RunScanner 1.0 released! (out of beta)

system · 2007-08-20T16:35:39.000Z

The antivirus.

system · 2007-08-20T16:40:32.000Z

still probably a false postive…knowing avg-why are you using avg in the first place ???
try this- http://www.kaspersky.com/kos/english/kavwebscan.html & http://www.bitdefender.com/ click on scan now- both online not resident
and see if they detect anything :
what is the name of the trojan ???

system · 2007-08-20T17:02:26.000Z

drhayden1 post:15:

still probably a false postive…knowing avg-why are you using avg in the first place ???
try this- http://www.kaspersky.com/kos/english/kavwebscan.html & http://www.bitdefender.com/ click on scan now- both online not resident
and see if they detect anything :
what is the name of the trojan ???

Trojan horse SHeur.GYL.

I scan with 30 different antivirus/antispyware (including KAV and bitdefender) using multiple engine scan, much easier than using the two you mention.

And no I don’t use AVG (not mainly), I’m just reporting what i found.

But I’m not a dr like you, so I bow to your superior expertise with antiviruses.

Lisandro · 2007-08-20T17:26:33.000Z

drhayden1 post:13:

ran avast!-bitdefender online scan-kaspersky online scan
ad-aware 2007-superasntispyware-spyware doctor full version & ewido online scanner

Also
a-squared: clean
SpywareTerminator: clean
AVGas: clean

Strange that the ‘good’ guys does not detect the suspicious ‘bad’ guy… uh?

Lisandro · 2007-08-20T17:27:21.000Z

Lusher post:14:

The antivirus.

The well known false positives of Grisoft…

system · 2007-08-20T17:30:42.000Z

Tech™ post:17:

drhayden1 post:13:

ran avast!-bitdefender online scan-kaspersky online scan
ad-aware 2007-superasntispyware-spyware doctor full version & ewido online scanner

Also
a-squared: clean
SpywareTerminator: clean
AVGas: clean

Strange that the ‘good’ guys does not detect the suspicious ‘bad’ guy… uh?

Not so strange, I have found any number of ‘bad guys’ that initally only 1 or 2 scanners out of 30+ at virustotal find something fishy (via heuristics) so it is not so unthinkable that RS might be malware and only AVG and counterspy are seeing something possibly malicious via heuristics.

Not saying it is, mind you, just saying it is not impossible.

system · 2007-08-20T17:31:28.000Z

Tech™ post:18:

Lusher post:14:

The antivirus.

The well known false positives of Grisoft…

Is counterspy known to have high FP rates too?

system · 2007-08-20T17:40:21.000Z

Changelog 1.0.2
Fixed bug with “problem with shortcut , searching for file gui”
Fixed false positive warning with AVG antivirus
(Thanks to Lusher for reporting the bug)

Changelog 1.0.1 (Bugfix)
Fixed bug with AppInit_DLLs (Thanks to Lusher for reporting the bug)

Lisandro · 2007-08-20T17:42:03.000Z

Lusher post:20:

Is counterspy known to have high FP rates too?

As far I know, yes.

Lusher post:19:

Not so strange, I have found any number of ‘bad guys’ that initally only 1 or 2 scanners out of 30+ at virustotal find something fishy (via heuristics) so it is not so unthinkable that RS might be malware and only AVG and counterspy are seeing something possibly malicious via heuristics. Not saying it is, mind you, just saying it is not impossible.

Isn’t this just FUD?

system · 2007-08-20T17:51:31.000Z

at least it wasn’t found on my two computers and i have had bad experiences with false positives as tech and many others on this forum know
and that trojan you posted was misspelled-could find in couple of databases ???

http://i14.tinypic.com/5zbacnk.jpg

system · 2007-08-20T17:52:00.000Z

Tech™ post:22:

Lusher post:20:

Is counterspy known to have high FP rates too?

As far I know, yes.

Lusher post:19:

Not so strange, I have found any number of ‘bad guys’ that initally only 1 or 2 scanners out of 30+ at virustotal find something fishy (via heuristics) so it is not so unthinkable that RS might be malware and only AVG and counterspy are seeing something possibly malicious via heuristics. Not saying it is, mind you, just saying it is not impossible.

Isn’t this just FUD?

No it isn’t. Unless you think that there is no malware that isn’t detected by majority (or even all) of the scanners, but I know a person of your experience definitely isn’t so ignorant. Many (most?) new malware start out undetected by all the scanners (some might guess using heuristics), I reported 3 such samples in the last month and I wasn’t even hunting for them on purpose.

Besides a little bit of caution is hardly FUD, and I’m insulted you would accuse me of that!

system · 2007-08-20T17:53:19.000Z

drhayden1 post:23:

at least it wasn’t found on my two computers and i have had bad experiences with false positives as tech and many others on this forum know
and that trojan you posted was misspelled-could find in couple of databases ???

http://i14.tinypic.com/5zbacnk.jpg

Nah, it’s correctly spelled. It is clearly a heuristic (maybe generic?) type detection , you will never find information about it.

Lisandro · 2007-08-20T17:56:17.000Z

Lusher post:24:

Besides a little bit of caution is hardly FUD, and I’m insulted you would accuse me of that!

I’m not accusing anybody of nothing… just my personal impression and my experience with RunScanner.

system · 2007-08-20T18:01:22.000Z

you will never find information about it

so what's the point then looking for something that doesn't EXIST ??? ::)

system · 2007-08-20T18:06:58.000Z

drhayden1 post:27:

you will never find information about it
so what's the point then looking for something that doesn't EXIST ??? ::)

Hmm maybe you don’t know that much about antiviruses.

Some antivirus have a generic name given for malware that is detected by heuristics. It’s a placeholder name.

Normally an antivirus has a specific signature for a certain malware, so it can give it a proper name.

But heuristics are just a “guess”, so they don’t have actual names for it, just placeholder generic names. Until it is properly analysed , then a specific signature will be created for it, and a specific name.

system · 2007-08-20T18:12:43.000Z

http://i16.tinypic.com/62dheo7.gif

Hmm maybe you don't know that much about antiviruses.

i was just making a general comment and not to get in a who knows what and who doesn't :o better things to do with my time that worry about a little computer bug-when i have some real ones in real life to worry about and for knowing about anti-viruses and viruses-more that you will ever know ::) 8)

system · 2007-08-20T18:27:03.000Z

drhayden1 post:29:

and for knowing about anti-viruses and viruses-more that you will ever know : 8)

I have no doubt about that. Everyone of you AVAST! evangelist has forgotten more stuff about antiviruses than I will ever know.

Vlk · 2007-08-20T19:09:12.000Z

The new AVG “sheur.xxx” engine is well-known for a large number of false positives. It has been released just recently, and is not quite ready for the prime time. See e.g.
http://forum.grisoft.cz/freeforum/read.php?4,104095
http://forum.grisoft.cz/freeforum/read.php?4,106051
http://forum.grisoft.cz/freeforum/read.php?4,106099
http://forum.grisoft.cz/freeforum/read.php?4,105579
http://forum.grisoft.cz/freeforum/read.php?4,105529
and many more.
I’m quite sure RunScanner is a legit application. It is published by a Dutch guy called Moernaut (http://www.moernaut.com) and the setup file is even digitally signed.
There’s no reason to argue on this forum, especially about “who knows more about antiviruses” and the like. Please stay on-topic and follow the forum rules.

Thanks
Vlk

system · 2007-08-20T19:21:45.000Z

Vlk, given that’s I’m the guy who is single handedly posting about this app, as well as it seems one of the few people helping to check for bugs, I’m also like you “quite sure” the app is legit.

But you never know. I mean just because the file is digitally signed doesn’t mean much really, unless you can trust the person signing it. But you already knew that , I’m just saying…

Did anyone notice this latest version is > 2.5x bigger than the older one when it just fixes one minor bug? I wonder if this is connected with how this version no longer is flagged by AVG…

system · 2007-08-22T18:39:27.000Z

Changelog 1.0.3
Added trusted zones HKLM
Added HKCU\Software\Classes\Folder\Shellex\ColumnHandlers
Added HKCU\SOFTWARE\Microsoft\Active Setup\Installed Components
Added HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
Added HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad
Added 105 HKCU\Software\Microsoft\Internet Explorer\MenuExt
Fixed minor bug with incorrect filter
Fixed minor sorting bug in text log file
Changed behaviour with 068 → download lsp-fix
Changed ctrl+c (copy) formatting
Google lookup now also searches for GUID, registry entry if no exename available.

Announcements