Spyware Warrior

Devilin · Posted: Fri Sep 17, 2004 8:56 pm Post subject: giant company anti spyware ?

Lo all
I've been asked, to evaluate giant company anti spyware, seems Clean, and seems to work ok, although I've had dealings with the company before, over there anti popup software, I said there software contained spyware, they denied it, I asked them to thoroughly check, again they denied, finally I pointed out the spying files in detail, they didn't reply, so understandably I don't trust them,

Has anybody else checked their software, I may have missed something,

http://www.giantcompany.com
_________________
My greatness is only surpassed by my modesty click here to visit Devilin's fan club

eburger68 · Posted: Fri Sep 17, 2004 9:39 pm Post subject:

Devilin:

I've tested Giant AntiSpyware. It's a little rough around the edges, but it looks to me to be a serious effort at an anti-spyware tool. Like PC Tools and Spyware Doctor, this company has done its own thinking about how to create an anti-spyware tool, and it has several features -- most notably, a security threat assessment wizard that scans the PC's security settings and recommends changes -- that are noteworthy. The scan was a little slow and it kicked up a few minor false positives (most understandable), but it did detect a number of the spyware installers it stumbled across.

So, as with some of the other anti-spyware tools that I've tested but haven't added to the list, I wouldn't recommend this app over the usual ones. This looks to be a very recent release (early August), and there's certainly room for improvement. This might well be one to keep an eye on -- could become a contender sometime down the road.

Just what spyware did you think it or the company's other applications installed?

Eric L. Howes

Devilin · Posted: Sat Sep 18, 2004 1:50 am Post subject:

File: C:\WINDOWS\SYSTEM\DWSPY36.DLL Location: C:\WINDOWS\SYSTEM\ Size: 77312 Version: 7.0.0.1 CRC-32: 855908C9 MD5: 9BC7F273049DEEA9F07A6C8A6E4D29FA Supported languages:: English (United States) (1033/1200) File version: 7.0.0.1 Company name: Desaware Inc. Internal name: DWSPY36 Comments: Legal copyright: Copyright © 1998-2000 by Desaware Inc. All Rights Reserved. Legal trademarks: SpyWorks is a trademark of Desaware Inc. Original filename: DWSPY36.DLL Product name: wspy36 Module Product version: 7.0.0.1 File description: SpyWorks support library. Private build: Special build:

File: C:\WINDOWS\SYSTEM\DWSPY32.DLL Location: C:\WINDOWS\SYSTEM\ Size: 137216 Version: 5.0.2.1 CRC-32: 4C915ED6 MD5: BC4C799E0ED18A54212044C8503BF6A5 Read only: No Hidden: No System file: No Directory: No Archive: Yes Symbolic link: No Supported languages:: English (United States) (1033/1252) File version: 5.0.021 Company name: Desaware Internal name: DWSPY32 Comments: Legal copyright: Copyright © 1995-2000, Desaware Legal trademarks: SpyWorks is a trademark of Desaware Original filename: DWSPY32.DLL Product name: DWSPY32 Product version: 5.0.021 File escription: DWSPY32 SpyWorks subclassing engine DLL Private build: Special build:

Just SpyWorks suft , but they denied it was there, when I asked them about third party software, DWSPY32.DLL was associated with keylogging, when I check it out,
_________________
My greatness is only surpassed by my modesty click here to visit Devilin's fan club

eburger68 · Posted: Sat Sep 18, 2004 8:11 am Post subject:

Devilin:

Giant PopupInspector does indeed install the following "SpyWorks" files to \WINNT\SYSTEM32:

DWSHK32.OCX
DWSHK36.OCX
dwspy32.dll
DWSPY36.dll

After a bit of nosing around, however, I tend to think that SpyWorks is not malicious, but rather a third-party control that allows programs to intercept keystrokes for a variety of purposes as well as do some other fancy things.

SpyWorks does monitor keystrokes -- see the following screenshot from Keylogger Killer, which provides a report of programs that have hooked into the keystroke stream:

http://spywarewarrior.com/pics_pub/keylogger.jpg

Notice that on my box the DWSPY36.DLL isn't the only module that is monitoring keystrokes. Also monitoring keystrokes are PGP, BestCrypt, an Iomega ZIP drive program, and another anti-keylogger program that I have installed. There are completely legitimate reasons for programs to monitor keystrokes -- PGP, for example, does it to provide hot-key support for encryption/decryption and signing/verifying operations. And if you asked any of these companies whether they had installed "spyware," they'd deny it because they don't recognize these modules as spyware, but rather as part of the normal, legitimate functionality of their programs.

There is quite a bit of information out on the Net about the SpyWorks modules -- see:

http://www.desaware.com/products/universalnet/spyworks/index.aspx
http://www.desaware.com/products/universalcom/spyworks/index.aspx
http://www.vbxtras.com/products/spyworks.asp
http://www.hallogram.com/spyworks/
http://www.avdf.com/aug96/art_win32.html

The last is a technical article written by one of Desaware's own programmers, explaining how SpyWorks "subclassing" works. So, SpyWorks (an admittedly unfortunate choice of names) is a third-party module that could be installed by any number of programs for what look to be innocent purposes.

I also scanned my system with the following:

AVP 3.5
SpyCop 6.0
Trojan Hunter 4.0
Spy Sweeper 3.0
Pest Patrol 4.4
Ad-aware SE Personal 1.05

None of them flagged the SpyWorks modules as malicious, and I tend to think it's not because those modules are unknown to those companies. From what I can tell, the SpyWorks package has been around since at least 2001, and I have seen reports of other anti-malware software detecting it back in 2001-2002.

The SpyWorks modules are also removed when Popup Inspector is uninstalled. If they were being used for malicious purposes, I would have expected them to be left behind.

So, I don't see anything of concern in Giant's use of the SpyWorks modules. I'm always open to differing interpretations, provided there's good evidence to support those conclusions, however.

Best,

Eric L. Howes

Devilin · Posted: Sat Sep 18, 2004 8:59 am Post subject:

I believe your analysis is correct,
Although many website's at the time where suggesting keylogging activity, spysweeper, Pest Patrol amongst them
They must have updated since I check several months ago
And I checked spyworks website, package module deals, not inherently sinister
But the scan results suggesting a custom module,?
So I asked giant, they denied spyware, then refused to answer, once I'd pointed out the files, ?

Its probably all innocent, thanks for your help Eric

I'll conclude at $29.95 USD, free updates and upgrades for 1 year. its probably worth the chaps money, he's already install, and removed some toolbar nasty's with it, and his 15 day evaluation is running out,
The spynet thing does look like a promising addition,
_________________
My greatness is only surpassed by my modesty click here to visit Devilin's fan club