Suranappar_AJ4E
offlineMember
Why is it that the GOTD Team, removes all posts about this file?
It is not to be a part of todays Giveaway.
If you are going to endorse spyware/adware as a part of the Giveaway, then at least let the visitors/downloaders know about it.
Be that fair.
2 post removed.
Facebook remove.
Soon this one to.
What is it that your hiding from us GOTD Team?
May I ask you what you are speaking about?
I never saw a file CC.exe.
GOTD does not include any spyware.
The moderators for the GOTD comments are not the same as the moderators of the forums - besides BuBBy - and he is not on duty today.
So I can't tell you what has been deleted on the comments site or on Facebook and why.
graylox
Suranappar_AJ4E
offlineMember
Finally some who is listening, kudos for that graylox.
Inside to days setup file, not the GTOD one, but the one that is extracted, there is a file called CC.exe.
Windows 7 Firewall Controll (Free) cauth it as it tried to use internet undetected.
CC.exe is, if you serach the internet, is designed to not be detected, and show directed ads in ie your browser.
Just try the free version of the fire wall mentioned.
And see what it says on your computer.
I have tried to unarchive the setup file with Universal Extractor, to eaiser prove the case, but the file can not ge extracted. And so far that firewall is the only thing I know that captures this file in action. It is removed from temp folder asap so all traces are gone in a flash.
I am still serching for a software that might be able to unarchive the setup to prove my point here.
Suranappar_AJ4E
offlineMember
The cc.exe is executed and ask for internet access. After that the real Uninstaller Setup in lanched. If it was not for cc.exe being flaged all the time I try to install this software, I whould never noticed.
Suranappar_AJ4E
offlineMember
Alrigt I got some leads now.
Search google for "how to uninstall or view a inno setup file?"
innounp, the Inno Setup Unpacker
innounp.sourceforge.net/ - Översätt den här sidan
Inno Setup is a popular program for making software installations. ... FAR or Total Commander as a front-end see the MultiArc section below. ... -m process internal embedded files (such as license and uninstall.exe) -pPASS ... Inno Setup stores only one copy of such files, and by default innounp will also unpack one file. ...
That proggy vill prove that cc.exe is pressent in the setup file, and once again, it is the unwraped setup file I talk about.
VirusTotal didn't find any malware: 0/42
0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is goodware. 0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is malware.
File name:
file-3150596_exe
Submission date:
2011-11-20 21:05:00 (UTC)
Current status:
finished
Result:
0 /42 (0.0%)
Suranappar_AJ4E
offlineMember
Well nor do Malwarebytes' Anti-Malware or other software.
Lets spin it around, can YOU prove that cc.exe is not pressent in the setup file and that it do not request internet access prior to the install.
And once again, this is the unwrapped file, so its not an date validation issue.
But also try the above mentioned Inno Setup Unpacker.
It will unarchive the setup file.
Then check the {tmp} folder.
Suranappar_AJ4E
offlineMember
This is the scan made on a unwrapped setup file
0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is goodware. 0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is malware.
File name:
Your Uninstaller.exe
Submission date:
2011-11-21 18:03:26 (UTC)
Current status:
finished
Result:
1/ 42 (2.4%)
VT Community
not reviewed
Safety score: -
Compact
Print results
Antivirus Version Last Update Result
AhnLab-V3 2011.11.21.00 2011.11.21 -
AntiVir 7.11.17.250 2011.11.21 -
Antiy-AVL 2.0.3.7 2011.11.21 -
Avast 6.0.1289.0 2011.11.21 -
AVG 10.0.0.1190 2011.11.21 Suspicion: unknown virus
BitDefender 7.2 2011.11.21 -
ByteHero 1.0.0.1 2011.11.14 -
ClamAV 0.97.3.0 2011.11.21 -
Commtouch 5.3.2.6 2011.11.21 -
Comodo 10780 2011.11.18 -
DrWeb 5.0.2.03300 2011.11.21 -
Emsisoft 5.1.0.11 2011.11.21 -
eSafe 7.0.17.0 2011.11.20 -
eTrust-Vet 37.0.9579 2011.11.21 -
F-Prot 4.6.5.141 2011.11.21 -
F-Secure 9.0.16440.0 2011.11.21 -
Fortinet 4.3.370.0 2011.11.21 -
GData 22 2011.11.21 -
Ikarus T3.1.1.109.0 2011.11.21 -
Jiangmin 13.0.900 2011.11.16 -
K7AntiVirus 9.119.5508 2011.11.21 -
Kaspersky 9.0.0.837 2011.11.21 -
McAfee 5.400.0.1158 2011.11.21 -
McAfee-GW-Edition 2010.1D 2011.11.21 -
Microsoft 1.7801 2011.11.21 -
NOD32 6648 2011.11.21 -
Norman 6.07.13 2011.11.21 -
nProtect 2011-11-21.02 2011.11.21 -
Panda 10.0.3.5 2011.11.21 -
PCTools 8.0.0.5 2011.11.21 -
Prevx 3.0 2011.11.21 -
Rising 23.84.04.02 2011.11.18 -
Sophos 4.71.0 2011.11.21 -
SUPERAntiSpyware 4.40.0.1006 2011.11.21 -
Symantec 20111.2.0.82 2011.11.21 -
TheHacker 6.7.0.1.345 2011.11.21 -
TrendMicro 9.500.0.1008 2011.11.21 -
TrendMicro-HouseCall 9.500.0.1008 2011.11.21 -
VBA32 3.12.16.4 2011.11.21 -
VIPRE 11108 2011.11.21 -
ViRobot 2011.11.21.4785 2011.11.21 -
VirusBuster 14.1.76.0 2011.11.21 -
Additional information
MD5 : c1758012cf67db26981bdea51560aaa9
SHA1 : c41006f518aa7bd11a0351e7cedaa12781aa8502
SHA256: dfe286b78fd89ef8c04489cd93b4a3c5e3d790d288824d3b319574128bf8aa99
Suranappar_AJ4E
offlineMember
Try to scan the unwrapped file once
Suranappar_AJ4E
offlineMember
The unpacked/extracted cc.exe
0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is goodware. 0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is malware.
File name:
cc.exe
Submission date:
2011-11-21 18:16:56 (UTC)
Current status:
finished
Result:
1/ 42 (2.4%)
VT Community
not reviewed
Safety score: -
Compact
Print results
Antivirus Version Last Update Result
AhnLab-V3 2011.11.21.00 2011.11.21 -
AntiVir 7.11.17.250 2011.11.21 -
Antiy-AVL 2.0.3.7 2011.11.21 -
Avast 6.0.1289.0 2011.11.21 -
AVG 10.0.0.1190 2011.11.21 -
BitDefender 7.2 2011.11.21 -
ByteHero 1.0.0.1 2011.11.14 Trojan.Win32.Heur.089
ClamAV 0.97.3.0 2011.11.21 -
Commtouch 5.3.2.6 2011.11.21 -
Comodo 10780 2011.11.18 -
DrWeb 5.0.2.03300 2011.11.21 -
Emsisoft 5.1.0.11 2011.11.21 -
eSafe 7.0.17.0 2011.11.20 -
eTrust-Vet 37.0.9579 2011.11.21 -
F-Prot 4.6.5.141 2011.11.21 -
F-Secure 9.0.16440.0 2011.11.21 -
Fortinet 4.3.370.0 2011.11.21 -
GData 22 2011.11.21 -
Ikarus T3.1.1.109.0 2011.11.21 -
Jiangmin 13.0.900 2011.11.16 -
K7AntiVirus 9.119.5508 2011.11.21 -
Kaspersky 9.0.0.837 2011.11.21 -
McAfee 5.400.0.1158 2011.11.21 -
McAfee-GW-Edition 2010.1D 2011.11.21 -
Microsoft 1.7801 2011.11.21 -
NOD32 6649 2011.11.21 -
Norman 6.07.13 2011.11.21 -
nProtect 2011-11-21.02 2011.11.21 -
Panda 10.0.3.5 2011.11.21 -
PCTools 8.0.0.5 2011.11.21 -
Prevx 3.0 2011.11.21 -
Rising 23.84.04.02 2011.11.18 -
Sophos 4.71.0 2011.11.21 -
SUPERAntiSpyware 4.40.0.1006 2011.11.21 -
Symantec 20111.2.0.82 2011.11.21 -
TheHacker 6.7.0.1.345 2011.11.21 -
TrendMicro 9.500.0.1008 2011.11.21 -
TrendMicro-HouseCall 9.500.0.1008 2011.11.21 -
VBA32 3.12.16.4 2011.11.21 -
VIPRE 11108 2011.11.21 -
ViRobot 2011.11.21.4785 2011.11.21 -
VirusBuster 14.1.76.0 2011.11.21 -
Additional information
MD5 : 2582eae631775c01769e63febc1473e8
SHA1 : 72457d049ac416943361c0565caa8b938f1e2253
SHA256: 25409f0d433a3b1839613d9e23833b902fb068af59dc538db3df460c15193335
Suranappar_AJ4E
offlineMember
Whatever cc.exe is or is not, there are to many alerts about it, and its a sneaky one.
Innounp. didn't extract the setup file :(
But Kaspersky asked for green-light to run CC.exe. I stopped it and the uninstaller set up went on.
So a decent firewall can stop CC.exe.
In any case I installed the tool in a sandbox - and will delete it afterwards, I'm happy with Revo uninstaller. Revo is a long-time proven programme and totally reliable.
YU is still scanning my system - that is unacceptable how long that takes.
Well, in any case I don't blame the GOTD team for any unwanted "add-on". They scan the software properly before packing into their wrapper. Nevertheless, the last responsibility is on the user's side. And as you said, some files are not detected by scanners.
graylox
PS:
A remark to deleted comments on the main site:
Of course there are some rules what may not be posted, but very often it is just good or bad luck if a comment is approved or not. There are quite a lot of comments and very few moderators - I guess they are not always able to read every post. Besides that there is a filter, which tries to find spammers.
Though when BuBBy is on duty, he takes his time to read everything.
.....EDIT.....
I deleted the info I found with Google, as it was not really significant.
cc.exe is mentioned as ad-/spyware in connection with a toolbar. But I don't know, if this file cc.exe is in deed the same file.
It will be the best to ask the developer, what this file is and why it is needed.
I didn't install it and the programme runs nevertheless.
It's always better to ask the developer and/or malware experts before sending out warning messages.
No need to put the cat amongst the pigeons.
graylox
Buzz
offlineMember
I wondered about cc.exe too. Being part of the setup file from the Your Uninstaller
setup program, this is the first time I've seen it tried here.
Plus the (different) setup prog from authors site has the cc.exe thing too.
Once installed, the program (YU) also tries to connect (209.68.36.53 = ursoftware.com)
even if check for updates (with the cc.exe program blocked and closed on the install)
Suranappar_AJ4E
offlineMember
Ok, this leads nowhere. It is obvious that it is ok to bake into unknown and unnecessary files in the installation files. There was no functional need for the installation itself to run cc.exe in secret before the installation started. Basically 90% of all home users, know that this is how malware and other nasty spread around. The fact that you have not even reacted to the file, even though you yourselves have managed to confirm that it exists, is troubling. In view of what is written about cc.exe online, you should have reacted or at least wondered about this file. It is redundant, but sneak off and sneaks out online if it can. This is not a normal installation behavior. The potential damage this program was supposed to do, it is now too late to stop. But it makes me ask myself, what is most important for the GOTD team. I suppose you do not intend to find out why cc.exe was baked into the installation. That said any damage is already done so this thread can be closed.
Robert
offlineStrayCat
Please hold your horses...
In this particular case CC.exe (component checker) is a legitimate MDAC Utility for Windows platforms and is deleted when the program is installed.
(feel free to look at the install script)
FWIW Malware variants show up as running in the taskmanager.
Thanks Robert.
@ Suranappar, now again: what are you speaking about? Where is any damage?
You never could prove, that cc.exe in this setup is some kind of malware.
Enough people tried to help you.
It's always good to be cautious when installing a new software, therefore every user should have a decent av- and anti-malware programme - and have to learn how to use it.
Trying new software every day like GOTD gives us the opportunity to do, needs some knowledge and some kind of confidence in the GOTD team. Users who are only coming to this site trying to find any evidence for any underhandedness shouldn't be astonished, if they are being "moderated" - they should try to find a more satisfying hobby.
graylox
Suranappar_AJ4E
offlineMember
Well lets update this a bit shall we.
cc.exe with the GOTD, do not have a Icon, nor do it display any messages.
The info about the file in details is meger
Now the MDAC CC.exe has an icon, and in bouth Window and Console mode it displays a Windows about not being abale to be used under Vista.
The file downloaded from Microsoft says Component Checker 2.0 last changes 2008.11.04 it also has a copyright.
GOTD cc.exe has no Component Checker 2.0 tag, nor a copyright and was last changed 2011.11.01.
The GOTD is NOT the offical file.
*** Gonna link some files, uploading pictures ***
The GOTD cc.exe lacks the window popup that Microsofts version has, still the GOTD version is bigger.
If the cc.exe realy is related to MDAC, then is highly modifyed, and I doubt it is by Microsoft.
Suranappar_AJ4E
offlineMember
In all truthfullness graylox, you guys have never been able to prove that it is a safe part and that it should be there, nor have you been able to explain why it works in stealth mode.
Things like that gets folks to wonder what your up to, and why you are so defensive.
But as stated before, we are not gonna get any further. Even if I where to find a kicka*s proff, you whould still deny it. And I am sure you got a perfect explonation as why the GOTD had a modifed version of CC.exe with missing info, and why you refer to the original unmodifyed version.
I have not been able to find out that the GOTD cc.exe really is Componet Check due to lack of info on the file, the original file however was no problem to verify.
Things here do not add up.
Suranappar_AJ4E
offlineMember
Removed
What you find in software downloaded from other sources (here the website of the developer) is nothing you can blame GOTD for.
You didn't get any toolbar with the GOTD zip file. It seems cc.exe is just a useless and harmless remain of the toolbar files.
So, there is still the question what damage happened?
Please remember in case you are going to test other giveaways:
Terms and conditions Please note that the software you download and install during the Giveaway period comes with the following important limitations: 1) No free technical support; 2) No free upgrades to future versions; 3) Strictly personal usage.
THIS SOFTWARE PRODUCT IS PROVIDED "AS IS" WITHOUT ANY WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED. WITHOUT LIMITATION, TO THE FULLEST EXTENT ALLOWABLE BY LAW, END USER ASSUMES THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE DOWNLOADED SOFTWARE PRODUCT.
graylox
Hälsar Varberg från mig.
Topic closed.
This topic has been closed to new replies.
