
03-10-2009, 01:16 AM
|
 |
don't worry, it's just a donkey spell
Senior Moderator
|
|
|
|
|
|
|
Join Date: Oct 2004
Posts: 33,181
Points: 1,688,500,955.51
Bank: 0.04
Total Points: 1,688,500,955.55
|
|
Re: PIFTS.exe - Windows and ZoneAlarm Messages and Alerts - ZoneAlarm User Forum
Quote:
I have NIS and it generated an alert about PIFTS.exe this morning. I Googled it and got no hits - ZERO. I went to the Norton community forums to ask if anyone else had encountered it and what to do and found that another user had asked the same question. I added mine and a number of others added theirs, then the thread was deleted. Another thread popped up. The first one was just people who were wondering what was going on, but the second thread was full of suspicions. When Norton deletes a thread which was full of totally legitimate and non-threatening questions you really have to start wondering and apparently many people did. That thread was deleted, too. And so has every other thread that I've been able to find. It appears that Norton/Symantec is trying to cover something up by deleting these threads and hoping we all get bored and go away.
So this evening I decided to try Google again and look at this: I now get hits. It looks like ZoneAlarm users are seeing the same alerts. Has anyone been able to get to the bottom of this? I never allow anything to go to the web until I know what it is. And this apparent cover-up is very disturbing.
|
Quote:
Even more interestingly now, after posting a single post asking about PIFTS.exe, which was deleted, and a subsequent post to another forum asking about the deleted posts, which got deleted, I've now been blocked from creating new posts or replies on the Norton forums. They really don't want to talk about whatever this was.
And doubly interesting -- or perhaps not, who knows -- not sure if this is standard practice at Symantic or what, but opening the PIFTS.exe in a hex editor shows a large section of the end of the file consists only of "PADDINGXX" repeated over and over. I've got some background in programming and can't think of a good reason why you would need padding like that on a legitimate executable. However, if an executable in an update has been compromised it may require padding such as that to match the original executable's file size or something. But that's just pointless conspiracy theorizing that likely has no basis. It would be nice though to hear from Norton about what the **bleep** this thing is.
|
Quote:
On my system the file is located inside what appears to be a downloaded update file from Symantec. C ocuments and SettingsAll UsersApplication DataSymantecLiveUpdateDownloads1236641345jtun_pift s.zip.full.zip (not sure if the filename itself is consistent between systems). So far it appears to be some sort of update to Norton, but with absolutely no explanation provided, and obviously some hush-up attempts on the Norton forums.
|
|