p2p

[Epaminondas]

Hi everybody, and sorry for my poor English.

Few days ago, I noticed all emule-related *.exe files had disappeared from my internal HDD. I tried to copy them from a USB HDD, copy happened but two seconds later, the file disappeared again. This problem stopped when I deactivated Webroot Spy Sweeper's shield. After installing the Mule without Spy Sweeper, the install was completed successfully, but at the first boot after after having re-installed Spy Sweeper, I had a light blue screen annoucing "emule.exe deleted, eMule0.47a-Installer.exe deleted, shareazaa.exe not found, limewire.exe not found, kazaa.exe not found", etc. :confused:

Would it be possible that Spy Sweeper has been infected by some virus, or would it be an anti-p2p policy applied by Webroot?

My security tools are NAV 2006, NPF 2006, Ad-Aware, Ewido, Arovax, and formerly (of course) Spy Sweeper.

[morganlefay]

Check your view....show hidden files and system files

[Epaminondas]

OK. Done. And now? What do I have to check?
Thx

[morganlefay]

I am not sure what your question is??

Apply to all folders......

Can you see the files now??

MLF

[rcgreen]

What do I have to check?

Check if they have reappeared. Another question. How long
has Spy Sweeper been on the system? Did you recently
update definitions or change the configuration?

Did the P2P programs themselves disappear, or only EXEs that you
have downloaded?
:cool:

[Epaminondas]

I tried this before and no, they didn't reappeared. Today, Spy Sweeper isn't installed anymore on my system. If it was, it wouldn't be possible to use emule anymore. But when my emule problem occurred, I had had two Spy Sweeper automatical updates in less than one week.

No downloaded exe file disappeared, "only" emule.exe, LinkCreator.exe and eMule0.47a-Installer.exe.

The fact I had received two updates few time before might mean the problem comes from Webroot... except I frequently read people saying "What are u telling me? I got emule, Shareazaa and the very latest version of Spy Sweeper updated and I have no problem".

That's why my question : virus (or spyware or malware) or Spy Sweeper update?

[Epaminondas]

Originally posted here (http://www.AntiOnline.com/showthread.php?threadid=276210#post909987) by morganlefay
I am not sure what your question is??

Apply to all folders......

Can you see the files now??

MLF

When Spy Sweeper was still installed on my system, I tried this and no, I couldn't see the files. By "emule-related exe files", I mean emule.exe, LinkCreator.exe and eMule0.47a-Installer.exe. exe files downloaded by emule did not disappear.

[morganlefay]

are you sure you are looking in the right folder...

and that the files arent zipped up...hence no exe extension

otherwise I have no idea....

MLF

[nihil]

Two questions:

1. Is that a legitimate and licenced version of Spy Sweeper?

2. How do you know that your filesharing software is "clean" and is not in fact a version that also installs spyware?

:)

[Epaminondas]

Originally posted here (http://www.AntiOnline.com/showthread.php?threadid=276210#post909997) by morganlefay
are you sure you are looking in the right folder...

The right folder? Err... As only emule.exe, LinkCreator.exe and eMule0.47a-Installer.exe are concerned, I of course looked into c:\Program Files\emule and in d:\Install files... Where else could I?

[Epaminondas]

Originally posted here (http://www.AntiOnline.com/showthread.php?threadid=276210#post910005) by nihil
Two questions:

1. Is that a legitimate and licenced version of Spy Sweeper?

2. How do you know that your filesharing software is "clean" and is not in fact a version that also installs spyware?

:)

Yes, of course, it is a legitimate version of Spy Sweeper, I wouldn't dare use cracked security softwares, I'm quite paranoid. The latest version were received by email from Webroot on July 25th, it was the ss_505_1286_Full_FR.exe file.

My only filesharing soft, eMule (the installation file is eMule0.47a-Installer.exe) comes from http://www.emule-project.net/. Moreover, it has been running properly for monthes without any problem. That's y the question is : does the problem come from an anti-p2p patch sent by Webroot or from a virused file I would have downloaded? Neither NAV 2006 nor any anti-spyware nor any on-line scan detected anything. Then I thought NAV 2006 coud have been neutralized by some virused file. The on-line scans tested are the following :
Panda AV
Panda Spy Xposer
BitDefender Scan OnLine
X-Cleaner Micro Edition

+ the antispyware scan available on http://www.spywareguide.com/onlinescan.php.

No one found anything. :(

[Epaminondas]

Oops, it's http://www.spywareguide.com/onlinescan.php , without the period.

[nihil]

Hmmmm,

My warning was based on the fact that there are sites with malware on them, or infected versions of legitimate programs. Not to mention that the RIAA/MPAA and their minions might not be above a few "dirty tricks" :eek:

With Spy Sweeper, I seem to recall that there are two screens that come up and you select something like "always ignore" and "always delete"

I also seem to remember that SS had to detect the suspicious software first , then you had to tell it to ignore it? I don't think that there was a mechanism to select stuff to be ignored first?

I am not sure, but I seem to recall thinking that this was a bit of a PITA, as you had to let SS discover the application, delete it, then you instructed SS to ignore it, then you had to reinstall it.

I haven't played with a recent version, but maybe this is still the case?

I did think at the time, that this was rather long-winded and not a very intuitive way of going about things.

Sorry if I am completely off track with this, but I haven't used SS in a while, and the symptoms you describe do seem to match what I recall SS doing when I had it running?



:)

[Epaminondas]

Indeed, usually SpSw first annouces a detection and asks you what to do with it. Usually. But not this time. And I'm sure SpSw is involved as the problem stops when SpSw's shield is deactivated.

What is "PITA" for?

[nihil]

Hmmmm,

Once again, I could be wrong, but it sounds as if you loaded SS onto a machine that already had eMule on it? that could explain the problem, as I don't think SS asks you in those circumstances.

You could try deleting eMule, loading SS, then reinstalling eMule, maybe it would ask you then?

[Epaminondas]

Originally posted here (http://www.AntiOnline.com/showthread.php?threadid=276210#post910118) by nihil
Hmmmm,

Once again, I could be wrong, but it sounds as if you loaded SS onto a machine that already had eMule on it? that could explain the problem, as I don't think SS asks you in those circumstances.

You could try deleting eMule, loading SS, then reinstalling eMule, maybe it would ask you then?

Already tried this. When I launch eMule0.47a-Installer.exe (of course from my external HDD), it extracts normally all needed files, but when I look into C:\Program Files\Emule, all the needed files are in there, except emule.exe and LinkCreator.exe. The most strange in this problem is that it only occurs on my internal HDD. I got 2 external HDD, one is generally switched off as it's used for backup purpose, but the other one is permanently switched on and connected to my system. However, even with Spy Sweeper shield enabled, eMule0.47a-Installer.exe remains on it, as it instantly disappears from my C:\ or D:\ drive if I try a copy-paste of it... :confused: