Safe Returner 1.27.5 Release

Safe Returner is an awesomely impressive anti-malware tool which aids in the removal of Malware - Trojan Horses, Worms, Adware, Spyware and rootkits.

Features

1.Safe Returner is a smart version of Sysinternal's Autoruns which also shows you what programs are configured to run during system bootup. However, while Autoruns could not use without dedicated IT-staff, even a computer novice knows how to use Safe Returner right away.

2.None signature antimalware.
Safe Returner does not replace an antivirus product. It is strictly a post-infection removal tool.

What it does?

Safe Returner examines all the system files, the Windows Registry and the programs and files loaded at boot time. The majority of malicious programs (once triggered) load this way.

What's new

It could detect most type of hidden service rootkits,even the popular Black Energy 2.1+ rootkit

I know it is very difficult to remove Black Energy rootkit even manually use other anti-rootkit tools because the random driver will recreated while deleted by others.

the Black Energy 2.1+ rootkit sample is from
http://www.kernelmode.info/forum/viewtopic.php?f=16&t=42&p=3224#p3172

welcome for any other rootkit test!


Home page: http://www.safereturner.com

 

@egomoo: You site still shows and let us download old version (1.27.3) only.

 

I'm sorry,it will update while click "Scan" button

 

What about offline use? What will be update scenario when user has lost internet connection due to malware and you get Safe Returner trial from a friend on USB?

 

thanks for your tip,boyfriend

the new version download has been updated.

 

I have noticed this catchme.txt log being created when I run the program since version 1.27.4.
Log details:

read file error: C:\WINDOWS\System32\drivers\luvtnw.sys, The system cannot find the file specified.

 

@egomoo: Update version number (1.27.3 to 1.27.3) on your main page and post updated 'Plus" version on your site.

 

that means the file "C:\WINDOWS\System32\drivers\luvtnw.sys" do not exists

I use catchme to check whether the file is truely not found.

 

I wasn't worried...just curious.

 

Hi egomoo, I just installed the latest version (1.27.5) and your GUI still shows the DPI problem that I reported earlier when the system is set to use 120 DPI.

Al.

 

Dr. Web quarantines this for Backdoor Trojans. Would you upload the update to them so they can whitelist it?

 

Why do I feel that I am looking at Emmisoft at that GUI ?

 

Only Dr. Web report as a trojan.loader

I have uploaded two times the early version but the next time it happened again

 

I didn't notice you made a new thread for the new version.
I have a post in the old thread, FYI.
45+ minutes and counting.

 

Hi,

Is that mean you scan stop at "online analysis"?

if the can takes more than 10 minutes,it must have a error in the scan process.

 

Hi,I'm sorry.

It's a difficult problem,I have not fixed it now when you set 120 DPI.

 

1:46+ and counting.

How do I figure out what the error is.
Should I create a minidump of the process via task manager?
I have closed the program now.

 

Should I upload the .exe that your program keeps stopping on to somewhere?

 

could you do a scan again?What about the online anlysis progressbar ?

Does that stop at the end of progressbar ?

 

It halts during signature scanning, progress bar is 3/4 through, it stops on 1 specific .exe each scan attempt and stops there.
FYI, The version I downloaded was the top choice 1.27.5, not the bottom choice 1.27.3.

 

I am confused about RegKernelHelp.sys...Does it load before the SrKillKit.dll?

It seems to not load some of the time.

Also, I have this error in the device manager.

 

...one more screenshot

 

Yes,RegKernelHelp.sys is a part of SafeReturner to detect rootkits.

RegKernelHelp.sys will be created just like catchme.sys will be created by catchme.exe.

 

Still having the issue with it locking on one file.
Should I have run the installer as administrator?
I have tried run as admin and without, doesn't make a difference.

 

It just updated to version 1.27.6