WinTasks Pro ... Windows Explorer is a trojan - yeah right!

[Carol Haynes]

I used to use WinTasks Pro a lot but haven't had it installed for a while now. I though I would check for updates and install it again.

Surprisingly Uniblue have not updated the app since August 2005 (at least that is when I downloaded the last update)!

They now seem to be marketing it as a security tool and have updated the 'Process Library' which provides information relating to common running processes on your system.

This one amused me:



I wonder what Microsoft would think about their Gold Partner Status in light of this ....

[tomos]

they could be right you know

[PhilB66]

All it says that besides a legit explorer.exe there's also a trojan that goes by that name. See http://www.liutilities.com/products/wintaskspro/processlibrary/explorer/

[Carol Haynes]

Actually what you will see on that webpage is that it is a marketing scam - and personally I would expect better from Uniblue/LIUtilities.

I am not disputing that explorer.exe could be spoofed/hacked as a trojan (though I would expect Windows SFC to notice that such a core module of the operating system has been modified illegally - that is what SFC is for after all) but the purpose of the warning is to get you to download two Uniblue products, install them and then buy them.

WinTasks is not and never has been a security tool - if it was it would have had some updates in the last 18 months to keep up with current issues. It is really a TaskManager replacement/extension with a few nice features (like the use of profiles to disable/enable groups of processes by a one click method). Selling it on the current basis that it offers some security advantages is pure marketing of paranoia (like most of the bogus security software out there).

As a security tool the only advantage it has ove Windows built in TaskManager is access to a library of information relating to common processes. This is lamentably poor (IMHO) as for most tasks it just reads the info in the EXE file as supplied by the programmer - and so doesn't add any value added info. For those items in its database it mostly seeks to worry you into download completely unnecessary extra software for a 'free scan' - which basically means download trial versions of their own software - so it less security related than marketing - and that marketing is based on fear - shoddy IMHO.

[f0dder]

I am not disputing that explorer.exe could be spoofed/hacked as a trojan (though I would expect Windows SFC to notice that such a core module of the operating system has been modified illegally - that is what SFC is for after all) but the purpose of the warning is to get you to download two Uniblue products, install them and then buy them.

I don't think SFC would react on an explorer.exe that doesn't overwrite the original... you could drop it in system32\drivers to make it appear legit.

For those items in its database it mostly seeks to worry you into download completely unnecessary extra software for a 'free scan' - which basically means download trial versions of their own software - so it less security related than marketing - and that marketing is based on fear - shoddy IMHO.

I read that as free scam

[Carol Haynes]

I don't think SFC would react on an explorer.exe that doesn't overwrite the original... you could drop it in system32\drivers to make it appear legit.

I thought SFC maintained some sort of hash check on the installed version of EXPLORER.EXE and the one in use in memory. To spoof explorer wouldn't it have to load into memory and replace the standard version? I thought this sort of live spoof checking was introduced in Windows XP (or possible Win 2k) so that files are rolled back to standard versions automatically if they are tampered with?

[f0dder]

Yeah, but it only checks files on disk, and it checks based on file path, not only file name (that would be a disaster anyway - I can think of many legit products with a component called "explorer.exe").

But dropping files in the windows folder should of course be prohibited... but that comes down to user vs. administrator accounts, and Microsoft blew all chances of fixing that properly.

[franky158]

Has anyone tried the new tools on www.processlibrary.com - http://www.processlibrary.com/processscan and http://www.processlibrary.com/quicklink/? Have these replaced WinTasks - does anyone know? They're both free and really useful.

[Carol Haynes]

UniBlue (formerly LIUtilities) have numerous 'packages' that are actually bundles of utilities. Processlibrary is part of some of these apps (including WinTasks). When you click on a process in WinTasks Pro (not sure about standard) it looks up the process in processlibrary (which is actually included and updated as part of the package) and displays the details within the main screen - you can expand it and view it in a larger screen and it has links to the website.

As far as I can see the website (and the info in the database) are designed to get you to download other products. Quickly skipping through a number of common processes on my computer I get very similar messages to the one I posted at the start of this thread namely (to paraphrase) "essential do not stop this process ... registered as a trojan delete it". Seems particularly to apply to MS process but not exclusively.

Maybe I should report this behaviour to MS since they proudly display the Gold Partner label on their website since they effectively seem to be arguing that almost any essential MS process in Windows is registered as a trojan.

Note they don't say 'potential target for trojans and other malware' - which would be a more reasonable approach - they actually advocate removal of core windows functions like Explorer!! Anyone using this library that isn't tech savvy is going to have a hard time understanding what is required of them - and that it is actually impossible if you want your computer to function.

LIGHT GOES ON

Ah! What they are actually saying is WinTasks as a security app recommends the removal of Windows from your system - that makes sense!

This one is even more classic:

[attachimg=#]

So far all the MS processes I have looked at are labelled in similar ways ... some (like this one) even more severely than explorer.exe.

[f0dder]

Carol, if you can be bothered to do so, I think you should report them to Microsoft... I'm tired of companies with fishy strategies.

[Carol Haynes]

My last post has been edited with another example.

Yes it should be reported - have you ever tried contacting Microsoft?

Having said that I just found their Gold Partner website - which is basically a glorified club that MS charges for!

[f0dder]

Yes it should be reported - have you ever tried contacting Microsoft?

Nope, but generally I think you have to be lucky to get a reply - unless it's something really serious

[cranioscopical]

have you ever tried contacting Microsoft?

No need to in my case. I get quite a bit of email from Bill Gates, who's nice enough to offer me some hot stock tips.
Thanks to him I'm comforably invested in that scheme to extract bio-fuel from all those corn fields in the Sahara.

[Lashiec]

The problem in this instance is that Uniblue is doing things wrong, as always, and the information about the process is badly redacted. The notes should be in a separate section, down the article (or the window in this case) saying: "When lsass.exe is located here, and the file size is that or this, then the process is such malware..."

The best tool in this regard is Google or your favourite search engine, instead of a third-party process manager, which, really, had always pale in comparison with Process Explorer, PrcView or What's Running. I remember that, even before Uniblue started to resort themselves to questionable marketing schemes and tried to expand their software scope with dubious products, they were trying to provide information about the software running in your system.

BTW, how things are done the right way

Hey, cranioscopical, send me the link, I want to get rich too! (Those scammers do not bother to try hard these days )

[Nighted]

If Windows Explorer was a trojan, I'd have at least 50 kids right now. 

[Darwin]

Lashiec - The Ultimate Troubleshooter does it that way, too... I actually moved from WinTasks Pro to TUT because I found the information that it provides easier to locate and understand. Still have WinTasks installed, though...

[Carol Haynes]

I think problems arose when Uniblue bought LIUtilitities (which AIUI was a one man show and he wrote some brilliant stuff). Since he sold the title of the software to Uniblue they have more or less stopped developing WinTasks (apart from a minor update to v. 5 which was probably just done to raise revenue) and have concentrated on selling security and maintenance tools. I can't comment on the strength or abilities of those tools because I don't need their anti-spyware software or their registry cleaner (I refuse to use registry cleaners any more from any company) but they seem more aimed at raising revenu through intimidation than anything else.

What a pity!

[Darwin]

Yes, and its age shows as well. I am familiar enough with TUT and WinTasks to overlook the explorer.exe as trojan warnings, but I do think that if nothing else a GUI update is long overdue.