[NEWS]PIFTS.EXE - Un rootkit di Norton?

[.Kougaiji.]

Originariamente inviato da cico66

io questo file non l'ho trovato nel mio pc... e voi l'avete?

Hai norton?Se non lo trovi, ovvio, è nascosto in una cartella "non esistente"( a detta delle voci) ma te ne puoi accorgere tramite un firewall visto che fa richiesta di accesso alla rete.Io non uso norton e non ti so dire.

[Chill-Out]

Originariamente inviato da cico66

io questo file non l'ho trovato nel mio pc... e voi l'avete?

Originariamente inviato da .Kougaiji.

Hai norton?Se non lo trovi, ovvio, è nascosto in una cartella "non esistente"( a detta delle voci) ma te ne puoi accorgere tramite un firewall visto che fa richiesta di accesso alla rete.Io non uso norton e non ti so dire.

Dipende dalla versione in uso l'ormai famoso file PIFTS.exe è una patch diagnostica per le versioni 2006 e 2007 di Nav e Nis

[.Kougaiji.]

Concludo con questo link:
http://pastebin.ca/1357374

Qui ci sono tutte le info e screens riguardante questo file. I want to believe?


p.s.
Non ho testato i file in DATA, quindi attenzione se li volete scaricare

[Chill-Out]

Analisi di PIFTS.exe su VirusTotal e ThreatExpert

http://www.virustotal.com/analisis/7...93471d77940f4c

http://www.threatexpert.com/report.a...b5fafe57260810

[c.m.g]

alcune risorse per approfondimenti:

http://www.sophos.com/blogs/gc/g/200...ymantec-pifts/
http://it.slashdot.org/article.pl?sid=09/03/10/139229
http://digg.com/software/What_is_PIF...covering_it_up
http://digg.com/software/What_is_PIF...overing_it_up?
http://www.reddit.com/r/reddit.com/c...sexe_file_and/
http://www.tech-linkblog.com/2009/03...-piftsexe.html
http://www.abovetopsecret.com/forum/...php?tid=444230
http://forums.zonealarm.org/zonelabs...ssage.id=19880
http://community.norton.com/norton/b...d=nis_feedback (Norton Internet Security / Norton AntiVirus Forums)
http://chrysler5thavenue.blogspot.co.../piftsexe.html
http://2009031009.ubiuexiia.xorg.pl/pifts_exe.html
http://rss.slashdot.org/~r/Slashdot/...2KU/article.pl
http://www.freebase.org/
http://blogs.howstuffworks.com/2009/...t-is-piftsexe/
http://www.tech-linkblog.com/2009/03...piftsexe.html/
http://www.abovetopsecret.com/forum/thread444230/pg1
http://www.lockergnome.com/blade/200...ftsexe-fiasco/
http://antivirus.about.com/b/2009/03...ontroversy.htm
http://federalism.typepad.com/crime_...xe-update.html
http://www.telegraph.co.uk/sciencean....exe-file.html
http://blog.bull3t.me.uk/archives/in...-and-piftsexe/
http://technologyexpert.blogspot.com...ound-over.html
http://answers.yahoo.com/question/in...9204126AAGTEsK
http://forums.zonealarm.org/zonelabs...age.uid=443981
http://chrysler5thavenue.blogspot.co...exe-story.html

e molti altri:

http://www.google.com/search?hl=it&c...&start=20&sa=N

alcune immagini di post cancellati:








Risposta ufficiale Symantec:

PIFTS.exe or Product Information Framework Troubleshooter


This entry was created to answer the following key questions around PIFTS.exe:


- What is PIFTS.exe?
- What is the function of PIFTS.exe?
- What information does PIFTS.exe collect?


Norton security products contain a component called Product Information Framework (PIF), and a feature called LiveUpdate Notice (LUN).


LUN is an in-product messaging mechanism that is used to notify customers when new product versions are available. The messaging is targeted to particular systems based on product version, operating system version, and product state, and this state is determined by the PIF component.


For instance, LUN was used to notify users when a Vista compatible version of their product became available, and LUN will again be used to notify users when a Windows 7 compatible version of their product becomes available.


LUN is fully integrated into 2008 and later products, but is a standalone component in 2006 and 2007 products. LUN became available after the 2006 and 2007 products shipped, and was added to the 2006 and 2007 products using LiveUpdate (LU).


Symantec is aware of a problem affecting some 2006 and 2007 products where a subsequent PIF update did not successfully apply. The cause of this problem is currently under investigation, but the result is that these users may not receive appropriate LUN messaging.


To assist with identifying the extent, and potential cause, of the problem, Symantec created an investigative executable that analyzes the Norton product state, and reports the details to Symantec. This information will help Symantec to identify and correct the problem with PIF, in time for the Windows 7 release.


Product Information Framework Troubleshooter (PIFTS) executable details:


File name: PIFTS.EXE
File size: 102400 bytes
MD5 hash: 91b564d825a3487ae5b5fafe57260810


The PIFTS.EXE binary was released through LiveUpdate targeting 2006 and 2007 products. After downloading the LU package, LU executes PIFTS.EXE, and PIFTS.EXE collects product state information, and reports this information to Symantec.


PIFTS.EXE does the following:


- Determines what product is installed, NIS, NAV, N360, NCO, or NSW, by looking under the HKLM\Software\Symantec\InstalledApps registry key.
- Determines the version of the installed product by looking at the file version information of a key product file.
- Determines if PIF is installed by looking under the HKLM\Software\Symantec\InstalledApps registry key.
- Determines the version of PIF by looking at the file version information of two key PIF files.
- Determines if PIF is enabled, and what the PIF state is, by looking at the PIF registry under HKLM\Software\Symantec.
- Determines the version of PIF that LiveUpdate believes is installed, by reading the LU catalog.
- The collected information, as described above, is reported to a Symantec server, called stats.norton.com, using an HTTP GET request. This server is located at a Symantec datacenter located on the East Coast of the United States.


No additional information is collected, no personal information is collected, and no system modifications are made.

raggiungibile qui:

http://community.norton.com/norton/b...hread.id=39119

La società di sicurezza Sophos marchia il file come non pericoloso (Fonte).

[c.m.g]

intanto è già uscito un articolo su WikiPedia:

http://en.wikipedia.org/wiki/PIFTS.exe

[.Kougaiji.]

Eh vabbè :3

[epa]

Pazzesco cosa è successo http://www.trackback.it/articolo/gli...symantec/9038/
Dopo che la symantec si era ripresa con Norton 2009 non mi aspettavo un erroraccio del genere (tipo quello di AVG se non ricordo male)