PestPatrol sintf16.dll & client sniffers

[viking33]

Phil,
I did a search on my system for those files and didn't find any of them

[Phil Rabichow]

(I have Win 98 SE)
I recently ran Pest Patrol (free version). It shows a number of "pests" that Ad-Aware & Spybot don't show. I'm concerned with the few that are labeled spyware & keyloggers, but I could find very little information on these files doing a Google search. Does anyone know anything about the following entries: (Note: I renamed all of the extensions by adding PEST to the extension so I can rename them back.)

C:WINDOWSSYSTEMSIntfNT.dllPEST
C:WINDOWSSYSTEMSIntf32.dllPEST
C:WINDOWSSYSTEMSIntf16.dllPEST
C:WINDOWSLocal SettingsTemporary Internet FilesContent.IE5XQ6Q23PHclientSniffer_2_0[1].jsPEST
C:WINDOWSLocal SettingsTemporary Internet FilesContent.IE5ERG1UTMFvb_2_0[1].jsPEST

I would appreciate any insight about these, especially the last two.
Thanks,

[Phil Rabichow]

Thanks, Bob. I should have mentioned by OS & have edited my post to indicate Win 98 SE. Of course, these files may have nothing to do with the OS.

I have a little more info. The C:WINDOWSSYSTEMSIn*.dll files seem to be something to protect copying certain music CDs (I guess to reduce piracy). I found this at this site. I wonder why the're on my system with the date of 8/23/04, since I don't even rip CDs & haven't updated anything with respect to CDs or media players.

[JohnGray]

Bob

Odd. Google found several references to sintfnt.dll and the others when I just tried! <img src=/S/shrug.gif border=0 alt=shrug width=39 height=15>

John

[Phil Rabichow]

Hi John:
I was the one who ran the Google search. When I first ran it, I used sLntf, not sintf, as I confused the i & L. <img src=/S/blush.gif border=0 alt=blush width=15 height=15> Nevertheless, I'm still unclear why PP lists these files as spyware. The latter two seem to be related to Micromedia Flash & are in my TIF, but I'm still unclear why they're there or if I really need to delete them. PP listed one as a keylogger.

[viking33]

Phil,
I'm running XP Home. Maybe there's the difference?
How about the prog that you use for burning CDs? Or Media player? I've got MP 10.
I would get rid of the TIF occurances and try to rename the others one at a time to see if there is any apparent effect.

[Phil Rabichow]

Hi Bob:
Thanks for responding. I haven't changed anything about my CD player or burner. I still use WMP version 7.10, & Adaptec & Easy CD Creator that can came with the computer 5 years ago. That's why I'm confused that these popped up all of a sudden. Maybe I can find more info, but right now, I can't find a forum for PP.

[AlanMiller]

Hi Phil

Not familiar with Pest Patrol, but does it update its definition files? If so, these "new" warnings might be new false positives. To learn more of the origin of these files, maybe have a look at their Properties sheets in Windows Explorer. BTW, I don't have these on my 98SE, but do have CD software, so they're possibly specific to some particularprogram you have/ had.

Alan

[Phil Rabichow]

Thanks, Alan. Yes, PP updates it's definitions & I've even read in some forums that one should be cautious about PP's reports, as there are false positives. PP reports about 28 adware/spyware on my machine that other spyware programs don't. e.g. it claims there are entries from BonziBuddy, although I have none of the files associated with it. Charlotte has the paid edition of PP & says there are false positives.

It's just that I'm having a tough time deciding whether PP is worth the trouble. Some people rave about it, saying it finds spyware & key loggers that other programs miss & others say there are false positives. I would think that if I had a key logger, that Zone Alarm would at least let me know it's phoning somewhere & ask if I wanted to allow it.

[jscher2000]

> I wonder why the're on my system with the date of 8/23/04, since I don't even rip CDs & haven't updated
> anything with respect to CDs or media players.

How about just playing an audio CD? I heard from the news that some audio CDs are manufactured in such a way that they can ruin your drive. Perhaps it is possible to silently install copy protection software from just playing an audio CD??

(Reminds me of movie DVDs. Dell includes some software that blocks their efforts to replace the default player installed on Dell computers with whatever player software in on the DVD.)

[Phil Rabichow]

I haven't played any new CDs for a long time (which reminds me, I need to do that more often) <img src=/S/smile.gif border=0 alt=smile width=15 height=15>. So far, renaming the files hasn't seemed to bother anything, but time will tell. Thanks for the idea.

[charlotte]

Phil,

I had some problems a version or so back with false positives of BonziBuddy and something else with some custom libraries like the Redemption.dll and EasyMailSMTP because some versions of spyware and adware install these libraries as well. I notified the authors of the software and also PestPatrol and they got it cleaned up in short order. I also ran into problems with AdAware and SpyBot at about the same time and on some of the same files, so it wasn't a particular PestPatrol problem, merely an attempt to stifle some pesky spyware that was using legitimate code (legitimately or not, I don't know) to do its nefarious business. <img src=/S/shrug.gif border=0 alt=shrug width=39 height=15>

[Phil Rabichow]

Thanks, Charlotte. PP is the only one giving me "false" positives on these (if they are false). I'm using the latest free version & latest updates. I've seen some people rave about PP finding stuff that other programs miss, but if they also have false positives, I'm not sure what to do. I suppose I could ignore it & change my mind later. <img src=/S/shrug.gif border=0 alt=shrug width=39 height=15>

[charlotte]

If you're sure the items flagged are legitimate, as I was when I realized they were in a couple of licensed products/libraries we use, you can exclude those specific files or registry keys from further searches. I tracked down each and every file and registry key to see what they were (since allowing them to be removed broke things!) and then I started notifying authors and Pest Patrol. They patched their definitions within a day to ignore those items unless they were actually part of installed spyware. <img src=/S/shrug.gif border=0 alt=shrug width=39 height=15> I didn't get such good response from SpyBot when they caused the same kind of problems on the DSO exploit and had to flag that for exclusion.