What is PIFTS.exe? | Hacker News Reader

What is PIFTS.exe?

freebase.org

54 pointsnjrc18 comments

From a slashdot comment on the same topic, way down:

http://forums.zonealarm.org/zonelabs/board/message?board.id=...

Looks like a stats tracking part of their update program. Perhaps they wanted it secret and are employing forum admins with horrible self control.

Lesson: If you setup forums for your customers, dont go through deleting legitimate negative posts that concern your products. This magnifies the harm, not reduces it.

This is the internet, once something is posted here, its very hard to get rid of it.

Lesson: If you setup forums for your customers, dont go through deleting legitimate negative posts that concern your products. This magnifies the harm, not reduces it.

Particularly true for security software. You're supposed to be able to trust these guys with deep hooks in your operating system, yet they seem to be engaging in something resembling a "security by obscurity" strategy.

News flash: virtually all security vendors keep mum on the design and implementation of their products. Many of the host-based security vendors actively compete with reverse engineers in vain attempts to prevent malware from patching around their products. There are even popular data-loss prevention products that hook the scheduler and interrupt handlers to keep the kernel itself from inspecting them.

This is just not a news story.

This is just not a news story.

The fact that the implementation details of Symantec's security products are proprietary is not a news story. The fact that their response to questions about their product generating suspicious alerts on users' systems is to delete forum posts asking about it is a news story. The correct answer in this situation is to tell users that the program is a legitimate part of Symantec's product.

I agree with you. It is notable that SYMC flubbed the PR on this. I think I'm trying to say, there's probably no story in the executable itself.

So a "security" program is really the ultimate virus, one the user is not only aware of but completely submits to.

Official explanation:

http://community.norton.com/norton/board/message?board.id=ni...

a bad software update, and a weird attempt at removing 'spam' from their forum.

Hysteria on both sides. I'm pissed at Symantec for amateurish public relations on this, but also embarassed by the conspiracy theorists; there is no way, in 2009, that Symantec could get away with hiding objectionable code in their binaries. Part-time security people will dissect this program for sport; large enterprises already staff teams of people to evaluate the code they're deploying.

there is no way, in 2009, that Symantec could get away with hiding objectionable code in their binaries.

Granted. But there is no smoke without fire. I don't think its just a PR problem. If they could go to such lengths as to delete all those posts, there must be something in it other than the fact that they could not identify the problem, or they so stupid ?! I am intrigued to see how this unfolds !

Right. Clearly this isnt some government tracking program like some crazies predict.

But it is a good lesson in forum management, at least.

Definitely not stellar/unique news. However, I do like how quickly this news story is spreading.

I honestly can't believe that people still use Norton in this day and age, let alone that it was doing something dodgy.

As far as I know, all current versions of Microsoft Windows (XP and Vista) will throw a warning if installed on a computer without antivirus software. Since Symantec/Norton is one of the most well-known names in the business (and often comes bundled on new computers), it makes sense that people use their product.

Why do you say that you can't believe that people still use it in this day and age? Does Norton have a reputation for being absoluately terrible that I'm not aware of?

This is anecdotal evidence, obviously...

Case 1

Background: my partner is an IT technician. He works in the school that I attended when I was younger. We originally met when I was still in school.

About 9 years ago, before I was in any way IT literate, my mum had a computer running Norton AV. It was slow, and not just because the hardware of the time wasn't up to spec - Norton was seriously hogging the resources, and the computer was loaded down with various viruses. We didn't know this at the time, and I had my partner - the IT technician - make a personal visit to my home on a weekend to see if he could fix the problem.

He was working on the computer from around lunch time on the Saturday until near 11pm, and then had to return again on the Sunday, just to get the computer back to a safe, useable state. Norton AV was replaced with AVG, and that computer never had problems again.

Case 2

My partner knows a nice lady called Brenda. She had a laptop, given to her by her son, that was also running Norton AV. We've been round to fix a few issues on multiple occasions, but none more 'stunning' than the time my partner removed Norton and installed AVG and Spybot; the virus/trojan/etc count totalled over 1000. I have no idea how that machine was even running.

Case 3

My colleagues work machine, also running Norton. I removed it last year and installed Avast. As well as finding a couple of issues, the overall performance of the computer improved remarkably.

Apart from those 3 specific incidents, over the past few years I have advised multiple people online to remove Norton and install something like AVG or Avast, and the response has always been positive. At the end of the day, even ignoring my experience, I could never trust a program that has to be released with a "removal tool", because the uninstall process doesn't remove the program from the system properly.

I can confirm that. Long before I started using Linux and OS X, I had an oldish Windows PC that had Norton on it. Replacing it with AVG not only sped up my PC, AVG also got rid of several hundered pieces of malware.

Norton broke their silence. http://community.norton.com/t5/Norton-Protection-Blog/Symant...

Apparently it was just part of the update but it went out unsigned so it tripped the firewall. Some users were causing trouble so they just nuked all forum posts and accounts with the word PIFTS. It looks like maybe a bit more then that was going on, but other then some fighting with customers there's nothing special going on.

> IF PIFTS.EXE WAS HERE, THEN WHO WAS PHONE?

Gotta be 4chan messing with Norton.

If someone is looking for a good antivirus product, try F-secure.

Everytime I had to deal with a virus infection, they were always there with a free patch.

They are also playing nice with linux, and made a freely available Knoppix based rescue CD and are blogging about their activity.

http://www.f-secure.com/linux-weblog/2008/11/25/rescuecd-301...

They've always been there in bad times, they've earned my trust and that's the product I would advise to companies from now on.

Reply on news.ycombinator.com