CA's 'Pest Scan' Results Mislead Users

FriedDuck writes "After reading E-Weeks' article about CA's ranking of spyware threats I went to their site to check it out and try their free spyware scan. I was stunned. CA reported that my machine is being terrorized by eleven 'pests' including some that are pretty serious (not just tracking cookies.) Unfortunately all of the serious threats were false positives. CA reported that I had a key logger, cracking tool, and various other nasties that all turned out to be common software (e.g. Flash, SourceSafe) that one wouldn't easily mistake for malware. In fact, without exception my system contained none of the registry keys, folders, or binaries that CA itself say should be there. A blatant attempt at scaring people into buying shoddy software." Read on for the details of what was found, and what was actually on the system.

"If it matters, here's what it reported, and what was there on my system:

• System Spy - Key Logger. Mistook MSFT's SourceSafe executable for the keylogger. None of the other registry keys, folders or binaries were present
• Fake CD .99 - Cracking Tool. Mistook the generically-named unins000.exe that InstallShield uses as the Cracking tool. None of the other binaries were present
• Ezula TopText - Adware. Mistook the installation of Flash as the adware. Stupid.
• BonziBuddy - Spyware. Mistook a common library intalled by Borland's CaliberRM (EZSMTP object) as the spyware.

None of the other binaries, folders or keys (of which there are many) were present."

Comments

FYI re: AVG Free Edition

[Tumbleweed]

Speaking of virus scanners, I've got the new v7 of AVG's free edition on my newly-installed system, and found something odd. Some virus infections require Grisoft's "vcleaner.exe" program (from their website) to clean infections. Strangely, this also scans the entire system, and found (& fixed!) some things AVG itself didn't even find. Bizarre.

Help... file delete

[Davak]

I was recently writing this article for tech-recipes where I was trying to describe how to remove spyware files that are "protected."

http://www.tech-recipes.com/windows_tips778.html

Isn't there a program out there that will tell you which services or programs are protecting a file?

Davak

Re:Help... file delete

[Johnno74]

Yes, there is a tool to tell you what process has is holding a lock on a file - you mentioned it in your article too!

Use process explorer from Sysinternals. (free download)

If you use the "find handle" function, and enter the filename, or partial filename, it will list the processes that have this file opened. The find dll function is similar, but finds all processes that have loaded the specified DLL. Very handy for spyware that lives in a dll and has loaded itself with rundll.exe...

Its an incredibly useful tool. Its one of the first apps I install after a rebuild.

Re:Help... file delete

[rpresser]

Even quicker in many instances is Sysinternals handle.exe, a commandline version of the find handle function.

From the scan:

[shufler]

You must be using Internet Explorer with your security settings set to allow ActiveX controls to use the Pest Scan.

So, I must lower my security, so you can test my security? Well, I guess that means I win!

Time to upgrade to the 20th century

[Safety Cap]

~ MSFT's SourceSafe ~.

I'm glad to see that one other devloper on the planet is using source control, but you really need to upgrade. Seriously, not even MS uses VSS anymore---it is the most unstable, feature-scarce, POS source control there is.

May I suggest Subversion/Tortoise?

The best part about SVN over VSS is that you don't need to worry about exclusive locks. If one programmer (or yourself) checks out something and makes changes, you can still check out a pristine copy, make changes, and then everyone can check back in (last one in has to do a merge) without worry.

On a dev team of more than one, invariably someone will leave something checked out and then take a vacation. With VSS you're pretty much screwed, but with more advanced source control this is no longer an issue.

Unfortunately these tactics are too common

[Mycroft_VIII]

Unfortunately lots of free/shareware 'anti-spyware' tools generate false postives and do other 'wrong' things to get you to buy the full version. Some only find the malware, but make you pay to clean them out, and some don't work so well and worst are the ones that install thier own spyware and only clean out 'competitors'.
There is a site that tracks and lists quite a few 'rouge' anti-spyware programs:
http://www.spywarewarrior.com/rogue_anti-spyware.h tm
One of the things they advise against is following any google add, seems buying adds on google is very popular with the bad anti-spyware makers.
Personally I just stick with spybot S&D and adaware for most malware and avg for anti-virus.
And the LAST thing I'd ever do is trust some website to scan my computer, no telling what info they are collecting along with the scan to provide 'marketing data' for thier 'bussiness partners'.

Mycroft

Re: Unfortunately these tactics are too common

[macdaddy]

Even commercial software sensationalizes every so often. Take BlackICE for example. Back when I was a netadm at a Unv I used to frequently get calls, emails and even some visits from students and campus faculty/staff about an "attack" on their computers. Inevitably they'd show me a BlackICE log file warning them about some hacking attempt that involved a ping. Yeah, a ping. Good old ICMP Echo. That's real dangerous. It wasn't even a ping flood; just a single damned ping. Then there were the warnings from SMB packets on the network that were sent out from one of our servers or someone else's desktop. Stupid crap like that. I assume the BlackICE marketing folks want the users to really think they need the BlackICE products in order to survive on the 'Net. That's the onyl reason I can think of to annoy the users like that (and thus me).

Got to love CA

[MerlynEmrys67]

I remember WAY back in the Day - CA decided to give away free copies of their financial management software Simply Money.

This was the first time that I ran across free software that I thought I paid too much money for. It was horible. Since then - I was working for a company that was aquired by CA. Everyone in the Lab I worked for was dying to get out - even went so far as to place bets on who would end up at the bottom of the R&R chart to guarantee a buyout package, rather than leaving CA with nothing.

Re:CA=Computer Associates

[CoderDevo]

I'm not going to disagree with you. The poster could have used the full name at the start of the post, especially for a two-letter acronym since they typically signify countries or states.

But, to defend the poster, I would hope that a self-respecting news reading nerd would know CA as one of the 5 largest (by revenue) software vendors in the world, right after Microsoft, Oracle and SAP.

The company is identified as simply "CA" more commonly than as "Computer Associates International". I guess a valid excuse for not knowing this may be that CA does not offer a wide variety of consumer products beyond desktop security controls - as opposed to EA (sixth largest software vendor) or Id (not Idaho) who sell only entertainment software. Then again, Oracle has no consumer products and I hope you've heard of them.

Wrong colour :-)

[bigsteve@dstc]

There is a site that tracks and lists quite a few 'rouge' anti-spyware programs.

I think you meant "noir" not "rouge", n'est pas?