New Computer Hope tool

[kpac]

how would you detect a 64-bit OS from a log generated by a 32-bit program?

;
One way would be to check for the "Program Files (x86)" folder, instead of the normal "Program Files". Another way would be to automatically pick up on too many system files with (file missing) entries.

[Computer Hope Admin]

Nathan,

Just an observation,

Would it not be advantageous to have a suggestion/warning for users of the process tool to create a new restore point after they have fixed their problems in HJT?....Seems to me a lot of people of less experience would neglect to purge their systems of restore points which may contain copies of malware.

Correct me if I'm wrong but are restore points not already created when items are fixed?

Now that this thread has been revived, detection of 64bit PCs in HJT logs would be a great addition also...

Evilfantasy actually brought this up in another section and I believe it should be already addressed in an earlier release as shown below.

Update (bv1.2f)

* Look for "Program Files (x86)", which is the only thing I could see that should uniquely identify a 64-bit system.
* If this is found generate create a new error saying: "Your computer has a 64-bit processor which is not 100% compatible with HijackThis and can cause improper errors in the log."
* Create a flag indicating that it's a 64-bit system and do not warn on missing log lines if found.

[evilfantasy]

Could you make the reader just reject a 64bit log and send them to the forums? Or have it ignore any line with c:\program files (x86) in it?

[evilfantasy]

The CLSID search isn't working for every search, only a few.

CH search results. http://www.systemlookup.com/lists.php?list=1&type=clsid&search={a173b69a-1f9b-4823-9fda-412f641e65d6}&s=

Actual results. http://www.systemlookup.com/search.php?type=clsid&client=malwaresearch-ff&search={a173b69a-1f9b-4823-9fda-412f641e65d6}

[Computer Hope Admin]

Long time coming update for process tool.

Update (bv1.2f)

- Added several thousand additional processes
- Added better Windows 7 detection
- Updated script to not report error when seeing HiJackthis beta version log.
- When browsing through all processes lists processes 10 at a time. Helping with server overloads when having to query thousands of processes for each letter.
- Top 10 looked at processes listed on main page.
- Corrected above CLSID link suggestion Evil suggested. Just changed all links to match the above example.
- Corrected and improved detection with file descriptions containing directories. (help with detecting malware with valid names in alternate directory).
- Additional warning for users running IE 6 (since it's so insecure).
- If multiple anti-virus programs found in Getting your system clean section recommends removing one of them to prevent problems.
- Corrected CSS issue with how top bar on table was being displayed.
- Added a few more missing Firewall and Antivirus programs.
- Script now links all files found in the winsock hijack warnings.
- Dozens of other minor changes/fixes.

and Congrats everyone for over 10,000,000 files looked at surpassed a few months ago. 

[CBMatt]

Wow, very nice.  Kudos, Nathan!

[patio]

Excellent.....Nice Work !

[evilfantasy]

Nice work!

A concern I have found when running my Win 7 64bit log through is this.

C:\Windows\SysWOW64\rundll32.exe - Being identified as malicious.

Microsoft Windows process that handles handling.dll files that should be located in the C:\Windows\System32 directory not the c:\windows\syswow64\ directory.

VirusTotal Results 0/38 (0%)

Also I'm not sure how easy it would be but it is still suggesting the the O23 entries with '(file missing)' should be removed. Maybe you could add a ***** Note to O23 (file missing) entries that if they are on a 64bit system that the user should ignore them?

[Computer Hope Admin]

Thanks all and regarding the O23 entries Kevin, if detected as 64-bit those shouldn't be pulling up. I've added some additional 64-bit detection and a caution warning that will now be also shown in the "what to do in Hijackthis" section. If you happen to come across another 64-bit log that generates problems let me know and post a link to the log file. I've ran my 64-bit systems with the new updated version and also some other 64-bit logs I found through Google and all seems well now.

v1.5c Updates
===========
-Above mentioned 64-bit fixes.
-Additional improved support on detecting Windows 7
-Several hundred more processes (now well over 10,000 processes)
-Other minor fixes

[evilfantasy]

That's much better.

If anybody has a HJT log that shows MSE (Microsoft Security Essentials) entries please send it to me or post it here. I'm kind of disappointed that MSE does not show in my log. Microsoft is hiding it, which is good, but it's hidden too well IMHO.

[Computer Hope Admin]

That's much better.

If anybody has a HJT log that shows MSE (Microsoft Security Essentials) entries please send it to me or post it here. I'm kind of disappointed that MSE does not show in my log. Microsoft is hiding it, which is good, but it's hidden too well IMHO.

Yeah I've researched this on all the computers I have here and they all don't show up in the hijackthis logs or as a process. So unfortunately it appears as if it could be hidden in another process (e.g. svchost.exe) like the Windows Firewall. If anyone has ideas on detecting these I'm all ears.

[evilfantasy]

I'm not sure where it's running from. Even tools like Security Check by screen317 don't find it.

[evilfantasy]

Here it is. I don't know if it helps any...

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
"c:\Program Files\Microsoft Security Essentials\msseces.exe" -hide

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft Security Essentials
C:\Program Files\Microsoft Security Essentials\msseces.exe,0

HKEY_USERS\S-1-5-21-1616066376-2122674282-4061501089-1001\Software\Microsoft\IntelliPoint\AppSpecific\msseces.exe
C:\Program Files\Microsoft Security Essentials\msseces.exe

HKEY_USERS\S-1-5-21-1616066376-2122674282-4061501089-1001_Classes\Local Settings\MuiCache\10F\52C64B7E
@c:\Program Files\Microsoft Security Essentials\MpAsDesc.dll,-240

[BC_Programmer]

would "c:\Program Files\Microsoft Security Essentials\msseces.exe" not be in the processes list from the log?

[Broni]

If anybody has a HJT log that shows MSE (Microsoft Security Essentials) entries please send it to me or post it here.

This is interesting issue, because 1-2 months ago, I saw quite a few HJT logs from computers running MSE and could be seen in a list of running processes.
I just had another HJT log today from the computer running MSE and.....nada.
Some Windows update hid it even "better"?