Frequently Asked Questions

[Mark L. Ferguson]

http://www.geocities.com/marfer_mvp/FAQ_MSantispy.txt

1) Known bugs/errors/unpopular features

a) various mis-spellings and errata (e.g. "TxtFocus")
b) scan stops unexpectedly when clicking areas like "Microsoft AntiSpyware
Beta1" graphic or some menu items
c) Win9x installs are not supported. (expected behavior)
d) enterprise end user could block processes domain administrator wants to
run (http://support.microsoft.com/kb/892375)
e) CoolWebSearch, VX2 versions not detected
(http://www.intermute.com/products/cwshredder.html)
f) false positives
1) TAPICFG.EXE
2) EZCyberSearch
3) Network Essentials
4) various false PC Spy (Commercial Key Logger)
5) remote control software (VNC et.al.)
6) ?
g) DPI settings (not default) corrupt display
h) scan time settings (12:00 PM, et.al.) not correct.
i) notification icons behave incorrectly
j) Non-english time display problems
k) Tracks Eraser failures
l) Multi-user installs not working (Limited User errors, Fast User
Switching. etc)
m) Flying Alerts (Taskbar not at the bottom)
n) Script blocking not manageable
o) Abnormal Termination (Shell Execute hooks, et.al.)
p) No "Failed Install" notice
q) Tracking Cookies not deleted. (This feature is not included in the beta)
r) Accessibility features not included (for the beta)
s) Reactivate blocked items not working (There is a workaround. Copy out,
delete original, copy back)
t) CPU usage 100% (under study for specific hardware causes)
u) ?

2) FAQ's
a) "I like it" (Thanks for testing the beta and providing feedback.)
b) bug reports? (yes, file in this newsgroup. Please title the message so
it is obvious it is a bug, error, or false positive)
c) deployable via SUS, Enterprise? (this is still under consideration)
d) MS AntiSpyware cannot start with error 101 (Use the Update feature in
Add/Remove, "Change")
e) Giant Software owners (see page
http://www.giantcompany.com/commonQuestions.htm#gen_beta for
more information about general questions for currently licensed customers of
Giant Software
f) Group Policy options available? (under consideration)
g) about:blank issues (Click Tools, Suspected Spyware Report, and submit it
to Spynet)
h) Uninstall MAS? (Add/Remove app in Control Panel)
i) ?

3) Remarks
a) "it Doesn't work!! (It's a "Beta")
b) "Will it be free, or not?" (Not announced yet)
c) "My software is falsely accused of spying!"
(http://support.microsoft.com/kb/892340 MAS incorrectly identifies a program
as a spyware threat)
d) various other rants and trolling (yawn)

created by Mark L. Ferguson (NOT an MS-MVP)
free for re-publication

(If you would like to post reply comments or additions, anything but a rant
is fine.)

 

[Eric C. Vogel]

For F. Please add chktrust.exe part of .Net Framework.

 

[Mark L. Ferguson]

Thanks, I will add stuff to my online copy as I get it, and post here weekly
(baring a spam protest from the MSFT folks.)

 

[Bill Sanderson]

Great!

I'd put SPORDER.DLL in 6--except that one needs to be sure that the
sporder.dll in question is strictly legitimate--there are bad ones.

I see fixes of various degrees of technical difficulty available for the
following issues:

Error 101 continuously
Failure to launch UI under XP after apparently successful install
Winsock failures after removing either malware or false-positives.

Not sure whether you'd want to expand to include these, or whether the first
two are really solid enough to publish.

 

[Mark L. Ferguson]

My impulse is to include 'all the usual suspects" and clean them out as they
show true colors. I'm sure the 'auto-update" is going to throw out almost
all of them in short order. I have put your sporder.dll in with a caveat and
I expect to see a lot more like that. ( I had error 101 in 2) FAQ's - c)
http://www.geocities.com/marfer_mvp/FAQ_MSantispy.txt

 

[Bill Sanderson]

I think the winsock stuff is worth putting in somewhere:

(winsock reset for 2k, xp pre sp2, and 2003 pre sp1)

http://support.microsoft.com/default.aspx?scid=kb;en-us;817571

(Winsock reset for xpsp2)
at a command prompt:

netsh winsock reset
enter
restart machine.

If specific apps don't work after network connectivity is restored,
reinstall those apps.

Alternatively, if on XP, system restore is an option, but it will, of
course, restore the malware.

This is the recipe for "I ran the program and my network doesn't work
anymore." or "the firewall doesn't work anymore."

 

[Kent W. England]

Mark L. Ferguson wrote on 11-Jan-2005 6:42 AM:

f) false positives
1) TAPICFG.EXE
2) EZCyberSearch
3) Network Essentials
4) various false PC Spy (Commercial Key Logger)
5) remote control software (VNC et.al.)
6) ?

6) IE5 Toolbar Wallpaper from Microsoft IE5 Web Accessories is falsely
identified as GonnaSearch.

 

[Ron Chamberlin]

Marfer,
Nice job, nice job on this. Thanks!

Ron Chamberlin
MS-MVP