SuperAntispyware 6 Released

andrew129260 said:

So I have done my own testing on it, and I find it quite good. I like the new version a lot. It is very lightweight, very fast scan times, and has some nice extra features like a system investigator which gathers all kinds of info on your pc like startup items etc and the like and allows you to save the log. Will be very useful with malware removal.

That's good to hear. Did you happen to check to see if all that PC info gets sent back to SAS?

I use Microsoft Network Monitor to check out free programs. (Better than TCPView) It allows you to set filters for just about everything so you can watch a program in real-time. Very detailed but can be overwhelming until you get the hang of it.

carwiz said:

andrew129260 said:

So I have done my own testing on it, and I find it quite good. I like the new version a lot. It is very lightweight, very fast scan times, and has some nice extra features like a system investigator which gathers all kinds of info on your pc like startup items etc and the like and allows you to save the log. Will be very useful with malware removal.

That's good to hear. Did you happen to check to see if all that PC info gets sent back to SAS?

I use Microsoft Network Monitor to check out free programs. (Better than TCPView) It allows you to set filters for just about everything so you can watch a program in real-time. Very detailed but can be overwhelming until you get the hang of it.

Yes, if you do not opt out. There is (like with all security software) data that is gathered about your pc which is sent to there servers. But you can opt out. In a way though, some of that info HAS to be transferred back to them, otherwise they could not mark certain files safe or not. I chose to stay opted in, I know what there transferring.

So it works like Herd Protect in that the whole file is sent back to SAS? Bummer.

carwiz said:

So it works like Herd Protect in that the whole file is sent back to SAS? Bummer.

No, honestly the best way to explain it is for you to try it yourself in a vm.

The report I am talking about is the one that sends that data, if you do not run the report, it doesn't send anything back. This is a separate feature not related to the scanning.

"System Investigator – Shows what’s running on your PC in a new and exciting way. Customers and technicians can use this tool to quickly determine if a file on the system is potentially malware."

More info:

http://betanews.com/2014/07/30/super...-investigator/

http://www.ghacks.net/2014/07/30/use...stigator-tool/

From there Privacy policy:

"During your use of our software and services, our systems may also collect information from your computer that is not used to identify you, but is helpful in our efforts to provide the features or services you have requested. This includes information such as the type of computer and processor you are using, which version of the operating system is installed, the configuration of your computer in terms of other application programs used, your computer’s Media Access Control address, whether any security software is installed and if it is up-to-date, and information on how you use our products. We use this information to provide the services and functions you request, and to improve our product and service offerings in the future. "

Yabut.... If I've already run a scan and everything on my PC is clean, what does the Investigator do? Check the file again?

I'm just trying to understand it BEFORE I install it.

Oh well, I'm done here. I didn't like the way V5 worked. I was hoping for something less intrusive. I really don't need a machine to tell me what's in my refrigerator either.

carwiz said:

Yabut.... If I've already run a scan and everything on my PC is clean, what does the Investigator do? Check the file again?

I'm just trying to understand it BEFORE I install it.

Oh well, I'm done here. I didn't like the way V5 worked. I was hoping for something less intrusive. I really don't need a machine to tell me what's in my refrigerator either.

Did you read my post?

Why not test things in a virtual machine? :)

Hi, well after reading this thread I decided to install SAS Free version.

System Investigator - seems to download information on the detected entries. I tried blocking the connection and here's the result:



SAS seems to send usage statistics but additionally seems to send information on the user's decision making. For example following a scan I decided to trust several files that it detected as trojans and each time I made a selection my other security software prompted me to either allow or deny the connection attempt. It was SAS submitting some data and I assume that it relates to those decisions.Those "trojans" were Nirsoft products that commonly get flagged up as unwanted by most scanners!

On another note - I've removed the SAS startup entry so that it doesn't run except when I want it to. Additionally, as an experiment, I've disabled the SAS Core Service and Drivers to prevent them from running on boot.

Edit: [Further research shows that disabling the above allows SAS to work as a scanner but may impair it's functionality in terms of removal of unwanted files/ entries]

Drivers


Service (and drivers)


So far everything still works including the scan from right click context menu. I'm not sure what this service and drivers actually do as disabling them doesn't seem to affect anything. Of course I could be entirely wrong about that and run into problems but so far so good. I'm not suggesting that other users do the same.

Registry changes on SAS install:

Code:

=======================================================
** Sunday 03/08/2014 18:02:36 **
Low-level Drivers and Services
Registry Key hkey_local_machine\system\ControlSet004\services
Subkey !SASCORE has been added
=======================================================
** Sunday 03/08/2014 18:02:45 **
Low-level Drivers and Services
Registry Key hkey_local_machine\system\CurrentControlSet\services
Subkey !SASCORE has been added
=======================================================
** Sunday 03/08/2014 18:02:50 **
Additional Security
Registry Key hkey_local_machine\system\ControlSet004\control\safeboot\minimal
Subkey !SASCORE has been added
=======================================================
** Sunday 03/08/2014 18:02:52 **
Additional Security
Registry Key hkey_local_machine\system\CurrentControlSet\control\safeboot\minimal
Subkey !SASCORE has been added
=======================================================
** Sunday 03/08/2014 18:02:55 **
Additional Security
Registry Key hkey_local_machine\system\ControlSet004\control\safeboot\network
Subkey !SASCORE has been added
=======================================================
** Sunday 03/08/2014 18:02:56 **
Additional Security
Registry Key hkey_local_machine\system\CurrentControlSet\control\safeboot\network
Subkey !SASCORE has been added
=======================================================
** Sunday 03/08/2014 18:02:58 **
Launched SASCore64.exe[568] « services.exe[664] « wininit.exe[548]
Command Handlers and Associations
Registry Key hkey_classes_root\*\shellex\contextmenuhandlers
Subkey {CA8ACAFA-5FBB-467B-B348-90DD488DE003} has been added
=======================================================
** Sunday 03/08/2014 18:04:08 **
Low-level Drivers and Services
Registry Key hkey_local_machine\system\ControlSet004\services
Subkey SASDIFSV has been added
Subkey SASKUTIL has been added
=======================================================
** Sunday 03/08/2014 18:04:13 **
Low-level Drivers and Services
Registry Key hkey_local_machine\system\CurrentControlSet\services
Subkey SASDIFSV has been added
Subkey SASKUTIL has been added
=======================================================
** Sunday 03/08/2014 18:06:19 **
Run Keys and Startup Files
Registry Key hkey_users\S-1-5-21-165181766-1597162493-719806621-1000\software\microsoft\windows\currentversion\run
Value SUPERAntiSpyware (S) will be a new value with data
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
=======================================================
** Sunday 03/08/2014 18:06:26 **
Change Accepted

The services are only for the features that the paid product uses. Automatic updating, realtime protection, scheduled scans etc. For the free version, only the sascore needs to run.

andrew129260 said:

The services are only for the features that the paid product uses. Automatic updating, scheduled scans etc. For the free version, only the sascore needs to run.

Thanks for the info!