Re: Do you trust the uninstaller?

SnowyOne
Premium
join:2003-04-05
Kailua, HI

·RoadRunner Cable

·Clearwire Wireless

Re: Do you trust the uninstaller?

said by RavonTUS

:

So, here is the big question...Do I trust their uninstall program?

Here's an incomplete list of what the "Uninstaller" does.
[ Changes to registry ]
* Creates key "HKLM\Software\AutoLoader\x3uJ1RMQWRMK".
* Sets value "x85fZPOPWCY5fV"="" in key "HKLM\Software\AutoLoader\x3uJ1RMQWRMK".
* Creates key "HKLM\Software\AutoLoader\x3u51RMQWRMK".
* Sets value "x85fZPOPWCY5fV"="" in key "HKLM\Software\AutoLoader\x3u51RMQWRMK".

[ Process/window information ]
* Enumerates running processes.
* Enumerates running processes several parses....

Here's the Jotti scan results

MD5 3e532491eff52adf0c7f2befd94d80a3
Packers detected: -
Scanner results
AntiVir Found Trojan/Dldr.Apropo.R
ArcaVir Found nothing
Avast Found Win32:Apropo-2
AVG Antivirus Found nothing
BitDefender Found nothing
ClamAV Found nothing
Dr.Web Found nothing
F-Prot Antivirus Found nothing
Fortinet Found Adware/Apropos
Kaspersky Anti-Virus Found not-a-virus:AdWare.Apropos.q
NOD32 Found nothing
Norman Virus Control Found W32/Apropos.O
UNA Found nothing
VBA32 Found AdWare.Apropos.q

The "Uninstaller" has URL's as detected by Filealyzer

»download.contextplus.net/repermission/
»envolo.peopleonpage.com:80/servlets/auto
»envolo.peopleonpage.com:80/servlets/auto
»download.contextplus.net/apropos···ller.exe
»download.contextplus.net/apropos···ller.exe
»download.contextplus.net/shared/···ller.exe
»download.contextplus.net/shared/···ller.exe
»download.contextplus.net/
»envolo.peopleonpage.com:80/servlets/auto
»node2.ocslab.com/test/apropos/cl···ller.exe
»node2.ocslab.com/test/apropos/cl···ller.exe
»node2.ocslab.com/test/shared/Aut···ller.exe
»node2.ocslab.com/test/shared/Msv···ller.exe
»download.contextplus.net/
»node2.ocslab.com/apropos/client/···ller.exe
»node2.ocslab.com/apropos/client/···ller.exe
»node2.ocslab.com/shared/AutoUpda···ller.exe
»node2.ocslab.com/shared/Msvcp60Installer.exe

These URL's point to 4 different file downloads

"Msvcp60installer.Exe" * access denied when checking file properties
"a.exe" * access denied when checking file properties
"Aproposclientinstaller.Exe"
"Autoupdateinstaller.Exe"

Either these people have a serious problem with properly naming Exe's or this "Uninstaller" in reality is an "Installer"

permalink · 2005-10-31 07:58:23 · Print ·


Sunday, 06-Dec 07:21:30	Terms of Use \| Privacy Policy \| Hosting by www.nac.net - DSL,Hosting & Co-lo \| feedback \| contact over 10 years online! © 1999-2009 dslreports.com.republican-creole page compression OFF