Avast WEBforum

Other => General Topics => Topic started by: bbfi on November 25, 2003, 11:51:12 PM

Title: win.ini entries
Post by: bbfi on November 25, 2003, 11:51:12 PM
I was checking my win.ini today and noticed the following entries.

[Internal]
Device=ȺºËºÌ̾ÌɾºÉÏÇÌÌǺ½
Install=1066515763
[hkjhk]
nnhjhkj15=1067378634

Any ideas what these are?  I searched the web, but didn't find anything like these.   ???
Title: Re:win.ini entries
Post by: Walker on November 26, 2003, 12:41:50 AM
nnhjhkj15=

bbfi,

Don't know if this helps, but you might try searching for the 'pup' virus.

Have a look at this link...

http://www.security-forums.com/forum/viewtopic.php?t=8209 (http://www.security-forums.com/forum/viewtopic.php?t=8209)

Good luck
Title: Re:win.ini entries
Post by: bbfi on November 26, 2003, 01:04:18 AM
Walker,

That was one of the links I found on the web and I checked my computer for the 'pup' virus in all the locations but nothing showed up.   ???
Title: Re:win.ini entries
Post by: Walker on November 26, 2003, 01:14:46 AM
bbfi,

Where none of the comments in that link relavent to your case?. I noticed one of the posters at least had the same 'nnhjhkj15=' entry as yours.

Not that I know anything of this personally... sorry  :'(

Title: Re:win.ini entries
Post by: bbfi on November 26, 2003, 01:40:54 AM
Walker,

The only thing that was the same was -

[hkjhk]
nnhjhkj15=1066661473

I don't have DDMP*.dll, WinPup.exe files or the following directories C:\Program Files\ddm\0\ or C:\Program Files\Intenet explorer\ADD-INS\.
Title: Re:win.ini entries
Post by: Lisandro on November 26, 2003, 02:10:37 AM
bbfi, did avast! alert you of anything? Did you perform a full scan?
I suggest you delete that lines immediatly...  ;)
Title: Re:win.ini entries
Post by: bbfi on November 26, 2003, 07:34:51 AM
Technical,

Quote
did avast! alert you of anything? Did you perform a full scan?

I did a check with Avast, eScan Antivirus Toolkit Utility, ANTIDOTE for PC Viruses - SuperLite, eTrust EZ Antivirus, and BitDefender Free Edition.  My system is clean.   :)

Quote
I suggest you delete that lines immediatly...

Did it.   ;)
Title: Re:win.ini entries
Post by: Lisandro on November 26, 2003, 12:13:17 PM
Technical,

Quote
did avast! alert you of anything? Did you perform a full scan?

I did a check with Avast, eScan Antivirus Toolkit Utility, ANTIDOTE for PC Viruses - SuperLite, eTrust EZ Antivirus, and BitDefender Free Edition.  My system is clean.   :)

Quote
I suggest you delete that lines immediatly...

Did it.   ;)

I can really bet your system is clean after all  ;D
If you discover something else about this 'strange' virus, let us know...  8)
Title: Re:win.ini entries
Post by: bbfi on November 26, 2003, 06:27:14 PM
Technical,

I also ran a scan with a² Free Malware Scanner and all was clean.   :)  

This scanner can be downloaded at http://forum.a-2.org/viewtopic.php?t=173 (http://forum.a-2.org/viewtopic.php?t=173) with info about it at http://www.a-2.org/en/ (http://www.a-2.org/en/).   ;)
Title: Re:win.ini entries
Post by: Lisandro on November 27, 2003, 02:01:06 AM
Technical,

I also ran a scan with a² Free Malware Scanner and all was clean.   :)  

This scanner can be downloaded at http://forum.a-2.org/viewtopic.php?t=173 (http://forum.a-2.org/viewtopic.php?t=173) with info about it at http://www.a-2.org/en/ (http://www.a-2.org/en/).   ;)

Do you - or anybody else - nows anything more about a² (a squared) Free Malware Scanner?
Does it has a resident (guard) protection?
Could it be used simultaneously with avast?
How does it update?

I did some research on their forum pages and the features could be;

# Background Guard with IDS
The Background Guard of a² personal has several jobs. Each started program will be scanned and blocked if necessary before it gets active. The IDS (Intrusion Detection System) is always active and protects the operating system. For example, it is able to protect other program-tasks against shutdowns initiated by Trojans. The improper bypassing of desktop firewalls by tunneling through the browser can also be prevented.

# Advanced IDS
The Advanced IDS mode is a component of a² personal which analyses the behavior of all running programs to detect harmful actions. If a program shows a Malware like behavior, the actions will be stopped. You have nearly no configuration work.

# System-Firewall
Expert users can optional choose to use the System-Firewall of a² personal instead of the Advanced IDS mode. This works similar to common desktop firewalls. But the big difference is, that not only connections to the web are monitored. Also operations inside the operating system and the programs are watched. You can define special rights for each program. For example you can deny a specific program to write an autorun entry to the system registry or deny access to a specific part of the harddisk for another program.

I'm afraid that there is something 'wrong' and don't smell so good in all of this... Do avast users can say something...  :o
Title: Re:win.ini entries
Post by: bbfi on November 27, 2003, 02:09:35 AM
Technical,

I'm not 'technical' enough to know about all the extra features.  The free one only does scans for malware.  I do not understand the IDS stuff, etc.   ???

I found another forum (NTFS) talking about it at http://www.ntfs.org/forum/showthread.php?s=d8bc019953a6acee41b00c8cadf39a51&threadid=40945 (http://www.ntfs.org/forum/showthread.php?s=d8bc019953a6acee41b00c8cadf39a51&threadid=40945).  Also, Wilders Forum talks about it at http://www.wilderssecurity.com/index.php?board=25;action=display;threadid=16821 (http://www.wilderssecurity.com/index.php?board=25;action=display;threadid=16821).  Maybe that would shed some light on the subject.   ::)
Title: Re:win.ini entries
Post by: Lisandro on November 27, 2003, 02:20:47 AM
Technical,

I'm not 'technical' enough to know about all the extra features.  The free one only does scans for malware.  I do not understand the IDS stuff, etc.   ???

I found another forum (NTFS) talking about it at http://www.ntfs.org/forum/showthread.php?s=d8bc019953a6acee41b00c8cadf39a51&threadid=40945 (http://www.ntfs.org/forum/showthread.php?s=d8bc019953a6acee41b00c8cadf39a51&threadid=40945).  Also, Wilders Forum talks about it at http://www.wilderssecurity.com/index.php?board=25;action=display;threadid=16821 (http://www.wilderssecurity.com/index.php?board=25;action=display;threadid=16821).  Maybe that would shed some light on the subject.   ::)

Thanks bbfi, I'll do some more research previously...
Take care, thanks for the links  ;)
Title: Re:win.ini entries
Post by: MWassef on November 27, 2003, 05:14:07 PM
Technical,
a2 is the new name of the free project 'ANTS' by Andreas Haak, I used to be a beta tester of it..
a2 has 2 versions, free and personal. Free version (only the on-demmand scanner, no guard included) is already released on 11/25 (More.. (http://forum.a-2.org/viewtopic.php?t=173)).
according to the site, the personal version is expected to be released soon..
I hope this could be helpful  ;D
Title: Re:win.ini entries
Post by: MWassef on November 27, 2003, 06:07:28 PM

bbfi,
how did you write the '2' that small ? ??? ??? ???

thanx in advance  ;D
Title: Re:win.ini entries
Post by: bbfi on November 27, 2003, 07:39:13 PM
minacross,

Quote
how did you write the '2' that small ?   ??? ??? ???

I just copied and pasted it from the a² forum.   ;D

What is your opinion of a² free?   ::)  I know that you get what you pay for  ;) , but there are no other free malware checkers or are there?   ???

Anyone else have any opinions for this a² free or other free malware scanners?   ;)  Thanks in advance.
Title: Re:win.ini entries
Post by: MWassef on November 27, 2003, 07:46:20 PM
the only free AT I know was SwatIt http://www.swatit.org which is a very poor one  :(
ANTS was really good. So, we just wait and see how a2 will act :-\
Title: Re:win.ini entries
Post by: Lisandro on November 28, 2003, 01:45:43 AM
What is your opinion of a² free?   ::)  I know that you get what you pay for  ;) , but there are no other free malware checkers or are there?   ???
Anyone else have any opinions for this a² free or other free malware scanners?   ;)  Thanks in advance.

I have just downloaded it... If it does not 'conflict' with avast! I could run and post the results (if any  ;D).
Wait for the sunny weekend.
Title: Re:win.ini entries
Post by: bbfi on November 28, 2003, 02:16:00 AM
Technical,

Anxious to hear what you find out.  While browsing a² forum, I read this post http://forum.a-2.org/viewtopic.php?t=47&sid=154cad921f443db2f6652b368009602d (http://forum.a-2.org/viewtopic.php?t=47&sid=154cad921f443db2f6652b368009602d).  Sounds interesting if possible.   ::)
Title: Re:win.ini entries
Post by: Lisandro on November 28, 2003, 02:23:01 AM
Technical,

Anxious to hear what you find out.  While browsing a² forum, I read this post http://forum.a-2.org/viewtopic.php?t=47&sid=154cad921f443db2f6652b368009602d (http://forum.a-2.org/viewtopic.php?t=47&sid=154cad921f443db2f6652b368009602d).  Sounds interesting if possible.   ::)

What exactly? It's a long post... (it remembers me techie's  ;D and Hornus'  ;D ones). What do you mean exactly?  ;)
Title: Re:win.ini entries
Post by: Lisandro on November 28, 2003, 02:26:01 AM
Maybe, bbfi, you refer to this post of Andreas Haak (Site Admin)

Integration of certain AV programs
Hi,

well, I will let you know about some ideas we can discuss and that will maybe be a way of a powerfull cooperation.

As you all know a² has a pluginable engine. It would be possible to plug in third party engines, too. I simply have to add a "wrapper" that translates the a² flags and commands to the vendor specific ones. This is a big advantage ...

I thought about an integration of already installed AV software. That means:

If you have NOD32 installed a² offers you integrate the NOD32 engine into the a² engine. So everytime a² scans a file its automatically scanned by NOD32, too.

This adds more security and helps to make security easy. You only have to activate the scan plugins and you have one common interface to all your installed software that is supported. There are some more benefits:

1. You don't have to learn several products. You just have to learn how to use a². If you want to change your virus scanner a² will only load an other plugin. Thats it.
2. You only have to run one guard, so you won't loose any wasted resources. The guard is able to "remember" what files were scanned and is able to allow much more fine tuning than most other guards. You can say: "Well, scan the file only if its executed and not every time its accessed" etc. . This will help to increase performance and stability.
3. A² and its guard are much better protected than every other AV software. Its simply impossible to terminate or manipulate settings or processes that a² uses while its loaded. So you don''t have to fear any internet worm or backdoor that trys to kill your primary line of defense.

Of course the direct integration of the already installed engines is not neccessary. You can say what engine a² hsould use. It won't force you. You can of course use a² and your favorite av program without the integration. and without limitations. I think I said it several times above:

A² is designed as a perfect second line of defense and as an addition that is compatible to as any software as possible.

-----------------------------------------------------------------------

I'll take a look. Anyway, there isn´t a plugin for avast! right now.  ;)
Title: Re:win.ini entries
Post by: techie101 on November 28, 2003, 02:43:56 AM
Some background here.

Andreas is not only the site administrator you mentioned, but is also the main developer of ANTS.  He is a brilliant young man.

The a2 program is a newer version of ANTS which was an excellent anti-trojan utility developed by Andreas but unfortunately, sometime last year, he became ill and further builds stopped.

Then, from what I learned, a new development team was being formed to continue with ANTS.  ANTS had Guard problems which would hang the system.  The Resident Guard was the feature I liked most.  Most of the freeware anti-trojan utilities did not have a resident feature.

Anyway, I did like Ants on-demand scanner.  It performed well, and was very stable in W98 and ME systems.

If a2 is anything like it's former "self" ANTS, then it's a winner!

techie
Title: Re:win.ini entries
Post by: Lisandro on November 29, 2003, 04:03:04 AM
Some background here.

Andreas is not only the site administrator you mentioned, but is also the main developer of ANTS.  He is a brilliant young man.

The a2 program is a newer version of ANTS which was an excellent anti-trojan utility developed by Andreas but unfortunately, sometime last year, he became ill and further builds stopped.

Then, from what I learned, a new development team was being formed to continue with ANTS.  ANTS had Guard problems which would hang the system.  The Resident Guard was the feature I liked most.  Most of the freeware anti-trojan utilities did not have a resident feature.

Anyway, I did like Ants on-demand scanner.  It performed well, and was very stable in W98 and ME systems.

If a2 is anything like it's former "self" ANTS, then it's a winner!

techie

Ok Techie...

A cannot see the 'Integration of certain AV programs' or 'with avast'...
I run, install, get a code, update and ... what more... ?

Does this software is like 'SpyGuard'? Or works like 'Script Defender'?
I mean, you cannot really scan your system, just believe you're being protected in background? I try to scan, receive an area window (to choose which folders I want to scan) and then nothing  :(
Not an OK button, nothing!
What can I do? How can I scan the system?

Please, techie, help me  :'(
Title: Re:win.ini entries
Post by: bbfi on November 29, 2003, 05:53:46 AM
Technical,

Quote
I try to scan, receive an area window (to choose which folders I want to scan) and then nothing  Not an OK button, nothing!
What can I do? How can I scan the system?

Button is at bottom right of scanner.

Title: Re:win.ini entries
Post by: raman on November 29, 2003, 09:25:45 AM
Guys, this is an Avast Supportforum. If you have questions about A2 ask them in their Forum: http://forum.a-2.org/ :)
And allwayse be aware, it is a beta and not ready at all! An other new AT (beta too!) can be found here: http://www.ewido.net
Title: Re:win.ini entries
Post by: bbfi on November 29, 2003, 07:27:58 PM
Quote
Guys, this is an Avast Supportforum

Oops!  I guess we got a little side tracked.   ;)

Quote
An other new AT (beta too!) can be found here: http://www.ewido.net

Thanks for the info.   :)   It would be nice to have a few free malware or trojan checkers.   ;D
Title: Re:win.ini entries
Post by: Lisandro on November 29, 2003, 08:55:33 PM
Technical,

Quote
I try to scan, receive an area window (to choose which folders I want to scan) and then nothing  Not an OK button, nothing!
What can I do? How can I scan the system?
Button is at bottom right of scanner.

Sorry, for me it is not there!
Sorry raman, but I tryed to post at a2 forum either without any answer untill now (http://forum.a-2.org/viewtopic.php?p=1055#1055).

Hoping anybody could help!  ::)
Title: Re:win.ini entries
Post by: Godzilla on November 29, 2003, 10:50:22 PM
you have to switch via Control Panel to small fonts.

It doesnt work with 120 dpi settings.

However, i would not recomend a² in this development phase now.

Regards,
Godzilla
Title: Re:win.ini entries
Post by: Lisandro on November 29, 2003, 11:16:07 PM
you have to switch via Control Panel to small fonts.

It doesnt work with 120 dpi settings.

However, i would not recomend a² in this development phase now.

Regards,
Godzilla

I will have to reboot to see if it works...
Anyway, very thanks.
Why is not safe to thrust in the a² in actual phase?  ;)
Title: Re:win.ini entries
Post by: Godzilla on November 29, 2003, 11:40:04 PM
Quote
Why is not safe to thrust in the a² in actual phase?  ;)

Sorry, but i don't want to discuss about this.
It was just a personal note that you should take care with alpha/beta or
"in early stage" developments. If it works for you - fine, use it.
I can't and i dont want to say much more to this - this would be unfair.
But please note this is the AVAST support forum.

Regards,
Godzilla
Title: Re:win.ini entries
Post by: Lisandro on November 30, 2003, 01:28:06 AM
Hey Godzilla and raman... We were in avast! forum for quite a while... Now this thread is in the GENERAL TOPICS and I do not think it is out of bound...

I finished my scanning and the report is:
a² Report
Filename Diagnosis
E:\...\Synchronize 1.1.exe Trojan.Win32.RC5_Dropper.c
E:\...\Virdir Manager 0.9.exe Backdoor.Ptakks.dr

I will upload this two files into pk ftp site... and see if anybody in avast! team has something to tell. Why both of you are saying I'm out of bound? Why don't you say if a2 is or not a good solution?  :'(