Microsoft Spyware Beta Performance

[John]

Hello All ...

I have the MS Spyware Beta installed and it runs every
night at 2:00am. So far, after running every night for
several months, it has never found anything. Nothing!
However, on any given day, SpyBot finds lots of stuff.

How come that is?

Any suggestions for me?

John

 

[Richard Urban [MVP]]

This has been addressed many dozens of times here. Suggest you go back a few
weeks and just read - looking for people who have made the same comment.

Hint = different programs search for different things.

--
Regards,

Richard Urban
Microsoft MVP Windows Shell/User

Quote from: George Ankner
"If you knew as much as you thought you know,
You would realize that you don't know what you thought you knew!"

 

[benoit]

Hello,

yes but it is good to have ONE program that do all

now it has found dns catcher adware,
transponder.abbetterinternet.aurora adware and egroup
dialer , it set that in quarantine, i remove it from
quarantine, i reboot the pc , i run MWAS and the 3
spyware are still there

i do that 3 times and allways the same now i stop

what's the problem ?
are you sure it works ?
i will have all my program by microsoft but ...

benoit

 

[Richard Urban [MVP]]

Ah yes! If we lived in a perfect world. But it will never happen. It would
be like saying that all virus's ever introduced on the net have been written
by one person. No one is that intelligent.

--
Regards,

Richard Urban
Microsoft MVP Windows Shell/User

Quote from: George Ankner
"If you knew as much as you thought you know,
You would realize that you don't know what you thought you knew!"

 

[AndyManchesta]

If you have all these problems then no spyware remover
alone can help you, The main advise I can give you is to
visit Windows updates and install SP2 and all the
security patches if you havent already

Then download Ewido Security Suite as this will perform
better with dialer's

Download the trial version of Ewido Security Suite here

http://www.ewido.net/en/download/

Install ewido.
During the installation, under "Additional Options"
uncheck "Install background guard" and "Install scan via
context menu".
Launch ewido
It will prompt you to update click the OK button and it
will go to the main screen
On the left side of the main screen click update
Click on Start and let it update.
DO NOT run a scan yet. You will do that later in safe
mode.


Download Ccleaner and install to remove temp and unused
files

http://download.ccleaner.com/download121bino.asp


Then reboot into safe mode (Reboot and keep tapping F8
then choose safe mode from the list)


Run Ewido:

Click on scanner
Choose complete system scan
Click the Start Scan button to start the scan.
During the scan it will prompt you to clean files, click
OK
When the scan is finished, look at the bottom of the
screen and click the Save report button.
Save the report to your desktop


Then run MSAS and remove anything found then finally use
Ccleaner to remove all temp & unused files

Then boot back to normal mode and see whats left and
repost



I know this sounds like common sense but you need to be
aware of what files you are downloading or you will
continue to have problems,

If you visit a site and it says you need to install their
ActiveX to continue you should be suspicious unless you
know it to be a genuine site such as Antivirus scanners,

If you press a video download and if presents a file
with .exe at the end do not run it, most times you will
find a video file that has a .exe extention will be a
dialer or it has been on the ones I've tested in the past.

With Aurora thats a nasty infection but it can now be
removed quite easily once you know all the steps, I will
not post all that here as you have a few problems so
Ewido when run in safe mode should fix a few of them, If
Aurora continues then repost and I can provide you will a
detailed fix for that.

You really cannot blame MSAS for you downloading and
running malicious programs on your pc but the more you
get infected then it will make it easier for you to see
where you are going wrong and where these files are
coming from, Its not easy to get infected so Im curious
where your problems come from,

You need to upgrade Windows if you havent already then
install a good firewall and Antivirus remover and keep
away from certain sites that spread all this
rubbish,SpywareBlaster and Spyware Guard can also help
protect your system,

I know there's a trojan going round that installs Aurora
so maybe this is where its come from but crack & serial
sites are also full of trojans, even entering some of
them can install a trojan if your protection and security
settings are not good enough

MSAS is in the beta testing stage and does very well from
what I can see but you cannot rely on any one remover
when you are downloading dialers and trojans, Once they
are on your pc or once you let a malicious site install
ActiveX components then the problems will keep coming
back, Installing a good firewall and using Antivirus
scanners will help you get clean again and stay that way.

Regards

Andy

 

[benoit]

Ok ok ..

but i ask me, i ask you (microsoft) how is it possible
that the programm found the 3 spyware , he set them in
quarantine, i remove them from quarantine and when i try
a scan again the are always there ???

is it normal ?
is it a bug and you will adapt the programm ?

benoit

 

[blkwlnt64]

benoit, it sounds like the problem is hiding in system
restore. So first turn off 'system restore', reboot
in 'safe mode', run a 'full scan' in MSAS and take
necessary action, run 'full scan' a second time(it should
come out clean), reboot in normal mode and turn on system
restore again.

 

[Bill Sanderson]

Have you submitted a tools, suspected spyware report--detailing what happens
on your system?

That's one way to get direct feedback to the product team that this
detection/cleaning isn't working.

--

 

[benoit]

Hello Andy,


thanks for the explanation.
in fact that's the children they go to site from game and
so one
but my question was also why msas found the spyware, set
them in quarantine and when i scan another times they are
always there, that's also my question, but perhaps is it
the reason blkwlnt64 explain, i try it.

thanks a lot to all off you

benoit

 

[benoit]

ok thanks i do that

benoit

-----Original Message-----
Have you submitted a tools, suspected spyware report-- detailing what happens
on your system?

That's one way to get direct feedback to the product team that this
detection/cleaning isn't working.

--




.

 

[Robin Walker [MVP]]

but my question was also why msas found the spyware, set
them in quarantine and when i scan another times they are
always there

Because the malware is of a type which automatically regenerates itself if
it detects that some components of itself have been deleted or moved.

 

[benoit]

ok
that's what i want to hear.
it will say that your program is a "little" light.
it is not difficult to write a program that remove only a
file but not the program that create the file, it is too
simply.

benoit

ps :i have try with "safe mode" and "system restore off"
and it don't work.

i will try the idee from andy with edimo & co

-----Original Message-----

but my question was also why msas found the spyware, set
them in quarantine and when i scan another times they are
always there

Because the malware is of a type which automatically regenerates itself if
it detects that some components of itself have been deleted or moved.

--
Robin Walker [MVP Networking]
(e-mail address removed)


.

 

[benoit]

hello
i have try that but it don't work ... i try edimo
benoit

 

[Anonymous Bob]

ok
that's what i want to hear.
it will say that your program is a "little" light.
it is not difficult to write a program that remove only a
file but not the program that create the file, it is too
simply.

benoit,

When malware programs exhibit this type of behavior it's my firm
conviction they should classed as trojans rather than
adware/spyware. It's a constant game of cat and mouse with the
malware developers using random file names, hidden and system file
attributes, unlikely registry entries, trickler files, etc, etc, ad
nauseum.

Bear in mind too, that this is a beta 1 program that Microsoft
released 3 weeks after acquiring Giant. I sure that Microsoft is
highly motivated to product an end product that's world class in
order to reduce their own cost of support to say nothing of the
support cost for consumers, companies large and small, and major
corporations and vendors. It's a multi billion dollar problem in the
US alone.

Have faith,
Bob Vanderveen

 

[benoit]

i have tried but i have a message over proxy ..
the feedback is not go out
benoit

 

[Bill Sanderson]

Sorry to hear that!

Please believe me that in fact, this feature works for many users, although
others see that symptom. I have apparently identical machines in an office
some of which see that issue and others don't. I've been unable to solve
this one.

--

 

[AndyManchesta]

Hi Again Benoit

Its like Robin says Aurora will regenerate each time you
reboot unless you manage to get all the files at the same
time, Heres a great tool for Aurora thanks to racooper
Boot into safe mode after downloading this then use it
first, next Ewido then finally Ccleaner. (This file has
been updated in the last couple of days to make it more
powerfull so It should take care of your problems)

You may be best saving any of the instructions of here as
you might need to refer to them in safe mode.(open
Notepad and copy and paste what you want from here into
notepad then close notepad and it will ask you if you
wish to save it, change the .txt name to anything you
want and save it where you can easily find it later)

Download to desktop and run in safe mode

Thanks to Robert Cooper for this Fix !

Nailfix.exe

http://xsorbit26.com/users5/andymanchesta/index.php?
action=dlattach;topic=3719.0;id=310

save to desktop or c:/drive

Once in Safe Mode,

please double-click on nailfix.exe. Click "Next" in the
setup, then make sure "Run Nailfix" is checked and
click "Finish". Your desktop and icons will disappear and
reappear, and a window should open and close very
quickly --- this is normal.

Clear your prefetch folder to remove the traces that are
left in there

Goto Start menu then run and type

prefetch

Delete all the files in this folder, if some are genuine
do not worry they will be replaced next time they are
used, Just delete the contents to be sure we get this in
one attempt,

Goto start then run and type

%temp%

delete the contents of that folder


Then use Ewido/MSAS and Ccleaner in safe mode


Then reboot back to normal mode and see how things look
if you are clean then reset your system restore to remove
any infected restore points you may have but only do this
once you are clean, A infected restore point is better
than no restore point at this stage,

If you need any help just let me know

Andy

 

[Guest]

also doesnt spybot remove cookies whereas microsoft
antispayware does not, this could be the loads of things
thst spybot is finding that MSAS isnt maybe???

 

[Anonymous Bob]

I had an interesting experience along those lines yesterday. I was
listening to "ThisWeekinTechnology" (TWIT) using WindowsMedia.

During the course of the blogcast, the new ZAP 6 started an
automatic spyware scan and found a tracking cookie from...awwww, you
guessed it ;-)... WindowsMedia.

So here's the point Microsoft, you may not want to scan for tracking
cookies so as not to delete your own cookies, but people like me run
multiple antispyware programs and your cookies will go away anyhow.

Hey Microsoft, you might as well add that capability to MSAS.

In for a dime, in for a dollar.

Bob Vanderveen

 

[Bill Sanderson]

I had an interesting experience along those lines yesterday. I was
listening to "ThisWeekinTechnology" (TWIT) using WindowsMedia.

During the course of the blogcast, the new ZAP 6 started an
automatic spyware scan and found a tracking cookie from...awwww, you
guessed it ;-)... WindowsMedia.

So here's the point Microsoft, you may not want to scan for tracking
cookies so as not to delete your own cookies, but people like me run
multiple antispyware programs and your cookies will go away anyhow.

Hey Microsoft, you might as well add that capability to MSAS.

In for a dime, in for a dollar.

And therein, I suspect, lies part of the reason for the long "consideration"
phase. If they remove one corporate entities tracking cookies, how do they
justify not removing their own. Or--do they remove all tracking cookies
regardless of whose they are?

I don't think I know enough about tracking cookies--do they serve any
legitimate technical, as opposed to marketing, purpose?