SugarnSpyce
join:2004-08-06
Australia
|  reply to NanDog
Re: PestPatrol says: eAcceleration/StopSign are Clean!
eAcceleration is clean by PestPatrol but I don't want it on my system please help me remove it. Its not in ADD/REMOVE PROGRAMS but it is in C:/Programs Files/Acceleration Software/System Patcher - sputils.dll - sys_alert.ex (Stop Sign) - updater.dll pleassssssse tell me how to get rid of these it says ACCESS DENIED The Source file maybe in use. So what do I do now???? 
Thanks in anticipation |
|
davidnason
Premium
join:2004-08-04
Poulsbo, WA
| reply to dadkins
said by dadkins  :
Please correct me if I am wrong, but isn't that *YOUR* downloader? From *YOUR* website(s)?
said by davidnason :
dadkins: I'm sure you've read the other topics on this forum in which a number of others here have already noted that PestPatrol, and subsequently others, had previously labeled the stub download component of eAcceleration's installer as a trojan. That is, of course, what you're seeing. And that is part of what PestPatrol is now saying is clean.
said by dadkins :
Here's a thought...disinfect/kill/replace the downloader that is being used for your online scan. Also, if you read towards the end of the other thread, you will see that the uninstaller that is being used by your company needs some serious work. Just ask novaflare what get's left behind.
dadkins: thanks for the suggestion; it will be replaced soon - but there is nothing to disinfect. If you won't believe PestPatrol, I'll refer you to the same thread you referenced - read the significant number of posts by Eric Howes (eburger68) and Keith2468 where they describe the downloader as an installer component that does not fit the definition of "trojan downloader". By the way, on the same thread it was observed that using Spybot or AdAware to remove eAcceleration components is certainly likely to hamper a complete uninstall. And you forgot to mention that as a result of the uninstall, 8 registry entries were left - that's all that was left.
David Nason
Chief Technology Officer
eAcceleration Corporation
davidnason@eacceleration.com |
|
SnowyOne
Premium
join:2003-04-05
Kailua, HI | Are you responding to questions/concerns chronologically or selectively?
--
Dave said "By the way, 4294967295 is just another way to write -1". |
|
eburger68
Premium,MVM
join:2001-04-28
3 edits | reply to davidnason
Re: PestPatrol says: eAcceleration/StopSign are Cl
Hi All:
I decided to test Stop-Sign once again. This is my third time in the last month. (I previously tested on July 5 and July 27.)
Installation
I must say that I was pleasantly surprised with the installation process this time around. EAcceleration has made some significant changes to the installation process since the last time I tested (July 27) -- all for the better.
The most significant and important change is that the user now has complete and transparent control over the software modules that are installed. While before the user could select the popup blocker or the firewall or the threat scanner (anti-virus + anti-spyware) to install, the user always wound up with the eAcceleration Software Station -- with its mildly pushy advertising, which I discussed in some of my previous posts in the other thread. The user also wound up installing the Oodlz Games and Kon-X shortcuts (among other things), whether the user wanted those or not.
That's all changed. The installation process now presents the user with a choice between "Standard Install" and "Custom Install" (see the attached screenshot # 1). If the user chooses "Custom Install," the user is presented with a menu of software modules to install (see screenshot # 2). This menu allows to user to select or de-select any of several modules to install -- from the threat scanner to the pop-up blocker all the way down to the games and Kon-X software. The user can even elect not to install the Software Station, which was the bulkiest of all the software modules in prior versions.
For this test I elected to install only the threat scanner, not wanting to deal with the Software Station and its slightly sleazy advertising. The threat scanner downloaded and installed in short order, though there was no clear notice to the user when the installation had finished. I knew only when the Stop-Sign tray icon appeared and all hard drive activity ceased.
One minor annoyance: the installer didn't handle my 120 dpi desktop font size very well -- that's why the text in the screenshots is occasionally cut-off and run together. I expect that will be corrected in future versions of the installer.
The Threat Scanner
The threat scanner itself still has the same problems that I encountered before:
1) It is one of the slower anti-malware scanners I have encountered, taking over 20 minutes to do a full scan of my system. By contrast, most other scanners take between 5-10 minutes.
2) Heuristics are still being used without any warning to the user that they are being used and that heuristics are known to cause false positives. Moreover, the user is given no option to turn heuristics off to reduce false positives. Strangely enough, the online help indicates that there is a setting to turn heuristics off, however, it does not appear in the threat scanner settings.
3) Predictably, the threat scanner kicked up several false positives. It even flagged CWShredder and Jason Levine's ScriptSentry as potential malware based on its heuristic detections. All the more reason for users to be given notice of heuristics and the ability to turn them off.
4) The threat scanner provides no option to specify a maximum file size to scan. Thus it would not skip the several large ( > 1 gb ) encrypted container files that I have, slowing the scan down even more.
5) The scan report is not as useful as it could be because in some cases it neglects to provide information about the Registry keys or files detected as malware. In such cases the user is left to dig through the scan log for that information.
Uninstallation
Once I finished the scan I decided to uninstall. eAcceleration has redone the uninstaller as well. When the user clicks the entry in Add/Remove Programs, the user is presented with options to install more eAcceleration products or uninstall particular eAcceleration software modules. There is also an Add/Remove Products shortcut in the Start Menu Program Group that presumably does the same thing. I elected to uninstall everything.
The uninstall went without a hitch for the most part. After rebooting, Ad-aware found one file and one Registry key related to eAcceleration -- nothing serious. Pest Patrol found a few more Registry keys -- again, nothing serious. Spybot Search & Destroy found nothing.
Summary
All in all, eAcceleration has done a decent job cleaning up its download and installation process from where it was back in 2002/2003. Gone is the deceptive advertising that foisted software on unwitting web surfers. Gone is the pushy installation process that required users to install the eAcceleration Software Station and other unwanted software just to get the threat scanner, popup blocker, or whatever other software module the user was interested in. And with the disappearance of the Software Station -- except for those users who want it -- gone is the annoying advertising that previously intruded on the user's dealings with the eAcceleration software that was installed.
The threat scanner itself still has problems, and I cannot recommend it as an anti-virus solution, given the other fine anti-malware scanners that are available (some for free). But the worst of eAcceleration's practices seem to have ended.
Regards,
Eric L. Howes |
|
John2g
Qui Tacet Consentit
Premium
join:2001-08-10
England
| reply to davidnason
Re: PestPatrol says: eAcceleration/StopSign are Clean!
Thank you for that write up Eric.
I still see no reason to install any of their software. They might have cleaned up their act, but there are plenty of alternative and better aplications, both as freeware and payware.
The thought of trusting them to protect my computer from viruses, or by their firewall, does not bear one seconds thought.
--
Better to remain silent and be thought a fool, than to speak and remove all doubt. |
|
pcdebb
RIP dadkins
Premium
join:2000-12-03
Tampa, FL
clubs: 
| reply to SnowyOne
said by SnowyOneWould:
you be willing to give a complete list of exactly what companies you have/will make a similar request to?
This was asked twice and the only answer he can give is "all of them". to me that is a dodgy response, how about names of the companies? I'm sorry, but a simple statement saying one person gave you the green light doesn't make things right. You have to work much harder than that to win people over after the very tainted past. I for one will continue to steer clear of this product. |
|
CalamityJane
Premium,VIP,MVM
join:2002-08-27
Eustis, FL
| reply to davidnason
Re: PestPatrol says: eAcceleration/StopSign are Cl
Wow! This is good news  These improvements should mean we won't have users coming here and other forums needing help removing unwanted software they didn't intend to install. That's always been my biggest concern, ever since my first encouter with eanthology doing a driveby download on my elderly neighbor's PC and other users in forums having the same problem. I sure wish more companies of rogue and suspicious software would make note and do the same. Perhaps your company can show them it can be done!
I want to thank eburger68 as well for re-testing the package and reporting back to us. That is even more useful than the report back from Pest Patrol. As always, you are a tremendous asset to the Security Community here with your investigation and contributions, Eric!
Thumbs up to you davidnason , I hope that you all will continue to improve your product and make a successful program that people will accept and have no fear of using. It is certainly stepping in the right direction, finally, and I hope that your efforts are recognized by your company as such!
While it may take some time and effort to overcome the past, I am sure you expected this. Moving forward with no complaints or requests for help from unhappy, unwilling users of eAcceleration products will be a refreshing relief here
Thank you! I do wish you success in your new direction towards making this a legitimate program.
This isn't my endorsement or even evaluation of the product, however, I'm always happy to see a vendor who can see the true problems we in the Security Community have and take the appropriate steps to improve.
--
It takes a disaster to make a woman out of a female
Gladiator Security Forum
Proud Member of ASAP (Alliance of Security Analysis Professionals) »www.a-sap.org/ |
|
novaflare
The Dragon Was Here
Premium
join:2002-01-24
Barberton, OH
| reply to davidnason
well looks like 2 more little steps left for yu guys david
1 lose them assinine comercials serious here i hate them not just cause of the freescan that requires a full dl (miss leading)but because the people in the comercials are stiff in the way they talk. No inflection talking in monotone etc.
and
2 kinda 2 parts to this one regarxding the install
Loose the stub downloader (your already working on this) and the secound part give the installer a status bar and rework it so it doesnt suck up all the cpu time makeing it nearly impossible to do any thing else dureign install.
When im installing software im often re reading the faqs on the site and various other things about the product and when you cant move your mouse you cant do this.
o yeh forgot one thing ditch some of the names keep 1 or 2 at most redirect the web sites with some note or another to the main web site for stopsign or the other name that is kept. As it stands now it looks like your hideign behind multiple names. Hopeing people will dl and install spyware because the site they dl from isnt stop sign or e anthology.
I recomend keeping the sites that were previously known to be pushing the spyware/ish stopsign and rebuiling those sites reputations and not trying to start over fresh with another name. That wont look good for you or your company
--
new 3d chat comunity at »planetvirtuel.com my site »spellbound.valshea.com/news.php |
|
dadkins
Can you do Blu?
Premium,MVM
join:2003-09-26
Hercules, CA
 ·Comcast
| reply to davidnason
Re: PestPatrol says: eAcceleration/StopSign are Clean!
Ok, eburger68 has a bigger set than I do, Thanks for the writeup Eric!
davidnason, whether the downloader(bad name) is or is not the Wren trojan, several reputable antivirus company's programs see it as being infected...it would be a good idea to change it.
Your company's past practices have put a damper on the possibility of your software being installed on my machine. I'm fairly certain that others share my concerns.
Keep at it though, it is always good to see a software company improve design/practices.
David
--
Nuke 'em all, let God sort 'em out. |
|
William Mc
Premium
join:2004-07-27
Washougal, WA
| reply to davidnason
I don't think so and no thanks, Spybot S&D says its a spybot, Spybot S&D hasn't changed with the last update.
--
Ground Control, SRS(DW4000), G11 1370, BE 4.2.1.10 |
|
mers2
Premium,MVM
join:2004-03-20
USA
clubs:
 ·AT&T U-Verse
| reply to davidnason
Re: PestPatrol says: eAcceleration/StopSign are Cl
I will take eburger68's word with more confidence then Pest Patol's. Thanks Eric for once again doing the work once again.
While I am very happy to see the changes the company has made, they still need to prove themselves with a quality product. At least now they will have the chance. |
|
SnowyOne
Premium
join:2003-04-05
Kailua, HI
·RoadRunner Cable
 ·Clearwire Wireless
1 edit | reply to davidnason
Re: PestPatrol says: eAcceleration/StopSign are Clean!
"PestPatrol says – eAcceleration and Stop-Sign are Clean!"
I can only see 2 different scenarios.
1.eAcceleration and Stop-Sign have concluded that there is more $ to made on the other side of the tracks.
2. They decided to create a market for their Anti-Whateverware software years before it's release.
I'll advocate a cautious approach.
--
Dave said "By the way, 4294967295 is just another way to write -1".
|
|
blackkhat
join:2002-10-03
Joliet, IL
| reply to eburger68
Re: PestPatrol says: eAcceleration/StopSign are Cl
Eric: Just an FYI, in the threat scanner options, if you click on the "Cleaner Opt" button, there is a checkbox option for heuristic searches. I'm not sure why, but the option for heuristic searches only shows up in the paid versions of the software.
novaflare: In the new version of the downloader, there is a full status bar. It wasn't included in this set of screenshots, but after you select the components that you want to download, there're options for whether or not you want outbreak news, automatic updates, a progress/status bar, desktop icon, and quick launch icon. |
|
eburger68
Premium,MVM
join:2001-04-28
| blackhat:
Thanks for the info. I suspected that was the case. All the same, it's a problem that heuristics can't be turned off in the free scanner, since heuristics are known to produce false positives and trial users could be making purchasing decisions based on the scan reports of the trial version.
Best,
Eric L> Howes |
|
novaflare
The Dragon Was Here
Premium
join:2002-01-24
Barberton, OH
| reply to blackkhat
said by blackkhat :
Eric: Just an FYI, in the threat scanner options, if you click on the "Cleaner Opt" button, there is a checkbox option for heuristic searches. I'm not sure why, but the option for heuristic searches only shows up in the paid versions of the software.
novaflare: In the new version of the downloader, there is a full status bar. It wasn't included in this set of screenshots, but after you select the components that you want to download, there're options for whether or not you want outbreak news, automatic updates, a progress/status bar, desktop icon, and quick launch icon.
Thats after the stub downloader has already dled the full installer with out notice. Or has this already been changed?
--
new 3d chat comunity at »planetvirtuel.com my site »spellbound.valshea.com/news.php |
|
eburger68
Premium,MVM
join:2001-04-28
2 edits | novaflare:
You asked:
said by novaflare :
Thats after the stub downloader has already dled the full installer with out notice. Or has this already been changed?
In the version that I tested just a few days ago there is a progress bar for the download of the main installer (screenshot # 1) as well as for for the download and installation of the software modules the user has selected (screenshot # 2).
As I noted in my review above, it would be nice to see a notice box to the user when the installation has completed ("Installation completed" or something like that), but there are several progress bars for the different parts of the download and installation process.
Eric L. Howes |
|
keith2468
Premium,MVM
join:2001-02-03
Winnipeg, MB
| reply to davidnason
Re: PestPatrol says: eAcceleration/StopSign are Clean!
There is pretty much never a reason for installing any particular protection product -- there are pretty much always competing alternatives.
Some have an advantage one month, others are ahead the next month.
Some are cheaper, others have better automated support, others have better human support.
Which is best depends on who is asking and which month they ask.
And that is how it is with StopSign.
The essential point is that currently eAcceleration products, perfect or imperfect (currently no complex software is perfect) are not trojans or spyware or adware in any meaningful sense of those words.
That many AV and ASW products detected the downloader is merely because many AV and ASW vendors share files amongst themselves in different groups. With so many low hazard files, and during busy times, they don't do their own fresh research to confirm that the file is really a genuine threat.
So one AV analyst somewhere has a bad day, or gets a bee in his bonnet, and it is during a busy time of the year, and the next thing one knows 30 AV and ASW products end up with a false positive.
My feeling from reading about eAcceleration products is they are more targeted to those who are more interested in ease of use and human support -- as opposed to targeting those who want to search the web in order to put together their own suite of freeware, donationware and paid-for products, run a series of 3 manual updates every two days, and 2 manual updates once a week, google on detected files to check for reports of false positives, and so on (the stuff many of us here love doing).
And you know, a lot of regular people will be safer to spend the bit of money and let someone else do the research for them.
This is our hobby or profession, it isn't for everyone. Some people don't want to do it, and some people can't afford the time to do it, and some people don't have the aptitude to learn to do it.
Sure StopSign isn't prefect -- but look at what Ad-aware turns up that Spybot misses, and what Spybot misses that Ad-aware turns up, and what they both miss.
And look at Symantec's support if you need something not already in their database. Or what NAV leaves behind after a standard uninstall -- especially at the impact of what is left behind.
Anyway, it is very good news that this eAcceleration thing is now in the process of being cleared up.
And we have a company in the security field that is looking to invest time and money on improving its products. And consumers have another choice in security products.
--
(Virus&Hijacking FAQ + Submit suspected malware + Backups FAQ + Security FAQ TOC) |
|
keith2468
Premium,MVM
join:2001-02-03
Winnipeg, MB
| reply to SugarnSpyce
SugarnSpyce,
probably you should start a new topic to solve the specific problem with your computer and removing StopSign.
Maybe mention which version of StopSign it is, or at least when you installed it, which operating system you have, and how it was that you tried to remove it.
One general quick tip on uninstalls, if you have trouble removing software such as:
- using a different product to do the uninstall and that other product leaves things behind
- blue screen of death during uninstall and things left behind
- other uninstall problem
Then if you can re-install the same version of software, and then re-try the uninstall, that will sometimes work. It is an easy thing to try anyway.
However, if there is a bug in the uninstall, then the software vendor's website should be consulted. But since David is here, maybe you can get direct help if you start a new topic on your computer and its uninstall problem.
--
(Virus&Hijacking FAQ + Submit suspected malware + Backups FAQ + Security FAQ TOC) |
|
SnowyOne
Premium
join:2003-04-05
Kailua, HI
·RoadRunner Cable
·Clearwire Wireless
| reply to keith2468
Re: PestPatrol says: eAcceleration/StopSign are Cl
"Which is best depends on who is asking and which month they ask.
And that is how it is with StopSign."
I'm asking this month (August 2004) which month StopSign was better than Adaware or SpybotSD or any
protection product for that matter?
Sure StopSign isn't prefect -- but look at what Ad-aware turns up that Spybot misses, and what Spybot misses that Ad-aware turns up, and what they both miss."
What has StopSign detected that Adaware/SpybotSD has missed?
"My feeling from reading about eAcceleration products is they are more targeted to those who are more interested in ease of use and human support
I try not to believe everything I read, with special emphasis on self promo literature.
"So one AV analyst somewhere has a bad day, or gets a bee in his bonnet, and it is during a busy time of the year, and the next thing one knows 30 AV and ASW products end up with a false positive."
I don't believe for a second that StopSign got it's reputation from one AV analyst somewhere.
Nor do I believe it was simply a misunderstood collection of friendly software
I can't help but notice that the specific product comparisions all focus on negative aspects. That's not much of an endorsement.
--
Dave said "By the way, 4294967295 is just another way to write -1". |
|
SugarnSpyce
join:2004-08-06
Australia
| reply to keith2468
Re: PestPatrol says: eAcceleration/StopSign are Clean!
More info 4u on my problem Keith. On my C drive in my folder "Acceleration Software" I have another folder "SystemPatcher" in that folder I have sputils.dll, updater.dll sys_alert_exe (STOP SIGN) all created 13th March, 2004 V2.0.0.116 and I am running Windows 2000. I go into My Computer - Explore and then open those folders and right click on them and delete but I get the message "Cannot delete sys_alert: Access is denied. The source file may be in use." I do the same thing on each of the files and get the same error message. Acceleration is not in my Add/Remove Programs on Control Panel.
Can you please help me further. Thanks in anticipation.
Sugar |
|
