Possible Effects of Microsoft AntiSpyware on Evidence Collection

1
Possible Effects of Microsoft AntiSpyware on
Evidence Collection

• Logan Browne
• HP IT Security

2
Microsoft Windows AntiSpyware (Beta) is a
security technology that helps protect Windows
users from spyware and other potentially unwanted
software.

• Microsoft AntiSpyware Website
• lthttp//www.microsoft.com/athome/security/spyware/
  software/faq.mspxgt

3
Background

• On December 16, 2004, Microsoft announced its
  acquisition of GIANT Company Software, Inc., a
  provider of top-rated anti-spyware and Internet
  security products.

4
Background

• On January 6, 2005, Microsoft announced the
  availability of the first beta version of
  Microsoft Windows AntiSpyware.
• Windows users can now download it for Free.
• lthttp//www.microsoft.com/athome/security/spyware/
  software/gt

5
What is it?

• Rebranded version of GIANT AntiSpyware 1.0
• Collection of security and privacy tools
• 6.2MB download (MicrosoftAntiSpywareInstall.exe)
• Works with Windows 2000, Windows XP, and Windows
  Server 2003
• Over 50 monitors to check for spyware activity
• Also includes Privacy Tools

6
The issue

• In addition to the Spyware removal features this
  tool also includes capabilities to erase Internet
  tracks, and securely delete files.
• Though these capabilities have been available in
  many other tools, they are now Free and offered
  by Microsoft in a default installation.

7
From http//www.winsupersite.com/images/reviews/ms
_antispyware_preview_06.jpg
8
Tracks Eraser

• Track Eraser lets you clear the histories of a
  number of different programs.
• Users clear their histories, by checking the box
  next to the name of the program.
• There is support for erasing the tracks of
  Internet Explorer, RealPlayer, Adobe Acrobat,
  ICQ, and others.

9
From http//www.winsupersite.com/images/reviews/ms
_antispyware_preview_10.jpg
10
Secure File Shredder

• Very similar to the Symantec and PGP tools.
• Overwrites the allocated file space several
  times.
• Claims to use DoD recommendations, though which
  ones are not specified.
• (See me for a further rant about mythical
  government specifications, if interested.)

11
From http//www.winsupersite.com/images/reviews/ms
_antispyware_preview_11.jpg
12
Recommendations

• Microsoft AntiSpyware makes some evidence
  destroying tools available to a larger audience
• Check for this tool when you obtain a system.
• default install in C\Program Files\Microsoft
  Antispyware\
• It is still unknown if Microsoft will release the
  final version for Free, and it is unclear if
  these Advanced Tools will be included.
• I suspect that it may be rolled into Service Pack
  3 for Windows XP this July

13
References

• http//www.microsoft.com/athome/security/spyware/s
  oftware/
• http//www.giantcompany.com/
• http//www.pcworld.com/reviews/article/0,aid,11930
  0,00.asp
• http//www.winsupersite.com/reviews/ms_antispyware
  _preview.asp

14
(No Transcript)