BleepingComputer.com: Looking for norton sample - pifts.exe

Fase, was it you who submitted the sample to mediafire? If so, if you follow the get request in wireshark, can you post what the response by the server is?

Got it.

From the wireshark logs, my guess is that it is used by Norton to see how many times a particular database update or patch was installed.

GET /n/p?module=2667&product=unknown&version=-1&e=-1&f=-1&g=-1&h=-1&i=0&j=-1 HTTP/1.1
User-Agent: PATCH021809DB
Host: stats.norton.com

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Content-Length: 0
Date: Tue, 10 Mar 2009 16:20:40 GMT
Connection: close

Not sure if all those companies are in cahoots. What makes you think ZA and Google are involved? It appears that the ZA threads are still live.

I will check on file acess, but right now its just pinging their servers when a new update is installed.

Symantec, Norton AntiVirus Products
Symantec, the makers of Norton AntiVirus and related products, is reportedly working with the FBI on ways to preclude their products from detecting Magic Lantern. Eric Chien, a top researcher at Symantec, emphasized the ability to detect "modified versions."[9]

NSA spying
In May 2006, USA Today reported that millions of telephone calling records had been handed over to the United States National Security Agency by AT&T Corp., Verizon, and BellSouth since September 11, 2001. This data has been used to create a database of all international and domestic calls. Qwest was allegedly the lone holdout, despite threats from the NSA that their refusal to cooperate may jeopardize future government contracts,[7] a decision which has earned them praise from those who oppose the NSA program.[8]
U.S. District Judge Anna Diggs Taylor on August 17, 2006 ruled that the government's domestic eavesdropping program is unconstitutional and ordered it ended immediately. The Bush Administration has filed an appeal in the case which has yet to be heard in court.[9]
Former Qwest CEO Joseph Nacchio, who was convicted of insider trading in April 2007, alleged in appeal documents that the NSA requested that Qwest participate in its wiretapping program more than six months before September 11, 2001. Nacchio recalls the meeting as occurring on February 27, 2001. Nacchio further claims that the NSA cancelled a lucrative contract with Qwest as a result of Qwest's refusal to participate in the wiretapping program.[10]
A social media experiment and website covering the Qwest holdout, Thank you Qwest dot Org, built by Netherlands-based Webmaster Richard Kastelein and American Expatriate Journalist Chris Floyd, was covered by the CNN Situation Room,[11]USA Today,[12]New York Times,[13][14]International Herald Tribune,[15]Denver Post,[16][17]News.com, [18] and the Salt Lake Tribune [19]

Qwest Communications Corporation QWEST-INET-11 (NET-67-128-0-0-1)
67.128.0.0 - 67.135.255.255
SwapDrive QWEST-IAD-SWAPDRIVE4 (NET-67-134-208-128-1)
67.134.208.128 - 67.134.208.255