to run it for next month's updates".

    I should have said "...run an updated sweep during next months..."

    ashwin
     
  6. meneer

    meneer Registered Member

    Joined:
    Nov 27, 2002
    Posts:
    1,132
    Location:
    The Netherlands
    There are lots of free removal tools.
    etrust
    Avast
    Just google a bit.

    (ps don't you just love bbspot :))
     
  7. ashwin

    ashwin Registered Member

    Joined:
    Feb 17, 2005
    Posts:
    66
    Thanks Meneer.

    When I went to the etrust site, I noticed at the bottom address bar it said
    "transferring data from sales.liveperson.net"

    1) I'll google that too. Do you know what it means??

    2) Is it recomended to leave AVG running while installing and running AVAST or NOD32?

    The NOD32 site said to uninstall other AV's before installing theirs, but I wanted to have AV protection in case I needed internet access for help during a new AV install/configure.
     
  8. ashwin

    ashwin Registered Member

    Joined:
    Feb 17, 2005
    Posts:
    66
    I ran the cleaners from AVAST and e Trust, but the online RAV scan says the "mydoom" and "lovegate" are still there.

    Yes - I finally saw how to "deactivate" the AVG, so maybe I'll try to install the NOD32...

    Highest Regards

    Ashwin

    whats bbspot??
     
  9. meneer

    meneer Registered Member

    Joined:
    Nov 27, 2002
    Posts:
    1,132
    Location:
    The Netherlands
    Sorry, can't help you any further. Are you sure it's not a false positive?

    www.BBSpot.com takes a lot of your spare time. There are some hilarious articles (like mas eating ie) and some great comparative reviews (like firefox compared to ie)
     
  10. ashwin

    ashwin Registered Member

    Joined:
    Feb 17, 2005
    Posts:
    66
    The nice folks over at Pandasoftware extracted those 12 bad boys and found an adware in the registry: "virtual bouncer"

    http://www.pandasoftware.co.uk/psuk/2360-viruscentre.htm

    They don't extract malware, so I'm off to find something to clean the registry and am open to suggestions...and I'll check other forums areas, and the websites you've listed.

    thanks meneer

    ashwin
     
  11. Bubba

    Bubba Updates Team

    Joined:
    Apr 15, 2002
    Posts:
    11,271
    There is a chance that you can remove VB thru Add-Remove Programs....but....I would suggest you download AdAware from here. Once the program is installed....do an update to get the latest definition files and then do a full system scan....let AdAware fix anything it finds.

    Edit
    Duh....I need to read better....you have Adaware :blink:
    Have you donwloaded the latest definition files and let Adaware scan ?
     
  12. ashwin

    ashwin Registered Member

    Joined:
    Feb 17, 2005
    Posts:
    66
    I updated everything, and then ran in sequence:

    Ad Aware and found "data miner" in IE cache

    Ewido and found unamed tracking cookie in Docs/settings

    MAS detected natha.

    The two found items above are probably from the few minutes I used IE after using it for the active x control feature for the online scans...

    So I'm thinking the "virtual bouncer" is still in the registry.

    Question: best to try all the above again in "safety mode"?? It's something I've heard about but I'm on new territory.

    Also: The RAV scan said it also "found" 394 e-mails. Do you think that means infected e-mails!!?? Well, OK, I have let a few pile up in Yahoo...Could they all be full of more Bad Boys waiting to raise havoc??

    Highest Regards

    ashwin
     
Loading...
Thread Status:
Not open for further replies.