Two days after PIFTS.EXE

I woke up today and decided to check out the Norton forums official PIFTS.EXE topic, in search of what new developments have taken place. I was treated with for the most part, the reiteration of points that myself and others have made countless times throughout the course of the topic. It is sad to see a few sheep are still able to argue with such blunt evidence regarding the deletion of honest topics, and the obvious coverup.

There was one very useful post providing some insight into what actions PIFTS.EXE actually takes, and I'd like to post it here:

An admin over at The Bleeping Computer clarifies why the other content is being accessed:

---

Unfortunately, most people here do not understand programming. The reason why this program opens up so many of these folders is not because they are scraping the contents, but because the libraries and modules they are using to access the Internet automatically access them. I monitored all file access while running the program, and yes they did access the folders, but did not query the contents.

This is just conspiracy theory fodder at its best.

---------------------------------------------------------------------------------------------------------

Slightly reassuring, right? I have only these things to say:

Symantec will most likely not provide us any more information, since they will assume that for the most part, the damage is done. They've "pulled" the patch, despite that it was apparently necessary enough to include in the update at one point. Only a limited number of users will ever hear about it.

They've posted an official statement, and most people will read that, and be satisfied. The information in the official PIFTS.EXE topic will most likely be passed right by.

If the pifts.exe process WAS necessary for them to determine all that information about which clients needed upgrading, upon installation of windows 7 (This, when you think about it, really makes absolutely no sense), then chances are they have remodeled the file so that it now runs in secrecy, and did not actually "pull" the patch.

Beyond that, even if the file is not scraping information from all these "conspicuous" places that it now has access to, who's to say that in the future, new updates might make use of those new access points that Symantec has, on all the users hit by the "blunder" ? Consider upon this, friends :P.

Even if PIFTS.EXE accesses these sensitive areas of your computer as a result of .net framework, or whatever it is it needs to do to "phone home", this at least proves that Norton has no qualms about sending you new executable files that access your computer in unexplained ways, with no "release notes", unsigned, and are not too worried about leaving the issue open for debate for days until really providing any insight whatsoever. They also have no qualms about deleting paying customers topics and posts whenever a support issue comes up, as well as banning them, merely as the result of trying to cover up their own mistake. Not a reassuring way to treat customers, if you ask me.