republican-creole
site Search:


 
    All Forums Hot Topics Gallery






how-to block ads


 
Search Topic:
Uniqs:
1315
Share Topic
Posting?
Post a:
Post a:
page: 1 · 2
AuthorAll Replies


dp
Premium,MVM
join:2000-12-08
Greensburg, PA
kudos:7

CWShredder 1.56.3 Update

»www.spywareinfo.com/~merijn/file···dder.zip


Sparrow
Crystal Sky
Premium
join:2002-12-03
Sachakhand

3 edits

 
I think I have finally resolved the false positive (FP) of CWShredder continuously "finding and removing" CWS.Msconfig from my OS.

When a user specified change is made in msconfig under the Startup tab by checking or unchecking a startup item from the list, (in my example, I checked "AdeptecDirectCD" to run at Startup, and chose "Exit Without Restart"), the Edit String for:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

contains the new entry of

C:\WINDOWS\PCHEALTH\HelpCtr\Binaries\MSConfig.exe /auto.

CWShredder seems to be picking this change up as CWS.Msconfig.

I will appreciate if a few other people would verify this by checking a new entry in Start > Run > msconfig > Startup > Exit Without Restarting, and then running CWShredder to see if it picks up the entry as CWS.Msconfig.

Running: XP Pro - SP2 v.2096

EDIT Please add what OS you are running.

I've bothered Merijn enough about this already, so any help here will be taking a nuisance (me) off his back.
--
Security Forum FAQs .. ♥ .. Computer Cops - Symantec Forum .. ♥ .. Starfire "5 in 4"


chachazz
Premium
join:2003-12-14
kudos:4

Right on the money Crystal! Yep, same result.



Bubba
GIT-R-DONE
Premium,MVM
join:2002-08-19
St. Andrews
Reviews:
·DIRECTV
·Pickwick Cablevi..
·Comcast

1 edit

reply to dp
CS....I followed your verification steps.... Start > Run > msconfig > Startup > ....made a change and then Exit Without Restarting....I then ran CWS v. 1.56.3 and nothing was found.

OS= Win 98 SE all MS Critical updates installed.

edit: SP
--
*Team Z* Member



chachazz
Premium
join:2003-12-14
kudos:4

XP Home here.


boblandy2
Premium
join:2002-05-06

reply to Sparrow

said by Sparrow:
I will appreciate if a few other people would verify this by checking a new entry in Start > Run > msconfig > Startup > Exit Without Restarting, and then running CWShredder to see if it picks up the entry as CWS.Msconfig
i wanted to do the above to give you another look (xphome), but msconfig shows only the startup entries and there are none unchecked that i can check. i must be missing something....
--
look out kid they keep it all hid


Sparrow
Crystal Sky
Premium
join:2002-12-03
Sachakhand

You can also "uncheck" one of the items and "Exit without restart," which will still change the Edit String in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run.

Checking or unchecking an item doesn't matter, and should produce the same result. I get the same results from either scenario.

After running a "test scan" with CWShredder, you can "check" the item again in msconfig if you want it running at startup.
--
Security Forum FAQs .. ♥ .. Computer Cops - Symantec Forum .. ♥ .. Starfire "5 in 4"



dp
Premium,MVM
join:2000-12-08
Greensburg, PA
kudos:7

reply to Sparrow

I wasn't able to duplicate this either. So far it appears to be affecting only XP. I unchecked an app from starting from the 'Run' key and exited w/o reboot. Ran CWS and nothing was found. Running WinME.
--
Write your questions down on the back of a $20 dollar bill and send them to me

boblandy2
Premium
join:2002-05-06

reply to Sparrow

said by Sparrow:
I will appreciate if a few other people would verify this by checking a new entry in Start > Run > msconfig > Startup > Exit Without Restarting, and then running CWShredder to see if it picks up the entry as CWS.Msconfig
confirmed in winxp SP1
--
look out kid they keep it all hid


dadkins
Can you do Blu?
Premium,MVM
join:2003-09-26
Hercules, CA
kudos:18

reply to Sparrow

Nope, nothing found...


dp
Premium,MVM
join:2000-12-08
Greensburg, PA
kudos:7

hmm, so much for the XP theory



Sparrow
Crystal Sky
Premium
join:2002-12-03
Sachakhand

I thought the same thing, dp See Profile. Let's wait for a few more checks.

Apparently the only thing it is doing is removing the entry from the
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run;
but if a user makes a change to the msconfig startup list, and runs CWShredder after the change, it will not take effect.

It's just one of those little bugs that really bugs me!
--
Security Forum FAQs .. ♥ .. Computer Cops - Symantec Forum .. ♥ .. Starfire "5 in 4"



dp
Premium,MVM
join:2000-12-08
Greensburg, PA
kudos:7

reply to dp
Anyone else interested in trying to duplicate what Crystal Sky has posted at »CWShredder 1.56.3 Update
The more input the better
--
Write your questions down on the back of a $20 dollar bill and send them to me


boblandy2
Premium
join:2002-05-06

reply to dp

said by dp:
hmm, so much for the XP theory
why do you say that? so far 3 people with winxp have confirmed and 1 has not been able to confirm. doesn't that indicate a stronger likelihood that Sparrow See Profile is on the right trail? maybe if dadkins See Profile tried again, his results might change. i found it to be the case and so did chachazz See Profile.

you're right, though... the more the merrier
--
look out kid they keep it all hid


dp
Premium,MVM
join:2000-12-08
Greensburg, PA
kudos:7

said by boblandy2:
doesn't that indicate a stronger likelihood that Sparrow See Profile is on the right trail
Oh, I definitely think Sparrow See Profile is on to something. That's why we need some more input to provide to Merijn so he can fix it
--
Write your questions down on the back of a $20 dollar bill and send them to me

boblandy2
Premium
join:2002-05-06

then i misunderstood. i thought you were saying that her xp theory was not valid
--
look out kid they keep it all hid



Sparrow
Crystal Sky
Premium
join:2002-12-03
Sachakhand

reply to dp

Just for the record, FP still occurring in 1.57.0.


dadkins
Can you do Blu?
Premium,MVM
join:2003-09-26
Hercules, CA
kudos:18

2 edits

reply to dp

Don't let me hold you up, but I tried with this newer version and well, still nothing. I even killed a couple of them and exited...

EDIT: If it's doing this on your systems, Please do contact Merijn and let him fix it. I don't wan't it to start doing that(or worse) on mine.


Sparrow
Crystal Sky
Premium
join:2002-12-03
Sachakhand

I sent Merijn a link to this thread the day I started it, so he can keep tabs here.



CalamityJane
Premium,VIP,MVM
join:2002-08-27
Eustis, FL
kudos:8

reply to dp
Did ya'll know that Merijn has his hands full with real threats to contend with? Like the new variant we don't have a fix for yet?

Plus, he does have a life

quote:
About me
I am a student from the Netherlands that codes in his free time, and especially CWShredder and HijackThis have become quite popular around here. You can download those here, as well as some other apps I wrote.

If you just need help with some piece of (suspected) spyware/foistware, or want someone to take a look at your HijackThis logfile, you are very welcome on the SpywareInfo forums.

If you would like to take a look at my old Geocities page, which has more text, some rants, howtos and more interesting stuff to read, visit
»www.geocities.com/merijn_bellekom/new/.
Note that my handle there is Klont. It's still the same guy reading your emails though.
quote:
April 25, 2004:
Tomorrow I'm moving. Last time we moved, our ISP took 3 weeks to setup Internet access, so I'm just posting it here in case I drop off the net for another month.

Suffice it to say I can't reply to emails during the move.
»www.spywareinfo.com/~merijn/index.html

He does a really terrific job at removing the real threats from people's PC's. He does this on his own time and charges you all NOTHING!

Debate here all you want, but please do not burden him with your splitting-hairs emails. That I see as a waste of time when he could be developing cures for the real nasties out there. I don't see a wide-spread mass amount of people complaining except one false positive - ONE (who is not infected BTW). Do you really want to hold up progress for the thousands who are infected for ONE?

If you are having a problem with CWShredder and you are NOT infected - please just delete the program and stop bothering him. That would leave him time to develop cures for those who are infected.

So does this FP create any kind of problem on your PC?

If you think you can write a better program and offer it for free and continue to develop it with the latest threats, then please - go for it and let us know!

Thanks
--
It takes a disaster to make a woman out of a female
Gladiator Security Forum
Proud Member of ASAP (Alliance of Security Analysis Professionals) »www.a-sap.org/

Monday, 04-Jun 05:05:23 Terms of Use & Privacy | feedback | contact | Hosting by nac.net - DSL,Hosting & Co-lo
over 12.5 years online © 1999-2012 dslreports.com.
Most commented news this week
Hot Topics