I have noticed numerous changes in this latest beta
release on Feb. 16. I am running this beta on 75 plus
corporate machines and the new release is not finding or
removing anywhere near what 1.0.501 release did.

Even though both versions have the latest def installed
the release from Feb 16th fails to find mywebsearch,
popular screensavers, myway, funwebproducts and at least
10 more popular spyware programs.

I would recommend microsoft pull this version from the
16th immediately version 1.0.509 because there is
obviously something seriously wrong. I have
uninstalled .509 on several machines and reinstalled
the .501 version and sucessfully found and removed lots of
additional spyware. This should not be something has
changed!

If Microsoft would like to contact me I would be happy to
show my results in detail for them.

Travis Mitchell
Sintering Tech
812-663-5058 ext. 544
(E-Mail Removed)

Can you be more specific in your description of the problem?

If you are talking about the same 75 machines, if MSAS .501 REMOVED those
entities, then they should not get back on any of those machines and of
course .509 will not find them because they don't get back on due to MSAS
using active defense.

IF those entities are getting back on the machines, you have several
problems and MSAS is not the only one.

Pleas explain.

JohnF.



"Travis Mitchell" <(E-Mail Removed)> wrote in message
news:296101c51e6e$9d6c6650$(E-Mail Removed)...
>I have noticed numerous changes in this latest beta
> release on Feb. 16. I am running this beta on 75 plus
> corporate machines and the new release is not finding or
> removing anywhere near what 1.0.501 release did.
>
> Even though both versions have the latest def installed
> the release from Feb 16th fails to find mywebsearch,
> popular screensavers, myway, funwebproducts and at least
> 10 more popular spyware programs.
>
> I would recommend microsoft pull this version from the
> 16th immediately version 1.0.509 because there is
> obviously something seriously wrong. I have
> uninstalled .509 on several machines and reinstalled
> the .501 version and sucessfully found and removed lots of
> additional spyware. This should not be something has
> changed!
>
> If Microsoft would like to contact me I would be happy to
> show my results in detail for them.
>
> Travis Mitchell
> Sintering Tech
> 812-663-5058 ext. 544
> (E-Mail Removed)

Sorry, I was not very specific. I had 5 machines this
morning that I had not installed MSAS on before and
installed release .509. This new release did find some
entries for mywebsearch toolbar and popular screensaver
and some additional misc. spyware. However, It seemed
unusual to me because the number was so low, so I went
ahead and removed all the spyware in MSAS.509 and notice
that it did remove the actual toolbar or screensaver.

Now, I am very familiar with both mywebsearch toolbar and
popular screensaver because I have about 50 workstations
that users had both of these installed on. So I
removed .509 through add/remove programs and install .501
and reran MSAS and found hundreds of files and registry
keys which I expected to see and sucessfully removed
everything with MSAS.501

I understand this is not a very scientific finding yet and
I have only tested a small number of spyware infected
machines but there is a noticable difference with at least
these two specific spyware related software. These
machines were 2000, XPSP1 and XPSP2. I will try to post
additional findings over the next week but for now I am
finding much more with MSAS.501

Time permitting I will futher prove this in a controlled
test environment as well.

Plese let me know if you have futher questions.

Travis Mitchell
>-----Original Message-----
>Can you be more specific in your description of the
problem?
>
>If you are talking about the same 75 machines, if
MSAS .501 REMOVED those
>entities, then they should not get back on any of those
machines and of
>course .509 will not find them because they don't get
back on due to MSAS
>using active defense.
>
>IF those entities are getting back on the machines, you
have several
>problems and MSAS is not the only one.
>
>Pleas explain.
>
>JohnF.
>
>
>
>"Travis Mitchell" <(E-Mail Removed)> wrote in message
>news:296101c51e6e$9d6c6650$(E-Mail Removed)...
>>I have noticed numerous changes in this latest beta
>> release on Feb. 16. I am running this beta on 75 plus
>> corporate machines and the new release is not finding or
>> removing anywhere near what 1.0.501 release did.
>>
>> Even though both versions have the latest def installed
>> the release from Feb 16th fails to find mywebsearch,
>> popular screensavers, myway, funwebproducts and at least
>> 10 more popular spyware programs.
>>
>> I would recommend microsoft pull this version from the
>> 16th immediately version 1.0.509 because there is
>> obviously something seriously wrong. I have
>> uninstalled .509 on several machines and reinstalled
>> the .501 version and sucessfully found and removed lots
of
>> additional spyware. This should not be something has
>> changed!
>>
>> If Microsoft would like to contact me I would be happy
to
>> show my results in detail for them.
>>
>> Travis Mitchell
>> Sintering Tech
>> 812-663-5058 ext. 544
>> (E-Mail Removed)
>
>
>.
>

Thank you for your details! Wow - that is disconcerting - please keep us
informed. I'll have to setup a test of this as well.

Thanks again,

JohnF.


"Travis Mitchell" <(E-Mail Removed)> wrote in message
news:2f1a01c51e76$30697900$(E-Mail Removed)...
> Sorry, I was not very specific. I had 5 machines this
> morning that I had not installed MSAS on before and
> installed release .509. This new release did find some
> entries for mywebsearch toolbar and popular screensaver
> and some additional misc. spyware. However, It seemed
> unusual to me because the number was so low, so I went
> ahead and removed all the spyware in MSAS.509 and notice
> that it did remove the actual toolbar or screensaver.
>
> Now, I am very familiar with both mywebsearch toolbar and
> popular screensaver because I have about 50 workstations
> that users had both of these installed on. So I
> removed .509 through add/remove programs and install .501
> and reran MSAS and found hundreds of files and registry
> keys which I expected to see and sucessfully removed
> everything with MSAS.501
>
> I understand this is not a very scientific finding yet and
> I have only tested a small number of spyware infected
> machines but there is a noticable difference with at least
> these two specific spyware related software. These
> machines were 2000, XPSP1 and XPSP2. I will try to post
> additional findings over the next week but for now I am
> finding much more with MSAS.501
>
> Time permitting I will futher prove this in a controlled
> test environment as well.
>
> Plese let me know if you have futher questions.
>
> Travis Mitchell
>>-----Original Message-----
>>Can you be more specific in your description of the
> problem?
>>
>>If you are talking about the same 75 machines, if
> MSAS .501 REMOVED those
>>entities, then they should not get back on any of those
> machines and of
>>course .509 will not find them because they don't get
> back on due to MSAS
>>using active defense.
>>
>>IF those entities are getting back on the machines, you
> have several
>>problems and MSAS is not the only one.
>>
>>Pleas explain.
>>
>>JohnF.
>>
>>
>>
>>"Travis Mitchell" <(E-Mail Removed)> wrote in message
>>news:296101c51e6e$9d6c6650$(E-Mail Removed)...
>>>I have noticed numerous changes in this latest beta
>>> release on Feb. 16. I am running this beta on 75 plus
>>> corporate machines and the new release is not finding or
>>> removing anywhere near what 1.0.501 release did.
>>>
>>> Even though both versions have the latest def installed
>>> the release from Feb 16th fails to find mywebsearch,
>>> popular screensavers, myway, funwebproducts and at least
>>> 10 more popular spyware programs.
>>>
>>> I would recommend microsoft pull this version from the
>>> 16th immediately version 1.0.509 because there is
>>> obviously something seriously wrong. I have
>>> uninstalled .509 on several machines and reinstalled
>>> the .501 version and sucessfully found and removed lots
> of
>>> additional spyware. This should not be something has
>>> changed!
>>>
>>> If Microsoft would like to contact me I would be happy
> to
>>> show my results in detail for them.
>>>
>>> Travis Mitchell
>>> Sintering Tech
>>> 812-663-5058 ext. 544
>>> (E-Mail Removed)
>>
>>
>>.
>>

Can you give a testing protocol for a particular bug? Pick something easy
to find--give us a URL, ideally, so that we can install and test this for
ourselves under the two builds.

--
FAQ for Microsoft Antispyware:
http://www.geocities.com/marfer_mvp/FAQ_MSantispy.htm

"Travis Mitchell" <(E-Mail Removed)> wrote in message
news:296101c51e6e$9d6c6650$(E-Mail Removed)...
>I have noticed numerous changes in this latest beta
> release on Feb. 16. I am running this beta on 75 plus
> corporate machines and the new release is not finding or
> removing anywhere near what 1.0.501 release did.
>
> Even though both versions have the latest def installed
> the release from Feb 16th fails to find mywebsearch,
> popular screensavers, myway, funwebproducts and at least
> 10 more popular spyware programs.
>
> I would recommend microsoft pull this version from the
> 16th immediately version 1.0.509 because there is
> obviously something seriously wrong. I have
> uninstalled .509 on several machines and reinstalled
> the .501 version and sucessfully found and removed lots of
> additional spyware. This should not be something has
> changed!
>
> If Microsoft would like to contact me I would be happy to
> show my results in detail for them.
>
> Travis Mitchell
> Sintering Tech
> 812-663-5058 ext. 544
> (E-Mail Removed)

Travis,

Thank you for sharing your experience in the beta of Microsoft Windows
AntiSpyware. As with any beta product we are actively seeking ways to
improve the product and feedback like yours is an important part of this
work. To help us better understand your experience please submit a
suspected spyware report to us through the application by clicking Tools ->
Suspected Spyware Report.
Once the report is submitted, please view your completed report from SpyNet
and reply back to the newsgroup with the ScanID listed in the web browser.

An example ScanID would be: ScanID=732e5e60-d3b5-4c4e-926a-f7a7a7db5d79"


--
-steve

Steve Dodson [MSFT]
MCSE, CISSP
PSS Security

--

This posting is provided "AS IS" with no warranties, and confers no rights.
Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm

Note: For the benefit of the community-at-large, all responses to this
message are best directed to the newsgroup/thread from which they
originated.
"Travis Mitchell" <(E-Mail Removed)> wrote in message
news:296101c51e6e$9d6c6650$(E-Mail Removed)...
>I have noticed numerous changes in this latest beta
> release on Feb. 16. I am running this beta on 75 plus
> corporate machines and the new release is not finding or
> removing anywhere near what 1.0.501 release did.
>
> Even though both versions have the latest def installed
> the release from Feb 16th fails to find mywebsearch,
> popular screensavers, myway, funwebproducts and at least
> 10 more popular spyware programs.
>
> I would recommend microsoft pull this version from the
> 16th immediately version 1.0.509 because there is
> obviously something seriously wrong. I have
> uninstalled .509 on several machines and reinstalled
> the .501 version and sucessfully found and removed lots of
> additional spyware. This should not be something has
> changed!
>
> If Microsoft would like to contact me I would be happy to
> show my results in detail for them.
>
> Travis Mitchell
> Sintering Tech
> 812-663-5058 ext. 544
> (E-Mail Removed)

Travis Mitchell wrote:
> I have noticed numerous changes in this latest beta
> release on Feb. 16. I am running this beta on 75 plus
> corporate machines and the new release is not finding or
> removing anywhere near what 1.0.501 release did.
>
> Even though both versions have the latest def installed
> the release from Feb 16th fails to find mywebsearch,
> popular screensavers, myway, funwebproducts and at least
> 10 more popular spyware programs.
>
> I would recommend microsoft pull this version from the
> 16th immediately version 1.0.509 because there is
> obviously something seriously wrong. I have
> uninstalled .509 on several machines and reinstalled
> the .501 version and sucessfully found and removed lots of
> additional spyware. This should not be something has
> changed!
>
> If Microsoft would like to contact me I would be happy to
> show my results in detail for them.
>
> Travis Mitchell
> Sintering Tech
> 812-663-5058 ext. 544
> (E-Mail Removed)

After reading this I performed the same test, with MSAS version 1.0.509
I did two Full Scans one right after the other and got two complete
clean scans. Then I uninstalled ver. .509 and installed version 1.0.501
did a download to make sure I was running the same definition file and
then did a Full Scan and got the following hits:

MYWebSearch
Popular Screensavers
FunWeb Products
MyWay Search Bar

Removed all of the above and then did a second scan with .501 and it
came back clean.

Danny

Danny - I don't know how you "prepped" the system you used for this test.
Are you able to do a similar test, but, after scanning clean with .509, can
you do the step Steve Dodson suggested--do a Tools, Suspected Spyware
report, and post the URL for your report here?

Maybe then do .501, scan, clean, and another such suspected spyware report,
with a URL?

--
FAQ for Microsoft Antispyware:
http://www.geocities.com/marfer_mvp/FAQ_MSantispy.htm

"Danny Kile" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> Travis Mitchell wrote:
>> I have noticed numerous changes in this latest beta release on Feb. 16. I
>> am running this beta on 75 plus corporate machines and the new release is
>> not finding or removing anywhere near what 1.0.501 release did. Even
>> though both versions have the latest def installed the release from Feb
>> 16th fails to find mywebsearch, popular screensavers, myway,
>> funwebproducts and at least 10 more popular spyware programs. I would
>> recommend microsoft pull this version from the 16th immediately version
>> 1.0.509 because there is obviously something seriously wrong. I have
>> uninstalled .509 on several machines and reinstalled the .501 version and
>> sucessfully found and removed lots of additional spyware. This should not
>> be something has changed!
>>
>> If Microsoft would like to contact me I would be happy to show my results
>> in detail for them. Travis Mitchell
>> Sintering Tech
>> 812-663-5058 ext. 544
>> (E-Mail Removed)
>
> After reading this I performed the same test, with MSAS version 1.0.509 I
> did two Full Scans one right after the other and got two complete clean
> scans. Then I uninstalled ver. .509 and installed version 1.0.501 did a
> download to make sure I was running the same definition file and then did
> a Full Scan and got the following hits:
>
> MYWebSearch
> Popular Screensavers
> FunWeb Products
> MyWay Search Bar
>
> Removed all of the above and then did a second scan with .501 and it came
> back clean.
>
> Danny

That's what I'm trying to do myself, but I can't find a good place to get
infested. I rmember someone posting that he went to one page and picked up
20 some bugs but I can't find the post.

Any ideas? I'm ready to run a test of .501 versus.509 on a separate machine
I have set up in my DMZ.

JohnF.


"Bill Sanderson" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> Danny - I don't know how you "prepped" the system you used for this test.
> Are you able to do a similar test, but, after scanning clean with .509,
> can you do the step Steve Dodson suggested--do a Tools, Suspected Spyware
> report, and post the URL for your report here?
>
> Maybe then do .501, scan, clean, and another such suspected spyware
> report, with a URL?
>
> --
> FAQ for Microsoft Antispyware:
> http://www.geocities.com/marfer_mvp/FAQ_MSantispy.htm
>
> "Danny Kile" <(E-Mail Removed)> wrote in message
> news:(E-Mail Removed)...
>> Travis Mitchell wrote:
>>> I have noticed numerous changes in this latest beta release on Feb. 16.
>>> I am running this beta on 75 plus corporate machines and the new release
>>> is not finding or removing anywhere near what 1.0.501 release did. Even
>>> though both versions have the latest def installed the release from Feb
>>> 16th fails to find mywebsearch, popular screensavers, myway,
>>> funwebproducts and at least 10 more popular spyware programs. I would
>>> recommend microsoft pull this version from the 16th immediately version
>>> 1.0.509 because there is obviously something seriously wrong. I have
>>> uninstalled .509 on several machines and reinstalled the .501 version
>>> and sucessfully found and removed lots of additional spyware. This
>>> should not be something has changed!
>>>
>>> If Microsoft would like to contact me I would be happy to show my
>>> results in detail for them. Travis Mitchell
>>> Sintering Tech
>>> 812-663-5058 ext. 544
>>> (E-Mail Removed)
>>
>> After reading this I performed the same test, with MSAS version 1.0.509 I
>> did two Full Scans one right after the other and got two complete clean
>> scans. Then I uninstalled ver. .509 and installed version 1.0.501 did a
>> download to make sure I was running the same definition file and then did
>> a Full Scan and got the following hits:
>>
>> MYWebSearch
>> Popular Screensavers
>> FunWeb Products
>> MyWay Search Bar
>>
>> Removed all of the above and then did a second scan with .501 and it came
>> back clean.
>>
>> Danny
>
>

>-----Original Message-----
>That's what I'm trying to do myself, but I can't find a
>good place to get infested.

Maybe to use this as test reference:

The Tests: Design & Methodology
http://spywarewarrior.com/asw-test-guide.htm#test

Then we also have Kazaa:
http://www.kazaa.com/us/index.htm

And some cliks inside cracks.am and belonging pop up
pages.... Not scientific but a lot happens if you follow
some links.

http://www.cracks.am/

--
plun