Google Earth and SpyWare?

[James]

Yesterday I installed Google Earth (beta) on my computer. This morning I
ran CounterSpy and low and behold it discovered a commercial keylogger
(AB System) placed there by Google Earth. At first I quarantined it but
then I decided to remove it. My anti-spyware rated it a serious threat.
Does anyone have any information on this? I've tried getting answers
from CounterSpy but so far no success.

 

[MCR]

Yesterday I installed Google Earth (beta) on my computer. This morning I
ran CounterSpy and low and behold it discovered a commercial keylogger
(AB System) placed there by Google Earth. At first I quarantined it but
then I decided to remove it. My anti-spyware rated it a serious threat.
Does anyone have any information on this? I've tried getting answers
from CounterSpy but so far no success.

I dont think you would have got it from Google Earth, as Google's
philosophy is 'do no evil', and they have become huge because of it. I
use Ad-aware and spybot S&D and they reported nothing when I completed a
recent scan.

 

[R. McCarty]

How do you know that it was Google Earth that installed it ?

I'm using 3.0.0464 and none of my Security tools have found
or indicated a keylogger is installed. Are you running the Free
version of Google Earth or one of the paid versions. Are you
sure the AB System was really on the PC - many of these tools
will sometimes give you a "False Positive" result.

 

[Yves Leclerc]

Did you also check with Microsoft AntiSpyware? This is Microsoft's version
of CounterSpy, which they now own.

 

[James]

How do you know that it was Google Earth that installed it ?

I'm using 3.0.0464 and none of my Security tools have found
or indicated a keylogger is installed. Are you running the Free
version of Google Earth or one of the paid versions. Are you
sure the AB System was really on the PC - many of these tools
will sometimes give you a "False Positive" result.

It's the free version of Google Earth that I'm running. When I deleted
the keylogger, Google Earth would no longer function. I've sent a
message to CounterSpy and been told that it "might" just be a false
positive as you've mentioned. Their technical department should be
contacting me before day's end. Meanwhile, I'm not about to dump the
program nor am I about to log into any financial institution. Thanks for
the replies.

 

[James]

How do you know that it was Google Earth that installed it ?

I'm using 3.0.0464 and none of my Security tools have found
or indicated a keylogger is installed. Are you running the Free
version of Google Earth or one of the paid versions. Are you
sure the AB System was really on the PC - many of these tools
will sometimes give you a "False Positive" result.

Oh... and as a second thought:

My wife also installed this free version of Google Earth on her
computer... ran the same scan this morning and got the same results: AB
System Keylogger... serious threat. We quarantined it and Google Earth
would no longer work on her computer as well. As soon as we ran a
"Repair" on Google Earth, the keylogger was replaced and the program ran
perfectly. So... what is the real story here?

 

[James]

Oh... and as a second thought:

My wife also installed this free version of Google Earth on her
computer... ran the same scan this morning and got the same results: AB
System Keylogger... serious threat. We quarantined it and Google Earth
would no longer work on her computer as well. As soon as we ran a
"Repair" on Google Earth, the keylogger was replaced and the program ran
perfectly. So... what is the real story here?

Latest report:
-------------------

Hi James,

We looked into that, and this is a false positive.
We will fix it ASAP!

The CounterSpy Team

 

[James]

Latest report:
-------------------

Hi James,

We looked into that, and this is a false positive.
We will fix it ASAP!

The CounterSpy Team

Spyware Scan Details
Start Date: 8/9/2005 9:10:12 AM
End Date: 8/9/2005 9:12:20 AM
Total Time: 2 mins 8 secs

Detected spyware

AB System Spy Commercial Key Logger more information...
Details: It takes screenshots, Stealth Tactics, Logs keystrokes, Sends
mail, Stays Resident, Connects to the internet
Status: Deleted
Elevated spyware - Elevated threats are usually threats that fall into
the range of adware in which data about a user's habits are tracked and
sent back to a server for analysis without your consent or knowledge.

Infected files detected
C:\Program Files\Google\Google Earth\ijl15.dll


Detected Spyware Cookies
No spyware cookies were found during this scan.

 

[Pennywise]

|>Detected spyware
|>
|>AB System Spy Commercial Key Logger more information...
|>Details: It takes screenshots, Stealth Tactics, Logs keystrokes, Sends
|>mail, Stays Resident, Connects to the internet
|>Status: Deleted
|>Elevated spyware - Elevated threats are usually threats that fall into
|>the range of adware in which data about a user's habits are tracked and
|>sent back to a server for analysis without your consent or knowledge.
|>
|>Infected files detected
|>C:\Program Files\Google\Google Earth\ijl15.dll

Well that clears google

Check the properties of that file:
Intel Corporation
Intel? JPEG Library
--

 

[John Moore]

Latest report:
-------------------

Hi James,

We looked into that, and this is a false positive.
We will fix it ASAP!

The CounterSpy Team

It seems a few of these Spyware progs detect more false-positives than
they actually detect real spyware. I'll stick to the free ones like
Ad-aware, Spywareblaster, Spybot S&D and keep my HOSTS file up to
date.

 

[James]

It seems a few of these Spyware progs detect more false-positives than
they actually detect real spyware. I'll stick to the free ones like
Ad-aware, Spywareblaster, Spybot S&D and keep my HOSTS file up to
date.

It had already been identified as a false positive and simply required
that I reset my definitions. I also have the "freebies" but I'd rather
be safe than sorry and so I opt for this highly-rated paid program. I
figure a few dollars spent in this regard is not too much for security
and peace of mind. But hey... if it floats your boat...

 

[John Moore]

It had already been identified as a false positive and simply required
that I reset my definitions. I also have the "freebies" but I'd rather
be safe than sorry and so I opt for this highly-rated paid program. I
figure a few dollars spent in this regard is not too much for security
and peace of mind. But hey... if it floats your boat...

I've tried a few of the "pay-for" ones and they have never found a
thing on my PC after using the free ones so I figure they ain't worth
paying for. I've tried "CounterSpy", "SpywareDoctor", and
"SpySweeper". I don't like running memory resident progs either so
wasn't interested in their "on-guard" type modules either.