Claria and Office 2003

[Diggy]

My Pest Patrol foud these two suspicious registry entries. I realize that
Gator has renamed itself Claria, so this concerns me a bit. I would delete
them right away, except that they are in these "trusted publisher" keys.

Pest Detected in
HKEY_CURRENT_USER\software\microsoft\systemcertificates\trustedpublisher\crl
s
Pest: Claria
User Action: registry entry ignored, NOT Quarantined


Pest Detected in
HKEY_CURRENT_USER\software\microsoft\systemcertificates\trustedpublisher\ctl
s
Pest: Claria
User Action: registry entry ignored, NOT Quarantined

Does this mean they were put there by MS? I was wondering if maybe MS
Office 2003 was using these to send info back on what other software I am
using. I think that Office 2003 has an opt in capability for this. I
haven't been able to find anything on the web yet, and Pest Patrol's site
only tells about the standard Gator threat.

I don't have any other funny processes running, and also a search of the
hard drives didn't find anything else named Claria.

 

[Curtis Koenig [MSFT]]

These keys indicate the presence of certificates. The certificates could
have been issued from anyone that you accepted, there are not from
Microsoft. However, removing these keys could have other effects on other
software, I can not say for sure.

I should also note that Office 2003 does not send data back to Microsoft at
any time and there is not opt-in program that I am aware of for such data.
The only data that Microsoft software will ever go look for is for updates,
at no time is data gathered about any other software installed on the
computer.
--
Curtis Koenig
Support Engineer
Product Support Services, Security Team
MCSE, MCSES, CISSP

This posting is provided "AS IS" with no warranties and confers no rights.
Please reply to the newsgroup so that others may benefit. Thanks!

--------------------

 

[Diggy]

Thanks for the info about the registry keys. I'll export them both and then
delete them to see what stops working.

But are you SURE about the info gathering thing? I could have sworn that
when I first installed Office 2003 I was asked if I would like to help MS
develop better products by providing some info on how I used Office 2003 and
what other software I used. And Zone Alarm catches this program on a
regular basis: OSE.EXE; it is trying to connect to the internet. I thought
it was trying to send info to MS. Office doesn't look for updates on it's
own, right? I thought only XP had an autoupdate option.

--
ICQ#
| These keys indicate the presence of certificates. The certificates could
| have been issued from anyone that you accepted, there are not from
| Microsoft. However, removing these keys could have other effects on other
| software, I can not say for sure.
|
| I should also note that Office 2003 does not send data back to Microsoft
at
| any time and there is not opt-in program that I am aware of for such data.
| The only data that Microsoft software will ever go look for is for
updates,
| at no time is data gathered about any other software installed on the
| computer.
| --
| Curtis Koenig
| Support Engineer
| Product Support Services, Security Team
| MCSE, MCSES, CISSP
|
| This posting is provided "AS IS" with no warranties and confers no rights.
| Please reply to the newsgroup so that others may benefit. Thanks!
|
| --------------------
| >From: "Diggy" <[email protected]>
| >Subject: Claria and Office 2003
| >Date: Tue, 23 Dec 2003 17:57:58 +0900
| >
| >My Pest Patrol foud these two suspicious registry entries. I realize
that
| >Gator has renamed itself Claria, so this concerns me a bit. I would
delete
| >them right away, except that they are in these "trusted publisher" keys.
| >
| >Pest Detected in
|

HKEY_CURRENT_USER\software\microsoft\systemcertificates\trustedpublisher\cr

| l
| >s
| >Pest: Claria
| >User Action: registry entry ignored, NOT Quarantined
| >
| >
| >Pest Detected in
|

HKEY_CURRENT_USER\software\microsoft\systemcertificates\trustedpublisher\ct

| l
| >s
| >Pest: Claria
| >User Action: registry entry ignored, NOT Quarantined
| >
| >Does this mean they were put there by MS? I was wondering if maybe MS
| >Office 2003 was using these to send info back on what other software I am
| >using. I think that Office 2003 has an opt in capability for this. I
| >haven't been able to find anything on the web yet, and Pest Patrol's site
| >only tells about the standard Gator threat.
| >
| >I don't have any other funny processes running, and also a search of the
| >hard drives didn't find anything else named Claria.
| >
| >
|

 

[Curtis Koenig [MSFT]]

If you added a component that allows for usage gathering it might send data
in. I am personally unaware of such a program but I am sure it could exist
as we have similiar programs for MSN Messenger and for Internet Explorer
that I am aware of as I personally participate. As for updates, previous
versions of office did not automatically look for updates, I am unsure
about Office 2003 as I have not looked into its detalils. I do know however
that Windows Update will soon be changing to Microsoft Update and it will
house updates for all Microsoft products, so it is possible that Office
2003 has been configured in advance of this change.

--
Curtis Koenig
Support Engineer
Product Support Services, Security Team
MCSE, MCSES, CISSP

This posting is provided "AS IS" with no warranties and confers no rights.
Please reply to the newsgroup so that others may benefit. Thanks!

--------------------