AntiSpyware Beta

I'm using Microsoft AntiSpyware Beta1 spyware program to
protect my computer from spywares. It has been activated
all the time by showing small icon on the system tray.
However my document and setup files were destroyed
recently by "PoeBot.Explorer Trojan" virus. I just was
wondering why AntiSpyware program wont prevent this virus
from entering to my computer even it found this bug by
manual scanning? My OS is Windows XP Home Edition.

Actually it is Spyware not a Trojan. Best recommendation then would be to
restart in safe mode and do a deep
scan. On the Scan Page choose Scan Options > Full System Scan. Do this at
least two times until detects something. Also, before you restart in safe
mode, disable System Restore, some trojans and spyware programs are likely
to restore themselves with system snap shots:

Right click My Computer > Properties > System Restore, check the "Disable
System Restore" check box and restart in safe mode.

Restart in safe mode instructions:
www.microsoft.com/resources/documentation/
windows/xp/all/proddocs/en-us/boot_failsafe.mspx

Remember, this is still beta and cannot be judged as a finished shipping
product. I also recommend using additional AntiSpyware utilities in tandem
with Microsoft AntiSpyware, also use your Antivirus solution to do a
thorough scan in safe mode also and ensure that it fully up to date.

Ad-Aware - www.lavasoftusa.com
Spybot - http://www.safer-networking.org/
CWShredder - http://www.intermute.com/products/cwshredder.html
Spy Sweeper - www.webroot.com

--

Andre
http://spaces.msn.com/members/adacosta
FAQ for MS AntiSpy http://www.geocities.com/marfer_mvp/FAQ_MSantispy.htm


"Jack" <anonymous@discussions.microsoft.com> wrote in message
news:142b01c53163$5b3524e0$a401280a@phx.gbl...
> I'm using Microsoft AntiSpyware Beta1 spyware program to
> protect my computer from spywares. It has been activated
> all the time by showing small icon on the system tray.
> However my document and setup files were destroyed
> recently by "PoeBot.Explorer Trojan" virus. I just was
> wondering why AntiSpyware program wont prevent this virus
> from entering to my computer even it found this bug by
> manual scanning? My OS is Windows XP Home Edition.
>

"Jack" <anonymous@discussions.microsoft.com> wrote in message
news:142b01c53163$5b3524e0$a401280a@phx.gbl...
> I'm using Microsoft AntiSpyware Beta1 spyware program to
> protect my computer from spywares. It has been activated
> all the time by showing small icon on the system tray.
> However my document and setup files were destroyed
> recently by "PoeBot.Explorer Trojan" virus. I just was
> wondering why AntiSpyware program wont prevent this virus
> from entering to my computer even it found this bug by
> manual scanning? My OS is Windows XP Home Edition.
>


Okay, now repeat out loud: Microsoft AntiSpyware. Say it again out
loud: Microsoft AntiSPYWARE. Got it now? It is an anti-***SPYWARE***
product. It is not a virus detector. It is not a trojan detector. It
is not [yet] a rootkit detector. It detects SPYWARE. Some spyware may
contain a virus (to replicate itself across the network) or behave as a
trojan but spyware is just spyware (covert invasion of privacy).

Definitions of spyware:
http://dictionary.reference.com/search?q=spyware
http://www.google.com/search?q=define:Spyware
http://searchcio.techtarget.com/sDe...i214518,00.html

Note that none of them mention viruses or trojans. Only
http://www.webopedia.com/TERM/s/spyware.html comes close since it
mentions that *delivery* of spyware is similar to delivery of trojans.
A trojan typically incurs some harm to your system. Spyware just spies
on you and possibly sends private info elsewhere. In fact, unlike a
trojan, spyware would very much never want to do any harm to your system
because it wants to remain hidden and continue to function.

So why are you not using anti-virus software to monitor your system? AV
products have varying visibility of trojans (none are as good at
detecting trojans as they are for viruses), so you might also
considering using anti-trojan software. Of course, that trojan had to
be allowed in and installed by some action you committed, so at some
point it was something you did that let it in and let it run, like
opening an e-mail attachment, not using secure settings in your security
zone used for your browser, like letting some ActiveX component get
installed (for which you may have been prompted and said Yes, or your
security zone is configured not to prompt you and you left it that way).

--
____________________________________________________________
Post your replies to the newsgroup. Share with others.
E-mail reply: Remove "NIXTHIS" and add "#VS811" to Subject.
____________________________________________________________

"Andre Da Costa" <andred25@hotmail.com> wrote in message
news:%23zIkFbWMFHA.2160@CPMSFTNGSA04.privatenews.microsoft.com...
<snip>
> Also, before you restart in safe
> mode, disable System Restore, some trojans and spyware programs are
> likely
> to restore themselves with system snap shots:

<snip>

Just a word of caution: disabling System Restore will delete *all* your
snapshots (hence why malware that infects them cannot reinfect your
system using that method). See http://support.microsoft.com/?id=310405.

--
____________________________________________________________
Post your replies to the newsgroup. Share with others.
E-mail reply: Remove "NIXTHIS" and add "#VS811" to Subject.
____________________________________________________________

PoeBot.Explorer is actually Spyware, check here:
http://www.cybersoft.com/about/alerts.php

--

Andre
http://spaces.msn.com/members/adacosta
FAQ for MS AntiSpy http://www.geocities.com/marfer_mvp/FAQ_MSantispy.htm

<Vanguard> wrote in message
news:%23ZS%23gxWMFHA.2160@CPMSFTNGSA04.privatenews.microsoft.com...
> "Jack" <anonymous@discussions.microsoft.com> wrote in message
> news:142b01c53163$5b3524e0$a401280a@phx.gbl...
>> I'm using Microsoft AntiSpyware Beta1 spyware program to
>> protect my computer from spywares. It has been activated
>> all the time by showing small icon on the system tray.
>> However my document and setup files were destroyed
>> recently by "PoeBot.Explorer Trojan" virus. I just was
>> wondering why AntiSpyware program wont prevent this virus
>> from entering to my computer even it found this bug by
>> manual scanning? My OS is Windows XP Home Edition.
>>
>
>
> Okay, now repeat out loud: Microsoft AntiSpyware. Say it again out loud:
> Microsoft AntiSPYWARE. Got it now? It is an anti-***SPYWARE*** product.
> It is not a virus detector. It is not a trojan detector. It is not [yet]
> a rootkit detector. It detects SPYWARE. Some spyware may contain a virus
> (to replicate itself across the network) or behave as a trojan but spyware
> is just spyware (covert invasion of privacy).
>
> Definitions of spyware:
> http://dictionary.reference.com/search?q=spyware
> http://www.google.com/search?q=define:Spyware
> http://searchcio.techtarget.com/sDe...i214518,00.html
>
> Note that none of them mention viruses or trojans. Only
> http://www.webopedia.com/TERM/s/spyware.html comes close since it mentions
> that *delivery* of spyware is similar to delivery of trojans. A trojan
> typically incurs some harm to your system. Spyware just spies on you and
> possibly sends private info elsewhere. In fact, unlike a trojan, spyware
> would very much never want to do any harm to your system because it wants
> to remain hidden and continue to function.
>
> So why are you not using anti-virus software to monitor your system? AV
> products have varying visibility of trojans (none are as good at detecting
> trojans as they are for viruses), so you might also considering using
> anti-trojan software. Of course, that trojan had to be allowed in and
> installed by some action you committed, so at some point it was something
> you did that let it in and let it run, like opening an e-mail attachment,
> not using secure settings in your security zone used for your browser,
> like letting some ActiveX component get installed (for which you may have
> been prompted and said Yes, or your security zone is configured not to
> prompt you and you left it that way).
>
> --
> ____________________________________________________________
> Post your replies to the newsgroup. Share with others.
> E-mail reply: Remove "NIXTHIS" and add "#VS811" to Subject.
> ____________________________________________________________
>

>-----Original Message-----
>I'm using Microsoft AntiSpyware Beta1 spyware program to
>protect my computer from spywares. It has been activated
>all the time by showing small icon on the system tray.
>However my document and setup files were destroyed
>recently by "PoeBot.Explorer Trojan" virus. I just was
>wondering why AntiSpyware program wont prevent this
virus
>from entering to my computer even it found this bug by
>manual scanning? My OS is Windows XP Home Edition.
> Are you running Anti-Virus Programs???? That would
have stopped that virus....Dave

>.
>

"Andre Da Costa" <andred25@hotmail.com> wrote in message
news:ugsBfNXMFHA.1368@CPMSFTNGSA04.privatenews.microsoft.com...
> PoeBot.Explorer is actually Spyware, check here:
> http://www.cybersoft.com/about/alerts.php


I didn't bother to look it up. The OP was the one that said it was a
virus which then put it outside the venue of malware that MSAS was
developed to detect. It was my mistake in believing the OP knew what
they were talking about. The OP also never mentioned if he did an
update and manual scan right after installing MSAS to guarantee the
spyware wasn't already on his system. His inference is that the
real-time scanner didn't detect it (which it probably won't since it
detects *changes* in the monitored critical areas) and that he did not
think of actually performing a scan after installing the product. Also,
if he disabled MSAS so its real-time scanners weren't active and then
the spyware got installed, the real-time scanner probably doesn't go
searching all files and checking the signatures against them since that
would generate a lot of disk activity, something you do by performing a
manual scan.

Having the real-time scanners enabled does not obviate the need to
perform the manual scans to actually check the signatures against the
files. Looking at the settings for the real-time agents (Internet,
System, and Application) shows that none of them go scanning files to
check them against the signatures to detect the entry of spyware. They
only check for changes in critical areas; i.e., they check behavior and
don't go checking the fingerprint of every file. You need to use the
real-time scanners to monitor for *changes* in critical areas AND you
need to periodically perform a scan to exercise the signatures against
your files.

The other problem with MSAS is that it *polls* for those changes. It
does not intercept them. You can edit the hosts file with Notepad, exit
Notepad, and maybe a minute later MSAS will notify you that the hosts
file got changed. The application that performed the change is long
gone. That's why MSAS cannot identify the application or even the
process that made the change because it's probably long gone by the time
MSAS gets around to detecting the change. WinPatrol has the same defect
of polling for changes. Prevx (Home version is free) intercepts the
changes and will hang the application attempting to make the change so
the user can decide whether or not to allow the change at the time the
change is attempted and Prevx also knows the application that is
attempting to perform the change (and why you can tell Prevx to allow to
block that application in the future). I use both MSAS and Prevx
because Prevx is an IDS (intrusion detection system) product that
intercepts suspicious behavior but is not specifically geared to
detecting spyware whereas MSAS is geared to detecting spyware (by using
its manual scan) but notifies the user too late. Prevx isn't for
newbies.

Since anti-virus products now include detection of trojans and some
spyware programs (and some promise to starting including detection of
rootkits), I suppose anti-spyware product might do the same and overlap
but in reverse by including detection of trojans and viruses, but I
won't hold my breath waiting for an all-in-one malware detector program
that catches them all.

--
____________________________________________________________
Post your replies to the newsgroup. Share with others.
E-mail reply: Remove "NIXTHIS" and add "#VS811" to Subject.
____________________________________________________________

Jack - can you say more about what happened? I have seen Poebot detected on
my own machine, and believe it to be a false positive.

You mention losses of some sort--what exactly happened?

--
FAQ for Microsoft Antispyware:
http://www.geocities.com/marfer_mvp/FAQ_MSantispy.htm

"Jack" <anonymous@discussions.microsoft.com> wrote in message
news:142b01c53163$5b3524e0$a401280a@phx.gbl...
> I'm using Microsoft AntiSpyware Beta1 spyware program to
> protect my computer from spywares. It has been activated
> all the time by showing small icon on the system tray.
> However my document and setup files were destroyed
> recently by "PoeBot.Explorer Trojan" virus. I just was
> wondering why AntiSpyware program wont prevent this virus
> from entering to my computer even it found this bug by
> manual scanning? My OS is Windows XP Home Edition.
>

I think you're confused. Spyware and virus protection
are different critters and typically require
different/separate programs.

Your PC should be protected by an Anti-Virus program like
Norton, McAfee or similar and it should be current with
all updates, as should all your software.

I'm running Norton Anti-Virus, SpyBot Search & Destroy,
Zone Alarm firewall and recently MS Anti-Spyware, but I
don't always have it active. I've never had *any*
problems...

>-----Original Message-----
>I'm using Microsoft AntiSpyware Beta1 spyware program to
>protect my computer from spywares. It has been activated
>all the time by showing small icon on the system tray.
>However my document and setup files were destroyed
>recently by "PoeBot.Explorer Trojan" virus. I just was
>wondering why AntiSpyware program wont prevent this
virus
>from entering to my computer even it found this bug by
>manual scanning? My OS is Windows XP Home Edition.
>
>.
>