BoClean 4.10

[dom424]

Just got my new update emailed to me. Only problem after it is installed my computer will not boot up. After log in BoClean does it scan and then it just stops. After doing a Ctrl-Alt-Delete it tells me Explorer is not responding. Did a GoBack and tried again but the same thing. After 1 more GoBack I went back to 4.09. Anyone else have this happen? I am using Windows Me.

[Phazor]

Dom,

Have this same problem also. Deleted it and went back to 4.09. If you hear anything let me know.

Phazor

[TonyKlein]

The same thing happened to me, and I dropped Kevin a line.

It turns out that if you uninstall 4.09 first, 4.10 will install without a prob.

However, I now am unable to start up Outlook Express (5.5 SP2/Win98 SE).

When I fired up Outlook Express (5.5 SP2) with the intention of thanking Kevin for his swift reply, it just wouldn't start.
I waited for 15 seconds, and tried again, and again, ending up with 6 instances of Msimn in active tasks, but no Outlook Express in sight.

I ended task on them all, shut down BOClean, and tried again, and sure enough, OE came right up'.

I'd be interested to hear whether anyone else is experiencing this, and will post here myself , as soon as I get a reply from NSClean support.

Cheers, Tony

[TonyKlein]

OK, I got a reply from Kevin lightning fast, as always:

"Run BOClean. In the BOClean configuration screen, if you look down towards the lower right corner, there's a checkbox there marked "Fasthook" ...
If you UNcheck that and then reboot, Outbreak should come up working ... we did see a couple of circumstances where this has happened and what it is is MSIMN is being hooked by an antivirus that won't allow BOClean at the program, but BOClean has halted it and is waiting for access to it. UNchecking the "Fasthook" will cause BOClean not to do that."

And of course he was right! :)

[Paul Wilders]

..unfortunately, this does not work for all. Copy and paste from PSC:

{QUOTE-> I redid the SETUP program so that the entrails are removed BEFORE the new BOClean goes in ... I'm guessing
that pieces of the old 4.09 still remain and that's the reason why. We stopped shipping "last night" and will resume with the adjusted SETUP program that will clean out the old first as soon as folks are here in the morning <-QUOTE}

Those encountering problems after going to suggestions made earlier on, are advized to drop PSC an email.

regards.

paul

[Paul Wilders]

Coming with the NEW corrected BOClean v4.10:

{QUOTE-> Paul

The new BOClean 4.10 version is attached to this email for you.

The filename is BOC410.EXE just in case your security software manages to rename it to prevent it from running. All you need to do is doubleclick your BOClean traybar icon and select "Shutdown BOClean" from the BOClean popup menu to close BOClean so that it can be replaced. If you forget to do so, then the new installer will complain about not being able to write the "BOClean.exe" file. If BOClean is already not running, then there's no traybar icon to shut down.

Once that's done, uninstall BOClean 4.09 and then you can then run the BOC410.EXE file which was attached to this email to begin the installation.
Once it's installed and run, doubleclick on the traybar icon and when the menu appears, click on "Check for update" to collect the most recent update with automatic verification and installation.

Please visit our site at www.nsclean.com/supboc.html (http://www.nsclean.com/supboc.html) for documentation on the new BOClean 4.10.

NOTE: Some people required a "patch" for previous versions of BOClean, NO PATCH IS REQUIRED FOR THIS VERSION.

FINAL NOTE: If you STILL have problems, go to the configure screen of BOClean and UNcheck the "FastHook" checkbox in the lower right corner ... that'll turn OFF the "instant notify" from our hook and disable the system
hookage - this will be necessary if a poorly behaved security program isn't handling the hook chain properly ... that could also be the cause. <-QUOTE}

regards.

paul

[octogen]

I have installed BOClean 4.10 and it is running fine. I installed over version 4.09, i.e. w/o uninstalling version 4.09. Prior to installation, I shut down programs and services, except Explorer and Systray. Has anyone else installed it this way with success?

[Paul Wilders]

Hi octogen,

Guess you have been lucky ;D. Nevertheless, it's recommended to install the new version accordingly to the instructions from PSC, in order to avoid problems ;)

[Fred_T]

My advice, especially if you're running Outlook Express, is don't mess with v4.10 until the "Big Boys & Girls" say it's alright.

I've been agonizing over it for two days as amply described here and in the GRC forum. Notwithstanding that v4.10 has a couple of great new features, save yourself a lot of grief...stick with v4.09 for the time being.

"Fasthook" Fredinho

[Fred_T]

Oops...Sorry. My advice is intended ONLY for users like me who are at the bottom of the PC food chain!

Fredinho

[FanJ]

Well, I tried it too .....

Problems with Fasthook and problems without Fasthook.
So it was Fast removed from my system.....

[TonyKlein]

Hmmm, there seems to be some work to do yet, at NSCLean... ::)

For my part, I can only say that, after disabling Fasthook, I have no problems with the new version.

[FanJ]

https://grc.com/x/news.exe?cmd=article&group=grc.security.software&item=64647&utag=

{QUOTE-> I received this feedback from Kevin:
"once we get everybody updated, I'm going to go back
over this and figure out why. I'm inclined to think it might be a bug in
the new Microsoft "Visual Studio dotNET C++ compiler" which we had to use
to generate the fasthook DLL. Normally we write our code in Borland C++ and
suffer no problems, but in order to provide proper XP support, we HAD to
use Microsoft's sausage press for that DLL. Once we get to the bottom of
it, we'll be updating that DLL as part of a routine BOClean update."

Sky
<-QUOTE}

And there are other postings at GRC.security.software with this subject:
Re: BOClean 4.10 and fasthook

[FanJ]

Nancy is asking feedback at the PSC-forum at Becky's:

http://66.119.216.59/ubb/ultimatebb.php?ubb=get_topic;f=40;t=000224

[javacool]

New software releases often have problems - it's impossible to test EVERY system configuration possibility out there.

I'm happy that the code is at least IN there, and I have NO doubt that Kevin will get these problems some people have been having fixed soon.

-javacool

[FanJ]

The following is a quote from Kevin over at GRC:

https://grc.com/x/news.exe?cmd=article&group=grc.security.software&item=64920&utag=

[hr]
Yes, there have been a few (60 so far) problems reported with BOClean
4.10 going in without a prior uninstall of 4.09 (or an uninstall of 4.10
which accomplishes same removal from registry of old entries and early
startups) when either Kerio, ZoneAlarm or Sygate is present on Win98SE
boxes ... I'm still trying to get to the bottom of it and am still here
beating my head against the wall. The problem sounds like the "Fasthook"
is activated somehow, and after the first day we saw that a few people
were having problems with an associated DLL included with BOClean that
provides the "Fasthook" services and defaulted it to "off" ... the
"standard hook" works if this is turned off and doesn't seem to run afoul
of the firewall's system hooks. What we have going on though is
"contention" where the firewall locks down and backing off BOClean solves
it for now, long enough for me to continue to work on why the deadlock is
occurring at all on Win98 and ME. Under NT, Win2000 and XP, all works
famously. If the three mentioned firewalls aren't there (using either no
firewall or something else) no problem either. For many, still no problem.

What we did determine though is if any remains of BOClean 4.09 are still
installed, BOClean 4.10 needs to load AFTER Explorer comes up. Because of
this, we relocated the startups from one location in the registry where
4.09 started up earlier than anything else in the past to a new location
where it starts after Explorer. What's most likely is that since you
didn't uninstall 4.09 (I inadvertently neglected to mention the need for
the uninstall of 4.09 in the emails that went out the first day and
adjusted the SETUP program to take care of it as of the second day of
release) that original "early start" key may have still been there and
triggered the whole thing. When you uninstalled (assuming that you
received yours after 4pm on the 27th) that would have corrected it as well
since the uninstall mode would have cleared the registry entries in the
4.10 setup as well. That's my guess.

One of the reasons why I've been "invisible" the last few days is I'm
still struggling to pinpoint the cause - wasted a lot of time checking out
how the various firewalls worked only to discover yesterday that it isn't
the firewalls causing the problem - they're contributing to it by the way
they use VXD's to hook Win9X/ME, but the problem has been determined to be
the Microsoft Visual Studio DOTNET 7.0 that we had to use to build that
DLL. There's a bug in the compiler itself which favors properly working
code on NT/2000/XP and does subtle hoses for 95/98 and ME. Something in
there isn't right and I've been struggling to find out where the problem
is and work around it. The REST of BOClean (aside from the Fasthook DLL)
is written in Borland and that's what we've always built our stuff with.
The DLL unfortunately needs to access pieces of the Windows kernel that
aren't documented and so we're stuck at the moment.

Bottom line though, turn off "Fasthook" and BOClean falls back on its
traditional hook which doesn't require that pesky DLL where a problem
arises. As soon as I get a working compile out of Microsoft's compiler,
and we can test it, I'll provide everybody the fix. Been at it all weekend
and am still banging my head against the wall. What's more frustrating
than anything is we handed out 4.10 prior to release to just over 450
folks, and only one ran into any problems. I made the mistake of assuming
that to be a fluke. Yow. :)

Anyhoo, a reload SHOULD get you past the problem you had the first
go-round - that was the old 4.09's entrails that probably caused that.
Just make sure since you did run into the lockup that you install, then
instead of rebooting as you are told, RUN BOClean as soon as it's been
installed (instead of rebooting), doubleclick on the traybar icon, select
"Configure BOClean" and when the configuration screen comes up, make SURE
that the small checkbox in the lower right corner marked "Fasthook" is
*NOT* checked. Uncheck it if it is. Then you should be OK until we get the
DLL replaced.

My apologies ... we test the hell out of everything we make before
letting it go. This has been an even more unpleasant surprise for me.
That'll learn me to use Microsoft's latest to design a piece of our stuff.

For everyone else, be happy to provide chapter and verse on this once I
get the problem solved. I've received a number of emails from folks with
questions about how our web page is laid out and more esoteric questions
from "which firewall is better than another" and so on. For now, I'm only
answering email from people that are having problems that need immediate
attention. Answering emails and dropping by here is time spent away from
working on the code and checking out nasties. Once I come up for air, I'll
get to those as well as time permits. Hope this helps for now ... it's
been a hell of a week. :)

[Paul Wilders]

The culprit:

{QUOTE-> but the problem has been determined to be
the Microsoft Visual Studio DOTNET 7.0 that we had to use to build that DLL. There's a bug in the compiler itself which favors properly working code on NT/2000/XP and does subtle hoses for 95/98 and ME. Something in there isn't right and I've been struggling to find out where the problem
is and work around it. <-QUOTE}

I do wish PSC all the best in working this out, redesigning BOCLean, and providing an "all working copy" to their users.

regards,

paul