SCI: Tech Fears Arise Over Norton and Pifts.exe

reply to post by coolism



Yes, digg seems to be censoring this story as well...

digg.com...


...

reply to post by Cadbury


Same not buying it. If it was that, why not make a more normal looking file. Give more info. And als why send the info to microsoft and some other wierd location. And why work with Google?

Originally posted by burdman30ott6

For what it's worth, anybody still using Internet Explorer should have recieved the memo urging them to use Firefox instead. Much safer and less open to attacks, not to mention much easier to cleanse the history, cookies, and keystroke captures (ie: passwords) from.

That's an interesting point when you consider that the Colorado Office of technology recently made a statement saying firefox is insecure and to use IE instead. Not too sure there's a conspiracy there though because the feds have made statements saying the opposite

news.slashdot.org...

reply to post by Cadbury



Although there was a lot of spam later,origanally they were erasing questions which were well put without being insulting.They censored anything with pifts.exe in it.Hopefully we have some screen grabs earlier in this thread.

Very interesting post. I'm glad I don't use Norton. I tend to think that most of the anti virus programs help develop viruses to continue their purpose. There is no way I'd ever let Norton or any corporate entity connect to my pc in the first place.

This kind of reminds me of the ADVAPI32.dll file and what I read about it being a back door. I don't remember if it was Bruce Schneier or not that went over it but for all you windows users, Linux might be something worth looking into if your concerned.

While I am not an expert several things...
I have Norton 2009 on three computers. It does allow you to allow or disallow in the "sharing program". I have all three not allowed.

AVG Free is good if you do not go surfing around. If you surf much, AVG is going to miss stuff. I know, learned the hard way.

Stopzilla found 147 problems, three of which were trojans, two high risk downloaders, and such.

However, I will say that I do have some level of expertise, that allowed me to be able to completely remove Norton from any computer....right up untill 2008. Since then, remains of Norton will remain unless you perhaps work for them and know the secrets.

This is an interesting thread...would like to get to the bottom of it!

Originally posted by kuhl
reply to post by Cadbury

 

Although there was a lot of spam later,origanally they were erasing questions which were well put without being insulting.They censored anything with pifts.exe in it.Hopefully we have some screen grabs earlier in this thread.

Indeed so. I said exactly the same thing earlier in the thread:

Originally posted by Cadbury
reply to post by XXXN3O

 

But didn't the spam start after they'd already removed the legitimate queries they've now labelled as "collateral damage?"

I to just contacted smynatec. They gave me the typical run around and send they were fixing issues and do not install the pifts.exe file. When I asked if they were monitoring my information with this download they said..."No, don't worry---you're protected."

Something is going on.

Originally posted by Cyberzone
reply to post by Cadbury

 

Same not buying it. If it was that, why not make a more normal looking file. Give more info. And als why send the info to microsoft and some other wierd location. And why work with Google?

Exactly, and then some...

Let me just post the "official explanation" again in case anyone missed it (as it's been pushed off the page):

Washington Post

Update, 2:23 p.m. ET:

Dave Cole, senior director of product management at Symantec, said the PIFTS file was part of a "diagnostics patch" shipped to Norton customers on Monday evening. The purpose of the update, Cole said, was to help determine how many customers would need to be migrated to newer versions of its software as more Windows users upgrade to Windows 7.

"We have to make sure before we migrate users to a new product that we can see what kind of load we can expect on our servers, and which customers are going to have to be moved up to the latest version of our product," Cole said.

As to why Symantec has been deleting posts about this from their user forum, Cole said the company noticed that minutes after the update went out hundreds of new users began registering on the forum, leaving inane and sometimes abusive comments.

"We want to be out there in the community, but by the same token, if we see abuse we will shut it down pretty quickly," Cole said. "There was no attempt at secrecy here, but people were spamming the forum and making it unusable to everyone."

And here's the bit I missed off of the end the first time:

In Symantec's defense, when I first heard about this earlier this morning, I noted privately to a couple of folks that some of the comments being left on the Symantec forum bore many of the hallmarks of "4Chan," (a.k.a. "anonymous"), a virtual community that thrives on playing practical jokes and causing trouble online. The summary about this incident posted to News-for-nerds site Slashdot this morning links to a key 4Chan forum.

So it looks like they're just going to try and blame it all on these Anonymous fellows.

I would rather reformat my computer over and over then buy all of that BS anti-spyware.

UPDATE!

I've spent the last 20 minutes trying to post this.

My computer has stopped functioning since I turned it on this morning.

Okay I found the .exe in my system. I don't know how it got there but it is.
You can't delete it unless you use Unlocker.

Unlocker told me that the file was not in use by any other program but it still wouldn't let itself be deleted. So I used Unlocker and its gone.

Now here the two real interesting things.

It seems to store three extra files in the WINDOW/Prefetch folder these seems to be backup files of some sort. All three can be erased.

The second odd thing that I noticed is it creates a link on my desktop and start menu to ebay after I delete the files.

When I look into the properties of the link it says things in German...

I have screen shots of all of these I will post in the next couple of minutes but for some reason my Internet is DEAD SLOW!

Funny you should bring this up, but yesterday (3-9-09) at 07:39:54 P.M. I had a prompt by Norton about a program trying to run, or to access my network. It was called PIFTS. I was a bit suspicious since it appeared out of nowhere, I had not accessed a new webpage or ran a program or anything. It just popped out and since it was unexpected, I just blocked it that instance since it also didn't claim it was a threat. I thought maybe I'll figure out what it is later. Well anyways, I just verified that it was PIFTS in my security history through the Norton program itself. It says 'This one time, you blocked PIFTS from accessing your network resources.'

Now I don't know if it may be related, but recently Norton keeps blocking attempted intrusions into my computer. I've had various intrusion attempts these past three months but it always blocks them automatically. I don't know but it seems strange to me. I don't know what PIFTS does or what it's for so I don't know if it may be related but I thought I should mention it.

[edit on 10-3-2009 by Phoenix521]

UPDATE!

I've spent the last 20 minutes trying to post this.

My computer has stopped functioning since I turned it on this morning.

Okay I found the .exe in my system. I don't know how it got there but it is.
You can't delete it unless you use Unlocker.

Unlocker told me that the file was not in use by any other program but it still wouldn't let itself be deleted. So I used Unlocker and its gone.

Now here the two real interesting things.

It seems to store three extra files in the WINDOW/Prefetch folder these seems to be backup files of some sort. All three can be erased.

The second odd thing that I noticed is it creates a link on my desktop and start menu to ebay after I delete the files.

When I look into the properties of the link it says things in German...

I have screen shots of all of these I will post in the next couple of minutes but for some reason my Internet is DEAD SLOW!

reply to post by Cadbury


They might even get away with it. Blaming Anonymous.

After doing battle with a number of both commercial and free softwares (staring of course with Norton), I've arrived at the only cleaning and protection tool I use which is free: Advanced Windows Care . It has won 20 awards from major names like C|Net, PC Magazine and PC World. The reason why I like it is because it only does what I tell it to do when I tell it to do it. That kind of control is priceless. I have the professional version on my wishlist of things to buy soon.

[edit on 10-3-2009 by saint4God]

Washpost article, credible, leave this one alone.

GO BACK IN YOUR HOMES CITIZENS, NOTHING TO SEE HERE

[edit on 10-3-2009 by unknown known]

[edit on 10-3-2009 by unknown known]

reply to post by sp00n1


Yes it seems they are.

searching for pifts.exe on digg.com shows nothing but there are plenty of articles now submitted. Most have enough to make the front page but absent they are.

Digg

But here are over 20 submitted articles
Google search

Oh man, this is starting to look like the ChadDrone thread in the beginning.

Unless people post pieces of code here from the program that do what people claim that it does, people shouldn't be ranting and raving about some supreme killer virus made by Norton.

What is all this speculation based on anyway? An IP Address?

Why would PIFTS.exe send info to Google? I have no idea.

In a totally unrelated piece of information, did you know google was founded with seed money from the CIA (and this has been admitted to by Google).

Yep. The two are totally, totally unrelated.

[edit on 10-3-2009 by sir_chancealot]

Symantec's comments about why the deleted posts doesn't make sense. Because a few people made some jokes they decided to delete any post referencing PIFTS THere were plenty of legitimate questions being asked and that just sounds like a load of BS. They also actually blocked "PIFT" from the forum registration