Backweb Lite

[Guest]

Anybody know why MSAS ignores Backweb Lite?
Or is it only Spybot that clasifies it as spyware.

 

[Bill Sanderson]

Backweb lite is used by a number of vendors as an update mechanism for
various features of their products--Hewlett Packard, and Logitech, among
others. It is also the antivirus definition distribution mechanism for
F-secure's antivirus product. Removal of backweb-lite in this context is a
Bad Thing--and one reason that Spybot Search & Destroy is no longer
installed on my machine.

I know for certain that other BackWeb versions have been used to distribute
spyware--but the failure to differentiate the standard commercial variants
used by these major vendors doesn't give me confidence.

We need to be careful of our language here: When you say "MSAS ignores
Backweb Lite"--do you mean that it is not detected at all, or that it is
detected, with a suggested action of Ignore?

 

[Richard Urban]

Hello Bill,

If you don't mind stating the fact, which Logitech products, that you know
of, use backweb lite? I have noticed many startup entries for my Logitech
wireless mouse and I have not been able to I.D. all of them.

Thanks!

--


Regards,

Richard Urban
Microsoft MVP Windows Shell/User

Quote from George Ankner:
If you knew as much as you think you know,
You would realize that you don't know what you thought you knew!

 

[Bill Sanderson]

I can't say with any certainty, I'm afraid. Some of the mice.... In my
opinion, most of Logitech's and HP's use of BackWeb is really advertising,
rather than support--I wouldn't object to blowing those away. In the case
of F-secure's antivirus update channel, however, it is essential.

 

[Randy Knobloch]

Anybody know why MSAS ignores Backweb Lite?
Or is it only Spybot that clasifies it as spyware.

This entry may help you choose whether you need the program
or not -
http://castlecops.com/s356-BackWeb.html

Yes, the SpyBot database classifies it as a "threat";
http://www.safer-networking.org/en/threats/177.html

To full understand how this app is affecting your O/S, proceed
as follows;
Download and run HijackThis;
(http://aumha.org/downloads/hijackthis.zip)
Read this Tutorial *before* first use;
(http://www.bleepingcomputer.com/forums/index.php?showtutorial=42)
Once done > run HijackThis > save a scan log and post it to /any/ of the
following (expert) forums for analysis.
*Note, registration is required prior to posting a log.
- Not listed in any particular order -
(http://aumha.net/viewforum.php?f=30)
(http://www.bleepingcomputer.com/forums/forum22.html)
(http://www.dslreports.com/forum/security)
(http://castlecops.com/forum67.html)
(http://www.cybertechhelp.com/forums/forumdisplay.php?f=25)
(http://www.geekstogo.com/forum/Malware_Removal_HiJackThis_Logs_Go_Here-f37.html)
(http://gladiator-antivirus.com/forum/index.php?showforum=170)
(http://forum.iamnotageek.com/f-130.html)
(http://forums.maddoktor2.com/index.php?showforum=17)
(http://www.spywarewarrior.com/viewforum.php?f=5)
(http://forums.spywareinfo.com/index.php?showforum=18)
(http://forums.techguy.org/f54-s.html)
(http://forums.tomcoyote.org/index.php?showforum=27)
(http://forums.subratam.org/index.php?showforum=7)
(http://www.5starsupport.com/ipboard/index.php?showforum=18)

Silj

--
siljaline

MS - MVP Windows (IE/OE) & Security, AH-VSOP
_________________________________________
Security Tools Updates
http://aumha.net/viewforum.php?f=31

Reply to group, as return address
is invalid that we may all benefit.

 

[Guest]

MSAS does not detect it at all.
I actually know that the particular instance of Backweb Lite on my machine
is from the Kodak software I installed the other day.I was just interested in
the detection discrepancy.

 

[Bill Sanderson]

Thanks for the clarification. I think I like that way of doing things. I
don't know, of course if the "bad" backweb variants are detected. Perhaps
they no longer exist in the wild--don't know.

There's another query from "benoit" in another group today about detection
discrepancies between competing products. This issue is one reason why I'm
glad Microsoft is doing the work it is with this beta. There's no
information sharing mechanism in relation to the range of threats covered by
Microsoft Antispyware as there is with viruses. There are no common
definitions, either. Attempts to create such mechanisms and definitions
have failed in the past. At the moment, antispyware.org seems to be
succeeding in providing at least some common definitions.

I think that the spyware world will look quite different at the time this
product releases in final form than it did when the beta was released in
January of this year--and all of us are participating in creating that
change.

--