Thursday, September 2nd 2010, 4:51pm UTC+2

You are not logged in.

  • Login
  • Register

Avira not detecting "naughtypirates" spyware

prazim

Date of registration:
Sep 11th 2007


Version: AntiVir Premium



1

Wednesday, October 15th 2008, 8:25pm

Avira not detecting "naughtypirates" spyware

I am using Avira Premium and ran a spyware detection tool (adsspy) today to double check. It identified that a handful of my files were infected with something called "naughtypirates" I cleaned the files, rebooted and other files are now infected, so I am thinking that there is something not being detected on my system that is infecting files once the others are cleaned.
Thanks,
Sue
  • Go to the top of the page

kevin009

Community member

Date of registration:
Aug 9th 2007



2

Thursday, October 16th 2008, 7:40am

Hello,
Please release these files from quarantine and upload them to virustotal and post the results here. I think, that standalone antispyware tool caused False positives, or may be a rogue program like XP antivirus 2008.

Quoted

adsspy
I have no idea to the name of this antispyware program. Please tell me where you got it from?

Regards,

This post has been edited 2 times, last edit by "kevin009" (Oct 16th 2008, 7:41am)

  • Go to the top of the page

Nicolae Moldoveanu

Avira GmbH

Date of registration:
May 22nd 2006


Version: Avira Prem. Security Suite


Location: Bucharest



3

Thursday, October 16th 2008, 8:35am

Hi,
Please post here a link to your third party spyware software.
This is what I found for adsspy:

Quoted

Ads Spy is a tool used to list, view or delete Alternate Data Streams (ADS) on Windows 2000/XP with NTFS file systems. ADS is a way of storing meta-information for files without actually storing the information in the file it belongs to, carried over from early MacOS compatibility from Windows NT4. Recently browser hijackers began using this technique to store hidden information on the system, and even store trojan executable files in ADS streams of random files on the system. Use with caution.
Nicolae Moldoveanu
Avira GmbH
  • Go to the top of the page

prazim

Date of registration:
Sep 11th 2007


Version: AntiVir Premium



4

Thursday, October 16th 2008, 4:52pm

This is the link: http://www.merijn.org/programs.php

Thanks so much for your help!
Sue
  • Go to the top of the page

ahmed12

Community member

Date of registration:
Jun 23rd 2008


Version: AntiVir Personal


Operating System: XP SP3,Windows 7 32-bit


Location: Egypt,cairo



5

Thursday, October 16th 2008, 6:11pm

can you please tell us the path of the files infected and get a screen shoot for the adsspy program after it has finished the scan see this for more information about how to take a screen shoot http://forum.avira.com/wbb/index.php?pag…&threadID=71060

also a hijackthis log will be useful for more in formation about hijackhis http://forum.avira.com/wbb/index.php?pag…ght=#post650258

This post has been edited 1 times, last edit by "ahmed12" (Oct 16th 2008, 6:12pm)

  • Go to the top of the page

prazim

Date of registration:
Sep 11th 2007


Version: AntiVir Premium



6

Friday, October 17th 2008, 4:39am

Thank you, Ahmed. Today, the tool continued to report the alternate data streams, but not in the files it initially reported (other than temp files), and it isn't reporting "naughty pirates", so I'm not sure if the problem is resolved at this point, or not. At any rate, I reran it tonight upon seeing your post, and it didn't report anything, so I don't know if the problem has been resolved for good, or not. What you could do to see sample results is download and run it - as it's free to see representative results. Apparently not all ADS are problematic, based on the developer's website.

I was understandably surprised to have it report the "naughty pirates" alternate data streams and definitely hope Avira can do something to prevent systems using their tool from becoming infected by it.
many thanks,
Sue
  • Go to the top of the page

prazim

Date of registration:
Sep 11th 2007


Version: AntiVir Premium



7

Monday, July 6th 2009, 8:17pm

I'm sorry, I didn't see the request to upload the screenshots. Here they are: http://www.esnips.com/web/naughtypirates/
Thanks,
sue
  • Go to the top of the page

Nicolae Moldoveanu

Avira GmbH

Date of registration:
May 22nd 2006


Version: Avira Prem. Security Suite


Location: Bucharest



8

Tuesday, July 7th 2009, 9:31am

Quoted from "prazim"

This is the link: http://www.merijn.org/programs.php


Hi,
Please upload that software using this link
Nicolae Moldoveanu
Avira GmbH
  • Go to the top of the page