RCC - check your system's trusted root certificate store

Not enough time...
I'm still working on a more advanced GUI tool though.

 

Okay.
Can't wait for that!

 

[offtopic]Today i found this on gHacks: http://www.ghacks.net/2015/02/18/scan-files-for-hidden-executable-contents/
and read about the tool "MZReveal" which is linked to that site: http://trax.x10.mx/ which lists MZreveal 1.11 but your homepage list
version 1.03 and the link is offline.
So which one is the real one?[/offtopic]

 

v1.11 is the current version. I just fixed the version number and link. Sorry for the confusion!

 

What is the current status for RCC ?

 

Due to time constraints, I am releasing updates at a slower pace.

A new build should be available by this weekend.

 

Build 1.69.012, with updated signatures, is now available for download.

 

I haven't run this since last year, because I only had the XP desktop.

However, I now have a laptop [Surface Book], Windows 10, and thought I would get reacquainted with this utility.

I was surprised to see this. I guess it is OK.

 

Thanks!

It is still necessary to copy the cert.db and nssckbi.dll from Pale Moon to the RCC folder, but it works.

@Tarnak: This is normal, because the file comes from another PC and unknown Publisher but the file is clean.

 

Thank you for updating the program.
Does anybody know where the 2 detected certificates come from?

 

"XBL Server ..." - maybe something Xbox-related? XBL = Xbox Live
Installing a game or using the Xbox-App may have added this.

 

I also have these and hopefully it's due to the Xbox live service (or potentially hardware related to the Xbox Controller). I know the wireless controller is treated like a network device so..IPSEC? Anyway, you would think it would be easy to find info on that if it's an official MS cert but there's literally nothing on the internet about it.

 

Yes, it's not easy to review the purpose of certificates, if nothing or very few can be found.

 

The "Time of insertion" information can often be very useful in such cases. When investigating unknown certs, check if you installed new hardware or software at that time, or played a new game for the first time.

Also can you have a look in certmgr.msc to see if these certs carry any private keys?

 

after running RCC I see some red and some are from Adguard. I am wondering if I can delete the eset one since I don't have that installed.

in certmgr.msc I have one from Heimdal and that I have not had installed for a year. I should be able to delete that one also?

 

If Heimdal and ESET are deinstalled, the corresponding certificates can be deleted.

 

Yes, but they are legit and do no harm.
Both security companies are trustworthy and there are so many questionable certificates in the store, I would worry more about...

 

If i use /strict more certificates (26) are displayed, but i'm not sure about some of them. I'll better leave them that way

 

@mood:
So you are following the same guideline, as me:
If it ain't broke, don't fix it.

I have set my ZAM to scan for suspicious Root-CA, but ZAM did not report any.
Even if it did, I would not fire, without deep investigation.

 

Any chance for an update? Now it shows old database and quits automatically.

 

There was a problem with the download link. Updated version (1.69.013) is now available.

 

Thanks!

 

Hello

I have a problem with latest version : 1.69.013

 

Can confirm, same error, database too old.

 

RCC 1.69.015 is now available for download!

https://www.trustprobe.com/fs1/apps.html