Page 1 of 2

Potential security threat - hsbr.exe?

Posted: Wed Sep 22, 2010 7:51 am
by endfire79
Hi, I recently downloaded Microsoft Security Essentials, and then re-downloaded BOP & BOTF from this site onto my new desktop (I've had it on my other laptop for a while, but never had MS Securtiy Essentials on it).

I just got the following alert from MSE. Any ideas?

================================================
Program:Win32/PowerRegScheduler:

Category: Potentially Unwanted Software

Description: This program has potentially unwanted behavior.

Recommendation: Review the alert details to see why the software was detected. If you do not like how the software operates or if you do not recognize and trust the publisher, consider blocking or removing the software.

Microsoft Security Essentials detected programs that may compromise your privacy or damage your computer. You can still access the files that these programs use without removing them (not recommended). To access these files, select the 'Allow' action and click 'Apply actions'. If this option is not available, log on as administrator or ask the local administrator for help.

Items:
containerfile:D:\botf\BOPL\hsbr.exe
containerfile:D:\botf\BOP\hsbr.exe
containerfile:D:\botf\hsbr.exe
containerfile:D:\BOTF_1.0.2_English_German_d.exe
file:D:\botf\BOPL\hsbr.exe->[RSRCEmb]
file:D:\botf\BOP\hsbr.exe->[RSRCEmb]
file:D:\botf\hsbr.exe->[RSRCEmb]
file:D:\BOTF_1.0.2_English_German_d.exe->(inno#000030)->[RSRCEmb]
===============================================

Posted: Wed Sep 22, 2010 8:41 am
by thunderchero
simple solution delete the files.

it is only the original registration for microprose products. and it does no use since there is no microprose to send it to any way.

thunderchero

Posted: Wed Sep 22, 2010 8:46 am
by endfire79
Thanks! My hunch was that it was a dud.

Cheers on the mod, it's very good.

Posted: Wed Sep 22, 2010 12:45 pm
by KrazeeXXL
I always use www.virustotal.com in such cases.

Results to hsbr.exe (tested 3 minutes ago)

Posted: Wed Sep 22, 2010 2:21 pm
by goodone
it's a false positive, ofc.

but the best practice would be to report this false positive to microsoft mse department... they should clear the file, before this detection spreads to other security companies, and becomes a bigger issue.

that's what i would do, if my norton got out of way . 8)

Posted: Wed Sep 22, 2010 3:20 pm
by KrazeeXXL
goodone wrote:if my norton got out of way .


don't forget to mention it's low ability for almost anything else. Except perhaps its big Overall-System-usage and it's unbeaten ability in tormenting poor gamers with it's useless annoyances and an almost perfect (fake) security-feeling. :lol: :twisted:

goodone wrote:it's a false positive, ofc.


Better false positives then nothing at all. In this case it's ofc out of question. But it can't hurt to be careful about those things. Much ppl don't care and that's why we've got spam in more then 98% of all e-mails worldwide. ;)

To add is that I trust every of Gowron's and/or thunderchero's releases. I know they wouldn't act careless.

Posted: Wed Sep 22, 2010 3:42 pm
by goodone
krazeexxl, i already suggested updating one's information about norton, it's far from outdated, it's obsolete. or simply, provide proof for ranting.

i bet all u ranters haven't even used norton, at least not for years. :roll:

anyway, it doesn't rly surprise me the issue comes from mse. 8O and my suggestion stays.

Posted: Wed Sep 22, 2010 3:57 pm
by KrazeeXXL
Ok, my post was supposed to be funny. If I hit a nerve then sorry. Somehow I guess you're perhaps a Norton employee :lol:

But you shouldn't imply that I dunno about Norton. As a matter of fact I do.

To my everlasting regret a very good friend of mine is still paying for this piece of junk just because he needs this fake security feeling. Always wondering y his system becomes mega-slow after some weeks since the last reinstallation and he isn't that kind of warez/bittorrent/whatever user. The complete opposite.

So my ranting has a reason and almost everyone of some hundred IT colleagues I know and work(ed) with will rant even more about Norton. Ok it improved a bit with the system usage and the game mode but it's still stuck in my head as one of the worst av's out there forever.

Fine, if you're a fan. I'm not. (nothing to argue about imo)

And I surely don't need an update about junk.
It was junk, it is junk. Guess what?

It'll ever stay junk.

btw I used it myself for 5 days... then reinstallation...
Now it may be improved but it still has this image. And they have much to do to get rid of it. Imo they better go fighting some windmills instead of improving their image.

Posted: Thu Sep 23, 2010 2:54 am
by goodone
nope. i'm not a symantec employee. and u didn't hit a nerve, i just dislike ignorant viewpoints.

i guess simply av testing companies do not agree with u ppl. just take a look at reviews and drop ur history-and-rants-induced fears. given a choice i'll trust the former, and my own experience. everybody is now imitating norton again [just like they did in their beginning years].

as a matter of fact, symantec was creating anti-virus products when we didn't even have windows. if u gonna rant about history, their long-lasting standing in the field is much heavier that three years of creating a somewhat resource hog. when it comes to viruses, experience in handling them is of a greater importance than performance of one's computer. i rly do not think it's a false feeling of security. i have no reason to believe that. and i never stopped using norton [for 17 years now; but i do agree, i skipped few bad-borns - not enough to chase me away]. how many viruses for all that time - zero!

on the other hand, i have an enormous list of large corporate and industry users using symantec corporate products. just that is simply enough to take symantec security experience through the roof.

nowdays ppl trust so many crappy av apps, like free avast or avg, or even pay for trend micro [for god's sake] or turn to microsoft [geee, there's a company with shinny history]. even this thread says something about it.

but that's not all bad, since i receive more customers [as an it prof] when they make bad security choices. one of them was a free avg user [for a year now, he's a happy norton user, who doesn't call but to confirm he extended his subscription]. so, be free to use whatever u wish, but if u rant, better provide some proof. i can back all of my standing points.

this is the last of my rants considering this matter. now, back to better stuff.

Posted: Thu Sep 23, 2010 4:27 am
by KrazeeXXL
It's all relative especially when it's about AV.

the more ppl use one specific AV the more it'll get attacked anyway. So sooner or later a really good product will degrade if the creators miss to invent and adopt new technologies. AV is a prime example.

I for myself won't use an AV again which acted like an open door imo.

So you got 0 viruses. Then you can consider yourself lucky. I can find at least 10 ppl in the next minute who weren't that lucky with Norton. Can you do the same? ;)

I can't see any proof in your post as you can't see any in mine. But ok you got me as I will take a look at what Norton is doing atm ;)

I don't have to show you that I'm not an ignorant person. It's about experiences.

Fool me once, shame about you. Fool me twice...

Posted: Thu Sep 23, 2010 9:21 am
by eprahsnada
I tell you what I found about Norton, I found out the sodding thing had downloaded itself onto my pc so every so often it would pop up saying "your computer has viruses on it" or tracking cookies and then says i should pay to download norton, i mean where did this message come from? my pc had never had Norton on it, and was using AVG, which had recently scanned my pc to find no problems.

im no expert on AV software but i find norton to also share qualities with a steaming pile of something brown and smelly (excuse the foul language =])

Posted: Thu Sep 23, 2010 12:33 pm
by KrazeeXXL
hm this probably didn't have anything to do with Norton.

I dunno as it now is but you can often use it for free for a month for testing purposes. If you like it and want to keep it you pay some bucks for the licence. Through miscellaneous pc-newspapers I could use Norton for at least 5 years for free. :lol:

So this sounds more like a common blackmail-tactic to me.

you should probably check your MBR for infections.

Try Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net


When you reinstall your system the first thing you should do b4 opening a connection to the internet is installing the latest service pack and patches for your OS.

It's not clever to install XP SP2 and then to download with this outdated system even SP3 from the MS server :lol: (probably just secured through the windows swiss cheese firewall XD)

Posted: Thu Sep 23, 2010 4:10 pm
by eber3
eprahsnada wrote:I tell you what I found about Norton, I found out the sodding thing had downloaded itself onto my pc...
I had the same problem. Apparently with the last Java update, they included Norton Security Scan, without tell anybody or giving you an option to not download it. Unistalled easy enough though.

Posted: Fri Sep 24, 2010 4:06 am
by zenith23
eber3 wrote: I had the same problem. Apparently with the last Java update, they included Norton Security Scan, without tell anybody or giving you an option to not download it. Unistalled easy enough though.
McAfee invited itself onto our laptop when the wife downloaded Acrobat Reader. It does however give you the option not to, but she's so tech illiterate it scares me.
easily removed though.
Norton appearing like that though is extremely annoying. having used it for a few years I would never go back, I'm sure it wrecked our Viao.

Posted: Fri Sep 24, 2010 11:38 am
by KrazeeXXL
hehe, this usually happens to ppl who just hit the "ok-button" not reading any dialogs and who therefor don't uncheck such options.

Happend to me, too, some days ago as I installed "foxit pdf reader" and got this stupid "ask.com toolbar" for FF.

If I wanted "ask.com toolbar", I'd installed it by myself dang it. Ok in a stupid way I did ;)

But programs who just install them by themselves w/o my knowledge and/or authorization... that's a whole different story.
I just can suggest you to run your browser in a sandbox (you got one included in "Comodo AV" f.e.)
or at least run your Browser w/o admin-rights.

That's the little 1x1

Also get yourself "noscript" and "adblock plus" for FF. some of the best add-ons imho.