Is aswBoot.exe malware? in Security

Is aswBoot.exe malware? in Security http://www.dslreports.com/forum/r16652263 en Sat, 28 Nov 2009 21:07:15 EDT Sat, 28 Nov 2009 21:07:15 EDT Re: Is aswBoot.exe malware? http://www.dslreports.com/forum/remark,16765057 st_helper : Eric,

Thank you for the interjection and for providing additional clarification on the listing.

ST_Helper]]> http://www.dslreports.com/forum/remark,16765057 Wed, 23 Aug 2006 15:37:37 EDT Re: Is aswBoot.exe malware? http://www.dslreports.com/forum/remark,16738039 SpannerITWks : Good interjection from eburger68, as leopards can indeed change their spots, contrary to what some think, and they should be applauded for doing so. Good for you Spyware Terminator !

Also a nice oppourtunity to be reminded about the MyNetWatchMan SecCheck scanner too.

Spanner
--
I Only Know What I Know, But I'm Learning all The Time - Stay Safe - Spanner intheWorks
/SpannerITWks]]> http://www.dslreports.com/forum/remark,16738039 Sat, 19 Aug 2006 08:41:34 EDT Re: Is aswBoot.exe malware? http://www.dslreports.com/forum/remark,16737980 eburger68 : Hi All:

Since the note at Spyware Warrior regarding Spyware Terminator has become a subject of discussion, let me say a few things about that note.

First, it's important to read the note carefully and not read into it more than is there. For instance, we never claimed that Spyware Terminator was malware itself (in fact, we also said quite clearly that it wasn't) or that Spyware Terminator was involved in the distribution of malware.

We said the the company behind Spyware Terminator had at one time distributed adware, and we initially listed the product on the Rogue/Suspect list because of that connection, until we could get a better sense for the company's course of behavior following its decision to exit the adware business.

Second, it's important to recognize that the Rogue/Suspect list includes a wide variety of products. On the low end, we list products that are bad at what they purport to do -- detect and remove spyware and adware. On the high end we have products that install malware themselves, that hijack users' PCs, or that use fraudulent tactics to push their products on unsuspecting consumers.

My point is, don't assume that because a product is listed on the Rogue/Suspect list that the product or company behind the product is guilty of the worst behavior imaginable. Take the time to read our notes regarding the product.

Third, when we de-list a product, as we did with Spyware Terminator, we do so with the confidence and expectation that the vendors have rectified the problems identified with the product or the practices associated with the product. In this case, the problem was our uncertainty over the vendor's own trustworthiness, given its historical connection to adware distribution. We de-listed the product because the vendor had satisified our concerns. And, I can report, the vendor continues to satisfy our concerns.

We document the product de-listings that we perform, because we think readers of the page deserve to know what happened with a particular paroduct that they know was once listed. As I've told several vendors at this point, "We don't do memory holes at Spyware Warrior."

But it's important that those de-listing notes not be taken for more than they are. They certainly shouldn't be regarded as a kind of "scarlet letter" that forever marks a product -- that's certainly not how we created the de-listing notes.

To those who are debating whether or not to give Spyware Terminator a trial, my advice would be to do so. We don't recommend the product at Spyware Warrior, but that's no reason for readers here not to try the product, if they are so inclined. Spyware Terminator is not malicious in any way and poses no danger to your system. If you encounter what you suspect to be a false positive in its scan results, tehn you should handle it the way you would false positives with any other product: report it/them to the vendor so that they can be corrected.

My apologies for the lengthy interjection here, but I wanted to make sure that folks were clear on just what the Rogue/Suspect list is and how it functions.

Best,

Eric L. Howes
--
Microsoft MVP

Sunbelt Software

Spyware Warrior]]> http://www.dslreports.com/forum/remark,16737980 Sat, 19 Aug 2006 08:18:52 EDT Re: Is aswBoot.exe malware? http://www.dslreports.com/forum/remark,16737750 Dustyn : Note on SpywareTerminator: "We originally listed Spyware Terminator on this page out of concerns that Crawler, the company behind the product, had established connections with IBIS, a well known adware distributor responsible for such adware programs as Wintools, Websearch, & Huntbar. Although we found no problems in our initial testing with Spyware Terminator, and while the vendor itself announced that it was exiting the adware business (1), we decided out of caution to impose a three month probation period before we would consider re-testing and, if warranted, de-listing the the product from the Rogue/Suspect list. During that three month probation period we monitored the behavior of IBIS and Crawler. At the end of the three month probation period we re-tested Spyware Terminator, again finding no problems serious enough to justify listing the program on this page. As the vendor involved has not been involved in the distribution of adware for many months, and as the program itself exhibits no problems serious enough to warrant mention on this page, we have decided to de-list Spyware Terminator from the Rogue/Suspect list and can no longer regard the program to be "rogue/suspect."

The case in point was that SpywareTerminator WAS a product that at one point involved itself in the distribution of Adware.

I'm curious how you can say this product has been clean from the beginning? :hmm:
--
»/forum/wall]]> http://www.dslreports.com/forum/remark,16737750 Sat, 19 Aug 2006 05:36:52 EDT Re: Is aswBoot.exe malware? http://www.dslreports.com/forum/remark,16737723 SurfinGenie :

said by st_helper

:

This is one of the Spyware Terminator team members. I wanted to say hello to all the members and thank everyone for doing a wonderful job with this forum and site. It's truly one of the best places to discuss.

I came across this post today, in which it mentions comments from Spyware Warrior. Again, we disagree with the label since this product has been clean from the beginning. At the end of the day the product has to speak for itself and we're going to do everything possible to win the hearts and minds of ours users.

We're working very hard and I think the product speaks for itself. If you visit download.com 3 out of the top 5 applications for the week are anti-spyware applications and none of them offer 100% Free real-time protection. There is a clear demand for users wanting an anti-spyware application and we're trying to fill the demand by providing a good quality product for free.

Spyware Terminator Difference:
1) 100% Free Real-time protection
2) Includes HIPS
3) Anti-virus integrated (ClamAV)
4) Regular updates
5) Active research and development team focused on improvements

Additional notes:
1) Listed at download.com - »www.download.com/Spyware-Termina···g=tab_ur
2) Listed at betanews.com - »fileforum.betanews.com/detail/Sp···394850/1
3) Site Advisor label - »www.siteadvisor.com/sites/spywar···ator.com

I hope I've answered some of your questions or concerns. I look forward to answering additional questions or concerns. Have a wonderful weekend.

ST_Helper

What should be of concern is the tagging of a legitimate component of a well-known AV [ AVAST ] as a trojan by SpywareTerminator.
:o
--
Surf safely !!!]]> http://www.dslreports.com/forum/remark,16737723 Sat, 19 Aug 2006 05:11:36 EDT Re: Is aswBoot.exe malware? http://www.dslreports.com/forum/remark,16732091 st_helper : This is one of the Spyware Terminator team members. I wanted to say hello to all the members and thank everyone for doing a wonderful job with this forum and site. It's truly one of the best places to discuss.

I came across this post today, in which it mentions comments from Spyware Warrior. Again, we disagree with the label since this product has been clean from the beginning. At the end of the day the product has to speak for itself and we're going to do everything possible to win the hearts and minds of ours users.

We're working very hard and I think the product speaks for itself. If you visit download.com 3 out of the top 5 applications for the week are anti-spyware applications and none of them offer 100% Free real-time protection. There is a clear demand for users wanting an anti-spyware application and we're trying to fill the demand by providing a good quality product for free.

Spyware Terminator Difference:
1) 100% Free Real-time protection
2) Includes HIPS
3) Anti-virus integrated (ClamAV)
4) Regular updates
5) Active research and development team focused on improvements

Additional notes:
1) Listed at download.com - »www.download.com/Spyware-Termina···g=tab_ur
2) Listed at betanews.com - »fileforum.betanews.com/detail/Sp···394850/1
3) Site Advisor label - »www.siteadvisor.com/sites/spywar···ator.com

I hope I've answered some of your questions or concerns. I look forward to answering additional questions or concerns. Have a wonderful weekend.

ST_Helper]]> http://www.dslreports.com/forum/remark,16732091 Fri, 18 Aug 2006 11:13:37 EDT Re: Is aswBoot.exe malware? http://www.dslreports.com/forum/remark,16654620 Cheese : Hmmmm]]> http://www.dslreports.com/forum/remark,16654620 Sun, 06 Aug 2006 14:55:58 EDT Re: Is aswBoot.exe malware? http://www.dslreports.com/forum/remark,16653403 Psicop : People at Wilders have reported SpywareTerminator to give a series of FP of trusted appointments.

BTW, ST I reckon is out. I tried to log into their website for the last two weeks and the site is down.

Even though they were clean after being initially reported as malware at spywarewarrior, I wouldn't touch it because you know: once you are thief you remain as such.

Cheers.]]> http://www.dslreports.com/forum/remark,16653403 Sun, 06 Aug 2006 10:56:36 EDT Re: RE: How can I tell if an anti-spyware program is legitimate? http://www.dslreports.com/forum/remark,16653308 FiOS Dan : Goodness me, I didn't realize the list was compiled by Eric. All the better. :)
--
Courage is being scared to death but saddling up anyway.
]]> http://www.dslreports.com/forum/remark,16653308 Sun, 06 Aug 2006 10:27:49 EDT RE: How can I tell if an anti-spyware program is legitimate? http://www.dslreports.com/forum/remark,16653261 amysheehan :

said by FiOS Dan

:

First I've heard of that site...thanks. Also glad to see no sign of SUPERAntiSpyware on the list, as it is rapidly becoming my AS program of choice.

For more info see the Security Forum FAQ:
»Security »How can I tell if an anti-spyware program is legitimate?

:)
--
DSLR Phishtracker]]> http://www.dslreports.com/forum/remark,16653261 Sun, 06 Aug 2006 10:08:37 EDT Re: Is aswBoot.exe malware? http://www.dslreports.com/forum/remark,16653246 NetWatchMan : This is a good example of where you can utilize the Hash Corroboration component of our SecCheck scanner to determine if a file is likely trusted:

»www.mynetwatchman.com/tools/sc

SecCheck has aggregated SHA1 hash dumps from thousands of systems and enables you to see how hashes on your system compare to what others have submitted. E.g. in this case I'm guessing you should have seen dozens of other Avast users submitting the same SHA1 for the aswBoot.exe file.

Note the following two columns:

Machines Reporting Same Hash
-and-
Total Machines Reporting

If the machines reporting a hash is low (say less than 5) the file may not be malware, but I'm sure not going to trust it. If the number of machines reporting a hash is greater than 20, the file is almost certainly trusted.

The attachments show the extreme low-end and high-end of this trust analysis from an infected lab system.
--
Lawrence Baldwin
myNetWatchman
The Internet Neighborhood Watch

Untrusted File
Extremely Trusted File

]]> http://www.dslreports.com/forum/remark,16653246 Sun, 06 Aug 2006 10:02:22 EDT Re: Is aswBoot.exe malware? http://www.dslreports.com/forum/remark,16652992 FiOS Dan : First I've heard of that site...thanks. Also glad to see no sign of SUPERAntiSpyware on the list, as it is rapidly becoming my AS program of choice.
--
Courage is being scared to death but saddling up anyway.
]]> http://www.dslreports.com/forum/remark,16652992 Sun, 06 Aug 2006 08:05:49 EDT Re: Is aswBoot.exe malware? http://www.dslreports.com/forum/remark,16652634 amysheehan :

said by billy g :

I recently ran a spyware scan with SpywareTerminator and it reported that I have a nasty trojan c:\Windows\system32\aswBoot.exe Is this a valid trojan?? I uploaded it (aswBoot.exe) to VirusTotal and none of the scanners reported it was malware. I looked it up online it and does appear to be malware in some cases. Can any of the experts comment if this is a valid part of some program or if it is genuine malware?!?! Thanks very much.

I would not rely on the results of the program you scanned with that found aswboot as malware. I WOULD trust the VirusTotal results and read more info about the products you can trust before installing any anti-spyware apps --
SpywareTerminator is not on the short list of
Trustworthy Anti-Spyware Products
»www.spywarewarrior.com/rogue_ant···stworthy

It has been listed at least once as UN-trustworthy - NOTE: »www.spywarewarrior.com/rogue_ant···erm_note

SOURCE: The Spyware Warrior List of
Rogue/Suspect Anti-Spyware Products & Web Sites
»www.spywarewarrior.com/rogue_ant···products

:)
--
DSLR Phishtracker]]> http://www.dslreports.com/forum/remark,16652634 Sun, 06 Aug 2006 03:26:01 EDT Re: Is aswBoot.exe malware? http://www.dslreports.com/forum/remark,16652626 anon : Thanks for the help guys. It turns out it is only part of Avast antivirus, as you've said. I guess just another false positive by SpywareTerminator. It can scare you a bit when these spyware scanners throw up a false positive like that. I wish they could make them more reliable and less FPs like most AVs.]]> http://www.dslreports.com/forum/remark,16652626 Sun, 06 Aug 2006 03:21:16 EDT Re: Is aswBoot.exe malware? http://www.dslreports.com/forum/remark,16652583 Dustyn : Not a virus/trojan whatsoever.
It's Avast-AntiVirus.
Ironic that it would be reporting this as a trojan!? :p]]> http://www.dslreports.com/forum/remark,16652583 Sun, 06 Aug 2006 03:00:24 EDT Re: Is aswBoot.exe malware? http://www.dslreports.com/forum/remark,16652384 BlitzenZeus : It very likely is the avast boot scanner, if you ever schedule a boot time scan this is the program that runs before windows continues to load.

Next time find the file itself, and check its properties.]]> http://www.dslreports.com/forum/remark,16652384 Sun, 06 Aug 2006 01:49:52 EDT Re: Is aswBoot.exe malware? http://www.dslreports.com/forum/remark,16652321 dadkins : Do you have avast on your machine?
Have you had avast on your machine?
--
Think outside the Fox... Opera

]]> http://www.dslreports.com/forum/remark,16652321 Sun, 06 Aug 2006 01:32:28 EDT Is aswBoot.exe malware? http://www.dslreports.com/forum/remark,16652263 anon : I recently ran a spyware scan with SpywareTerminator and it reported that I have a nasty trojan c:\Windows\system32\aswBoot.exe Is this a valid trojan?? I uploaded it (aswBoot.exe) to VirusTotal and none of the scanners reported it was malware. I looked it up online it and does appear to be malware in some cases. Can any of the experts comment if this is a valid part of some program or if it is genuine malware?!?! Thanks very much. ]]> http://www.dslreports.com/forum/remark,16652263 Sun, 06 Aug 2006 01:14:22 EDT