SCI: Tech Fears Arise Over Norton and Pifts.exe

Personally, I think the whole PIFTS.exe debacle was engineered by virus makers to get people to search for it via google/yahoo, and direct people to sites that will infect their computer with a real virus.

reply to post by kuhl


If they took it down on purpose that will just inflame this matter. They should post a statement as soon as possible if this is not something to worry about.

Silence speaks volumes.

The last time I used Norton was years ago, I installed it and had major issues with it, so I un-installed it or tried to anyway.
It literally would not install, even using an un-installer didnt work, so to me its a pile of junk.
Back in the late 90's both Norton and Mcafee were great, especially Mcafee but then they let their popularity ruin them, just like every other good piece of software out there.
Then I went to AVG and for a while it was just like the old Mcafee but after a while they also ruined themselves.
Now, when I need to scan, I download Avast, run it, then un-install it.
Right now Avast is like the old AVG but im afraid they too will fall victim to their own popularity and try to take over your entire computer, just like the others eventually did.

When the FBI first began distributing their key logger "magic lantern" i think, they lobbied both Norton and Mcaffee to allow the trojan to go undetected during scans, at first they refused but they eventually gave in, just like they always do.

My advice is to use a hardware firewall and if you can find an older version of Zone Alarm (4 or 5) use it because it simply runs quietly in the background and does its job, without interfering to much.
Its hard to find a good AV or firewall program that doesnt completely integrate itself with your OS and suck up all of your resources.

This PIFTS.EXE issue is interesting and the fact that Norton is trying cover it up, makes it even more interesting.
It seems like privacy advocates and ordinary people are fighting an uphill battle with Government agencies.
One of two things will eventually happen.
People will either say to hell with it and cut themselves off from the internet or they will give in, my bet is on the latter.

Norton sights back up this was posted by p1fts revealer

PIFTS has been confirmed to me a law enforcement rootkit. See here: it.slashdot.org.../03/10/139229

[edit on 10/3/2009 by kuhl]

reply to post by kuhl


Gone already.

Originally posted by s4dreamlnd93
Lol Norton help just froze up

hahaha.... i'm sitting here pressing F5 constantly to watch all the pifts posts get deleted. I guess a lot of people are doing the same thing. Are we now taking part in a DOS on the norton site? Have we become robots in a botnet?

The location of mine was...

C:\ProgramData\Symantec\LiveUpdate\Downloads\Updt822\PIFTS.exe

It also tried to change 13 registry keys...

Just to throw a random rock into the bush... I wonder if it goes as "deep" as this:

Cybersecurity Chief Resigns

reply to post by kuhl


I wouldn't consider a post by an AC to be trustworthy information.

Originally posted by kuhl
Norton sights back up this was posted by p1fts revealer

PIFTS has been confirmed to me a law enforcement rootkit. See here: it.slashdot.org.../03/10/139229

[edit on 10/3/2009 by kuhl]

I assume you mean this comment from slashdot?

inside info from a friend that works there- this is a backdoor that Symantec was forced to put in, similar to CIPAV. It is to be used by law enforcement and they are under court order not to reveal its existence. rootkit revealer will show you the entire directory.

Source

That's just one guys comment on a message board. I'll wait for Norton to comment or a real security researcher to cover it before I assume that.


It's very interesting how they are deleting threads, and you can't even register a username there with the name "PIFT" in it since it's blocked/forbidden

[edit on 10-3-2009 by warpboost]

Norton's board seems to down as of 14:21 gmt.
Damage control?

Originally posted by Salamandrax
Norton's board seems to down as of 14:21 gmt.
Damage control?

Possibly, The other very real possibility is ddos.

I created an account on NORTON. just so that i could post a new thread. I just told them how dirty they where and that they lost a customer. Not even 1 minute later tghey deleted the thread. Than like a couple seconds after wards someone posted a thread asking what PIFTS.Exe where. I told him they dont want you to know and that this thread will soon be deleted, not even 30 secs later thread deleted. I tried posting a new thread and when i did i got a message saying i was baned from the site.
LOSERS!!


Peace!

reply to post by Salamandrax


community.norton.com...

Forum Private Messages's are offline for maintenance, Please check back after 12:00 PM PDT. We apologize for any inconvenience.

The board is still up though for registered users it seems but ask about this topic and you get an ip ban.

I am assuming you are talking about the same thing?

[edit on 10-3-2009 by XXXN3O]

Well... this seals it for me... I have AVAST!, Spybot, Cccleaner, and a couple other freebies- and when someone hands me their older computer- I am slapping Ubuntu on it and I a going to learn how to use it. When I have mastered it, I am putting it on this beast here, WINE, and goodbye, Windows.

This is defenitely some excitement in my morning.. I'm suprised people aren't spamming the whole website!! Meaning, non-related topics and other forum sections..

I'll be watching how this unfolds most certainly..

reply to post by XXXN3O


Wow its now down for maintenance completely.

Wow.

Seems to be after you view it for 5 mins.

If you clik on a google link you can still get in again but then it goes down.

Are they blocking ips that arent posting now but are viewing this site?

Strange



[edit on 10-3-2009 by XXXN3O]

The forums are now COMPLETELY down -

community.norton.com...

EDIT: That was brief! They're back up!

[edit on 10/3/09 by thebox]

Originally posted by Armour For Victor
I created an account on NORTON. just so that i could post a new thread. I just told them how dirty they where and that they lost a customer. Not even 1 minute later tghey deleted the thread. Than like a couple seconds after wards someone posted a thread asking what PIFTS.Exe where. I told him they dont want you to know and that this thread will soon be deleted, not even 30 secs later thread deleted. I tried posting a new thread and when i did i got a message saying i was baned from the site.
LOSERS!!


Peace!

Talk about adding fuel to a fire.


Also; pasting here are a bunch of links related to the matter;
twitter.com...
forums.zonealarm.org...
www.tech-linkblog.com...
www.abovetopsecret.com...
chrysler5thavenue.blogspot.com...
questionbox.jp.msn.com...
forums.13x.com...
forums.shoryuken.com...
www.listown.com...
easemystress.blogspot.com...
outdoorsbest.zeroforum.com...
forums.guru3d.com...
www.techsupportforum.com...
javamex.blogspot.com...
www.neowin.net...
=0&p=590684466&#entry590684466
www.net-benefit.com...

www.reddit.com...
digg.com...
hotnewsexplorer.blogspot.com...
blog.bull3t.me.uk...
www.islandcrisis.net...
www.ireport.com...

news.trimmail.com...
www.safer-networking.org...
en.wikipedia.org...(software)
www.eweek.com...

pastebin.ca...
http:///m7ec1714a

If that is too messy, I can lob em into a pastebin, =D otherwise, its just info to help you get your head around this whole debacle

Hey guys, we're making some breakthroughs on what this little bugger does over here in the comments. Someone ran a strings on it and found some interesting information that symantec didn't know could be gleaned from their backdoor. For example look at this string in the file

: d:\perforce\entiredepot\consumer_crt\patchtools\patch021809db\release\PIFTS.pdb