Symantecs Norton und PIFTS.exe Einstellungen

[Gast_peks_*]

Computer support forums are lighting up with queries from users wondering what to do about an alert on whether to trust a file called "PIFTS.exe". Meanwhile, someone at Symantec's support forum seems to be deleting posts from users inquiring about this alert almost as soon as they go up on the forum.Swa Frantzen, an incident handler with the SANS Internet Storm Center, writes today that PIFTS.exe appears to be related to a Norton update since it has a has a component in it that leverages the user's Internet connection to contact a Web page at norton.com, which is owned and operated by Symantec.


Also, it appears that PIFTS.exe is being submitted quite a bit to VirusTotal.com, a free service that people can use to scan suspicious files against more than three dozen different anti-virus products. ThreatExpert also has a writeup that confirms that this file phones home to Symantec.

Quellen:
http://voices.washingtonpost.com/securityf...rss=securityfix
http://it.slashdot.org/article.pl?sid=09/0...29&from=rss

Mal gucken was das nun ist...

Nachtrag:
Anubis Analyse der Datei
ThreatExpert Analyse

Der Beitrag wurde von peks bearbeitet: 10.03.2009, 15:51

[Gast_peks_*]

Der Vollständigkeitshalber noch dieses Update:

Update, 2:23 p.m. ET: Dave Cole, senior director of product management at Symantec, said the PIFTS file was part of a "diagnostics patch" shipped to Norton customers on Monday evening. The purpose of the update, Cole said, was to help determine how many customers would need to be migrated to newer versions of its software as more Windows users upgrade to Windows 7.

"We have to make sure before we migrate users to a new product that we can see what kind of load we can expect on our servers, and which customers are going to have to be moved up to the latest version of our product," Cole said.

Quelle: http://voices.washingtonpost.com/securityf...ain_of_mys.html