Dec
23
Anti-virus/security software sucks
Filed Under Ranting, Security, Software, Stupid, Viruses | 30 Comments
To celebrate symantec-sucks.blogspot.com's existence I have decided to finally upload my avsucks folder.
Oct
17
Defeating a Trend Micro PC-Cillin uninstall password
Filed Under Security, Software, Stupid, Technical | 10 Comments
If you are asked for a password when removing Trend Micro PC-Cillin, open regedit, browse to HKEY_LOCAL_MACHINE\Software\Trend Micro\PC-Cillin and either rename or remove the System sub-key. Then try the uninstaller again. It's just that stupideasy!
This doesn't work if you are already in the uninstaller being asked for the password and then remove you the key, so remove the key before starting the uninstall process.
Midas reports:
You can also use pcctool.exe for 2007 and older or tissprt.exe (or similar name) for 2008.
which will remove Trend Micro PC-Cillin without a password. You can find it in the installation directory.
Jun
15
MP3s for 2nd appearance
Filed Under Computer America, Dial-a-fix, Fixes, Security, Software, Technical, Vista, XP | 4 Comments
I was going to edit the previous post, but making a new post will bump everyone's RSS, etc, so I am just making this stub to paste the URLs for each hour:
* 06/15/07 - Hour 1
* 06/15/07 - Hour 2
Don't forget about FREE Dial-a-fix support at Lunarsoft.net! Even if I'm too busy to be around, the regulars there know Dial-a-fix better than anyone and can definitely lead you in the right direction. Also, they'll help you with general computer/tech support problems too, not just with Dial-a-fix.
Mar
12
HijackThis updated to version 2.0.0 beta
Filed Under Security, Software, Viruses | 8 Comments
We’ve waited a long time for this… At last Merijn Bellekom has finished a brand new version of his most famous program, HijackThis.
And that’s not the only bit of news about HijackThis. It seems that Merijn has managed to sell the program to Trend Micro. Merijn's own explanation is here.
HijackThis 2.0.0 beta is downloadable here.
Changes:
- AnalyzeThis added for log file statistics
- Recognizes Windows Vista and IE7
- Fixed a few bugs in the O23 method
- Fixed a bug in the O22 method (SharedTaskScheduler)
- Did a few tweaks on the log format
- Fixed and improved ADS Spy
- Improved Itty Bitty Procman (processes are frozen before they are killed)
- Added listing of O4 autoruns from other users
- Added listing of the Policies Run items in O4 method, used by SmitFraud trojan
- Added /silentautolog parameter for system admins
- Added /deleteonreboot [file] parameter for system admins
- Added O24 - ActiveX Desktop Components enumeration
- Added Enhanced Security Confirguration (ESC) Zones to O15 Trusted Sites check
Mar
5
Why are McAfee, Symantec and Norton vilified?
Filed Under Security, Software, Viruses | 7 Comments
Worldwide there is a tendency in anti-virus forums and anti-spyware forums to complain about the anti-virus products from McAfee, Symantec and Norton.
Why is that, you may ask? Yes, they are bloated, they take almost half a millennium to scan your system and they were about the last products that could flawlessly work with Vista. But then, there are hundreds of crappy or sub-standard products available on the internet and a program like RogueRemover will take on but a few of the worst offenders. So, why do we care?
The root of this problem lies with the fact that these companies have brilliant sales departments. We all know that a good salesman can sell anything to an unwary customer. And there are hardly any more customers unaware than those who reside in the computer procurement departments of large companies and schools. McAfee, Symantec and Norton are pre-installed in virtually every computer that finds its way into your company or school. No problem, no hassle to search and find the best possible anti-virus scanner. No, that problem has already been conveniently solved for them by the seller.
We, the real experts, know better. We like lightning quick scans, as less false positives as possible, an appealing GUI and a responsive staff that will take all our problems seriously.
So, why do we care? We care because we have the best possible anti-virus programs running on our own computers but we have to live daily with these programs that can't meet our own high standards.
It can be regarded as a form of mental torture that, in the end, makes us more mature and resilient. Regard it as a test and also as an ongoing incentive for other companies to keep developing even better anti-virus programs and anti-spyware programs.
And in the end who really cares? It's not our own money that is wasted on these programs.
edit by DjLizard: I'm filing this under Incompetence also :D
Dec
4
CWShredder no longer supported
Filed Under Security, Software, Viruses | Leave a Comment
CWShredder, originally made by Merijn, creator of HijackThis, hasn't been updated for quite a long time now (since November 2005). I've asked the current owners of the program, Trend Micro, a couple of times if they planned to support it in any way ever again.
I finally got some sort of answer:
Dear Sir
CWshredder is a free software and It is not supported
Best Regards
Peter
Trend Micro technical Support
Edit: Well, CWShredder has never been supported (since it's freeware) so its status hasn't changed. He basically didn't answer your question. Your question was whether there will be any more updates, and he instead answered a question you didn't ask — whether there is CWShredder technical support. --DjLizard
Nov
4
Windows Media Player phones home
Filed Under Security, Software | 2 Comments
Windows Media Player 10 and 11 both have developed a nasty tendency to behave like spyware: they report back to their master and do so to a multitude of sites. They automatically retrieve content even if you don't explicitly click Online Stores and/or Guide, simply launching WMP will result into WMP retrieving content.
What is this spyware-like activity?
The spyware-like activity is the automatic downloading of content when you launch Windows Media Player (aka WMP) with an active Internet connection. The content (images, cookies, javascript, etc.) will end up in Internet Explorer's Temporary Internet Files.
This can easily be confirmed by first emptying Internet Explorer's Temporary Internet Files and Cookies, and then launching WMP.
To counter these problems you could simply try to block the offending sites by putting them in your Windows HOST file, and into Internet Explorer's Security-> Restricted Sites, and Privacy areas. But alas, the HOSTS-file method won't necessarily work because Microsoft has decided to implement a strategy to bypass the HOSTS file in certain instances for some microsoft.com URL's.
And you can't simply turn the update function in Windows Media Player (aka WMP) off because you only have the choice between updating every day or week or month.
The result is that you cannot prevent your WMP from contacting Microsoft's sites.
How to prevent WMP from phoning home
To prevent WMP from automatically contacting sites which WMP automatically retrieves content from you'll only have a few options:
1. The best choice is to install a third-party two-way personal firewall such as Comodo, Kerio, ZoneAlarm, etc. In your personal firewall set it to Block/Disallow WMP access to your Internet connection by creating a permanent rule. Or at the very least and perhaps a better recommendation is to set your personal firewall to Ask every time WMP is launched so that permission must be first granted by you rather WMP is allowed to automatically retrieve online content or not.
2. Compile a list of the sites which are loaded by looking into Internet Explorer's Temporary Internet Files and Cookies.
3. Using the list you compiled in #2 block the cookies, scripts, etc., from offending sites in Internet Explorer.
Note: Don't block go.microsoft.com as doing so will break many links that Microsoft utilizes when visiting microsoft.com.
On the other hand: do you really care? It only checks for updates and bypassing the HOST-file is done for security reasons in order to prevent malware from wrecking Windows Update.
In the end it depends on your mindset: do you think that Microsoft spies on you or do you think Microsoft helps you to keep your system safe.
(post witten in cooperation with Andavari)
Oct
28
RegSeeker customized exclude.ini file
Filed Under Security, Software | Leave a Comment
Hoverdesk's RegSeeker 1.52 is a very good registry cleaner but sometimes it seems a bit too aggressive in its cleaning. Users have complained about programs and settings that have been modified when they shouldn't be.
To counter these problems Andavari has now created a customized exclude.ini file.
If you experience any problems resulting from the use of RegSeeker or want a specific exclusion included into the RegSeeker customized exclude.ini file you can contact Andavari via a Personal Message (PM) in the CCleaner.com forum. The file will be updated if and when needed so don't forget to check regularly.
Andavari's RegSeeker customized exclude.ini file is downloadable here.
Hoverdesk's creator Thibaud Djian has been notified and he promised me to keep a close look at the exclusions in Andavari's file and will decide if he updates RegSeeker with them at a later date.
Oct
23
Sophos is recommending that system administrators ask their security vendors if they are capable of properly protecting them on the forthcoming 64-bit version of Vista, as arguments continue regarding access to Microsoft's operating system code (kernel). Sophos has reassured its customers that Sophos Anti-Virus will offer full protection against malware threats on Vista, and suggests that some security vendors may not have given sufficient thought to the new operating system when developing their products.
Anti-virus firms Symantec and McAfee have recently made high-profile complaints that they are being "locked out" of the Vista operating system kernel by Microsoft's PatchGuard prevention system. They argue that this is preventing them from continuing to develop pro-active protection against new malware, sometimes referred to as 'host intrusion prevention' or 'HIPS'. They claim this action is anti-competitive.
However, Sophos argues that its approach to HIPS technology has met with no problems on both the low-spec and high-spec versions of Windows Vista. In addition, Sophos claims that Microsoft has so far provided all the interfaces that Sophos needs for providing this form of protection.
Oct
21
Windows XP SP3 available in 2008
Filed Under Security, Software, XP | Leave a Comment
Windows Service Pack Road Map now gives a preliminary date for the much anticipated Service Pack 3 for your Windows XP.
SP3 for Windows XP is currently planned for the first half of 2008. This date is preliminary and subject to change. And it will...