Teching It Easy: Windows Vista & 7: Microsoft AntiSpyware

Windows Defender for Windows XP and Server 2003 Now Available!

Tue, 24 Oct 2006 16:56:12 GMT

Quote:
"Windows Defender is a free program that helps protect your computer against pop-ups, slow performance, and security threats caused by spyware and other unwanted software. It features Real-Time Protection, a monitoring system that recommends actions against spyware when it's detected and minimizes interruptions and helps you stay productive. Now with 2 free support incidents for Windows XP and Windows Server 2003."

Download HERE

Don't forget to check out my Windows Defender Preview at ActiveWin.com which I will be updating soon to reflect the changes in the final release.

Windows Defender for Windows XP and Server 2003 is finally here, after a two year beta, it’s been a long time coming for sure. Featuring a major over haul to the UI, Windows Defender is a culmination of months of hard work from both the Anti-Malware team and feedback from the community. Since January 2004, Windows Defender, formally named Windows AntiSpyware has been downloaded over 25 million times.

Technorati tags: Windows Defender, AntiSpyware, Security, Microsoft

Windows Defender BETA 2 Release Notes Updated

Fri, 17 Feb 2006 00:23:52 GMT

"Thanks for testing Windows Defender Beta 2. We have updated the release notes at:

http://www.microsoft.com/athome/security/spyware/software/about/releasenotes.mspx
Here we have links to KB's and other FAQs of issues commonly reported in the newsgroups, and is a good place to start before posting issues with the beta. Once again thanks for running Windows Defender!

--
-steve

Steve Dodson [MSFT]
Windows Defender Beta Lead
MCSE, CISSP
http://blogs.technet.com/stevedod"

Windows Defender - Unable to Complete Update

Wed, 15 Feb 2006 06:57:58 GMT

If you are experiencing difficulty updating Windows Defender BETA 2, please try the following work around suggested by Steve Dodson:

Open the command prompt

Go to C:\Program Files\Windows Defender\ folder

Execute the following command: msiexec /x AS_Sigs.msi

Then Check for updates

Windows Defender - Installation Failure on Windows 2000

Wed, 15 Feb 2006 06:55:49 GMT

For users who are experiencing installation failure on Windows 2000, apply the following patch before installing Windows Defender BETA 2.

GDI+ package:
http://www.microsoft.com/downloads/details.aspx?familyid=6a63ab9c-df12-4d41-933c-be590feaa05a&displaylang=en

Windows Defender - Install Error 1609

Wed, 15 Feb 2006 06:50:48 GMT

If you encountering an error installing Windows Defender BETA 2, please try the following suggestion:

1. (Start -> Run...) net localgroup Users /add
2. Install WindowsDefender.msi.
3. (Start -> Run...) net localgroup Users /delete

Windows Defender BETA 2, now available!

Tue, 14 Feb 2006 14:31:05 GMT

From Microsoft Downloads

Qoute:

"Brief Description

Windows Defender (Beta 2) is a free program that helps you stay productive by protecting your computer against pop-ups, slow performance and security threats caused by spyware and other potentially unwanted software.

Overview

This release includes enhanced features that reflect ongoing input from customers, as well as Microsoft’s growing understanding of the spyware landscape.

Specific features of Windows Defender Beta 2 include:

A redesigned and simplified user interface – Incorporating feedback from our customers, the Windows Defender UI has been redesigned to make common tasks easier to accomplish with a warning system that adapts alert levels according to the severity of a threat so that it is less intrusive overall, but still ensures the user does not miss the most urgent alerts.
Improved detection and removal – Based on a new engine, Windows Defender is able to detect and remove more threats posed by spyware and other potentially unwanted software. Real Time Protection has also been enhanced to better monitor key points in the operating system for changes.
Protection for all users – Windows Defender can be run by all users on a computer with or without administrative privileges. This ensures that all users on a computer are protected by Windows Defender.
Support for 64-bit platforms, accessibility and localization - Windows Defender Beta 2 also adds support for accessibility and 64-bit platforms. Microsoft also plans to release German and Japanese localized versions of Windows Defender Beta 2 soon after the availability of the English versions. Use WindowsDefenderX64.msi for 64-bit platforms.

Download Windows Defender for Windows XP x86 (32-Bit) HERE
Download Windows Defender for Windows XP x64 (64-Bit) HERE

This one caught me off guard.

AntiSpyware Beta 1 - Definitions Update [5785]

Fri, 16 Dec 2005 23:22:01 GMT

There are new updates for Microsoft AntiSpyware beta 1 Refresh Update Build 615. To ensure you have the latest definitions, click Help > About Microsoft AntiSpyware > under "Microsoft AntiSpyware system information:

Spyware Definition Version: 5785 (12/16/2005)

You can acquire the updates by ensuring you have AutoUpdater turned on (Options > Settings) or File > Check for Updates (Manual)

Screenshots of Windows Defender BETA

Sat, 10 Dec 2005 17:55:59 GMT

From NeoWin Forums

Its not clear if this is the much anticipated BETA 2 release of Windows Defender, formerly named Windows AntiSpyware or just an interim release. The screenshots show the new interface that utilizes Windows Explorer navigation buttons. The interface is clean and easy to understand. The UI based upon Microsofts forth coming Integrated Security Suite, Windows OnceCare, which includes solutions for AntiVirus, Backup, AntiSpyware and PC TuneUp.

Check out the screenshots here

Check out the Microsoft Anti-Malware Team Blog here

Microsoft AntiSpyware New Build (build 1.0.701)!

Tue, 22 Nov 2005 00:48:22 GMT

We have just released a beta refresh for Windows AntiSpyware (build 1.0.701) onto the download center. This build extends the Windows AntiSpyware (Beta) expiration date to July 31, 2006.

We will be turning on the software update notification early next week, but you can download the latest beta refresh manually at : http://www.microsoft.com/antispyware

For more information, please monitor the Microsoft anti-malware blog at
http://blogs.technet.com/antimalware

Thanks.

--
Mike Chan [MSFT]
Technical Product Manager (Windows Defender)
Microsoft Corporation

AntiSpyware Beta 1 - Definitions Update [5779]

Mon, 21 Nov 2005 11:41:44 GMT

You can acquire the updates by ensuring you have AutoUpdater turned on (Options > Settings) or File > Check for Updates (Manual)

Sony DRM Rootkit

Sun, 13 Nov 2005 18:30:32 GMT

From Anti-Malware Engineering Team

Qoute:

"I've been getting a lot of questions in the last week about Microsoft's position on the Sony DRM and rootkit discussions, so I thought I'd share a little info on what we're doing here. We are concerned about any malware and its impact on our customers' machines. Rootkits have a clearly negative impact on not only the security, but also the reliability and performance of their systems.

We use a set of objective criteria for both Windows Defender and the Malicious Software Removal Tool to determine what software will be classified for detection and removal by our anti-malware technology. We have analyzed this software, and have determined that in order to help protect our customers we will add a detection and removal signature for the rootkit component of the XCP software to the Windows AntiSpyware beta, which is currently used by millions of users. This signature will be available to current beta users through the normal Windows AntiSpyware beta signature update process, which has been providing weekly signature updates for almost a year now. Detection and removal of this rootkit component will also appear in Windows Defender when its first public beta is available. We also plan to include this signature in the December monthly update to the Malicious Software Removal Tool. It will also be included in the signature set for the online scanner on Windows Live Safety Center.

I'll update you if any more information comes up.

best,
-jasong"

Check out the Anti-Malware blog here

AntiSpyware Beta 1 - Definitions Update [5775]

Fri, 11 Nov 2005 22:59:04 GMT

You can acquire the updates by ensuring you have AutoUpdater turned on (Options > Settings) or File > Check for Updates (Manual)

AntiSpyware Beta 1 - Definitions Update [5773]

Tue, 08 Nov 2005 17:52:36 GMT

You can acquire the updates by ensuring you have AutoUpdater turned on (Options > Settings) or File > Check for Updates (Manual)

Sorry I haven't posted MSAS Update information in a while, in related news:

Microsoft AntiSpyware is now Microsoft Windows Defender
Windows Defender will be a part of Vista

Microsoft AntiSpyware is now Microsoft Windows Defender

Sat, 05 Nov 2005 00:33:46 GMT

From Microsoft AntiMalware Team

Microsoft is proud to announce that the final name for Microsoft's Windows AntiSpyware technology will be Windows® Defender. We believe the name more accurately describes the protection that we offer to our customers against spyware and other potentially unwated software and describes it in a more positive way. We expect Windows® Defender to be included in an upcoming release of Windows Vista. The engineering team has also been making progress towards the new signature distribution infrastructure. Windows® Defender will receive signature updates through the Windows Update infrastructure and will start appearing on Windows Server Update Services (WSUS) consoles shortly. The two new additions will be "Definition Updates" in the classifications and "Windows Defender" in the product categories.

For additional information and relevant discussion on Windows Defender and other Microsoft anti-malware technologies, please visit the anti-malware engineering team blog at http://blogs.technet.com/antimalware.

Thanks,
Mike Chan
Product Manager

Microsoft AntiSpyware - Statistical Information

Mon, 10 Oct 2005 15:18:39 GMT

From Microsoft AntiSpyware Newsgroups

Microsoft Antispyware - Most popular product download in Microsoft history (but watch out, when IE7 releases!)

18,000,000 active users (measured by uptake of signature updates)

Spynet - 20,000 community votes/hour

In the average 90 minutes, 54,000 people install Microsoft Antispyware.

22,500 pieces of spyware or malicious software are removed.

Dang! Imagine when this product is finalized and released to the web?

AntiSpyware Beta 1 - Definitions Update [5763]

Thu, 29 Sep 2005 22:40:13 GMT

You can acquire the updates by ensuring you have AutoUpdater turned on (Options > Settings) or File > Check for Updates (Manual)

AntiSpyware Beta 1 - Definitions Update [5761]

Thu, 22 Sep 2005 22:58:18 GMT

You can acquire the updates by ensuring you have AutoUpdater turned on (Options > Settings) or File > Check for Updates (Manual)

Anti-phishing White Paper

Thu, 22 Sep 2005 15:47:18 GMT

From Microsoft Download Center

Qoute:

" Overview

The focus of this white paper is to describe the basic workings of a new capability, the Microsoft® Phishing Filter, which will be included in the upcoming release of Internet Explorer 7, and as an add-in to the MSN Search Toolbar. The Microsoft Phishing Filter will not only help provide consumers with a dynamic system of warning and protection against potential phishing attacks, but — more important — it will also benefit legitimate ISPs and Web commerce site developers that want to try to ensure that their brands are not being “spoofed” to propagate scams and that their legitimate outreach to customers is not confusing or misinterpreted by filtering software.

Download document here [Microsoft Word document]

AntiSpyware Beta 1 - Definitions Update [5757]

Thu, 15 Sep 2005 16:39:24 GMT

You can acquire the updates by ensuring you have AutoUpdater turned on (Options > Settings) or File > Check for Updates (Manual)

AntiSpyware Beta 1 - Definitions Update [5755]

Wed, 14 Sep 2005 17:17:19 GMT

You can acquire the updates by ensuring you have AutoUpdater turned on (Options > Settings) or File > Check for Updates (Manual)

AntiSpyware Beta 1 - Definitions Update [5753]

Fri, 09 Sep 2005 21:02:14 GMT

You can acquire the updates by ensuring you have AutoUpdater turned on (Options > Settings) or File > Check for Updates (Manual)

AntiSpyware Beta 1 - Definitions Update [5751]

Thu, 01 Sep 2005 22:40:03 GMT

You can acquire the updates by ensuring you have AutoUpdater turned on (Options > Settings) or File > Check for Updates (Manual)

AntiSpyware Beta 1 - Definitions Update [5749]

Thu, 25 Aug 2005 23:39:31 GMT

You can acquire the updates by ensuring you have AutoUpdater turned on (Options > Settings) or File > Check for Updates (Manual)

AntiSpyware Beta 1 - Definitions Update [5747]

Thu, 18 Aug 2005 22:41:29 GMT

You can acquire the updates by ensuring you have AutoUpdater turned on (Options > Settings) or File > Check for Updates (Manual)

AntiSpyware Beta 1 - Definitions Update [5745]

Sat, 13 Aug 2005 20:40:33 GMT

You can acquire the updates by ensuring you have AutoUpdater turned on (Options > Settings) or File > Check for Updates (Manual)

AntiSpyware and OneCare Live

Thu, 11 Aug 2005 18:13:22 GMT

From Steve Dodson's Blog

Qoute:

"Today when I came in to the office, I was made aware of an issue which stated that a Microsoft Representative was quoted as saying Windows AntiSpyware would no longer be available for free.

The statement quoted in many forums is not true.

As we have been saying since day one, Microsoft Windows AntiSpyware will be available at no charge to licensed users of Windows. Users who validate their Windows install through WGA will be allowed to download the AntiSpyware beta, as well as the full standalone version of AntiSpyware when it releases to the web."

Read the rest here

Well, that should sooth any worry about Microsoft AntiSpyware being free or not. The cost of it is just a legal copy of Windows.

AntiSpyware Beta 1 - Definitions Update [5743]

Sat, 06 Aug 2005 17:07:31 GMT

There are new updates for Microsoft AntiSpyware beta 1 Refresh Update Build 615 today. To ensure you have the latest definitions, click Help > About Microsoft AntiSpyware > under "Microsoft AntiSpyware system information:

Spyware Definition Version: 5743 (8/05/2005)

You can acquire the updates by ensuring you have AutoUpdater turned on (Options > Settings) or File > Check for Updates (Manual)

Microsoft AntiSpyware Beta 1 - Turn off Script Blocking

Sat, 30 Jul 2005 20:44:59 GMT

By Bill Sanderson

I can suggest two ways to make this work:

1) shut down Microsoft Antispyware, via right-clicking on the notification area icon, and choosing shut down.

Restart it after the batch file has been run.

2) Choose to deactivate the Application Agent checkpoint--"Script Blocking", which is causing you problems.

AntiSpyware Beta 1 - Definitions Update [5739]

Fri, 29 Jul 2005 00:24:14 GMT

You can acquire the updates by ensuring you have AutoUpdater turned on (Options > Settings) or File > Check for Updates (Manual)

Microsoft Windows AntiSpyware (Beta) Build 1.0.615

Tue, 19 Jul 2005 15:28:49 GMT

From http://www.microsoft.com/spyware

Quote:

The latest beta refresh, build 1.0.615, addresses issues pertaining to how Windows AntiSpyware (Beta) provides information to the user about processes running on a PC, solves an issue regarding the delivery of new anti-spyware signatures for some customers and provides new signature updates to help protect against recently identified spyware. Existing users of the beta (Builds 1.0.501, 1.0.509, 1.0.613, and 1.0.614) will receive a software update that includes the new beta refresh. The new beta refresh is also available for download through this site. Microsoft would like to encourage all Windows AntiSpyware (beta) users to download and install the new update (Build 1.0.615).

Download here

Microsoft AntiSpyware Build [615 Release]

Tue, 19 Jul 2005 01:14:28 GMT

From Steven Dodsons Blog

It has been a few weeks since the last update, and the A/S team needed some work to do so we decided that we should release build 615 to the web. Actually, we wanted to correct an issue found with the signature update mechanism and we wanted to get an updated build out there this week. Starting in the next hour or so, beta testers will be able to download the updated build from the web (http://www.microsoft.com/spyware) or wait for the automatic update to the software. As a side benefit, we are not updating shellextension.dll so that users will not have to reboot after this update. To prevent this reboot, beta testers will notice that the version on shellextension.dll will be 1.0.614 and will not be incremented to 1.0.0.615 like other files. We have been testing this new build for about a week now and it does resolve the signature update issue. Please post to the newsgroups if you see any issues or have any comments on this new build.

-steve

AntiSpyware Beta 1 - Definition Update [5735]

Sat, 16 Jul 2005 17:59:35 GMT

There are new updates for Microsoft AntiSpyware beta 1 today. To ensure you have the latest definitions, click Help > About Microsoft AntiSpyware > under "Microsoft AntiSpyware system information:

Spyware Definition Version: 5735 (10/06/2005)

You can acquire the updates by ensuring you have AutoUpdater turned on (Options > Settings) or File > Check for Updates (Manual)

NOTE: Some persons have been experiencing issues upgrading from definitions 5727, 5729, 5731 and 5733 to 5735. Please remember to have the following patch applied:

"Right click on MSAS icon within systray and choose shutdown.

Right click and "Save target as..."
http://download.spynet.com/ASDefinitions/gcDeterminationData.gcd
http://download.spynet.com/ASDefinitions/gcThreatAuditScanData.gcd
http://download.spynet.com/ASDefinitions/gcThreatAuditThreatData.gcd

Copy/paste these files to Program files/Microsoft Antispyware
Restart MSAS and "check for updates"
Done until MS realize that this is a bug.............."

If you encounter issues trying upgrade automatically or manually from definitions 5731 and 5733 to 5735, try updating manually more than once (File > Check for Updates) or copy the back the .gcd files again from the above links to the program files group for Microsoft AntiSpyware.

Claria Detection in AntiSpyware

Thu, 14 Jul 2005 22:20:55 GMT

From Steve Dodson's Web Blog

Claria has been receiving a lot of news lately, and so I figured I would re-post what is going on over here in regards to this. We put the following statement on our website as well

(http://www.microsoft.com/athome/security/spyware/software/claria_letter.mspx):

"This week we received some questions around Microsoft's classification of Claria software in our Microsoft Windows AntiSpyware (Beta). We wanted to take this opportunity to clear up any misconceptions and explain our current policies and practices.

As you may know, the analysis of software is based on a single set of objective criteria, which can be found on our web site: Windows AntiSpyware (Beta): Analysis approach and categories.

Microsoft offers all software companies the opportunity to request a review of how Microsoft classifies their products through our vendor dispute process. In January, Claria filed a request for Microsoft to reevaluate some of its products. Upon review of their software against our criteria, we determined that continued detection of Claria's products was indeed appropriate. We also decided that adjustments should be made to the classification of Claria software in order to be fair and consistent with how Windows AntiSpyware (Beta) handles similar software from other vendors. At the end of March, we communicated to Claria the result of our analysis through our standard process.

We take software analysis for Windows AntiSpyware (Beta) very seriously and handle all vendor requests in the same manner. All software is reviewed under the same objective criteria, detection policies, and analysis process. Absolutely no exceptions were made for Claria. Windows AntiSpyware (Beta) continues to notify our users when Claria software is found on a computer, and it offers our users the option to remove the software if they desire.

Microsoft is committed to helping protect our customers from spyware and other unwanted software by providing guidance and technology solutions. We firmly believe that people should have complete control over what runs on their computers.

Today, anti-spyware vendors use different approaches, definitions, and types of criteria for identifying and categorizing spyware and other potentially unwanted software. This has limited the industry’s ability to have a broad, coordinated impact in addressing the problem. That is a key reason Microsoft is a founding member of the Anti-Spyware Coalition, a group of technology companies and anti-spyware companies working alongside public interest groups to address key spyware issues.

Meanwhile, Microsoft Windows AntiSpyware (Beta) is an initial beta release and we continue to receive valuable feedback from customers, which is helping our development of the final version of Windows AntiSpyware. We encourage people to provide feedback at WASFeed@microsoft.com and stay up-to-date on the latest developments on Windows AntiSpyware at Microsoft Windows AntiSpyware (Beta) Home."

Please do give us feedback in the newsgroup or in the e-mail alias as we are making decisions for future builds based on this feedback.

-steve

Microsoft AntiSpyware - Silent Install - A success

Wed, 13 Jul 2005 21:51:53 GMT

By Grafis

GOAL
- Run MSAS from CD: a silent install, scan machine with current DEFs, operator intercation on found objects, silent uninstall when finished
    - From CD because I'll be upgrading 80 Laptops in a Hotel
    - Automated because... (see above)
    - Remove because it's Beta, and because it blocks (asks for
permission) on administrative tasks such as SMS if left in protect mode

KEYS to Success
(current keys... you may have to update names, pathing or other adjusts as the documents listed fall out of date).

- GCD files for client setup and latest DEFs: Run and configure ALL settings using "Options" from your menu pulldowns. I used all GCD files from the MSAS Programs folder to prevent being asked to configure the
client.
** I had to play with settings to get MSAS to run silent, scan silent & do results as I wanted.

- Proper switches (not all these seem to work, 'update' in particular)
http://blogs.technet.com/stevedod/archive/2005/04/21/404046.aspx

- Register gcasDtServ.exe
http://www.overdose.net/docs/msas_silent_remote_install.txt

- *** Each test install MUST be on a machine that has never had MSAS installed. This caused me huge issues with step one on this list (GCD's) even if I deleted the entire install folder on the local machine

SCRIPT - key basics in order of runningInstall
   D:\msas\Microsoft AntiSpyware.msi /QN INSTALLDIR=c:\msas\

Register gcastServ to avoid 101 installer errors
   C:\msas\gcasDtServ.exe /regserver

Copy all (8-11 files depending on the phase of the moon...)
   COPY D:\msas\*.gcd C:\msas\

Run a scan with a nice pretty interface
   C:\msas\GIANTAntiSpywareMain.exe -scan -withMainUI

Uninstall
   MsiExec.exe /X{536F7C74-844B-4683-B0C5-EA39E19A6FE3} /Q

Remove folder
   RMDIR c:\msas /s /Q

Microsoft AntiSpyware - Permanent Fix for Definition Update Issue

Wed, 13 Jul 2005 00:55:38 GMT

By Robin Walker [MVP]

After much debugging, I have found that the problem with definition update failures and repetition is because of an incorrect version of the file gcUnCompress.dll in C:\WINDOWS\SYSTEM32\ (for XP) or C:\WINNT\SYSTEM32\ (for 2000 or systems upgraded from 2000).

The incorrect version is of length 130,272 bytes. The correct version is of length 95,448 bytes.

To update your system to install the correct version of the file, do the following:

1. In the System Notification Area, right-click on the MSAS icon and select "Shutdown Microsoft AntiSpyware".
2. In Explorer, navigate to C:\WINDOWS\SYSTEM32\, locate the file "gcUnCompress.dll", right-click on it, and select "Delete".
3. In Control Panel "Add or Remove Programs", select "Microsoft AntiSpyware" and click button "Change".
4. Click "Next".
5. Select "Update Microsoft AntiSpyware", click "Next".
6. Click "Install".
7. When the re-installation finishes, click "Finish".
8. In Explorer, in folder C:\WINDOWS\SYSTEM32\, check that "gcUnCompress.dll" is now 95,448 bytes long, by right-clicking it and selecting "Properties".
9. Launch MSAS, pull down the File menu and select "Check for updates" - this time it really will update your definition files to the latest version.
10. In Explorer, open the folder C:\Program Files\Microsoft AntiSpyware, and satisfy yourself that the modification dates of the three definition files have changed:
gcDeterminationData.gcd
gcThreatAuditThreatData.gcd
gcThreatAuditScanData.gcd

Done!

You won't ever have to manually install the definition files again, nor will
the update keep repeating every time you try.

Microsoft AntiSpyware CounterSpyware incompatibility workaround

Fri, 08 Jul 2005 20:31:38 GMT

Thanks to Melelina
This problem will be fixed in the soon to be released 1.5 version of CounterSpy.. Here's the answer from Phil Owens, Product Manager, Sunbelt Software posted as a sticky in the CounterSpy official forum at Castlecops.
http://castlecops.com/t111858-Necessry_to_uninstall_Microsoft_AS_Beta.html

Posted: Wed Mar 30, 2005 5:15 am Post subject:
--------------------------------------------------------------------------------
Here is what we know:

If you have both Microsoft AntiSpyware and CounterSpy installed all should run well. We have tested this and they seem to play nicely together wheninstalled. However if you uninstall either one of the products the other seems to break.

Scenario 1:
1. Both CounterSpy and Microsoft AntiSpyware installed
2. Uninstall CounterSpy
3. Microsoft's gcasDTServ.dll pegs CPU at 100% and will not end from the
task manager.

Workaround:
1. Boot Windows into Safe Mode
2. Launch msconfig and uncheck gcasServ.exe and any other gc*.exe in the startup tab then restart. (If you are not running a version of Windows that has msconfig you can delete the registry entry
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gcasServ)

3. From Control Panel - Add or Remove Programs click on Microsoft AntiSpyware and then click Change
4. In the installer click Update and follow the rest
5. Launch msconfig and check all the unchecked gcas*.exe files (Confirm that gcasServ was added back to the registry at the location above).
6. Reboot
7. All should be better

Scenario 2:
1. Both CounterSpy and Microsoft AntiSpyware installed
2. Uninstall Microsoft AntiSpyware
3. When CounterSpy is launched and an error message is displayed and will not launch.

Workaround:
1. From the Control Panel - Add or Remove Programs click on CounterSpy
2. Click the Change Button
3. In the installer click Update and follow the rest
4. Reboot
5. All should be better

This will be fixed in version 1.5. Before you all ask . It is currently in development and should not take us more then a couple months to release.

Thanks,
Phil Owens
Product Manager
Sunbelt Software

Microsoft AntiSpyware - Another Workaround for bug in setting scheduled scan times in the afternoon

Wed, 06 Jul 2005 18:01:04 GMT

By Bill Sanderson:

I've dug into this bug, as follows:

Users in locales where the default clock is a 24 hour format will find that they cannot set scheduled scan times in the afternoon.

This can be worked around by selecting a time format which uses 12 hour format rather than 24 hour.

This is on the Time tab, and a working format is: h:mm:ss tt

A non-working format is: any of the choices with a CAPITAL H at the beginning.

This isn't my discovery, it was posted by others here, but I've done some testing:

1) I set my language to English (United Kingdom) afternoon settings failed (default time is 24 hour.) Reset time to 12 hour,and afternoon settings worked.

2) I set my language to English (United States) Default time setting is 12 hour. Scheduling scans in the afternoon works fine. Change just the time settings to a 24 hour choice, and you can no longer set up a scheduled scanin the afternoon.

This bug appears to me to be new in build 614.
Control panel,
date, time, language, and regional settings
Regional and language options
Click customize next to your locale setting
Click the time tab.

Microsoft AntiSpyware & Claria Adware

Tue, 05 Jul 2005 18:53:28 GMT

By Andy Machesta
I think all this negative feedback about Microsoft and Claria isnt justified at all .Ive tested this myself and MS Antispy still make it very clear that Claria is Adware.It has changed them to ignore when the scan finishes but thats the only difference, it still detects claria and the option to ignore can easily be changed to remove.

I have loads of protection products installed and it was only MS Antispy that gave me repeated warnings that i was installing Adware on my system.Spysweeper and Spyware guard even though the real time protection is enabled both failed to notice the changes when i installed Claria.

It was only after the installation finished and i rebooted to let the changes take effect that spy sweeper then noticed Claria on my system then gave a warning ,Id allowed the changes on 3 MS Antispy alert pop-ups and
then it even gave another warning when i rebooted that Claria was trying to run on my pc which made it 4
warnings from MS.

I downloaded and run CPU Rocket which is one of Claria's many programs .Straight away i received Red Alert Popups from MS Antispy for each part of the Adware that was installing (Claria-Gain,Claria-Gain-rickler,Claria-
Dashbar)

Heres the Alert for Claria.Gain.Trickler

WARNING : MS Antispy Alert

MS Antispy has detected the threat Claria.Gain.Trickler trying to install a start up file on your computer. If you would like to allow Claria.Gain.Trickler to install the start up file click the 'Allow' Button below.

Name : Claria.Gain.Trickler
Type : Adware
Threat Level : Moderate
Author : Claria Corporation(Formerly known as Gator Corp)

Advise : Moderate risk items have some potential for adverse effects,but may be part of a wanted service, Users may decide to ignore such programs after review.

Even after pressing allow on all the pop up alert windows i then rebooted to make sure the install was complete and then got another warning from MS Antispy when i rebooted saying

Allow threat to run ?

Are you sure you would like to allow the threat Claria.Gain to run on your system?

Looking at the scan results MS Antispy are doing alot better than some of the other well known removers

MS Antispy - 3185 Traces of Adware Claria
Spysweeper - 809 Traces
Adaware SE - 52 total references to Claria
Spybot - 20 Claria files detected

To be fair to Ad-Aware and Spybot they mostly only detected the folders and not the files inside the folders
but removing the folders probably would of removed most of the files that the other scanners detected .

It was very easy to clean up the pc just by uninstalling CPU Rocket ,After i removed that and rebooted MS Antispy detected 30 traces in the registry in the classes folder and software folder for Gator related items which i removed and that was the end of Claria so i appreciate why MS Antispy are not regarding this as a big problem.

It still made it very clear i was installing Adware and gave repeated warnings which none of my other protection products did except spysweeper but it was already installed on my system by then.

Hope this helps people see Microsofts Antispy is still removing Claria and in my opinion the amount of traces
found by MS Antispy makes the other removers look really bad considering MS is still in the beta testing stage and doesnt cost anything.

Regards
Andy

Microsoft AntiSpyware: Issues updating from from 5725 to 5731 defintions

Fri, 01 Jul 2005 22:47:27 GMT

Users have been experiencing issues with recent 614 build of Microsoft AntiSpyware updating to the latest definitions. It seems there is some under the hood issues in the latest BETA builds of the product that have escaped the team concerning perpetual updating from the same 5725 to 5729 or 5731 definitions. Not worry, Plun has provided fix in the mean time until the Microsoft AntiSpyware Team gets this straigthened out.

Thanks Plun

AntiSpyware Beta 1 - Definitions Update [5731]

Fri, 01 Jul 2005 17:01:59 GMT

There are new updates for Microsoft AntiSpyware beta 1 Refresh Update Build 614 today. To ensure you have the latest definitions, click Help > About Microsoft AntiSpyware > under "Microsoft AntiSpyware system information:

Spyware Definition Version: 5731 (7/01/2005)

You can acquire the updates by ensuring you have AutoUpdater turned on (Options > Settings) or File > Check for Updates (Manual).

Microsoft AntiSpyware: Fixing Scheduling Issues in build 614

Fri, 01 Jul 2005 16:58:54 GMT

Question:

When i choose a time to run daily it reverts back to 9 am each time?

Answer:

Go to start/config/Country settings
Change Language to US Inglisch.
Close with OK or Apply
Open MSA change all your time settings the way you wont.
Then go back to set your default Language.
MSA will scan and update on the right time!

Thanks to Tom Emmelot

Microsoft AntiSpyware Update Notification screen, Build 614

Thu, 30 Jun 2005 19:32:47 GMT

There have been some posts concerning not being sure that the popup from MS offering 614 Build was the real deal or not. I just managed to have it pop on a pc, and snagged the screenshot.

From Ron Chamberlin

Microsoft AntiSpyware on News at 11

Thu, 30 Jun 2005 18:24:37 GMT

From Susan Bradley

Crazed woman arrested in Fresno after she disrupted a United flight from Las Vegas to Fresno. Passengers say that the woman unbuckled her seat belt during take off and crawled over the seats and began strangling a passenger two rows behind her. When questioning the surrounding passengers they said "I really don't know what happened." "One minute the guy was just discussing to the passenger next to him, how he downloads stuff through Morpheus and how it loads up pop ups and gunk on is machine and every so many weeks he uninstalls Morpheas and then uses Microsoft Anti Spyware to clean up his PC and then reloads Morpheous and starts over again". "He said that he didn't want to pay for Morpheous so he just put up with the pop ups and ads until it got really bad and then used the free Microsoft Anti spyware" Passengers said "the next thing we know she's screaming at the top of her lungs and got her hands around his throat". They said that the female passenger calmed down a bit when the gentlemen praised the Microsoft product for being so good [and free] in cleaning up his machine on a regular basis. and the fact that he was urging a fellow passenger to search on the Microsoft site to download it and install it on his machine.

The woman was carted away muttering..... "risk... he's actually ACCEPTING spyware as a reasonable computing experience because he's so cheap and sees this as perfectly fine"

My Say

Really strange and stupid woman. If the Microsoft AntiSpyware software is doing a good job of actually removing the software, why should he bother paying for something?

Would it have been any different if the guy was using Adaware or Spybot Search and Destroy?

Microsoft AntiSpyware build 613 or 614 update issues

Mon, 27 Jun 2005 16:22:24 GMT

People who are having problems with signature-updates having curious results: please try clearing your Internet Explorer browser cache before using the MSAS update function.

http://support.microsoft.com/default.aspx?scid=kb;en-us;892519

The issue of Help, About, sometimes showing an out of date version number is still with us in build 613, at least--I saw it twice today. However, I've never seen it be off by two versions.

Using the KB article to confirm what's on the disk is the way to get this right, and if I'm reading this thread correctly, you've confirmed, via the June 9th date, at least, that you are really back on 5725.

I'm not sure what's going on here, but I think I'd posit that you were never beyond 5725 in the first place--that the previous updates didn't "take." I'm not sure, however, what version is contained in the current downloads from Microsoft--on most machines, I've already been on 5729 when I've downloaded the 6.xx version, and that has (apparently--I've not looked at the files) remained in place. I'll check some more tonight and tomorrow.

Thanks to Randy and Bill

AntiSpyware Beta 1 - Definitions Update [5729]

Sat, 25 Jun 2005 23:55:05 GMT

Spyware Definition Version: 5729 (6/25/2005)

You can acquire the updates by ensuring you have AutoUpdater turned on (Options > Settings) or File > Check for Updates (Manual)

Please note there are some issues obtaining this update, if you are experiencing problems, please re-download the 614 build of Microsoft AntiSpyware and do a manual update again from the file menu.

Download Microsoft AntiSpyware Refresh Update build 1.0.614 HERE

AntiSpyware (beta) Build 614 Released

Sat, 25 Jun 2005 17:04:26 GMT

This one caught me by surprise, anyway it seems that not much has changed.

In this second beta refresh (Build 1.0.614), we’ve made other enhancements to the detection and removal capabilities, including improved Winsock LSP removal capabilities and support for long descriptions of categorized software. In addition, we have also extended the Windows AntiSpyware beta expiration date to December 31, 2005.

Download here

Microsoft AntiSpyware Beta Refresh Build 1.0.613 Download

Thu, 23 Jun 2005 22:30:18 GMT

Overview

Windows AntiSpyware (Beta) is a security technology that helps protect Windows users from spyware and other potentially unwanted software. Known spyware on your PC can be detected and removed. This helps reduce negative effects caused by spyware including slow PC performance, annoying pop-up ads, unwanted changes to Internet settings, and unauthorized use of your private information. Continuous protection improves Internet browsing safety by guarding over 50 ways spyware can enter your PC.

Participants in the worldwide SpyNet™ community play a key role in determining which suspicious programs are classified as spyware. Microsoft researchers quickly develop methods to counteract these threats, and updates are automatically downloaded to your PC so you stay up to date.

In this second beta refresh (Build 1.0.613), we’ve made other enhancements to the detection and removal capabilities, including improved Winsock LSP removal capabilities and support for long descriptions of categorized software. In addition, we have also extended the Windows AntiSpyware beta expiration date to December 31, 2005.

Download Microsoft AntiSpyware Refresh Update (Build 1.0.613) HERE

Aurora install source revealed

Thu, 23 Jun 2005 17:14:11 GMT

For those interested in exactly how Aurora ( Nail.exe ) is installed on their systems, this is a VERY informative read :

http://www.vitalsecurity.org/2005/06/aurora-install-source-revealed-and-175.html

Steve Wechsler (akaMowGreen)

MS-MVP 2004-2005

AntiSpyware (beta) Build 613 Released Today

Thu, 23 Jun 2005 17:11:31 GMT

From Steve Dodson (Microsoft)

Just a few minutes ago, we released the latest build of Windows Antispyware to the public. This build will resolve issues which will make using this product better for users. Starting today, users will start to see the automatic update mechanism fire off and advise users know they have a new update available. Some of the big improvements are:

1) Software expiration will be extended to December 31, 2005.
2) Alerts Moving Quickly Across the Screen : Messages which move quickly off the screen when the start bar is not docked horizontally are also fixed. Users who dock their start bar on the sides of their screen will now be able to read messages generated from Microsoft Windows AntiSpyware (beta). This issue is what we dubbed the “Flying Toast Issue” and one which I was passionate about getting fixed in this refresh build.
3) Support for Long Descriptions: Users of older builds only have access to the short descriptions which ship as part of the signatures. These short descriptions only provide limited information about potentially unwanted software. Long descriptions in build 613 will help users by giving them more information about the potentially unwanted software detected on their PCs.
4) Improved Winsock LSP removal mechanism: In some cases, removing spyware LSPs, or can disrupt network functionality. Through enhancements made in this beta refresh, we’ve lessened the chance that this problem will occur. This is a very exciting release, and one which will greatly improve the user experience on this excellent product.

-steve