PIFTS.exe is a Norton Embedded feature that logs literally everything from history, temp files, cookies, etc. First discovered by a 4chan user on /g/ who was subsequently told to make a thread on the Norton forums to find out just what the **** was going on. After said post was made, it was deleted by the Norton moderators. It was also soon discovered that all Google references to the Pifts.exe had mysteriously vanished from the interwebs. and it tries to contact a shady online storage place

they recently acquired. Let’s do a lookup on swapdrive! 67.134.208.160:80 is where PIFTS.exe asks to connect to.

Administrative Contact:
Wallace, Marc
Web Data Group, LC
PO BOX 7241
ARLINGTON, VA 22207-0241
US
703-352-1578

www.webdatagroup.com

Click on “Competitive intelligence.” Interesting! They talk about military intelligence gathering right on the page. So this “update” is scraping internet history and temp data and trying to contact a company who does online storage with shady ties to intelligence gathering. If it is datamining, Americans need not be surprised, we had AT&T do it on our phones and some act as if our computers are immune. Hey, let’s look more into one of the owners of Swapdrive in the Web Data Group! There are more interesting people than Marc Wallace.

“Roland Schumann is a former military intelligence officer, having served both on active duty and in the reserves. Trained in unconventional warfare and electronic intelligence gathering, he also has practical experience in airborne operations, human intelligence (HUMINT), counter-intelligence, and counter-terrorism. He has performed risk analyses in Latin America for the US government and in the United States for commercial and government interests.”

It is helped to be run by a former military intelligence officer. So there you have it, you have very shady actions by Symantec regarding the whole thing making people suspicious by deleting any mention of it, they claim it is a simple update, and when we dive into it, we find out it scrapes your internet history and temp files, interfaces with Google Desktop (G O E C 6 2 ~ 1 . D L L ) , and then where does it try to go? It tries to jump straight to Swapdrive (we know this because it asked permission to go to 67.134.208.160:80, which is Swapdrive). Who owns swapdrive? The Web Data Group based out of Arlington (wow, the same place the Pentagon is located, what a coincidence) who has a statement about using military intelligence information gathering right on their website and who has owners with shady backgrounds as army intelligence officers, and when Symantec is asked about PIFTS.exe, it immediately tries to cover it up and deletes everything related to it in a very suspicious fashion. Follow the trail, do some research, dig around.

Oh no folks, move along, certainly nothing interesting to see here!