If you have an issue with Windows Defender

[plun]

Ive been testing the real time protection and its impressive (screenshots

saved) ,it detected about 20 out of 25 different installers when I run them
and has been able to remove what it finds with acouple of exceptions (SpyAxe
gave an alert but only removed one CLSID entry and not the program and one
error code on cleaning) its let spambot trojans, look2me , Mirar & SpyAxe
install which has prompted the MS Removal tool to set this as my homepage

Hi Andy

Also performed some testing.......

20 out 25 > 80%.

Have you set your settings to be an advanced Spynet member and notify
you during tests ?

Going to test Winfixer/Errorsafe today and see how WD reacts.Within
Sweden we have a trnslated swedish Errorsafe version going around with
ActiveX intalls and this one causes a lot of trouble. The first one
I have seen transalted to trick users.

Have you seen this blog from Sunbelst ?

http://sunbeltblog.blogspot.com/2006/02/winfixer-pop-up-spoofs-windows-live.html

This blog entry was also "fun".........
Knock out WD ?

http://sunbeltblog.blogspot.com/2006/02/so-what-are-highconvert-folks-up-to.html

My personal opinion is that a newbie maybe need to
have notify messages surpressed but a normal to advanced user
has the knowledge to see that something is wrong with help from
WD notify messages and system changes if a malware is unknown.

regards
plun

 

[Bill Sanderson]

Thanks, Andy--my understanding of the pair of numbers that you cite in
relation to the .ocx is explained in a message from Mike Treit--in addition
to the .ocx, there must have been an archive of some sort--zip or arj or
whatever. One or both of those errors relates to Windows Defender
intentionally choosing not to delete an archive because one or more of its
contents is malware--they can't tell for sure whether there are other items
in the archive that are uninfected and valuable, so they leave the archive.

 

[Bill Sanderson]

I've turned on all the notices. I was installing sbs-2003 on a laptop as a
trial. I then went through and found drivers for all the stuff missing from
the initial install--ethernet nic, motherboard sound, smartcard reader. At
the end of that driver install process, I got an alert from Windows Defender
with a chance to approve or (?) disapprove each new driver.

Notification is one thing--but having to take specific approval action for
every such change on the PC could be a lot of work. I'm leaving these
things on--I like the view they give me of what is happening in a software
update or install, for example--but I sure wouldn't recommend it for the
average person.

--

 

[plun]

Hi Bill

This test result shows WD in action
with some ugly stuff.

http://hem.bredband.net/b288305/testing_spyfalcon_and_errorsafe.htm

WD has probably some mismatch within softwarelogic but it works.
Spycleaner is also a rather new PUP.

Ewido shows again "State of the art"........

But overall WD was good

regards
plun

 

[Bill Sanderson]

Thanks --good description--not the best set of results we could hope for.

I believe I've heard it said that they hope to improve on the dialog boxes
for that particular failure message--I think you are correct that it relates
to an archive of some sort--perhaps a cab file.

--

 

[plun]

Hi

Well, WD works and Spyfalcon is a new one.

About the fault I believe that this is a mismatch with
software logic and user resets.

First WD removed Winfixer but then I had one not notifided "alarm" to
acknowledge and beacuse of removal there wasn´t any to ack.

One other thing is that I didn´t do anything for a while and let
Errorsafe go on with scannings before I choosed to "Remove All".

Hopefully AndyM can bring more to this after his tests.

Nevertheless I feel confidence with WD and sees that it works.

So I am recommending MSAS Beta1 uninstalls within swedish forums.

No way back, just forward .........

regards
plun

 

[Bill Sanderson]

No way back, indeed.

I was impressed that those characters have a pretty effective looking
Swedish page--they are pretty creative--I just wish they were promoting a
better cause than their own pockebooks.

--

 

[plun]

Hi Bill

Yes, Errorsafe is the first rouge app i´ve seen translated to Swedish.

Winfixer and Errosafe is the same and gives a Vundo infestion
http://wiki.castlecops.com/Malware_Removal:_Virtumundo

Spyfalcon gives a Smitfraud "cold"
http://wiki.castlecops.com/Malware_Removal:_SpyAxe_Removal

Note that no carrier trojans was involved within this test which
makes it easier to handle.

And it is big money involved to trick users to pay........

regards
plun

 

[Guest]

Hi Bill ,

That makes sense as it was called azesearch.cab and inside that was
'azesearch4.ocx' and 'azesearch.inf' They were detected as CWS.MWSearch but
it displays the error in each scan . Ive also seen error's on these Programs
when they are detected in the scan which also displays failed if I choose
remove and prompts to scan again.

Failed : 0x80508017

SearchForItAdShooter

HKLM\SOFTWARE\Classes\SYI.SYIObj.1
HKLM\SOFTWARE\Classes\SYI.SYIObj

Replace Search

HKLM\SOFTWARE\Classes\ReplaceSearch.ReplaceSearchCtl.1
HKLM\SOFTWARE\Classes\ReplaceSearch.ReplaceSearchCtl

Ive checked the registry key permissions and they are set to allow full
control to myself (Admin) but the system checkboxes for read and full control
are blank, enabled Full Control to System and Defender was able to remove
them.

There was a Failed: 0x80508026 for Webhancer which was detected as
(RARSfx-whInstaller.exe) in System Volume Information but it didnt show in
the second scan, The CWS.WMSearch Failed error is for
'\azesearch.cab>azesearch4.ocx' and could get frustrating for novice users as
it prompts to run another scan each time it fails which then loops back to
the scan prompt again.

Here's the Real Time detections Ive noticed up to now running on the default
settings (All installers and screenshots saved)

Windows Defender Alerts when installing and running:

Azesearch.ocx - Detected as CWS.WMSearch, Fails to clean as explained above
Blockchecker
BrowserAccelerator
BrowserPal
CnsMin
Country.exe (KillAvTrojan) - Detected as SpySheriff
Dashbar
DashMemory
DealHelper
Exploit.wmf
GotSmiley
MediaGateway
Mirar Toolbar
PopUpBlocker - Mirar Detected
ReplaceSearch
RXToolbar
SearchForItAdShooter
Seekmo
Splitter (From Deepcom) - Webhancer Detected
SpyAxe
SpySheriff
SpywareStrike
SurfSideKick
tool5.exe (KillAVTrojan)- Detected as SpySheriff
VCMain (Bundled with some SSK and Qoologic installs) - Detected as SpySheriff
Webhancer
WebSecure(Gain)
WhenU
WinFixer2005
Zango-180
Zsearch

No Alert or warnings when Installing and Running:

sf.exe (Installed By CoolOnlineOffers) Trojan.Small detected using Jotti's
scan site
WinFixer2006
HotBar
Look2me
mpcsvc.exe (Trojon Ciadoor-AA)
tool4.exe (Trojon Ciadoor-AA)
Side bySideSeach
Dialer.hc

Mirar gave a detection for the toolbar but Defender wasnt able to remove it
or the trusted zones entries. SpyAxe displayed an alert but failed to remove
the program or startup reg entries but it did fully remove Spyware Strike
which is from the same rogue family so maybe it just needs abit of tweaking,

The MS Removal Tool Homepage has happened alot and not something I'd noticed
before, with it giving no details of what it found or removed I think
Defender might be linked to that as it's detecting problems in the scans.


Hey Plun,

Regarding the settings, I'm just running it on the default settings for now
as I wanted to see what its stopping by default but I will run the junk again
on advanced.

With Winfixer, Winfixer2005 is being detected and removed but not
Winfixer2006, I was able to install that and run it without any alerts from
Defender including after the system rebooted when Winfixer autostarts and
scans. Ive just read the Sunbelt Blog and that shows the steps they will take
to get on systems so it would be nice to see all of WinSoftware's app's
detected.

Cheers for the second link, I visited HighConvert afew months ago and it
would load exploit files as soon as the page was opened which dropp a bundle
of junk but I've not checked the page recently and that was on a machine with
no service packs,

The IP address from the Sunbelt blog is displaying the image the Sunbelt
team show on their site 'The Finger' and no hidden code but I just noticed if
you use the same IP address range and change the last digit from 68 to 69
then load the page It redirects using a hidden Iframe in the pagecode to open
a blank looking page at HighConverts site and this contains another hidden
Iframe to load a file called video.wmf , Windows Defender instantly displays
an alert for a wmf exploit so the IP address range is definitely worth
keeping a eye on

Chat to you later

Andy

 

[plun]

Hi Andy

Great work !

Hopefully someone from Defender team sees your test result
beacuse these apps are widely spread.

But, maybe they all are punishment for visiting Internets backyards



I also send you a mail with my own small test result.

Nevertheless I feel confidence about using WD.

regards
plun

 

[Bill Sanderson]

I wonder if the money end is the way to get at these guys? I guess, though,
it is like "snake oil" (American term for ineffective medicine sold by
travelling salesmen)--even though what they are buying doesn't do anything
useful, it is also not harmful--you can't really shut down a company just
because its products are not particularly useful--they can point to the
customer demand.

I would say those two groups--the smitfraud and vundo folks look like the
worst actors in the spyware area at the moment--and they seem to be pretty
well entrenched.

--

 

[Bill Sanderson]

Andy - I know Microsoft is interested in any site which is hosting known
exploits.

It might be a good idea to pass that IP and description on to
(e-mail address removed) You'll get a noncommittal response, but the
information will get checked and used.

--

 

[Guest]

Sorry Plun, I will check my emails now as I didnt realize you had sent one.
I agree with you overall it looks and performs great, With it being a new
program I'm just enjoying testing it and checking the common files , with the
advanced Spynet settings that could make it alot easier to update if they
notice a new file so Im glad to have it installed on my pc's.

 

[Guest]

Hi Bill

Id only looked at it after reading Pluns reply which included this link.

http://sunbeltblog.blogspot.com/2006/02/so-what-are-highconvert-folks-up-to.html

I don't know much about HighConvert but Ive seen their original site install
trojans and infections via exploits, the new IP is shown on the Sunbelt blog
and changing that last digit loads the exploit file. They are probably just
moving around or changing hosting companies due to their past record.

Andy

 

[plun]

Hi Bill

Well, one thing is to sell "sugar pills" for a smaller amount of money
but most dangerous is the use of credit cards.

This can be a "ticking bomb" where the bad guys collects card number
and waits some time, weeks or months and then they use these card
numbers in a massive withdrawal.........

So these rouge apps must be stopped as soon as possible.

regards
plun

 

[Bill Sanderson]

Indeed--these folks have shown themselves to be well beyond the reach of law
for some time now--giving them your credit card is a substantial risk.
--

 

[Guest]

Hi

I downloaded windows defender 2 bt wen i try to get spyware definition
updates it doesnt do anythin it just sits their even if i click the but 5
times! Im on windows xp sevice pack 2

 

[Bill Sanderson]

Are you on a corporate LAN? What happens if you go to Windows Update and do
an express scan?

--

 

[Guest]

No i am on xtra jetstream bt our connection has no other computers attached

 

[Bill Sanderson]

Great---that eliminates one set of issues with AutoUpdate.

So--what happened when you went to Windows Update? Is AutoUpdate working
for other updates?

--