Runscanner 1.0 Final Released - (Renamed from 0.9.6.0 - almost final version)

Discussion in 'other anti-malware software' started by RunScanner, Aug 13, 2007.

Thread Status:
Not open for further replies.
  1. RunScanner

    RunScanner Registered Member

    Joined:
    Feb 27, 2007
    Posts:
    58
    http://www.runscanner.net
    New feature : "Beginner mode" is targetted at "novice" forum users.

    Let me know your thoughts/remarks

    I'm looking for some people to test this on "real" infected machines.

    Changelog 0.9.6.0

    Fixed bug with links to folders in global startup.
    Fixed description bug with internet explorer buttons (added buttontext)
    Fixed bug with incorrect host file path
    Fixed bug with importing of existing .run file (history)
    Fixed bug 063 fix not working
    Fixed bug difference string / expandstring in registry
    Signed executable with authenticode certificate
    Changed icons for signatures (green, blue)
    Changed textlog for tasks items (added description)

    Added : Beginner, expert mode (wizard)
    Added : Backup & restore function
    Added : Scheduled jobs now show the application started by the job
    Added : free filter/search (you can now search on part of words ex: "f-secure" show all items with the phrase "f-secure")
    You can search in path,executable,company,md5
    Added : filesize to .run file
    Added : extra info window (easy for debugging and to copy/paste)
    Added : basic tutorial to the site
    Added : extra backup info window in the history tab
    Added extra vista UAC support
    Added vista support : now program asks to run as administrator by default

    Added item : 001 : hosts file location
    Added item : 001 : hosts file entries <> 127.0.0.1 (count)
    Added item : 047 IE trusted zones
    Added item : 048 IE ESC trusted zones
    Added item : 008 Autorun registry entries .default user
    Added item : 009 Autorun registry entries System user
     
    Last edited: Aug 13, 2007
  2. EASTER

    EASTER Registered Member

    Joined:
    Jul 28, 2007
    Posts:
    5,633
    Location:
    U.S.A. (South)
    Re: Runscanner 0.9.6.0 released (almost final version)

    Great Utility! and effort RunScanner. All the best for a successful run & following with this. Really like all the areas it uncovers whether on a regular basis or occasionally. Xtremely useful.

    Regards
     
  3. rdsu

    rdsu Registered Member

    Joined:
    Jun 28, 2003
    Posts:
    4,456
    Re: Runscanner 0.9.6.0 released (almost final version)

    Build 0.9.6.1 uploaded (minor release)
    http://www.runscanner.net/

    Changed : restricted sites/zones are now ignored
    Redesigned the beginner screen
    Fixed performance issues with uploading


    Great utility! :thumb:

    Keep going... ;)
     
  4. Perman

    Perman Registered Member

    Joined:
    Nov 23, 2005
    Posts:
    2,160
    Re: Runscanner 0.9.6.0 released (almost final version)

    Hi, folks: An interesting application, just like a CAT scan of your PC. Nothing can be hidden from its powerful scan. But two concerns: firstly , why would it ask to upload the scan results to the server(?) even in expert mode (asking outbound network connection) ? secondly, how is the state of its central database volume? I am using Prevx2 and it has a huge volume of database. How would this app's compare to Prevx2 ? I must say, however, it is a great program as long as it is a not me-too or mirrored application to some existing ones.
     
  5. RunScanner

    RunScanner Registered Member

    Joined:
    Feb 27, 2007
    Posts:
    58
    Re: Runscanner 0.9.6.0 released (almost final version)

    The outbound traffic is to clr.microsoft.com and to verisign to check the authenticode signatures of the files. (there is a warning on the top of the first screen)

    A "Quick scan" is expert mode doesn't do this check.

    A comparison with prevx = this application is freeware
     
  6. Perman

    Perman Registered Member

    Joined:
    Nov 23, 2005
    Posts:
    2,160
    Re: Runscanner 0.9.6.0 released (almost final version)

    Hi, folks: Thanks for reply BUT... I can not connect to these manually: crl.microsoft.com (mentioned by your scanner--top portion of page) NOR clr.microsoft.com( stated in your reply). Both in http:// or www. Can you advise?
     
  7. RunScanner

    RunScanner Registered Member

    Joined:
    Feb 27, 2007
    Posts:
    58
    Re: Runscanner 0.9.6.0 released (almost final version)

    The program uses the winverifytrust api http://msdn2.microsoft.com/en-us/library/aa388208.aspx to check the signatures of the signed executables.
    If you want to know exactly what's send to these addresses, I think it's best to use a sniffer.
     
  8. EASTER

    EASTER Registered Member

    Joined:
    Jul 28, 2007
    Posts:
    5,633
    Location:
    U.S.A. (South)
    Re: Runscanner 0.9.6.0 released (almost final version)

    Not a big deal really. That was done for MATCHING purposes and ensuring Microsoft files are indeed AUTHENTIC.

    EQSsecure (HIPS) also does the same and adds an option to disregard if you untick that feature.

    Regards EASTER
     
  9. lucas1985

    lucas1985 Retired Moderator

    Joined:
    Nov 9, 2006
    Posts:
    4,047
    Location:
    France, May 1968
    Re: Runscanner 0.9.6.0 released (almost final version)

    Congratulations :)
    I really like the logs of RunScanner
     
  10. RunScanner

    RunScanner Registered Member

    Joined:
    Feb 27, 2007
    Posts:
    58
    Re: Runscanner 0.9.6.0 released (almost final version)

    Meanwhile the final version has been released:

    Changelog 1.0 (final release)
    Rewrite of the "beginner - wizard" screen
    Added version check in beginner mode
    Added list of specialist helper forums
    Removed "no zone defined" entries from trusted zones
    Whitelisted microsoft trusted zones in textlog:
    Whitelisted 063 default items
    Whitelisted 036 default items
    Whitelisted "::1 localhost" in vista hosts file
    Whitelisted default 180 entries in log file
    Whitelisted default 106 entries in log file
    Fixed bug with incorrect "file not found"
    Several other small bug fixes

    http://www.runscanner.net
     
  11. rdsu

    rdsu Registered Member

    Joined:
    Jun 28, 2003
    Posts:
    4,456
    Re: Runscanner 0.9.6.0 released (almost final version)

    Excellent work! :D
     
  12. RunScanner

    RunScanner Registered Member

    Joined:
    Feb 27, 2007
    Posts:
    58
    Re: Runscanner 0.9.6.0 released (almost final version)

    Spread the word :)
     
  13. lucas1985

    lucas1985 Retired Moderator

    Joined:
    Nov 9, 2006
    Posts:
    4,047
    Location:
    France, May 1968
    Re: Runscanner 0.9.6.0 released (almost final version)

    Sure :)
     
  14. EASTER

    EASTER Registered Member

    Joined:
    Jul 28, 2007
    Posts:
    5,633
    Location:
    U.S.A. (South)
    Xcellent!!!
     
  15. EASTER

    EASTER Registered Member

    Joined:
    Jul 28, 2007
    Posts:
    5,633
    Location:
    U.S.A. (South)
    Re: Runscanner 0.9.6.0 released (almost final version)

    LUSHER

    Would you mind offering something of an explaination to that brief statement of refusal?
     
  16. RunScanner

    RunScanner Registered Member

    Joined:
    Feb 27, 2007
    Posts:
    58
    Lusher is just joking, he is spamming al over internet the release of version 1 :D
     
  17. LUSHER

    LUSHER Registered Member

    Joined:
    Feb 28, 2007
    Posts:
    440
    I'm starting to regret it. RunScanner has a slew of bugs (I already posted one pretty major one and will post the rest at the runscanner forum in a couple of hours), clearly there hasn't being enough testing.


    I think it needs a lot of work before it can be as rock solid as AutoRuns. Clearly, I should have being doing bug testing instead of doing silly marketing. It's not rock science , just a lot of work.


    Besides in one nazi-like forums, I'm getting my ass kicked for daring to post because of my lack of "creditability"...


    They don't question the creditability of the author but decide to attack the guy who is just posting about it, who is just inviting them to take a closer look. I really don't understand the logic.



    Whatever man. I think I really need to go get one of those staff position/ titles from some security forum like CastleCops , for people to take me seriously.


    Don't get me wrong RunScanner is still great, but I think it still needs to be tested a lot more to root out silly bugs. So I will keeping AutoRuns for now.
     
  18. EASTER

    EASTER Registered Member

    Joined:
    Jul 28, 2007
    Posts:
    5,633
    Location:
    U.S.A. (South)
    LUSHER

    It would be of some help to the rest of us if you would at least point out "some" of the bugs you are discovering that are disappointing to you.

    Thanks. That information helps guide us for what to expect & to look for plus serves as a chart of sorts from which to compare our own results with yours.

    The developer surely would be grateful for it too.
     
  19. RunScanner

    RunScanner Registered Member

    Joined:
    Feb 27, 2007
    Posts:
    58
    Lusher,

    You can post all bugs to the forum.

    I can ofcourse only solve the bugs that people submit to me.
     
  20. RunScanner

    RunScanner Registered Member

    Joined:
    Feb 27, 2007
    Posts:
    58
    The big bug that Lusher was mentioning is an error in "AppInit_DLLs"
    The AppInit_DLLs entries are missing in the log.
     
  21. stapp

    stapp Global Moderator

    Joined:
    Jan 12, 2006
    Posts:
    7,290
    Location:
    England
    Do you mean this thread? I thought they were pretty ok to you really., perhaps you'd just had a bad day and took things the wrong way.

    http://forum.piriform.com/index.php?showtopic=11164
     
  22. RunScanner

    RunScanner Registered Member

    Joined:
    Feb 27, 2007
    Posts:
    58
    I've uploaded version 1.0.1, the Appinit bug is fixed in this version.
    (actually appinit was missing from the scans)
     
  23. LUSHER

    LUSHER Registered Member

    Joined:
    Feb 28, 2007
    Posts:
    440
    Not this one. You really think I have such a thin skin? I'm fine if people post warning that's it's was beta, that's it's not as well tested as some others, it is not "approved" by the powers that be etc...

    But this guy keep questioning my creditability...

    Anyhow I exploded, and the guy now is backpedalling saying that he is not necessarily saying I'm not creditable, and that RunScanner is not necessary bad etc...

    Well sure,i would believe that if you didn't keep saying I am unknown to your "malware fighting community"... So? As if I would want to belong to your silly little club of mostly teenagers.

    Never mind, one of their precious moderators and "reknown" member of the silly malware fighting community already tried to use RunScanner to help people long BEFORE I even posted about RunScanner.

    I don't see anyone questioning HIS creditability in using a tool with a beginner user that is in early BETAo_O

    Double standards is all I can say, man...
     
    Last edited: Aug 19, 2007
  24. LUSHER

    LUSHER Registered Member

    Joined:
    Feb 28, 2007
    Posts:
    440
    I already did (see RS forums). I just did a simple comparison of autoruns and RunScanner logs (probably the same can be done with other tools like Hijackthis, Hijackfree, SilentRunners etc), I'm not sure if RS really does cover everything in RS.

    I also probably need to write a simple script to put entries in the scanned locations to check if RS really does detect the areas it says it is.

    I have never seen you post any real results except for vague talk about your "Research" , it would be nice if we see something concrete from you too.
     
  25. RunScanner

    RunScanner Registered Member

    Joined:
    Feb 27, 2007
    Posts:
    58
    Version 1.0.3.0 release

    Changelog 1.0.3
    Added trusted zones HKLM
    Added HKCU\Software\Classes\Folder\Shellex\ColumnHandlers
    Added HKCU\SOFTWARE\Microsoft\Active Setup\Installed Components
    Added HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
    Added HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad
    Added 105 HKCU\Software\Microsoft\Internet Explorer\MenuExt
    Fixed minor bug with incorrect filter
    Fixed minor sorting bug in text log file
    Changed behaviour with 068 -> download lsp-fix
    Changed ctrl+c (copy) formatting
    Google lookup now also searches for GUID, registry entry if no exename available.
     
Loading...
Thread Status:
Not open for further replies.