eEye Digital Security

 When Blink does a virus and malware scan are tracking cookies detected and dealt with?

From my understanding Norman (the AV used in Blink) does not deal a lot with Tracking Cookies, however, a awesome free product to use that you can run that will remove all of them and all other forms of temporary internet clutter from your system, it is called CCleaner.  It goes far beyond cleaning your system of what any AntiMalware product can ever do.

http://www.ccleaner.com/

In the post I made here about another subject dealing with Blink, I described how to configure CCleaner briefly:   http://forums.eeye.com/forums/t/752.aspx

My next question is what browser are you using?  I can help you configure your browser to the best settings so you don't have to worry as much about tracking cookies anymore.

Thanks for the response.  I already use ccleaner.  I only use it about once a month to clean things up and it deletes ALL cookies.  I am use to my old antivirus which deleted tracking cookies in the weekly scan  I didn't see any evidence that blink was doing that.  I actually never see much evidence that blink is doing anything.  I don't know if that is a good thing or a bad thing.  

      Understandable, when I first started using Blink I wondered the same thing.  Blink allows you to use your computer without asking you every friggin 5 minutes are you sure you want to do that??  Are you sure you really want to launch that program??  All the other security products out there are like hyper annoying little poodles barking at your ankles and running to the door everytime there is a noise when it is really nothing.  I have learned to enjoy my computer now instead of having to answer all these prompts from a security application.  Quite frankly, after using Blink for awhile, I uninstalled it and tried what I use to use ... remarkably I was annoyed very quickly and returned to using Blink.  Blink is so much more.  Not many security products offer you a full fledged security vulnerability assessment that you can run on your system to tell you what you have messed up, configured wrong, or that your missing a patch you never realized existed in the first place!

     As far as cookies, a lot of the ones that are used for tracking you come from places like doubleclick, google, and a few other places.  These entities also put all the blinky annoying advertisement ads up on your screen.  Depending on where you go, some of these ads may silently send your system off in the background attempting to connect to another domain which trys to download malware to your system silently without you knowing.  I created an IPS rule in Blink (duplicated from another one that existed) that block your machine from going out and grabbing these ads and so forth.  If your interested in doing the same, I have posted what I did to make the IPS signature in the post located here:  http://forums.eeye.com/forums/t/918.aspx .  I also update it from time to time if I come across a domain that is pushing ads everywhere I go.  Note if you use this, you will see areas in a webpage that are blank with nothing in it or an error box saying the page can not be displayed.  This is the result of these ads being blocked. 

Here are some examples of the log entries that would show in Blink (if you choose to log all of them):

Event ID:  BLINK-IPS-170000 
 Severity:  Information 
 Description:  Additional HTTP Requests 
 Alert: No
 Action: Terminated
 Attacker: 192.168.1.2
 Attacker Port: 4672
 Victim IP: 204.245.162.18
 Victim Port: 80
 Protocol: TCP
 Request: Host: edge.quantserve.com
 Process Path: C:\Program Files\Internet Explorer\iexplore.exe

Here are two from the famous ad and cookie tracking company "Doubleclick".  Google recently aquired this company too.

 Event ID:  BLINK-IPS-170000 
 Severity:  Information 
 Description:  Additional HTTP Requests 
 Alert: No
 Action: Terminated
 Attacker: 192.168.1.2
 Attacker Port: 4658
 Victim IP: 74.125.242.24
 Victim Port: 80
 Protocol: TCP
 Request: Host: ad.doubleclick.net
 Process Path: C:\Program Files\Internet Explorer\iexplore.exe

Event ID:  BLINK-IPS-170000 
 Severity:  Information 
 Description:  Additional HTTP Requests 
 Alert: No
 Action: Terminated
 Attacker: 192.168.1.2
 Attacker Port: 2759
 Victim IP: 74.125.91.154
 Victim Port: 80
 Protocol: TCP
 Request: Host: googleads.g.doubleclick.net

Here is one from the domain (atdmt.com) that runs a lot of flash banner ads and such which sometimes will attempt to redirect your system elsewhere to a site within its domain that trys to install the fake Antivirus program "AV2009" on your system.

Event ID:  BLINK-IPS-170000 
 Severity:  Information 
 Description:  Additional HTTP Requests 
 Alert: No
 Action: Terminated
 Attacker: 192.168.1.2
 Attacker Port: 2728
 Victim IP: 12.130.60.8
 Victim Port: 80
 Protocol: TCP
 Request: Host: view.atdmt.com
 Process Path: C:\Program Files\Internet Explorer\iexplore.exe