.msi files. - Page 2
Page 2 of 3 FirstFirst 123 LastLast
Results 11 to 20 of 21

Thread: .msi files.

  1. #11
    Master-Jedi-Pimps0r & Moderator thehorse13's Avatar
    Join Date
    Dec 2002
    Location
    Washington D.C. area
    Posts
    2,883
    If they truly are not spyware, then I would report the false positive to the vendor. That will nix the annoying warnings for everyone.

    --TH13
    Our scars have the power to remind us that our past was real. -- Hannibal Lecter.
    Talent is God given. Be humble. Fame is man-given. Be grateful. Conceit is self-given. Be careful. -- John Wooden

  2. #12
    Super Moderator: GMT Zone nihil's Avatar
    Join Date
    Jul 2003
    Location
    United Kingdom: Bridlington
    Posts
    17,191
    Hmmm,

    It is a good point about false positives though. I know that a lot of scanners will flag Alexa as spyware, but I am surprised to see it in 4 installation files? Anyway, we know that MS installs it, so the warning seems a bit superfluous?

    http://www.jsware.net/jsware/msicode.php3#unpack

    That site has tools that let you open up .msi files and see what they do
    Last edited by nihil; March 10th, 2008 at 08:06 PM.
    If you cannot do someone any good: don't do them any harm....
    As long as you did this to one of these, the least of my little ones............you did it unto Me.
    What profiteth a man if he gains the entire World at the expense of his immortal soul?

  3. #13
    Only african to own a PC! Cider's Avatar
    Join Date
    Jun 2003
    Location
    Israel
    Posts
    1,683
    Hey there. Thanks for the link.

    Spoke to my supervisor. She says that Alexa is Malware, I quote

    It can open up your computer to outsiders
    As nihil said

    Anyway, we know that MS installs it, so the warning seems a bit superfluous?
    I might be asking a stupid Q here - Why does MS install it if it gets flagged for malware?
    The world is a dangerous place to live; not because of the people who are evil, but because of the people who don't do anything about it.
    Albert Einstein

  4. #14
    Super Moderator: GMT Zone nihil's Avatar
    Join Date
    Jul 2003
    Location
    United Kingdom: Bridlington
    Posts
    17,191
    Alexa is strange one. as it is not a malware in my absolutely pedantic definition of such.

    You might consider it to be a form of spyware, but in reality it is just a bloody nuisance. It is actually a targeted advertising application that is the result of some sort of deal between Microsoft and Amazon (I think). I seem to recall that it needs IE to work?

    It is of no interest and absolutely no value to me so I always remove it. I take a very simple view that if I don't use something I don't want it running. Firstly it would be using MY resources and secondly it is just something else to go wrong and cause conflicts.

    I am not surprised that all Panda does is flag it in the .msi files............ far too complex to try to extract it from one of those! I would guess that what Panda does is clean the Registry and executables, so it cannot run. That is what SpyBot and AdAware do, if you so choose.

    I do not think that it is a security hazard in particular............. that would depend on how you run your system IMO............like IE on minimum security and always log in as Administrator? c'mon MS and Amazon are major players.............. if they were doing things like that, how come the drek/cack/poep hasn't hit the fan?

    If you cannot do someone any good: don't do them any harm....
    As long as you did this to one of these, the least of my little ones............you did it unto Me.
    What profiteth a man if he gains the entire World at the expense of his immortal soul?

  5. #15
    THE Bastard Sys***** dinowuff's Avatar
    Join Date
    Jun 2003
    Location
    Third planet from the Sun
    Posts
    1,250
    Wow

    Delete the msi files in question

    DevSupp.dll is probably hijacked

    If you notice the random characters your mal/spyware generated i.e., 36fe.msi

    This means your true issue is creating random install files so when you clean one, two more infect you. These are not the Microsoft installer, they are Microsoft installation packages.

    9 times out of 10 there will be a entry in the \...\currentversion\run KEYS (Current user - everyone who loged on) and system pointing to the instal packages.

    ie HKEY\LOCAL MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN and in the left pain will be c:\windows\36fe.msi

    Don't forget to dump system restore
    09:F9:11:02:9D:74:E3:5B8:41:56:C5:63:56:88:C0

  6. #16
    Only african to own a PC! Cider's Avatar
    Join Date
    Jun 2003
    Location
    Israel
    Posts
    1,683
    Sheesh, what a mission

    Thanks for all the tips everyone.
    The world is a dangerous place to live; not because of the people who are evil, but because of the people who don't do anything about it.
    Albert Einstein

  7. #17
    Super Moderator: GMT Zone nihil's Avatar
    Join Date
    Jul 2003
    Location
    United Kingdom: Bridlington
    Posts
    17,191
    Get copies of the files.....................

    If dinowuff is correct, you are NOT dealing with Alexa.

    Send the files to your research people to investigate
    If you cannot do someone any good: don't do them any harm....
    As long as you did this to one of these, the least of my little ones............you did it unto Me.
    What profiteth a man if he gains the entire World at the expense of his immortal soul?

  8. #18
    Master-Jedi-Pimps0r & Moderator thehorse13's Avatar
    Join Date
    Dec 2002
    Location
    Washington D.C. area
    Posts
    2,883
    virustotal or cwsandbox are two of my favorite for submitting questionable stuff.
    Our scars have the power to remind us that our past was real. -- Hannibal Lecter.
    Talent is God given. Be humble. Fame is man-given. Be grateful. Conceit is self-given. Be careful. -- John Wooden

  9. #19
    Super Moderator: GMT Zone nihil's Avatar
    Join Date
    Jul 2003
    Location
    United Kingdom: Bridlington
    Posts
    17,191
    Another one is Jotti:

    http://virusscan.jotti.org/

    Although virus total uses more scanners

    http://www.virustotal.com/

    Both are supported by and use Panda, so they should be OK for Cider to use. Obviously they are both using scanning techniques, whilst Sunbelt's CWSandbox actually tries to run the thing and see what it does

    If you cannot do someone any good: don't do them any harm....
    As long as you did this to one of these, the least of my little ones............you did it unto Me.
    What profiteth a man if he gains the entire World at the expense of his immortal soul?

  10. #20
    Super Moderator: GMT Zone nihil's Avatar
    Join Date
    Jul 2003
    Location
    United Kingdom: Bridlington
    Posts
    17,191
    Back on original topic so a double post

    It just ocurred to me that this might actually be some sort of trojan with Alexa as the payload.

    I seem to recall that there were one or two that specifically did this?

    As Alexa is a web surfing habits and site rating system, unscrupulous site owners would use this trick to increase the number of hits being reported to Alexa.

    Something similar to the click fraud scams for pay per click advertising schemes. There are trojans to do that as well
    If you cannot do someone any good: don't do them any harm....
    As long as you did this to one of these, the least of my little ones............you did it unto Me.
    What profiteth a man if he gains the entire World at the expense of his immortal soul?

Similar Threads

  1. How to Create bat files....
    By cool_boy in forum General Computer Discussions
    Replies: 3
    Last Post: June 29th, 2006, 03:45 AM
  2. Genral Windows Tips
    By Nokia in forum Tips and Tricks
    Replies: 0
    Last Post: June 12th, 2004, 06:36 PM
  3. The history of the Mac line of Operating systems
    By gore in forum Operating Systems
    Replies: 3
    Last Post: March 7th, 2004, 08:02 AM
  4. Tcp/ip
    By gore in forum Newbie Security Questions
    Replies: 11
    Last Post: December 29th, 2003, 08:01 AM
  5. Camouflage v1.2.1 The programme
    By Gbin@ryR in forum AntiOnline's General Chit Chat
    Replies: 8
    Last Post: February 28th, 2002, 05:52 PM

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •