Anti-Virus Company Says PeerGuardian is Malware
Written by Ben Jones on February 24, 2008Over the past week, some servers used for updating the anti-virus software NOD32 were labeled as anti-p2p by a popular list maker for PeerGuardian. In response, NOD32’s company, ESET, has categorised PG2 as malware in some of its latest updates.
It started off with Bluetack adding some IP addresses to its “Level 1 blocklist” that belonged to ESET (NOD32) update servers. “Level 1” is the term that Bluetack use for their lists containing (according to site admin ‘monk’):
- Companies (Or organizations. I won’t repeat orgs. over and over) who are clearly involved with trying to stop filesharing.
- Companies which anti-p2p activity has been seen from.
- Companies that produce or have a stong financial interest in copyrighted material.
- Government ranges or companies that have a strong financial interest in doing work for governments.
- Legal industry ranges.
- IPs or ranges of ISPs from which anti-p2p activity has been observed.
The IP addresses added were 89.202.149.32 to 89.202.149.63, 89.202.157.88 to 89.202.157.95 and 89.202.157.128 to 89.202.157.159, according to this forum post on the NOD32 support forum. These blocked IP ranges contain many of the servers used to provide anti-virus signatures for NOD32. These were added to the blocklist for alleged anti-p2p activities. However, what kind of anti-p2p activity was taking place is unclear.
Bluetack administrator ‘m00re’ told TorrentFreak that the IPs were added because “someone noticed them on a torrent”. ‘m0nk’, another administrator later told TorrentFreak that he noticed an IP belonging to ESET on a private tracker’s movie torrent that he was on. “It was only 1 IP, but since they’re a commercial software company with a strong financial interest in copyrighted material, they go on level 1 regardless”.
However, ESET didn’t take too kindly to this disruption of its business. A representative from ESET tried to contact Bluetack, to see about the removal from the list. He later posted a screenshot of the discussion to the ESET support forum.
This was the same kind of attitude experienced by Ludvig Strigeus almost exactly two years ago, after utorrent.com was added to the Bluetack lists. Similarly by the Opentracker people, and the German Chaos Computer Club.
Based on the feedback from Bluetack, ESET added PeerGuardian to their anti-virus updates. Two signatures called Win32/PeerGuardian were added in update number 2894 on the 21st of Feb, with another 5 added in update number 2895 the following day. These updates identify the PeerGuardian application as malware, and offer the user the ability to deal with the ‘infection’. Those that do, have been unable to use PeerGuardian afterwards.
Phoenixlabs, which makes PeerGuardian, put out this statement in response. Their representatives would not comment further on the subject, referring only to the statement. Bluetack, on the other hand, have been very vocal about it. ‘m00re’ said “whomever the person/persons are that made the flawed decision to maliciously target a non threatening application like PG2 is clearly a moron.” whilst ‘firstaid’ suggested that “people call them and have them stop having their product remove PG2 from their systems.”
ESET defended the addition, “By blocking update and threatsense servers detection of PeerGuardian as potentially unwanted application is fully justified as it could disrupt normal operation of NOD32 and or ESS.”
However, ESET has now changed it’s mind, saying “We have reconsidered detection of PeerGuardian and it will be removed in the upcoming update. However, we will actively continue protecting our users from blacklists that contain the IP addresses (ranges) of our update servers and thus preventing our paying or trial users receiving updates and keeping their computers protected.”
Previously: Mininova: Serving Billions of Torrents and Buying Bugattis
Next: Oscar Winners 2008 Popular on BitTorrent
215 Responses (Add yours or TrackBack)
Pages: « 1 2 3 4 [5] 6 7 8 9 » Show All
[quote comment="297589"]Do you pay for pg? You choose to have it on your computer, so that kind of agreeing to just about whatever it does. Besides that you can alter the lists yourself. I don’t see any harm done here. They are just trying to lookout for you.[/quote]
Again, you could say exactly the same about NOD32. The difference is that if Nod32 does something really bad, they have this list of offices and phone numbers to contact people, to deal with it (one of the bluetack admins, as I wrote above, even psoted it to the forums). Bluetack screws the pooch, there’s email, their own forum, and IRc, and thats it. Complaints are usually treated by Bluetack with either ignored emails, deleted forum posts, and IRC bans.
[quote comment="297592"]Again, you could say exactly the same about NOD32.[/quote]No you cannot.
Again: Users will not be pursued, logged, watched (with negative-result-for-said-users forces behind it) for updating virusscanner files. They WILL be pursued for trying to get Nod32 for free, for example. Which is highly prevented with the use of PG. Obviously ESET doesn’t like to lose money on p2p distribution of pirated copies, period.
[quote comment="297592"]Complaints are usually treated by Bluetack with either ignored emails, deleted forum posts, and IRC bans.[/quote]Ah, there you have it: They have never failed me or any of my requests or questions. You seem one of those angry victims of your own suspicious actions. I’d have banned you too, most likely.
I find it quite disturbing to see this site clearly siding with a stupid money-hungry virus-company over this. PG is open source, NOD32 isn’t. There are reasons for that.
For those who have missed the motives behind this:
http://torrentz.com/searchA?q=nod32
One of the recent ones up there had the dreaded detected peer in a swarm. Yes, I’d say that qualifies as suspicious. Ego-checking your own software’s cracks is not very smart. They’re just sad cowards for having been caught snooping, and now they try and turn it around on bluetack. bad losers.
TorrentFreak, why do you have a blatant shill for media companies like Ben Jones writing for you? This place gives me the creeps now after seeing his performance.
Sorry, I was a bit sleepy when I wrote the following;
[quote comment="297590"]They both look way too cold, official and biased to be trusted. Before you know it,[/quote]They both was refering to “verification and research” not, at anything else..
[quote comment="297590"]Oh and for the other idiots posting against the use of PG; Do you know the actual stats on PG usage and the amount of PG users caught in one way or the other by anti-p2p groups/the law? I do. None of them were using PG, ever.[/quote]That last bit was meant to read: None of the ones caught were using PG, ever. - Which, by the way, is true. ;-)
[quote comment="297607"]For those who have missed the motives behind this:
http://torrentz.com/searchA?q=nod32
[/quote]
Looks like its seeded very well. They are hurting them selfs when bringing this to attention.
There are just as many valid reasons for using blocklists as there are reasons for saying they don’t work or to put it in a better way they don’t offer 100% protection but this is not what this should be about!
Both ESET and Bluetack are at fault here.
Is that really so hard to see!?!
Bluetack shouldn’t have banned them in the first place without any ‘real evidence’ (if they don’t ban ranges because of stupid reasons the lists will provide even less security tho) and NOD shouldn’t have added PG (which has nothing to do with Bluetack in the first place big lol at that).
The only difference is ESET is a company and however made that decision is a true moron.
BT always does stuff like this and is therefore not a bit better than ESET.
So both sides are morons and they didn’t handle the situation very well.
On another note:
I wouldn’t really trust someone with my security stuff who makes an irc ’screenshot’ with a camera *shakes head*.
It seems the entire admin base of BISS are here trolling this thread because once again they have been caught abusing Peer Guardian users trust with their ridiculous blocklists, what started out as an excellent idea has denigrated into a “power trip” by those supposedly acting to protect file sharers.
As a file sharer myself and responsible for the best part of 250,000 users affected by the lists given out by Blutak I can claim some authority to speak aloud, they they do not represent the file sharing community.
It wont matter how many trolls you deploy BISS, the facts wont change, instead of cleaning up your act you threaten, abuse and mislead folks who ask questions you cannot answer such as why you seek to pretend you have some technical methods of detecting anti p2p folks when after discussions on your forum its 100% clear you do not, you couldnt even hold your own in the two conversations that have since been hidden from the public on your forum, not only where you unable to state why you felt it was ok to block an entire p2p network but you had no clue as to how the network operated, something that scared me as I was prior to that a PG user myself.
The end of the day comment is ppl like myself have the technical level of expertise to do the job properly and look only with sadness at BISS for making a great idea something thats an enemy to filesharers, its 2008 BISS, clean up your act, and dont waste your time shooting the messenger when mistakes are revealed, we SHOULD all be on the same side, learn to say sorry.
I would not pretend to claim no one using PG has ever been sued, this is not only wrong but factually inacurrate, BayTSP and MediaSentry have been logging many P2P networks activities for many years using various IP,s not on any of the blocklists to harvest traffic, to claim otherwise is to delude yourself, I am aware of a small quantity of user who have received notices of copyright infringing activity from their ISP’s whilst using PG over the years, lets stop with the propaganda please.
buhahahhahaha! die motherfuckerS!!!!!
Good gravy, people. Like people have been posting all over this thread, PeerGuardian is COMPLETELY USELESS. I wish more people would understand this. Here’s a little thought experiment. Let’s pretend that you have PG installed, and blocklist which perfectly describes all IP addresses used by the MPAA (this is laughably far from the truth, but that’s not the point). And let’s say you’re downloading a copy of Shrek from mininova.
If the MPAA wants to see who is downloading that copy, they don’t ever need to make a connection to your computer. They make a connection to the torrent’s tracker and they ask it for a list of every IP address in the swarm. That’s what a tracker does, it tracks your IP address and tells you the addresses of other peers.
So even though you have PG running, the MPAA doesn’t ever need to try to connect to you and get blocked. They already have your IP, and they’ll go ahead and send a subpoena to your ISP. Why should they waste their bandwidth trying to connect to you?
This isn’t a case of “PG is not perfect but it might help.” PG is totally useless with a perfect list, and this article is a clear demonstration that the quality of the lists is way, way worse than perfect.
If you think you are safe with peerguardian you are so wrong.
Lets not forget who are we fighting and how much money they have: enough to buy servers around the world at any isp. Lets block the ip of their servers? Oh yeah guess what? They have even more money and all you get is a stupid blocklist that probably blocks legit stuff too.
Everyone should know that you cannot be 100% safe with a blocklist (pg)
and anti-p2p companies often change their ip’s to stay away from the blocklist.
However you do block BAD connections and no one can access you from those ip’s so that means they constantly need to move on.
Look,… if no one is using a blocklist that means anti-p2p companies can constantly use the same ip and it will be much easier for them to do their job.
blocklists are good if they are UP-2-Date.
The childish Bluetack kiddies should ask mummy to wipe their snotty noses occasionally.
Ben Jones, thanks for an informative AND investigative post (except for the headline, should be the other way around).
This article gives me a bit of faith into this site again. No blatant “self-linking” to old posts instead of sources etc.
Thanks!
One important thing, it was never added as “malware” to the database.
It’s detected as “Potentially unwanted application”, something the customer specifically has to decide if he wants to detect during installation of NOD32.
ESET probably makes the BEST AV software there is. Seems a bit hasty to block them right off the bat. Maybe an employee at eset was a member of the tracker?
Either way, seems as though ESET was more or less right.
[quote comment="297577"][quote comment="297531"][quote comment="297082"]this is the standard argument that bluetack makes when it adds a block, swapping PG with nod32 and bluetack with ESET - why doesn’t the same arguments work the other way?) [/quote]
Well take a guess! Because the one yields a very expensive and considered illegal act, punishable by law, very unfortunate for the user, and the other doesn’t.
[/quote]
Punishable for what? Libel? Yeah, Were Eset to act like Bluetack, they’d have been sued many times over for Libel. Bluetack, well, i’m guessing thats why no-one actually knows who they are.
[/quote]
You are a little off the path here. Bluetack is a community effort. Bluetack allows people to make a choice. Bluetack blacklists are ‘freeware’.
You are welcome to use or not use their lists. There is no use libeling them every chance you get. You are just like the guy who downloads a free copy of Linux and then constantly complains about it not being just as easy to use as Windows; it’s FREE, don’t use it if you don’t like it!!!
You are welcome to make your own list. Good Luck! Quit libeling the Bluetack community! I’d like to see how friendly you are with the whiney n00bs after you spend a few years creating a FREE blacklist.
PG2 users have a good reason to press a class action suit against ESET. ESET has zero legal recourse against Bluetack or PG2. It is that simple!
[quote comment="297577"][quote comment="297545"]LOL, that’s probably why it’s freeware, right? I don’t think you understand: We, the users, the people, KNOW how good this list is, because they’ve often added OUR requests, visibly did so, in the open.
This time is a good example. Who are the assholes out for legal threat and thus money-wolves? ESET, not bluetack.[/quote]
Really? you check every IP added to the list? all what, 150,000 of them, each week? Are they still valid? If not, why are they still in the list? Have they provided to you, or anyone else, the evidence behind the block? I remember that Slyck went to test the quality of the lists, by checking the MD-D provided IP addresses. There were so many, it was impossible to do a comprehensive check, but of the ranges tested, only a 2% block rate, and this was after the IPs had been public for more than one update cycle.
You also say ESET are ‘money wolves’ because of a legal threat. Legal threat is a bit strong of a term for a letter from the companies attorney, requesting clarification for the block entries, and to warn that spreading false info may be litigatable. Lawyers are the prefered agent of choice for contacts such as these between two companies (and yes, despite their claims, bluetack is a company)
How do I know this? It’s called research, and it’s called verification. According to bluetack themselves, in discussion with our researcher, the extent of bluetack investigation is who an IP block is registered to. Not ‘who is actually using it’, not what they are using it for, nor ‘who else may be included in that block’.
[/quote]
Again, you are twisting a simple fact into your biased rhetoric. Why are you so concerned with what is on the list? Are you an active member of the Bluetack community? If you are a reporter of the news, why are you attempting to force your bias on the readers? If you feel there are so many problems with the blacklists, why don’t YOU get involved with the community and offer some constructive solutions? Be warned the community may decide against you.
Or, better yet, why don’t you create your own list, from scratch and comment every IP, proving why your list is sooooo much better than Bluetacks….
[quote comment="297577"]
Legal threat is a bit strong of a term for a letter from the companies attorney, requesting clarification for the block entries, and to warn that spreading false info may be litigatable.
[/quote]
That is a ‘legal threat’. See, ‘to warn that spreading false info may be litigatable’ is legalese for ‘we think you are libeling our company and we will sue you’.
So, one of ESET’s servers, according to Bluetack, was connected to a movie(?) torrent(s). Bluetack then blacklisted ESET’s servers. That is what Bluetack does. That is a foundation of Bluetack. Bluetack users have the capability of rejecting any part of the blacklists if they don’t agree. It is their free choice. We don’t have to listen to your bias, to make our decisions. In fact we question why you are so adamant against blacklisting ESET when you refuse to address the main issue.
The main issue here is WHY WERE ESET SERVER CONNECTED TO MOVIE TORRENT(S)???
As a TorrentFreak reporter, I think you should be feverently investigating this issue! Instead, you seem more concerned about the welfare and feelings of a possible anti-torrent company. Instead, you would rather focus your energy babbling about unconfirmed entries in a blacklist created by a leader in antip2p deterrence!
Get your priorities straight!!!
1.) i use both with latest updates .. nothing changed, no virus warning no update blocking ?!
2.) so what ? even if .. fuck em both i disable peerguardian to update and tell nod32 to ignore pg2
3.) is this for american servers or european ?! or both ?!
its logical that a antivirus company PROTECTS it users when a software blocks the virus definitions update servers by making peerguardian malware
and it might well be someone spoofing ip on the torrent ?
http://en.wikipedia.org/wiki/IP_address_spoofing
peerguardin blocks many government tv stations that might well not be smart to block, as they might give users more infomation if a hurricane, tornado or any natural disasters happends!
[quote comment="297783"]and it might well be someone spoofing ip on the torrent ?[/quote]Yeah right. Try and spoof the IP addresses that ESET uses and I’ll send you a million dollars right away.
Sorry, yet another excuse that’s not gonna fly for any serious IT security expert.
[quote comment="297768"]ESET probably makes the BEST AV software there is.[/quote]I’ve seen people write this here many times. It’s simply not true. Do some Google searching on impartial tests on virus scanning software and they’ll end up somewhere in the top 10, but not “the BEST”, ever.
In my long time professional experience, even the free Avira antivir software is a better choice, and has an earlier detecting karma than nod32. Oh, and doesn’t regard PG2 as malware (quite an important feature these days)!
Next to that, if you don’t require real-time scanning (which applies for me personally) clamwin from clamAV is by far THE best virus scanner software around. Oh, and open source.
ESET does not make the best AntiVirus software there is.
[quote comment="297687"]Good gravy, people. Like people have been posting all over this thread, PeerGuardian is COMPLETELY USELESS. I wish more people would understand this. Here’s a little thought experiment. Let’s pretend that you have PG installed, and blocklist which perfectly describes all IP addresses used by the MPAA (this is laughably far from the truth, but that’s not the point). And let’s say you’re downloading a copy of Shrek from mininova.
If the MPAA wants to see who is downloading that copy, they don’t ever need to make a connection to your computer. They make a connection to the torrent’s tracker and they ask it for a list of every IP address in the swarm. That’s what a tracker does, it tracks your IP address and tells you the addresses of other peers.
So even though you have PG running, the MPAA doesn’t ever need to try to connect to you and get blocked. They already have your IP, and they’ll go ahead and send a subpoena to your ISP. Why should they waste their bandwidth trying to connect to you?
This isn’t a case of “PG is not perfect but it might help.” PG is totally useless with a perfect list, and this article is a clear demonstration that the quality of the lists is way, way worse than perfect.[/quote]
Hmmm, hello, anybody in there?
The MAFIAA have to prove they were able to download an actual pirated version of a copyrighted work. IOW, they actually must download the evidence that they will use in court. Just to have a data that you were hooked up to a tracker torrenting some.copyrighted.material.foo does not mean squat and could be used as supporting evidence only.
[quote comment="297700"]Everyone should know that you cannot be 100% safe with a blocklist (pg)
and anti-p2p companies often change their ip’s to stay away from the blocklist.[/quote]Which is WHY bluetack responds so quickly on suspicious activity. Man, you people are stubborn!
Read and learn: http://www.bluetack.co.uk/forums/index.php?s=daa03e6b34a8e1e9ede0ef60b386c7fe&showtopic=18392&view=findpost&p=85958
[quote comment="297687"]Good gravy, people. Like people have been posting all over this thread, PeerGuardian is COMPLETELY USELESS.[/quote]Speaking from personal experiences with the law regarding serving and torrenting I can assure it’s not.
[quote comment="297703"]The childish Bluetack kiddies should ask mummy to wipe their snotty noses occasionally.[/quote]
If you don’t like it, don’t use it. It is that simple.
Why spend the rest of your life proving to the world what a complete immature ass you are?
Pages: « 1 2 3 4 [5] 6 7 8 9 » Show All
Add your response