Runscanner 1.0 Final Released - (Renamed from 0.9.6.0 - almost final version)

http://www.runscanner.net
New feature : "Beginner mode" is targetted at "novice" forum users.

Let me know your thoughts/remarks

I'm looking for some people to test this on "real" infected machines.

Changelog 0.9.6.0

Fixed bug with links to folders in global startup.
Fixed description bug with internet explorer buttons (added buttontext)
Fixed bug with incorrect host file path
Fixed bug with importing of existing .run file (history)
Fixed bug 063 fix not working
Fixed bug difference string / expandstring in registry
Signed executable with authenticode certificate
Changed icons for signatures (green, blue)
Changed textlog for tasks items (added description)

Added : Beginner, expert mode (wizard)
Added : Backup & restore function
Added : Scheduled jobs now show the application started by the job
Added : free filter/search (you can now search on part of words ex: "f-secure" show all items with the phrase "f-secure")
You can search in path,executable,company,md5
Added : filesize to .run file
Added : extra info window (easy for debugging and to copy/paste)
Added : basic tutorial to the site
Added : extra backup info window in the history tab
Added extra vista UAC support
Added vista support : now program asks to run as administrator by default

Added item : 001 : hosts file location
Added item : 001 : hosts file entries <> 127.0.0.1 (count)
Added item : 047 IE trusted zones
Added item : 048 IE ESC trusted zones
Added item : 008 Autorun registry entries .default user
Added item : 009 Autorun registry entries System user

 

Re: Runscanner 0.9.6.0 released (almost final version)

Great Utility! and effort RunScanner. All the best for a successful run & following with this. Really like all the areas it uncovers whether on a regular basis or occasionally. Xtremely useful.

Regards

 

Re: Runscanner 0.9.6.0 released (almost final version)

Build 0.9.6.1 uploaded (minor release)
http://www.runscanner.net/

Changed : restricted sites/zones are now ignored
Redesigned the beginner screen
Fixed performance issues with uploading


Great utility!

Keep going...

 

Re: Runscanner 0.9.6.0 released (almost final version)

Hi, folks: An interesting application, just like a CAT scan of your PC. Nothing can be hidden from its powerful scan. But two concerns: firstly , why would it ask to upload the scan results to the server(?) even in expert mode (asking outbound network connection) ? secondly, how is the state of its central database volume? I am using Prevx2 and it has a huge volume of database. How would this app's compare to Prevx2 ? I must say, however, it is a great program as long as it is a not me-too or mirrored application to some existing ones.

 

Re: Runscanner 0.9.6.0 released (almost final version)

The outbound traffic is to clr.microsoft.com and to verisign to check the authenticode signatures of the files. (there is a warning on the top of the first screen)

A "Quick scan" is expert mode doesn't do this check.

A comparison with prevx = this application is freeware

 

Re: Runscanner 0.9.6.0 released (almost final version)

Hi, folks: Thanks for reply BUT... I can not connect to these manually: crl.microsoft.com (mentioned by your scanner--top portion of page) NOR clr.microsoft.com( stated in your reply). Both in http:// or www. Can you advise?

 

Re: Runscanner 0.9.6.0 released (almost final version)

The program uses the winverifytrust api http://msdn2.microsoft.com/en-us/library/aa388208.aspx to check the signatures of the signed executables.
If you want to know exactly what's send to these addresses, I think it's best to use a sniffer.

 

Re: Runscanner 0.9.6.0 released (almost final version)

Not a big deal really. That was done for MATCHING purposes and ensuring Microsoft files are indeed AUTHENTIC.

EQSsecure (HIPS) also does the same and adds an option to disregard if you untick that feature.

Regards EASTER

 

Re: Runscanner 0.9.6.0 released (almost final version)

Congratulations
I really like the logs of RunScanner

 

Re: Runscanner 0.9.6.0 released (almost final version)

Meanwhile the final version has been released:

Changelog 1.0 (final release)
Rewrite of the "beginner - wizard" screen
Added version check in beginner mode
Added list of specialist helper forums
Removed "no zone defined" entries from trusted zones
Whitelisted microsoft trusted zones in textlog:
Whitelisted 063 default items
Whitelisted 036 default items
Whitelisted "::1 localhost" in vista hosts file
Whitelisted default 180 entries in log file
Whitelisted default 106 entries in log file
Fixed bug with incorrect "file not found"
Several other small bug fixes

http://www.runscanner.net

 

Re: Runscanner 0.9.6.0 released (almost final version)

Excellent work!

 

Re: Runscanner 0.9.6.0 released (almost final version)

Spread the word

 

Re: Runscanner 0.9.6.0 released (almost final version)

Sure

 

Xcellent!!!

 

Re: Runscanner 0.9.6.0 released (almost final version)

LUSHER

Would you mind offering something of an explaination to that brief statement of refusal?

 

Lusher is just joking, he is spamming al over internet the release of version 1

 

I'm starting to regret it. RunScanner has a slew of bugs (I already posted one pretty major one and will post the rest at the runscanner forum in a couple of hours), clearly there hasn't being enough testing.


I think it needs a lot of work before it can be as rock solid as AutoRuns. Clearly, I should have being doing bug testing instead of doing silly marketing. It's not rock science , just a lot of work.


Besides in one nazi-like forums, I'm getting my ass kicked for daring to post because of my lack of "creditability"...


They don't question the creditability of the author but decide to attack the guy who is just posting about it, who is just inviting them to take a closer look. I really don't understand the logic.



Whatever man. I think I really need to go get one of those staff position/ titles from some security forum like CastleCops , for people to take me seriously.


Don't get me wrong RunScanner is still great, but I think it still needs to be tested a lot more to root out silly bugs. So I will keeping AutoRuns for now.

 

LUSHER

It would be of some help to the rest of us if you would at least point out "some" of the bugs you are discovering that are disappointing to you.

Thanks. That information helps guide us for what to expect & to look for plus serves as a chart of sorts from which to compare our own results with yours.

The developer surely would be grateful for it too.

 

Lusher,

You can post all bugs to the forum.

I can ofcourse only solve the bugs that people submit to me.

 

The big bug that Lusher was mentioning is an error in "AppInit_DLLs"
The AppInit_DLLs entries are missing in the log.

 

I've uploaded version 1.0.1, the Appinit bug is fixed in this version.
(actually appinit was missing from the scans)

 

Not this one. You really think I have such a thin skin? I'm fine if people post warning that's it's was beta, that's it's not as well tested as some others, it is not "approved" by the powers that be etc...

But this guy keep questioning my creditability...

Anyhow I exploded, and the guy now is backpedalling saying that he is not necessarily saying I'm not creditable, and that RunScanner is not necessary bad etc...

Well sure,i would believe that if you didn't keep saying I am unknown to your "malware fighting community"... So? As if I would want to belong to your silly little club of mostly teenagers.

Never mind, one of their precious moderators and "reknown" member of the silly malware fighting community already tried to use RunScanner to help people long BEFORE I even posted about RunScanner.

I don't see anyone questioning HIS creditability in using a tool with a beginner user that is in early BETA

Double standards is all I can say, man...

 

I already did (see RS forums). I just did a simple comparison of autoruns and RunScanner logs (probably the same can be done with other tools like Hijackthis, Hijackfree, SilentRunners etc), I'm not sure if RS really does cover everything in RS.

I also probably need to write a simple script to put entries in the scanned locations to check if RS really does detect the areas it says it is.

I have never seen you post any real results except for vague talk about your "Research" , it would be nice if we see something concrete from you too.

 

Version 1.0.3.0 release

Changelog 1.0.3
Added trusted zones HKLM
Added HKCU\Software\Classes\Folder\Shellex\ColumnHandlers
Added HKCU\SOFTWARE\Microsoft\Active Setup\Installed Components
Added HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
Added HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad
Added 105 HKCU\Software\Microsoft\Internet Explorer\MenuExt
Fixed minor bug with incorrect filter
Fixed minor sorting bug in text log file
Changed behaviour with 068 -> download lsp-fix
Changed ctrl+c (copy) formatting
Google lookup now also searches for GUID, registry entry if no exename available.