Find and block pifts.exe-Norton file

[Ayush]

Hey Friends,

I would like to know that how do i find and block pifts.exe (the Norton sneaky file)? Apparently my security alarm is giving me warning that a pifts.exe is trying to access the internet. So for the safety purpose i would like to know that how do i block pifts.exe? Does any one have any idea about it? Any information on it would be appreciated.

Thanks a lot.

[Milton.J]

Follow the below steps to find out the pifts.exe file:-

The "PIFTS.EXE" file is located within the "C:\Documents and Settings\All Users\Application.

Data\Symantec\LiveUpdate\Downloads\Updt61" folder on my hard drive. The "UpdtXXX" folder (where "XXX" may be any 2 or 3 digit number) will most likely be different in your computer. By default, the "Application Data" folder is hidden. So, you may need to unhide the folder first before viewing its contents. And if searching for the "PIFTS.EXE" file, you will need to alter the "More Advanced Options" to include "Search Hidden Files and Folders". By default, the Windows Search utility does NOT search hidden files/folders.

Here is the best solution that I can recommend for you:-

(1) Uninstall Norton and replace with something like Avast,Nod32 and etc (no MacAfee)

(2)Uninstall Zonal Alaram and use your Windows Firewall.

Both these programs above are not very friendly when they decide to get into a bad mood. They are extremely moody programs when it comes to Windows Xp or Vista is convern

[Spyrus]

PIFTS.EXE appears to be a part of a patching application. The executable itself is unencrypted and contains several interesting bits of text such as:

• Go to the official Norton website for statical analyst.
• The ping url is %s PATCH021809DB
• d:\perforce\entiredepot\consumer_crt\patchtools\patch021809db\release\PIFTS.pdb
• SOFTWARE\Symantec\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifEngine

When you run it goes to the Norton website and you will find nothing suspicious there.

One odd thing is that the PIFTS.EXE executable is padded out to precisely 100KB (102,400 bytes) with a string saying "XXPADDINGPADDINGXX" several times. Presumably Symantec have their own reason for making sure that the file is exactly this length.

PIFTS.EXE appears to be contacting a statisitical tracking server, possibly to report back on the installed version. Perhaps this violates Symantec's privacy policy, perhaps it's part of the testing process that was accidentally included in the update.

[Shen]

PIFTS means Public Internet and File Tracking System. I am currently using both Norton SystemWorks and ZoneAlarm. According to my ZoneAlarm logs, the "PIFTS.EXE" program attempted to access the Internet twice. The first instance was automatically blocked. The second attempt, about 5 hours later, is the one that manually prompted me for a response.

The first attempt that was automatically blocked was attempting to access a destination DNS of " stats.norton.com ". So, my professional guess is that this supposed Norton "Update" was actually being used by Norton for analytical/statistical/demographic information. In other words, Norton was snooping on its users. Or worse yet, profiling its users.

The "PIFTS.EXE" file is located within the "C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\Downloads\Updt61" folder on my hard drive. The "UpdtXXX" folder (where "XXX" may be any 2 or 3 digit number) will most likely be different in your computer. By default, the "Application Data" folder is hidden. So, you may need to unhide the folder first before viewing its contents. And if searching for the "PIFTS.EXE" file, you will need to alter the "More Advanced Options" to include "Search Hidden Files and Folders". By default, the Windows Search utility does NOT search hidden files/folders.