Broadband Tech > Security > Security > veloz scumware seen on comercial just now

reply to novaflare

Re: veloz scumware seen on comercial just now

reply to novaflare
NovaFlare:

Could you post the Spybot scan log -- or at least the relevant portions that show the files that were detected? I'd be most interested in taking a look at it.

Best,

Eric L. Howes

said by eburger68:

---

NovaFlare:

Could you post the Spybot scan log -- or at least the relevant portions that show the files that were detected? I'd be most interested in taking a look at it.

Best,

Eric L. Howes

---

reply to novaflare
stop sign veloz related

eAcceleration: Uninstall settings (Registry key, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VelozSpeedup

eAcceleration: Desktop link (File, nothing done)
F:\Documents and Settings\nova flare\Desktop\Scan Now for Viruses and Threats.lnk

eAcceleration: Autorun settings (Registry value, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WebScan

eAcceleration: Autorun settings (Registry value, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\eanth_critical_update_alert

eAcceleration: Autorun settings (Registry value, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\EanthologyApp

eAcceleration: Browser helper object (Registry key, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6ACD11BD-4CA0-4283-A8D8-872B9BA289B6}

eAcceleration: Class ID (Registry key, nothing done)
HKEY_CLASSES_ROOT\CLSID\{656306C3-068A-488c-9770-8AE3ED35679C}

eAcceleration: Class ID (Registry key, nothing done)
HKEY_CLASSES_ROOT\CLSID\{D68CB49A-FB70-443e-B0EF-E8A4B27EBF43}

eAcceleration: Class ID (Registry key, nothing done)
HKEY_CLASSES_ROOT\CLSID\{631DA4A3-394A-4a1d-96B6-BB8513D9CDCD}

eAcceleration: Class ID (Registry key, nothing done)
HKEY_CLASSES_ROOT\CLSID\{D4ED8B39-DD6A-4e2e-89E6-B9B9714E71FF}

eAcceleration: Class ID (Registry key, nothing done)
HKEY_CLASSES_ROOT\CLSID\{D735E314-BE29-41d5-B3C6-7BE67E7D9411}

eAcceleration: Class ID (Registry key, nothing done)
HKEY_CLASSES_ROOT\CLSID\{83CF8444-9A11-4d27-9002-BF99CBB403F3}

eAcceleration: Class ID (Registry key, nothing done)
HKEY_CLASSES_ROOT\CLSID\{5E376569-EF05-403e-9771-0824A45413F9}

eAcceleration: Class ID (Registry key, nothing done)
HKEY_CLASSES_ROOT\CLSID\{41EC560D-9371-4923-B0AD-F6A9504D3AA0}

eAcceleration: Class ID (Registry key, nothing done)
HKEY_CLASSES_ROOT\CLSID\{F63C5B10-B709-4DF5-BA27-B90102AD313B}

eAcceleration: Class ID (Registry key, nothing done)
HKEY_CLASSES_ROOT\CLSID\{BB83FD23-AC96-472D-8AA2-7D8560A61D1A}

eAcceleration: Class ID (Registry key, nothing done)
HKEY_CLASSES_ROOT\CLSID\{878C1976-66AB-4454-A9B1-40CD594AC223}

eAcceleration: Class ID (Registry key, nothing done)
HKEY_CLASSES_ROOT\CLSID\{46D570D9-71C8-44E5-A76C-AADFE94442CA}

eAcceleration: Class ID (Registry key, nothing done)
HKEY_CLASSES_ROOT\CLSID\{459729AC-727D-4D97-B18A-72EE224EFEC0}

eAcceleration: Class ID (Registry key, nothing done)
HKEY_CLASSES_ROOT\CLSID\{6ACD11BD-4CA0-4283-A8D8-872B9BA289B6}

eAcceleration: Common files (Directory, nothing done)
F:\Program Files\Common Files\eAcceleration

eAcceleration: Context menu handler (Registry key, nothing done)
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\StopSignRCS

eAcceleration: Global settings (Registry key, nothing done)
HKEY_LOCAL_MACHINE\Software\eAnthology

eAcceleration: Global settings (Registry key, nothing done)
HKEY_LOCAL_MACHINE\Software\Acceleration Software International Corporation

eAcceleration: IE extension (Registry key, nothing done)
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{2F099F5D-7003-4441-82C2-707C7C273FEB}

eAcceleration: Interface (Registry key, nothing done)
HKEY_CLASSES_ROOT\Interface\{E6A8EE26-1FAD-431C-99D6-8DBA1E25CD72}

eAcceleration: Interface (Registry key, nothing done)
HKEY_CLASSES_ROOT\Interface\{D951B1F4-7399-426A-A925-D2C41FCF2002}

eAcceleration: Interface (Registry key, nothing done)
HKEY_CLASSES_ROOT\Interface\{BB80B457-F3F6-4992-A0C3-A128D58C7FB2}

eAcceleration: Program directory (Directory, nothing done)
F:\Program Files\Acceleration Software\

eAcceleration: Root class (Registry key, nothing done)
HKEY_CLASSES_ROOT\MSEaid.Gd

eAcceleration: Root class (Registry key, nothing done)
HKEY_CLASSES_ROOT\eAnthology.eAnthSpamBlock

eAcceleration: Root class (Registry key, nothing done)
HKEY_CLASSES_ROOT\eAnthology.eAnthScanner

eAcceleration: Root class (Registry key, nothing done)
HKEY_CLASSES_ROOT\eAnthology.eAnthPopupBlock

eAcceleration: Root class (Registry key, nothing done)
HKEY_CLASSES_ROOT\eAnthology.eAnthKonx

eAcceleration: Root class (Registry key, nothing done)
HKEY_CLASSES_ROOT\eAnthology.eAnthIntro

eAcceleration: Root class (Registry key, nothing done)
HKEY_CLASSES_ROOT\eAnthology.eAnthEmailSensor

eAcceleration: Root class (Registry key, nothing done)
HKEY_CLASSES_ROOT\eAnthology.eAntheAnthGen

eAcceleration: Root class (Registry key, nothing done)
HKEY_CLASSES_ROOT\Eac_mindef.MDefControl.1

eAcceleration: Root class (Registry key, nothing done)
HKEY_CLASSES_ROOT\Eac_mindef.MDefControl

eAcceleration: Root class (Registry key, nothing done)
HKEY_CLASSES_ROOT\Webcelerator.WebcBrowserHelper

eAcceleration: Type library (Registry key, nothing done)
HKEY_CLASSES_ROOT\TypeLib\{963DD0FF-4836-4DE4-9590-D7EFE8F62F8D}

eAcceleration: Type library (Registry key, nothing done)
HKEY_CLASSES_ROOT\TypeLib\{3E072AB7-3CDA-4536-8AFD-56B0FE6846B4}

eAcceleration: Uninstall settings (Registry key, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EanthTutor

eAcceleration: Uninstall settings (Registry key, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\webscan

eAcceleration: Uninstall settings (Registry key, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\StopSignEac

eAcceleration: Uninstall settings (Registry key, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EanthologyApp

eAcceleration: Version setting (Registry key, nothing done)
HKEY_CLASSES_ROOT\Defender.ScanGUi

eAcceleration: Version setting (Registry key, nothing done)
HKEY_CLASSES_ROOT\Defender.ScanCore

im not sure what this is exactly just that it wasnt there before the stop signn install

Kazaa.Irc.Spybot13.World: Settings (Registry value, nothing done)
HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun

Kazaa.Irc.Spybot13.World: Settings (Registry value, nothing done)
HKEY_USERS\S-1-5-21-2052111302-789336058-1343024091-1003\Software\Microsoft\Windows\CurrentV ersion\Policies\Explorer\DisallowRun

Kazaa.Irc.Spybot13.World: Settings (Registry value, nothing done)
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun

All the rest was just trackign cookies and that sort of bs i get those all the time. Checking ebay things like that .
--
new 3d chat comunity at »planetvirtuel.com
my site »spellbound.valshea.com/news.php

reply to novaflare
Thanks novaflare. Now I can inform my clients to stay the hell away from it and just use what's been recommended at this forum(which is what I've been telling them anyway, but now I have more proof to show them).Saved me from finding out the hard way(again). One of our kids is a network admin. for several small(and not so small) businesses and curious what the deal was, so I told him to check this out. So now he can warn his clients. Thanks again.

said by DonoftheDead:

---

Thanks novaflare. Now I can inform my clients to stay the hell away from it and just use what's been recommended at this forum(which is what I've been telling them anyway, but now I have more proof to show them).Saved me from finding out the hard way(again). One of our kids is a network admin. for several small(and not so small) businesses and curious what the deal was, so I told him to check this out. So now he can warn his clients. Thanks again.

---

reply to novaflare
novaflare:

I'm glad you posted that log, because the log doesn't tell the same story as you told earlier.

First, you didn't say whether or not you ran the Add/Remove Programs uninstaller. From the looks of the log, I'm guessing you didn't -- which is the reason we see so many eAcceleration Registry keys. If I'm wrong and you did run the vendor-supplied uninstaller first, then eAcceleration needs to improve its uninstaller.

Second, Spybot did not find any "kazaa related files," as you put it. What it found were some Registry keys -- not files -- that are not Kazaa specific. In fact, those Registry keys are perfectly normal Windows 2000/XP/2003 Registry keys used for Group Policies. See these pages from Microsoft:

»www.microsoft.com/windows2000/te···3501.asp
»www.microsoft.com/resources/docu···3626.asp

Now, I don't know what added those particular keys -- perhaps eAcceleration did. But the presence of those keys is not a surefire indication that "kazaa related files" were installed on your box. Still less are they an indication that the program that put them there is "spyware."

In fact, those keys can be used to BLOCK the execution of Kazaa -- or any other program deemed unsafe by the Admin of the computer or network. See:

»www.computing.net/netware/wwwboa···275.html

...for instructions and an example.

As I said in an earlier post, we need to be extremely careful in evaluating reported detections by AV programs and anti-spyware programs lest we succumb to galloping speculation that leads to unsupported, unwarranted conclusions.

Eric L. Howes

reply to novaflare
Novaflare, thankyou thankyou !!

These are the allegations that need checking, sorry I didn't catch you earlier.

The test/experiment is not on primarily whether the test software (stopsign) "is it a good product" or "does it have bugs".

The test/experiment is on whether PestPatrol's writeup of it is accurate.

quote:

---

Disables security software. Purports to be security software.
Adware - displays numerous popups recommending purchase of various Acceleration Software products.
Firewall Killer - interferes with operation of several personal firewalls.
Loader - quietly installs other files.
Exploit - uses social engineering and stealth tricklers to gain control of the system.

---

reply to novaflare
keith2468:

So far as I can tell the Pest Patrol write-up stems from the earlier versions of eAcceleration's -- specifically, the versions that got eAcceleration sued and justly earned the company a poor reputation. Thus, I don't think you'll find many reports of similar behavior in the current versions.

What you'd need to do to fully test Pest Patrol's claims is get your hands on an earlier version of Stop-Sign --preferably late 2002/early 2003.

The earliest Pest Patrol write-up listed on The Internet Archive ( »www.archive.org/ ) is from April 29, 2003. That version doesn't seem to be accessible at the moment for some reason. The July 4, 2003 version is, and it's pretty much the same as the write-up that appears on Pest Patrol's site now. I have another version from September of 2003 -- again, substantially similar to what appears today.

Since I've tested the latest version of Stop-Sign, let me briefly comment on the claims that you identify.

quote:

---

Disables security software. Purports to be security software.

---

quote:

---

Adware - displays numerous popups recommending purchase of various Acceleration Software products.

---

quote:

---

Firewall Killer - interferes with operation of several personal firewalls.

---

quote:

---

Loader - quietly installs other files.

---

quote:

---

Exploit - uses social engineering and stealth tricklers to gain control of the system.

---

said by eburger68:

---

Stop-Sign does install a few games as well as shortcuts for an email service named kon-X (an admittedly poor choice of names)

---

reply to novaflare

reply to novaflare
I must say I like their little googley eyed icon, it's great.

reply to Martinus
Martin:

You wrote:

said by Martinus:

---

So, basically, what we have here - and let's wipe out everything regarding the stub downloader - is a security app which in its trial version doesn't clean anything but where the retail version installs a few games? A few games???

---

said by Martinus:

---

This may be a whole new marketing concept from someone fresh from Harvard or Northwestern University which the big AV players still have not discovered and thus risk losing market share to this revolutionary bundle. It strikes me as a strange philosophy though. "We won't clean your box with the trial version but you will be able to play several games with the retail one". Amazing.

---

said by Martinus:

---

Now, if we go back to basics, what is this AV record regarding malware? How is heuristics? What about signatures? Is there any objective reason, even an economic one, why anyone would or should buy Stop-Sign rather than say, McAffee, NAV, KAV, BitDefender, NOD32, Panda et al?

---

reply to eburger68

Here is my latest Herpes!

You will have the added bonus of showing your guest " My Scars" since DrWeb is in fact doing that surgery at Stop Sign on an Accelerated basis.
--
Gladiator Security Forum »www.gladiator-antivirus.com/ Missing Kidshttp://www.missingkids.com/

reply to Martinus
LMAO:D:D
Looks more like the diary of a VD patient

reply to eburger68

said by eburger68:

---

novaflare:

I'm glad you posted that log, because the log doesn't tell the same story as you told earlier.

First, you didn't say whether or not you ran the Add/Remove Programs uninstaller. From the looks of the log, I'm guessing you didn't -- which is the reason we see so many eAcceleration Registry keys. If I'm wrong and you did run the vendor-supplied uninstaller first, then eAcceleration needs to improve its uninstaller.

Second, Spybot did not find any "kazaa related files," as you put it. What it found were some Registry keys -- not files -- that are not Kazaa specific. In fact, those Registry keys are perfectly normal Windows 2000/XP/2003 Registry keys used for Group Policies. See these pages from Microsoft:

»www.microsoft.com/windows2000/te···3501.asp
»www.microsoft.com/resources/docu···3626.asp

Now, I don't know what added those particular keys -- perhaps eAcceleration did. But the presence of those keys is not a surefire indication that "kazaa related files" were installed on your box. Still less are they an indication that the program that put them there is "spyware."

In fact, those keys can be used to BLOCK the execution of Kazaa -- or any other program deemed unsafe by the Admin of the computer or network. See:

»www.computing.net/netware/wwwboa···275.html

...for instructions and an example.

As I said in an earlier post, we need to be extremely careful in evaluating reported detections by AV programs and anti-spyware programs lest we succumb to galloping speculation that leads to unsupported, unwarranted conclusions.

Eric L. Howes

---

reply to novaflare
That is what I expected: bickering and libel between competitors, and hurting consumers by taking away their choices, and discouraging other companies from entering the industry.

But do you have any links to the story of eAdvantages legal history anyway? (I'm too disillusioned to go back through the 10 pages of posts.)

PestPatrol, and companies that seem to be following PestPatrol's guidance in this, are recognizing the current version of StopSign -- so they are keeping up with the version changes.

They must see that the allegedly harmful files they claim used to be there are no longer there. And they write signatures to detect the new apparently innocent files.

For the download stub, "download stub" is just the term for a little download program. These days security and other products use them mainly to protect the download from alteration by malware. Either PestPatrol always knew the stub was just a downloader, and summarized it as a trojan, or they updated their signature file to recognize the new innocent downloader and kept the old summary description.

But the proof will be if PestPatrol fails to remove the StopSign from its malware list now.

To my value system calling a product a trojan or spyware when it doesn't fit the standard description of that (or as it no longer is), and removing it, is worse than calling it attackware and asking the user to remove it.

And that is especially true when the other companies attack you first. There is a principle of self-defense.

StopSign isn't the only product to be treated like this. I think this is partly why investors and entreprenures don't get into the IT security field more, why we have so many products done part-time between contracts or by students. (I use their products and I'm very grateful, but to keep up with CWS and things like that requires an organized team working full time.)

Okay, I tried all of the free AV scanners before I added them here: »Security »What are some web based virus scanners and encyclopedias?

I think they pretty much all promote the paid-for version every time you run a scan, often before and again more prominently afterwards. There is one that even has a pop-up promoting the full version.

And the free scanner here: »www.mwti.net/antivirus/free_utilities.asp
works by downloading a .exe. It doesn't install like a full application package, but it doesn't run as a web application either.

Possibly if you'd installed the firewall part of StopSign it would have asked you to uninstall ZoneAlarm or Sygate. But the installation instructions and FAQs of ZoneAlarm and Sygate recommend the exact same thing -- you are only supposed to run one software firewall at time (although Windows ICF is sometimes an exception).

If I understand correctly you didn't install the anti-virus monitor, just the scanner. So perhaps if you'd installed the anti-virus monitor it would have prompted you to uninstall any other AV monitor. Again that is an industry standard recommendation, not something specific or special about StopSign: do not run more than one anti-virus monitor at a time. And KAV 5 also does a check to ensure that no other AV is running when it is installed.

You think eAdvantage is bad for dirty tricks on consumers?

You have no idea (and I really have no idea, just a few examples) of what goes on that we don't see.

IBM was once fined because its technicans were physically sabotaging competitors photocopiers in public libraries. That was back in the 1970s. I can't recall the settlement, but it might have been $10m. It was reported in Time Magazine if anyone wants to check on the amount.

Then there is the industrial espionage.

When you work at IBM, if you are writing on a whiteboard that is visible through the windows, even if on the third floor, you are supposed to always draw the blinds. There is a sticker to remind you of this on the white board. So IBM has seen expionage attacks on itself too.

And there is getting a process written into an industry standard without telling others on the standards committee that you hold a patent on it.

I'll just end up with the security companies that find obscure vulnerabilities, create defenses against them, put those defenses for sale on the market, and publicize the vulnerability openly, including sample code and coding tips for getting around unrelated protective measures built into the OS. Protection racket or what? (The practice has been dying out over the past 2 years.)

This thing with StopSign never had the ring of truth about it.

I figure if you have a paid help desk assisting customers in the removal of adware, there is no way your product could be real adware -- otherwise your help desk staff would never be able to close a call -- the customers would complain about symptoms as long as your product was installed.

This is an embarrassing profession to be in.
--
(Virus&Hijacking FAQ + Submit suspected malware + Backups FAQ + Security FAQ TOC)

Keith2468:

You wrote:

quote:

---

That is what I expected: bickering and libel between competitors, and hurting consumers by taking away their choices, and discouraging other companies from entering the industry.

---

quote:

---

But do you have any links to the story of eAdvantages legal history anyway? (I'm too disillusioned to go back through the 10 pages of posts.)

---

quote:

---

PestPatrol, and companies that seem to be following PestPatrol's guidance in this, are recognizing the current version of StopSign -- so they are keeping up with the version changes.

They must see that the allegedly harmful files they claim used to be there are no longer there. And they write signatures to detect the new apparently innocent files.

---

quote:

---

For the download stub, "download stub" is just the term for a little download program. These days security and other products use them mainly to protect the download from alteration by malware. Either PestPatrol always knew the stub was just a downloader, and summarized it as a trojan, or they updated their signature file to recognize the new innocent downloader and kept the old summary description.

---

quote:

---

But the proof will be if PestPatrol fails to remove the StopSign from its malware list now.

---

quote:

---

To my value system calling a product a trojan or spyware when it doesn't fit the standard description of that (or as it no longer is), and removing it, is worse than calling it attackware and asking the user to remove it.

And that is especially true when the other companies attack you first. There is a principle of self-defense.

---

quote:

---

If I understand correctly you didn't install the anti-virus monitor, just the scanner. So perhaps if you'd installed the anti-virus monitor it would have prompted you to uninstall any other AV monitor. Again that is an industry standard recommendation, not something specific or special about StopSign: do not run more than one anti-virus monitor at a time. And KAV 5 also does a check to ensure that no other AV is running when it is installed.

---

quote:

---

You think eAdvantage is bad for dirty tricks on consumers?

You have no idea (and I really have no idea, just a few examples) of what goes on that we don't see.

---

quote:

---

Then there is the industrial espionage.

---

quote:

---

This thing with StopSign never had the ring of truth about it.

---

reply to novaflare
well keith as i told the rep in my email
I will help them to rebuild their reputation if they can show me a few simple things
1 ditch the free scan and scaretatic advertisements from both tv and web
2 make the product easyer to install and uninstall i mean realy easy as in click a couple times installed click a couple more times uninstalled. (programs barely need to be installed realy a few reg entries and unzipping)

They take those 2 steps ill try stop sign once more and put it through its paces if it shows promise ill work with them further in a beta tester type deal to try and break the sucker in odd ways causeing the uninstaller to go stupid things like that.

Thing they need to do soon lose the other various names quit trying to get customers by hideing who they are/were by useing half a dozen names. Cut back to one or to say veloz and stop sign like stop sign made by veloz something of that nature.
Id also like to see people in the know at the company posting here often under a accoutn not anonomously. By in the know i do not mean customer service rep or help desk personal get a programer in here some one who the compunity cant talk to about isues that will crop up.
--
new 3d chat comunity at »planetvirtuel.com my site »spellbound.valshea.com/news.php