alt net

[Guest]

I have been running MSAS daily for many months now and it has never
identified any spyware on my system. Today I tried Spyware Doctor and it
identified -

Altnet Software - Bundled with Kazaa. Installs a browser helper object
which loads when IE is started. ...

Why hasn't MSAS identified this "spyware"? And can someone explain - in
very simple terms - how to remove it.

Many thanks
Alvis

 

[Guest]

Hello Alvis,

Try these links and let us know if these helped.

http://www.spywareremove.com/removeAltnet.html

http://www.spywareremove.com/altnet.shtml

Eиçel

 

[Bill Sanderson]

I'd recommend installing Windows Defender--the awaited beta2 version of
Microsoft Antispyware, and getting a second opinion. False positives are a
fact of antispyware life. This could be a false positive (something
innocent ID'd as bad) or it could be something a little different--a remnant
or related but not dangerous by itself file or registry entry--which
Microsoft Antispyware chose to ignore, but Spyware Doctor flags.

You can get Windows Defender here:

http://www.microsoft.com/downloads/...E7-DA2B-4A6A-AFA4-F7F14E605A0D&displaylang=en

just download and double-click to update the Microsoft Antispyware you have
in place.

In the end, you may have the same issue--one opinion from Spyware Doctor and
a different one from Microsoft's tools--you should check out the details
listed by Spyware Doctor as best you can --perhaps post them here--to try to
get more information.

 

[Guest]

Hello Engel

I carried out the instructions on the websites you mentioned – a very
complicated procedure for me -
but could not find any mention of Altnet anywhere. I will ask a more
technical friend to check it again at the weekend.

I then did as Bill advised below - downloaded and scanned with Windows
Defender with the following result –

“No unwanted or harmful software detected. Your computer is running
normally.â€

So hopefully all is well.

I was once advised to run two anti-spyware programmes and was trying Spyware
Doctor (not paid for it yet) but wonder now whether I should do so if they
can contradict each other and cause such confusion.

Many thanks for your help

Alvis

 

[Guest]

Hello Bill

Thanks for your advice - once again.

I downloaded and scanned with Windows Defender with the following result –

“No unwanted or harmful software detected. Your computer is running
normally.â€

So hopfully all is well.

Just a couple of queries re Windows Defender –

I did not uninstall MSAS Beta 1 before installing Windows Defender but it
seems to have disappeared. Hope this is OK.

Windows Defender has not downloaded its icon into the system tray like the
previous version did. Is it still running effectively? I did not realise it
was scanning at the time I had set until I opened the programme. MSAS used
to open a small box just above the system tray when scanning so you knew what
it was up to.

Once again, many thanks. It must be quite trying advising we computer
illiterates!

Kind regards

Alvis

 

[Eric Cross]

Yes, the program is still running. Windows Defender is configured to not
display an icon but future versions is planned to display an icon if you
want to see it there in the system tray.

 

[Bill Sanderson]

Everything you say is what I'd expect. Windows Defender is new to everyone,
so there are lots of questions about how it works.

Yes--no icon, for the time being anyway.

Yes--the real-time-protection and the scans can take place with no user
interface visible.

Because there's no common definition for spyware, there's quite a bit of
variability between vendors. Spyware Doctor is a highly reputable
product--there are lots that don't fit that description--but even good
doctors may disagree about a particular symptom.

I tend to trust Microsoft's judgement--so I'd not worry about the Spyware
Doctor finding at this point--it seems to be "odd man out" on this one. I
suppose you could try Ad-Aware or spybot search & destroy for yet another
opinion--but I don't think this is an important enough threat to warrant the
extra effort.

--

 

[Guest]

Many thanks for this explanation. Nice to know it's working silently in the
background.

Alvis

 

[Guest]

Hello again

Thanks for explaining about Windows Defender.

I check my computer regularly with Ad-aware - it never finds any problems.
Also used Spybot until a few days ago (when I lost something called
"framedyn.dll") and it never identified any problems.

You suggested in an earlier reply that I post details of the infections
found by Spy Doctor. Here are the details - sorry it's rather a long list
even though there are only 4 infections. It classified the infections as
"elevated".

Altnet Software
Bundled with Kazaa. Installs a Browser Helper Object which loads when IE
started.

Registry
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/System32/msvcirt.dll
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/System32/msvcirt.dll##
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/System32/msvcirt.dll##.Owner
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/System32/msvcirt.dll##{C0E10B5C-DA42-11D3-9FED-0004ACF74B57}

Hope I have not overwhelmed you with information.

Many thanks

Alvis

 

[Bill Sanderson MVP]

Sorry I missed this one: I don't have a clear opinion. The detected .dll
file is probably innocent--it's a standard file that many applications might
install.

I'm not sure about the GUID (that long string of letters and numbers)--which
could indicate that the file was put in place by something bad.

However--if that DLL and those registry entries are all that is
involved--that isn't enough to constitute a genuine threat.

Has Kazaa ever been installed on this system? Does Spyware Doctor have a
support forum you can check this out in?
--

 

[Guest]

Hello Bill

The general opinion was that the file was innocent. I submitted it to Zone
Alarm who found nothing malicious and have now submitted to WD. Scans by
Ad-aware and several other antispyware programs gave my computer a clean bill
of health.

Spyware Doctor have explained that

"Altnet normally comes bundled with peer to peer file sharing applications
such as Kazaa. Every time you continue to use the application that bundles
Altnet, Altnet will reinstall on your PC."

As Kazaa has never been installed on my computer I do not know how the above
comment can apply.

Spyware Doctor also assured me that they do not

"produce false positives to boost its number of positive detection unlike
other anti-spyware programs. The only reason Spyware Doctor is ahead of its
competition in the number of TRUE positive detection is because we have a
dedicated team in house at PC Tools whom actively seeks out any newly emerged
spyware, trojan, adware...etc daily."

I downloaded a replacement msvcirt.dll file and still got the altnet warning
from Spyware Doctor - so deleted the subfiles and the scans by Spyware Doctor
are now clear. I suppose I could have become a registered member of Spyware
Doctor but as it seemed out of step with the other programs decided not to.

Many thanks for your opinion

Alvis

 

[Bill Sanderson MVP]

I believe Spyware Doctor is reputable. Glad you were able to clean things
enough to avoid the redetection.

There are a couple of multiple vendor antivirus sites that can be useful
when something like this comes up--not all the vendors cover spyware, but
enough do that theres a good chance of getting a reading on something that
definitely IS spyware.

http://www.virustotal.com
http://virusscan.jotti.org


--

 

[Guest]

Many thanks Bill. Sorry for delay in replying - have been away.

Fortunately, I am now - at least for the time being - of any spyware of any
kind. Hope it remains that way.

Alvis