topbanner_forum
  *

avatar image

Welcome, Guest. Please login or register.
Did you miss your activation email?

Login with username, password and session length
  • October 18, 2019, 12:24 AM
  • Proudly celebrating 13 years online.
  • Donate now to become a lifetime supporting member of the site and get a non-expiring license key for all of our programs.
  • donate

Show Posts

This section allows you to view all posts made by this member. Note that you can only see posts made in areas you currently have access to.


Messages - BillR [ switch to compact view ]

Pages: [1]
1
Announce Your Software/Service/Product / Re: SunsetScreen v1.0
« on: September 08, 2016, 12:28 PM »
Summary - v1.25 tested via 3 online meta-AV scanners.  Avira CHANGED from positive to negative, :Thmbsup:  a very positive sign
ClamAV  was split 1 positive, 2 not.  4 other AVs positive.  50+ others null/negative.

A quick update on presumed false positives on SunsetScreen v1.25 released in August 2016, an ever better SunsetScreen.
http://www.skytopia....ftware/sunsetscreen/
---
VirusScan by Jotti
https://virusscan.jo...lescanjob/a26gj94qsh
1/19 positive (as of Tues., Sept 8 )
ClamAV     Sep 6, 2016      PUA.Win.Packer.SetupExeSection-1   [true of many utility downloads]
---
VirusTotal by Google
https://www.virustot...analysis/1473199738/
2/57 positive (as of Tues., Sept 8 )
Invincea          virus.win32.parite.c                20160830
Rising             Malware.Heuristic!ET (rdm+)   20160906
but note:
ClamAV             [null/negative]                     20160906
Avira (no cloud) [null/negative]                     20160906
---
Metadefender [formerly Metascan-Online] by OPSWAT
https://www.metadefe...8b3/regular/analysis
3/42 positive (but 5 updating/not available so really 3/37)
(as of Friday, Sept. 2 )
Avira           2219 ms      Sep 02 2016 (4 days ago)         ADWARE/InstallRex.Gen 
Filseclab      8282 ms      Sep 02 2016 (4 days ago)         W32.InstalleRex.L.crhx 
TotalDefense   16 ms      Sep 01 2016 (5 days ago)         Win32/Tnega.JOBKNaC 
but note:
ClamAV       2391 ms      Sep 02 2016 (4 days ago)         [null/negative]
---
Metadefender
2/42 (all engines reporting)
(as of Thursday, Sept. 8 )
Filseclab and TotalDefense remain positive but
Avira is now null/negative, as are the missing 5 engines from last week.
---
Slight differences in results for the same vendor between different online scanners and especially with installed AV products is to be expected (as all three sites say). 
My personal observation is that ClamAV packer warnings are almost pointless while Filseclab and TotalDefense are prone to false positives.  Rising was based on heuristic analysis.

UPDATE - Fixed "Sept. 8)" versus "Sept. 8 )"

2
Sorry I did not make that clear.  The only problem is with scrolling but I have not tested extensively.  @Ath, something along the lines of your guess sounds logical to me, but at a more subtle level as a few other simple snapshots have worked.

3
Anyone else with conflict between HitmanPro.Alert and Screenshot Captor Scrolling Window?
Suggestion for resolution?  Perhaps exclude a different/additional process in HMPA?

I posted the following excerpt yesterday.  (Issue 2 regards LastPass and HMPA encryption conflict.)

http://www.wildersse...age-313#post-2545573

Has anyone else encountered conflicts between:
Screenshot Captor and HitmanPro.Alert?

Issue 1: Screenshot Captor (just snipping via scrolling window feature) by DonationCoder and HitmanPro.Alert conflict. I have to stop Screenshot Captor in order to cancel the .Alert warning (canceling many more times might work eventually). Excluding the main process via Exploit Mitigation was not sufficient. (Win7, multiple browsers, .Alert all features except encryption)

To reproduce, install SC trial and show Quick Capture Bar; with browser open to a page that scrolls, click on scrolling window button; loop the error message a few times; cancel snipping request via the tray icon.


4
Announce Your Software/Service/Product / Re: SunsetScreen v1.0
« on: November 30, 2015, 07:21 PM »
Mouser's ScreenshotCaptor just ran afoul of hitmanPro.Alert (paid version).
Just lost the long post with details. :'(

hitmanPro.Alert encryption also breaks LastPass intermittently. 
-----
I think I tested current install version from your site.

If memory serves:
old v100 - old vt (7 months ago) yes
old v100 - today vt more (but completely different than above??)
old v100 - today jotti ClamAV
old v100 - today MO yes  (note, always check top and bottom of list at MO)
old v100 - today herdProtect 1 Reason Heuristic, but I suspect I will see 5 or 6 next time I run it.  hP has to upload new files and then analyze them.

Don't know if you are familiar with each one of these but VirusTotal, jotti, and Metascan-Online each has an easy to use web interface that supports drag-n-drop or select file name. 

For herdProtect, see the Reason Core Security site and go to Reason Labs menu item to check most recent results via hash to see the Reason Labs analysis (but not others??).  I don't know of a way to submit an individual file for analysis.  herdProtect is the predecessor to Reason Core Security.

Update -- Clarify wording; no substantive changes.
Update -- I would have lost the bet: hP results for v100 remain at 1: Reason Heuristic.

5
Announce Your Software/Service/Product / Re: SunsetScreen v1.0
« on: November 30, 2015, 07:40 AM »
:huh: Metascan-online: 
Filseclab Nov 25 2015  W32.InstalleRex.L.crhx  
TotalDefense Nov 29 2015 Win32/Tnega.JOBKNaC  
Zillya! Nov 29 2015 Backdoor.Poison.Win32.72429   

:-\ VirusTotal (a growing list): 
Panda  PUP/TSULoader  20151129 
Rising  PE:PUF.InstallRex!1.9E4C [F]  20151129 
TotalDefense  Win32/Tnega.JOBKNaC  20151130 
Zillya  Backdoor.Poison.Win32.72429  20151130 

;) Jotti: 
ClamAV PUA.Win32.Packer.SetupExeSection  [but then what isn't]

:o herdProtect [suspicious/Artemis/Tnega/...]: 
Bkav
McAfee
McAfee Web Gateway
Panda
Reason Heuristics
Total Defense
Trend Micro House Call
Reason Heuristics (2nd)
I may have missed a few as several engines weren't available.
  Presumed FP? (although anything "screensaver-ish" may be classified a PUP/PUA by definition -- albeit a sloppy one).

Two best lists I've found:
Those of you who actually author software and trip over this frequently may be able to suggest better resources.

6
So a quick summary:
  • WebSense corrected its rating. 
  • rgdot documented FP process:
    suggest that Websense researchers reevaluate a categorization by e-mailing [email protected]
  • N.A.N.Y. Challenge 2014 idea suggested: website oriented VT auto-submission tool.  (I originally wrote "2104".  I hope for a much better solution by then but don't expect to see it personally.)  Or maybe this already exists?
  • This challenge to Mouser's equanimity has passed.  :D

7
Has anyone found a way to report a false positive to these Websense jokers?  It never ceases to amaze me how these security services have no problem classifying things as malware for no reason and then make it almost impossible to contact them to have it corrected.

I've found reporting any reputation/blacklist false positives quite painful.   :(  In some cases I can't request a review unless I'm registered but registration requires a non-hotmail/gmail/... and non-mailinator/... account and a business phone and review/approval by the marketing(?) dept. OR purchasing the software.  In another, I had to resort to private correspondence with the contractor supporting the blacklist site (found his email from a different project years ago) because my email address was improperly treated as blacklisted on the registration page (a configuration/programming error triggered a review) and of course I couldn't use the website contact admin form to report a problem because I was under review.

Mouser and other authors, if you don't already, you might try submitting any published program version to the three AV meta-scan sites VirusTotal, Jotti.org, and Metascan-Online just to see if there is a problem and to get the (slow?!) review process started.  Between them they cover at least 25 *nix and MS Windows-based antimalware engines plus another three dozen Windows-based engines (although many primarily use signatures from one of the same few sources like BitDefender).  Most of these are primarily/just signature oriented.  Won't guarantee AV-conflict-free installations with actual installed antimalware products but I assume it should help.  

Mouser or others may disabuse me of the efficacy of this idea, of course. For example the new freeware-ish version of XYplorer (a great file manager) is still listed as malware by four engines a couple of weeks later.

The best summary of how to report file false positives that I know about is by Chiron on TechSupportAlert (please chime in if you know of other good ones, especially any that automate reporting!):

http://www.techsuppo...ntivirus-vendors.htm

tomos
towards the top of the page -- under "Classification" there's a link "suggest different classification".
Yes, tried that.  Don't expect it to work since I think the real problem is the evaluation of the file.  Of Jotti (~25 engines), VirusTotal (48), and Metascan-Online (40) only Antiy flags FARR. (Antiy FP review already requested.)

BTW, URLvoid also passes DC site as a whole.

8
Random Idea - Maybe a simple way to submit every(?) page of a site to VirusTotal for evaluation?  Several tools will list all links and build a tree and VT has a simple API so I guess this would be primarily a script (with a 16 second delay between submits) and some parsing of the results to build a simple report.
I've also noticed that www.some-site-xyz.com and some-site-xyz.com will return different results in VT even when one redirects to the other.

---------
Websense (Directly and via VirusTotal) - DonationCoder is Malicious   :o

http://csi.websense....4-bb68-a2b8006ae41e#

https://www.virustot...analysis/1390140476/

http://www.donationc...AndRunRobotSetup.exe

Requested reclassification as productivity software because:

FARR - Program launcher for MS Windows.
Other software is also available on donationcoder.com, much of it productivity related such as ScreenshotCaptor (enhanced print/capture screen) and JottiQ (MS Windows Explorer context menu extension to submit files to Jotti.org -- security productivity).

-----
File detected:   FindAndRunRobotSetup.exe
File threat classification:   Malicious
....
The Websense ThreatSeeker Intelligence Cloud is now reclassifying this URL due to the malicious file it drops. If you suspect someone from your organization went to this URL, inspect their machines for possible malware infection. The assessment overview below does not include the results of this file analysis.
-----
Scroll to the bottom to see FARR.exe analysis

9
Screenshot Captor / Re: Bug - Wrong Description
« on: November 17, 2013, 02:41 PM »
"I'm not sure I'm following exactly."  
Sorry, I wrote the comment in a hurry.  The problem is that the description sometimes includes (as best I can tell) inaccurate information.  Citrix may be significant but for the purposes of illustration just consider it "Site 1" and Ixquick "Site 2" and DuckDuckGo "Site 3".  Sometimes the description combines Window A / Site 1 with Window B / Site 2.

In the last example the captured window has one tab only.  The last line is accurate (logged out of Citrix) but the line above appears to refer to a different window (and IIRC probably a different session) with a tab that is displaying Ixquick.

Similarly, in the first example, that window has exactly two tabs (Ixquick displayed, DDG not) but the screen capture description references Citrix (the only tab in a different window).

In both cases I used the active window button from the Quick Capture Bar.  Setup is Vista and IE9.

Is it possible that I pressed a different button and that affected the description?
Yes, this absolutely might be 100% user error!
 I'm quite sure for one of the problem cases that I used the active window button: I consciously thought about the need to capture only the active window and that I wanted the window with one tab; I slowed down and double checked, even hovering over the (correct) button to read the tip.  I'm not nearly as sure about the other case.

Thanks for investigating this.  I will try to create a clean test case (but not until midweek) where I am very careful about which button I use, whether a new session or window, documenting order of actions, etc.  Now that I know how to capture SC itself (main window, anyway), I'll partially document it that way.

10
Screenshot Captor - New Screenshot

Button Labels:
Save image and sh...
Save image but hid...

Field Labels:
...Overide filename:
...omment/caption:

11
Screenshot Captor / Re: How to Capture Screenshot Capture Itself?
« on: November 15, 2013, 03:15 PM »
Thanks for quick response!  Found it under Capture menu in main window.  Should have known you would include it somewhere.  Not easy to search for in the forum, though.

QUESTION: How to use it to capture the new screenshot pop-up?  I can capture main window but not the one to illustrate the bug.  I'll poke around some more in a few minutes.  I'm documenting a bug in another program (hence installed SC again earlier).

12
Screenshot Captor / How to Capture Screenshot Capture Itself?
« on: November 15, 2013, 02:04 PM »
How does one use Screenshot Capture to capture screenshots of itself (e.g., those in documentation)?  Or does one just use a different tool?

Apologies if this has been answered before and my clumsy self-referential search in the SC forum failed to find it.

13
Screenshot Captor / Bug - Wrong Description
« on: November 15, 2013, 01:53 PM »
This is the description for the IE9 window and tab ("Start new topic ..."; other tab is "Screenshot Captor - Software - Donation Coder") that I am writing in now resulting from Grab Active Window:

iexplore
11/15/2013 , 2:26:53 PM
https://citrixeast.a...auth/loggedout.aspx?           <=====  ?????
CTX_MessageType=INFORMATION&CTX_MessageKey=SessionExpired
Start new topic - DonationCoder.com - Windows Internet Explorer

But the only citrix tab open refers to a different window (different session?) which is minimized to the taskbar.

I don't have this problem if I open a new session (from "Start new topic ...") with two tabs (ixquick.com and duckduckgo.com):
iexplore
11/15/2013 , 2:40:43 PM
https://ixquick.com/
Ixquick Search Engine - Windows Internet Explorer

or new window (from ("Start ...") with two tabs:
iexplore
11/15/2013 , 2:41:27 PM
https://ixquick.com/
Ixquick Search Engine - Windows Internet Explorer

or new window from the citix window:
iexplore
11/15/2013 , 2:43:33 PM
https://www.google.com/
Google - Windows Internet Explorer

But the citrix window/tab itself (only tab!):
iexplore
11/15/2013 , 2:46:59 PM
https://ixquick.com/                                                      <===== ?????
Citrix XenApp - Logged Off - Windows Internet Explorer

14
For this laptop I set default DPI scaling to large in Vista.  I think this causes the text on the buttons to overflow.   Re-sizing the pop-up with some application implementations/settings sometimes allows more text to display but not here.

One possible quick solution might be to enable hover display.   

I only use SC a few times a year so I don't have the icons/button-positions memorized.

Pages: [1]