1 edit | reply to novaflare
Re: veloz scumware seen on comercial just now Martin:
I think you missed my point. My point was that the term "Win32.Wren" is simply another name for the eAcceleration stub downloader. That's it, that's all. Thus, trumpeting the fact that a few AV programs flagged a "trojan downloader" in the eAcceleration .CAB files is overblown, because it makes it sound like the .CAB files are bundling something else nefarious when in fact the AV programs are merely identifying the eAcceleration product with another name.
Those .CAB files do bundle a stub downloader -- what the AV programs are labeling a "trojan downloader." The stub downloader unpacks from the .CAB file, executes, and downloads and installs the rest of the eAcceleration Stop-Sign package.
My guess is that the AV companies labeled the stub downloader a "trojan downloader" because of the "drive-by-download" installs at third-party web sites (coupled with onboxious, deceptive advertising detailed in previous threads here at DSLR) back in 2002 and 2003. That's what eAcceleration got sued for. And that's what likely prompted the AV companies to label the eAcceleration stub downloader a "trojan downloader" -- because it was being initiated without the full knowledge and consent of users visiting third party web sites to download and install software they didn't want (or need).
So far as I can tell, that kind of advertising has stopped -- under the duress of legal action. If anyone can find an ad at a third-party web site that initiates the download process and installation, please do post a link to it. I haven't been able to find it.
My ultimate point here is to urge people to keep a bit of perspective and not let galloping speculation lead to unwarranted conclusions.
Best,
Eric L. Howes |
|
1 edit | Eric. You are right.
But then again I think this is an issue of credibility. Nothing more and nothing less.
When I click on that Stop-Sign link and KAV pops-up with an alert of a trojan downloader, and when I can confirm that it is not a false positive, taking into account that all major AVs also flag it, I don't really care much what the reason or naming politics are or even why or how this stuff tries to get in your box. That's all an academic exercise.
The only real thing here is that if you download an AV, it should not contain dubious code. And I say dubious giving these guys some slack.
I can understand that if you install Kazaa or the DivX player, ok, there are some things you will need to cope with, but an AV is a whole different, dare I say,ethics game.
I mean. If you can't trust your AV, who you gonna trust? 
--
From the GSV "Ethics Gradient" |
|
 keith2468Premium,MVM
join:2001-02-03
Winnipeg, MB | Forget God then, Stephen Hawking is now saying he has been wrong about blackholes for 2 decades.
All it will take is an experiment with direct observation on a test computer.
It can't be done with blackholes, but it can be done with stop-sign.
I strongly suspect Eric is right on this about this one file. It sounds like what I've seen anti-adware companies openly admit to -- labelling software based on association -- but again, the experiment is not prohibitively difficult if someone has the system and tools available.
And this is especially so because Kaspersky didn't write up anything in its virus dictionary on the file (that I could find). So I doubt they did their own research on it. And Kaspersky is as good as AV companies get.
You say you get a drive-by download with default settings on a patched up-to-date Windows XP SP2 system with MSIE 6. I don't see that, but then my system has had a lot of security stuff installed over the years, so my system probably has lots of obscure settings that are no longer defaults. Could this be an SP2 bug?
Does anyone with up-to-date MS supported non-beta Windows XP or W2K and non-beta up-to-date MS supported MSIE 6sp1 have this start downloading on its own?
We know that Firefox downloads to the cache anything on a page visited (I read this in a FF topic here), requested or not. So Firefox merely downloading this to cache doesn't mean a hijack -- it is normal Firefox behaviour. Executing it without a user request -- that would not be normal Firefox behaviour.
The real determination on stop-sign requires an experiement and direct observation.
--
(Virus&Hijacking FAQ+Submit suspected malware+Security FAQ) |
|
1 edit | reply to Martinus
Martin:
That an AV program flags the download as containing a "trojan downloader" should be cause for alarm among users. But those looking into the software in a Security forum such as this one need to go beyond that initial report and investigate the underlying basis for the detection ('Win32.Wren Trojan Downloader").
Thus, this endless posting of screenshots of AV programs' detection of the eAcceleration stub downloader doesn't tell us much. We already knew that AV products were flagging the stub downloader as far back as 2002/2003 because of the distribution techniques used by eAcceleration. But the detection in and of itself tells us very little.
Let me be clear: I wouldn't recommend eAcceleration's software to anyone -- and I say that having actually gone through the full download and installation several times at this point and having actually used the software (I've got several megs of screenshots, scan logs, notes, copies of web pages, copies of various versions of the software, et al).
Moreover, I think the AV companies have been perfectly justified in targeting eAcceleration's software based on their past behavior -- behavior for which the company remains completely and utterly unrepentant, by the way. That alone is enough for me to continue to list this software on my "Rogue/Suspect Anti-Spyware" page ( »www.spywarewarrior.com/rogue_ant···ware.htm ) -- because the company is simply not a trustworthy source for anti-malware software, in my judgment.
You'll notice, though, that the entry for Stop-Sign in that "Rogue/Suspect Anti-Spyware" list does not specify that Stop-Sign "installs malware." There's a reason for that: namely, the detection that has been reported in this thread is for the stub downloader itself, not a separate piece of malware. So far as I can tell, you can install Stop-Sign without fear of having a virus, trojan, worm, or other piece of malware dropped on your box. The software may not be a very good anti-malware scanner, but it doesn't install malware itself.
In other words, it's a matter of classification at this point. And readers who see the screenshots of AV programs detecting "Win32.Wren Trojan Downloader" ought to be clear on just why that detection is happening and what it means.
Eric L. Howes |
|
| reply to keith2468
said by keith2468:
Forget God then, Stephen Hawking is now saying he has been wrong about blackholes for 2 decades.
But of course. And this is due to the simple reason that all these reasonnements are theories based on interpretations of measurements - read this right: Interpretations of Measurements -. There is not the tangible Newtonian apple falling to the ground here. It's all human extrapolations and humans, alas, sometimes they are mistaken.
As for this AV. I'm thru' with it. If you want the cab file I still have it in my Recycle Bin. That's the best place I could find for it in my box.
I've used almost all day - except when my wife reminded me that it was my turn to make dinner - writing and posting about this stuff which I know I'll never have nothing to do with but that somehow it hits a nerve in me knowing that a lot of people with good intentions are going to fall in its trap.
If it's a trojan or not in the pure etymological sense, I can't say, but I know that potential customers buying this software as a protecting AV are going to be cheated. And this is a fact that you, I and anybody with a minimum sense of computer security know for sure.
--
From the GSV "Ethics Gradient" |
|
|
|
2 edits | reply to eburger68
said by eburger68:
So far as I can tell, you can install Stop-Sign without fear of having a virus, trojan, worm, or other piece of malware dropped on your box.
Thanks, Eric, but I reckon I'll pass on that invitation for now. I'll remember it though when I go to help my worst enemy cleaning his box and setting an AV for him.
But, of course, instead of installing the free AVG or BitDefender or Avast,or Ad-Aware and SpyBot I'll install this eAnthology - or was it Stop-Sign? - free software which does the following:
"*Free Trial version detects but does not cure threats.
**Free Trial version detects but does not remove spyware.
***Free Trial version has limited functionality."
And if he is satisfied, I'll introduce him to the stub downloader.
--
From the GSV "Ethics Gradient" |
|
 novaflareThe Dragon Was HerePremium
join:2002-01-24
Barberton, OH
1 edit | Re: Does it really matter? said by slimpickinz:
The most common denominator in this thread seems to be IE.
Get a grip.
Shed the IE.
Then it really is a non-issue.
Its not weather or not you use ie its the fact its splatered all over the air waves. And sense they know that people like those on the forums are settign up moz xxxxx on other peoples computers to help lock down their computer against spyware they now use a prompt to install a xpi through firebird(fox) and prob plain old moz as well as netscape. Hopeing that these people that we help to secure in part by installign a moz based browser will click yes to the prompts and get nailed even throguh moz based browesers.
Go there and see for your self in moz make sure moz is set to prompt for xpi installs and isnt allowing them to install promptless. www.veloz.com click free scan do not go here unless you are sure you have every thing set up for prompting and not auto installs Its safe for those with precations in place.
--
new 3d chat comunity at »planetvirtuel.com
my site »spellbound.valshea.com/news.php |
|
 sivranBack to Opera againPremium
join:2003-09-15
Arlington, TX
kudos:1
 ·RoadRunner Cable
| reply to Anon
said by slimpickinz:
The most common denominator in this thread seems to be IE.
Get a grip.
Shed the IE.
Then it really is a non-issue.
You clearly haven't read much of this thread then. Come back when you have, and post something useful, or nothing at all.
Here's hoping NeOm (or another rep) returns tomorrow, I'd like to see his response to some of the replies to his post.
I never got an install attempt from the website, but then I never clicked the "Scan now" link either.
--
TCPA - Treacherous Computing
Kerio 2.1.5 - Best damn firewall
Win98SE - Best all-round Windows OS for home use, period. |
|
 Ben CiscoEmbrace IntellectPremium
join:2001-12-13
Wormhole | reply to Martinus
Re: veloz scumware seen on comercial just now said by Martinus:
...Stop-Sign? - free software which does the following:
"*Free Trial version detects but does not cure threats.
**Free Trial version detects but does not remove spyware.
***Free Trial version has limited functionality."
Ran into this at a client's about a month ago. Anti-virus my ass!
I'm in NC, and I've seen the ads too. To call them misleading would be akin to calling the Atlantic Ocean slightly damp...
--
Nobody's life, liberty, or property is safe while Congress is in session.
Badnarik 2004!
In Search Of...Firing Synapses
|
|
