Latest HTAStop? Old one on your site.

Discussion in 'other anti-malware software' started by DarkStar, Aug 2, 2003.

Thread Status:
Not open for further replies.
Page 2 of 2
  1. Mr.Blaze

    Mr.Blaze The Newbie Welcome Wagon

    Joined:
    Feb 3, 2003
    Posts:
    2,842
    Location:
    on the sofa
    :D thx guys i was able to get it this time yeah

    :Dkinda got excited like a little kid geting that big red shiney metal fire truck on christmass morning lol
     
    Mr.Blaze, Aug 5, 2003
    #26
  2. LowWaterMark

    LowWaterMark Administrator

    Joined:
    Aug 10, 2002
    Posts:
    18,280
    Location:
    New England
    That's where I'm using it. I've looked at what it does and it has caused no problems on my system. It's activated now. As MtM said above, since it can be activated and deactivated easily, there really isn't much of a problem.
     
    LowWaterMark, Aug 5, 2003
    #27
  3. notageek

    notageek Registered Member

    Joined:
    Jun 3, 2002
    Posts:
    1,601
    Location:
    Ohio
    I'm running Script Sentry do I need to use HTAStop?
     
    notageek, Aug 5, 2003
    #28
  4. Vietnam Vet

    Vietnam Vet Registered Member

    Joined:
    Feb 9, 2002
    Posts:
    306
    Do not use XP myself, but have seen a couple of reports that say if you use the classic mode, then Users in the control panel doesn't work, when HTASTOP2003 is toggled on.

    Perhaps the best answer is to try for yourself, but as others have said, a simple toggle on-off makes it pretty much a non-issue.
     
    Vietnam Vet, Aug 5, 2003
    #29
  5. LowWaterMark

    LowWaterMark Administrator

    Joined:
    Aug 10, 2002
    Posts:
    18,280
    Location:
    New England
    There seems to still be a little debate on that... For many conditions, I think you are covered by ScriptSentry, however, there's a question remaining regarding whether HTA contained in certain ways on a webpage can bypass the file association that ScriptSentry protects against. The author of ScriptSentry has suggested an additional protection which I think he may add to some future update. It's to disable the CLSID which is one of the three preventions in HTAstop, that I noted above. So, if he's suggesting that, I suspect there may be some chance of it getting by ScriptSentry.
     
    LowWaterMark, Aug 5, 2003
    #30
  6. notageek

    notageek Registered Member

    Joined:
    Jun 3, 2002
    Posts:
    1,601
    Location:
    Ohio
    Thanks LWM. I'll look into HTAStop a little bit more. Maybe I'll look into a program like WormGuard or something like that.
     
    notageek, Aug 5, 2003
    #31
  7. Paul Wilders

    Paul Wilders Administrator

    Joined:
    Jul 1, 2001
    Posts:
    12,475
    Location:
    The Netherlands
    We offer bandwidth for good security software. That said: in case any security/privacy developper or company wants us to mirror their program(s), it's common usance them contacting us. This hasn't been the case. No way we can and want to hunt down ourselves; time is a precious thing nowadays.

    In case PSC or any software developper wants us to mirror their software: an email surely would be a good start ;).

    regards.

    paul
     
    Paul Wilders, Aug 11, 2003
    #32
  8. spy1

    spy1 Registered Member

    Joined:
    Dec 29, 2002
    Posts:
    3,139
    Location:
    Clover, SC
    Well, I finally managed to get HTAStop2003 from Simtel (thanks to Brummelchen on MTM's site), but I had to go this route:
    ftp://gatekeeper.dec.com/pub/micro/pc/simtelnet/win95/security/HTAstop.exe .

    Now, however, there's been a question raised as to whether or not the program actually works - supposedly, if you're running XP (or maybe even WinMe), the mshta.exe simply gets re-created as it was at the next re-start - whether you've "fixed" it with HTAStop2003 or not.

    The info for the program does say (on this page http://www.nsclean.com/htastop.html ) that it's for "Windows95, 98, NT, 2000 or Windows ME" (I'm really kind of surprised W2K doesn't replace "critical" system files like XP does, if that's the case).


    Anyone got any input on this? Pete
     
    spy1, Aug 30, 2003
    #33
  9. LowWaterMark

    LowWaterMark Administrator

    Joined:
    Aug 10, 2002
    Posts:
    18,280
    Location:
    New England
    Actually, yes, it does work on XP. The reason that XP's feature of automatically regenerating system files does not fix mshta.exe is because it isn't simply deleted and left missing. Instead, HTAstop2003 renames mshta.exe to mshta.exf, (take a look for it in your system32 directory), and then copies notepad.exe back as mshta.exe. XP doesn't replace a system file if one is there, only if it's gone completely.

    Of course, you can only ask PSC to find out for certain whether it is supposed to be used on XP or not. For myself, I think that when they edited the page they just forgot to add XP. The first version of HTAstop may have been released prior to XP, so perhaps that's why it's not there. But, I don't know. :doubt:

    I do know that HTAstop2003 does prevent HTA from functioning on XP, as stated, though the minor bug in reply #28 above does exist. (That being, the XP "User Accounts" applet in the Control Panel doesn't work until you enable HTAs again.)

    When checking all this again because of your new post, I went back to the Simtel site and re-downloaded HTAstop2003 to retest with it, just to be sure of the facts before posting. The version at Simtel has been updated... My last download from there was Aug 2, and this new version is very slightly different when doing a file compare.

    There was a small bug in the previous version of HTAstop2003. When using it to reactivate HTA's on your system, it would properly remove the version of mshta.exe that was a copy of notepad, restoring it with a copy of the original it had saved as mshta.exf, however, when it linked to the exe from the CLSID in the registry, it pointed to the mshta.exf version, not the .exe version. It all still worked, since the mshta.exf was identical to the just restored .exe copy, but, that was still incorrect. So, this has been fixed now.
     
    LowWaterMark, Aug 30, 2003
    #34
  10. Milly

    Milly Guest

    Um, Windows File Protection works on digital sigs not just file names, and will therefore replace notepad-renamed-as-mshta. So it appears HTAstop Build 3 is broken too.
     
    Milly, Sep 1, 2003
    #35
  11. nameless

    nameless Registered Member

    Joined:
    Feb 23, 2003
    Posts:
    1,233
    You are correct about this. Rename any file in a temp directory to "mshta.exe", then copy that file over system32\mshta.exe... You will either have it restored quietly, or be prompted to insert your WinXP CD.

    The solution, if you wanted to do it manually, would be to make sure the WinXP CD wasn't inserted, then overwrite the system32\mshta.exe and system32\dllcache\mshta.exe files at the same time. My own way to do this would be to extract a ZIP file that contains two copies of the file I want to replace mshta.exe with (full paths in the ZIP file would be required). And of course when prompted, cancel and confirm the WFP request to restore the originals.

    If you ever run System File Checker (SFC) with the /scannow parameter, the original mshta.exe files will be restored (that's the whole intent of SFC--to verify valid system files). This is why I would create a ZIP file, with full paths stored, containing both bogus mshta.exe files. If I ever need to run "sfc /scannow", I let it replace the originals, then I pull the WinXP CD and extract the ZIP file and respond to the prompts. I've been doing that for eons with notepad.exe (so I can easily use a Notepad replacement).

    You can actually replace the mshta.exe files automatically, as needed (such as after running "sfc /scannow", or if you're just paranoid). Use the WinZip command-line support add-on. The command line you would use is as follows:

    "C:\Program Files\WinZip\WZUNZIP.EXE" -d -o -yo "[path to ZIP file]" C:\

    For example:

    "C:\Program Files\WinZip\WZUNZIP.EXE" -d -o -yo "D:\Data\Replace MSHTA.EXE.zip" C:\

    * The "-d" command-line option tells WZUNZIP.EXE to use the stored folders in the ZIP file being extracted.
    * The "-o" command-line option tells WZUNZIP.EXE causes the target files to be overwritten without a prompt.
    * The "-yo" command-line option tells WZUNZIP.EXE to overwrite the target files, even if they are hidden, system, or read-only files.

    A few points (sorry for the gory detail; I want to speak to novice users as well as the experts around here):

    1) Make sure the ZIP file being used has paths stored, and that it has nothing but the two mshta.exe files you want to overwrite. For example, this is what is inside my ZIP file (file/path):

    mshta.exe WINDOWS\system32\
    mshta.exe WINDOWS\system32\dllcache\

    Note that the two "mshta.exe" files represented above are bogus... They're actually renamed copies of Notepad.exe. I mention this because it's rather critical not to accidentally use the real mshta.exe files! (Kind of defeats the whole purpose.) :)

    So, when I extract to C:\ using the command line shown above, the actual files that get replaced are:

    C:\WINDOWS\system32\mshta.exe
    C:\WINDOWS\system32\dllcache\mshta.exe

    2) Do this when the WinXP CD is not inserted, or WFP will silently undo your replacement.

    3) Be sure to extract this ZIP file after running "sfc /scannow".

    4) After running the command line which extracts the ZIP file and overwrites the mshta.exe files, WFP will prompt you to insert your WinXP CD to undo the file replacement. Click "Cancel", then click "Yes" to confirm.

    5) Of course, make sure you use the correct path to WZUNZIP.EXE, not to mention your ZIP file. ;)

    Edit: Please read the caveat I added in my new post below before performing the procedure above. (I added it as a new post so that it would catch the attention of anyone who subscribed to this thread, who might have already performed the procedure.)
     
    nameless, Sep 1, 2003
    #36
  12. spy1

    spy1 Registered Member

    Joined:
    Dec 29, 2002
    Posts:
    3,139
    Location:
    Clover, SC
    Thanks LWM, Milly and nameless! Great info! Pete
     
    spy1, Sep 1, 2003
    #37
  13. LowWaterMark

    LowWaterMark Administrator

    Joined:
    Aug 10, 2002
    Posts:
    18,280
    Location:
    New England
    Ah, thanks for the clear explanation on how that works. I was unaware of the mechanics of all that.

    It would appear that HTAstop2003 did exactly what you described. I just checked my dllcache folder and found they did indeed replace that copy of mshta.exe with a copy of notepad, as well. That explains why this file did stay as a copy of notepad after running HTAstop, and was not replaced. I guess they thought of that, as well. So, it still appears that it does work on XP.

    Just rechecked by toggling HTA back to enabled again, and HTAstop reverts the copy in dllcache to original at the same time.

    Edit: Actually, couldn't they be doing it this way on XP:

    1. Replace the copy of mshta.exe in the dllcache folder with a copy of notepad.exe
    2. Rename the copy of mshta.exe in system32 to mshta.exf
    3. XP automatically replaces the now missing mshta.exe with the notepad version from dllcache.

    Getting XP to do the replacement itself?

    Edit 2: Hmm, I was just able to manually do this...

    1. I removed the copy of mshta.exe from dllcache folder
    2. I copied notepad.exe to dllcache\mshta.exe
    3. I renamed system32\mshta.exe to mshta.exf
    4. Windows XP then replaced the missing system32\mshta.exe with the notepad version from dllcache

    Very interesting! :)
     
    LowWaterMark, Sep 1, 2003
    #38
  14. tosbsas

    tosbsas Registered Member

    Joined:
    Feb 9, 2002
    Posts:
    789
    Location:
    Lima, Peru
    same config here - no trouble

    Ruben
     
    tosbsas, Sep 1, 2003
    #39
  15. Milly

    Milly Guest

    I fear you are mistaken (though I can't explain why you're seeing what you're seeing). I doubt that any version of HTAstop touches the DLLCache at all (and I've certainly not seen or heard of a build which does, though without documentation anything is possible).

    Could. But aren't, I don't think :-

    https://grc.com/x/news.exe?cmd=article&group=grc.news.latestversions&item=2370

    You might wish to bear in mind that this whole "serious new attack method" has been debunked as a mistake ...

    https://grc.com/x/news.exe?cmd=article&group=grc.security.software&item=88849

    ... and that there is no new mshta exploit. That this ...

    https://grc.com/x/news.exe?cmd=article&group=grc.security.software&item=88452

    ... just isn't true.

    I understand that people may wish to kill mshta nevertheless, of course, and this thread now contains methods for manually doing so (including that neat winzip trick), so some good has come of it. But XP|ME + HTAstop isn't an ideal recipe.

    - Added URL tags to fix all the GRC links - LWM
     
    Milly, Sep 4, 2003
    #40
  16. spy1

    spy1 Registered Member

    Joined:
    Dec 29, 2002
    Posts:
    3,139
    Location:
    Clover, SC
    Milly - Thank you for joining the discussion here! And, welcome to Wilders. (Read a lot of your stuff over on GRC). Pete
     
    spy1, Sep 4, 2003
    #41
  17. LowWaterMark

    LowWaterMark Administrator

    Joined:
    Aug 10, 2002
    Posts:
    18,280
    Location:
    New England
    Thanks Milly for the extra information. (Over at DSLR, the posting regarding the value of the need for HTAstop pretty much ended with people saying they didn't think the supposed exploit could do what was written up based upon how the code was supposed to run, but no one got a clear answer on it.)

    As to whether it works or not, well, on my XP system it does work exactly as I described. I don't know the mechanics of how the dllcache copy gets written, or why XP does not return the proper copy instantly as your reference says it should... (Edit: I wonder if there are configuration options in XP that accounts for the different results? Some installation option differences perhaps?)

    I say many times in the posts I make that I don't know what's going on inside the software, but rather I base my statements on external observations. That said: The currently available version of HTAstop2003 does indeed work on my system, meaning the changed copy of mshta.exe stays as a copy of Notepad, and the dllcache folder copy does change, as well. :doubt: I just toggled it back and forth, and this is what it shows in Windows Explorer (image below) regarding the dllcache copy. (Edit: Note that I had to close Explorer and reopen it to get it to reflect the change in the file.)

    Wondering...

    Has anyone else here run HTAstop2003 on Windows XP? What happens to the copy of mshta.exe in the System32 folder? Does it stay as a copy of Notepad? What happens to the copy in the dllcache folder? Does it work on your system like mine doesm or is my system just unique?
     

    Attached Files:

    LowWaterMark, Sep 4, 2003
    #42
  18. nameless

    nameless Registered Member

    Joined:
    Feb 23, 2003
    Posts:
    1,233
    A sidenote (more a "warning") to anyone considering following my instructions above... I have noticed that the User Accounts Control Panel applet no longer works with Notepad as a replacement for mshta.exe (the exact error is "C:\Temp\res:\C:\WINDOWS\system32\nusrmgr.cpl\nusrmgr.hta contains an invalid path.", where "C:\Temp" is a path that will vary by system). I was surprised by this, and I don't know what else might be affected by altering mshta.exe.

    I'm close to deciding that this whole "replace mshta.exe" thing is too elaborate and inconvenient for my taste. Having things broken, and having to remember extra stuff are security trade-offs that I tend to be very loathe to make. I have so many other layers of protection that I'm not too worried about anything going wrong anyway. YMMV. ;)
     
    nameless, Sep 6, 2003
    #43
  19. LowWaterMark

    LowWaterMark Administrator

    Joined:
    Aug 10, 2002
    Posts:
    18,280
    Location:
    New England
    Agreed, especially given the additional information Milly provided above (i.e. "...this whole "serious new attack method" has been debunked as a mistake..."), it hardly seems worth it now.
     
    LowWaterMark, Sep 6, 2003
    #44
  20. MickeyTheMan

    MickeyTheMan Security Expert

    Joined:
    Feb 9, 2002
    Posts:
    1,017
    You are right about the control panel. However you simplly need to deactivate HTA when you need to access it and then reactivate hta afterwards
     
    MickeyTheMan, Sep 6, 2003
    #45
  21. nameless

    nameless Registered Member

    Joined:
    Feb 23, 2003
    Posts:
    1,233
    Sure, but the point is that's a hassle, and it's just not worth it to me from this vantage point. I don't even really use that Control Panel applet--I just happened to be poking around when I discovered the issue--but I don't like having 5,000 little "gotchas" on my system like that.
     
    nameless, Sep 7, 2003
    #46
Page 2 of 2
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...