Malware and Virus RemovalProblems removing malware/viruses? Get help from our Malware removal experts.
Mission Statement
WindowsBBS is an online community dedicated to easily accessible technical support for those using Microsoft operating systems and other Windows software.
Our goal is to become the leading resource for computer users that require assistance with their day-to-day computer usage, including full support for networking PC's, virus & malware removal, system upgrades and general support questions.
"This page has an unspecified potential security flaw"
If this should be in the Security Forum, pls move it and the second post.
In a rare moment of rash exploration, I thought I would try this program. http://www.nirsoft.net/utils/pspv.html
The instructions told me that my AntiVirus would detecte the program as a Hack Tool, and it did. However, I just clicked the warning off and proceeded.
NirSoft Protected Storage PassView runs from the pspv.exe file without installation.
I ran it. I found it told me little (though that may be my lack of understanding as to how to use the data). So I removed the program (pspv.exe file and .chm Help file) from my PC.
Now when I want to look into my Content.IE5 folders, I am told "This page has an unspecified potential security flaw". The message is in a box with Internet Explorer in the Title Bar. I can click the message off and view the Content.IE5 files, but it is annoying.
I have cleared my TIF (using both Internet Options and SystemSecuritySuite which cleans out the index.dat file, too), used System Restore (to the date before I used pspv.exe), gone through the Registry, run several scans with my AV and Antispyware detectors. (I also scanned with NortonAV with and with scanning for HackTools.) Nothing is found. I also ran HiJackThis and, although I am not expert, found no obvious problem. See HJT log in next post.
And the message still pops up. Anyone have any ideas how to stop the message?
P.S. I should mention that I am not sure NirSoft caused the problem, but it occurred about the same time I installed/uninstalled pspv.exe.
Also I Googled the error message, but none of the references seem to apply. I have checked my settings in IE Tool|Internet Options|Security tab|Internet and Intranet Zones|Custom Level|Scripting. All are at Enable.
Last edited by Welshjim; 12th August 2006 at 19:58.
Didn't find the information you thought to find? Check out these Similar Threads
Logfile of HijackThis v1.99.1
Scan saved at 10:52:58 PM, on 8/10/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
I suggest you run the computer through the Microsoft Baseline Security Amalyser 2 and see if anything comes up. Can't readily find the download at MS so the URL points to MajorGeeks.
PeteC--Thnks for the idea of MSBSA. I ran it. Everything but two of the IIS items looks OK. (See attachment) The red check IIS items do not see particularly pertinent. In spite of MSBSA's report I can find no IIS Samples. Concerning the IIS Lockdown Tool, I am not certain/confident that it applies to me. I do run any of the programs/servers involved http://www.microsoft.com/technet/sec.../locktool.mspx
The only server I use is my ISP's server. I have no in-house server, nor router--just a direct connection to the ISP through a cable modem.
I got to the point in using the IIS Lockdown Tool where I was asked to pick a server template. As mentioned I was not confident that I could, especially when the instructions imply it is important to pick the right server. Many choices are given. The ones that might apply are:
1)Static Web Server
2)Other (Server that does not match any of the above)
3)Server that does not use IIS.
Any advice?
I am beginning to think that perhaps (by coincidence) the problem may be due to having installed the recent Windows Updates on or about the same date. I will test them out, one by one, this PM.
Geri--Thanks for the references. I am suspicious whether Protected Storage PassView really is malware. I have heard from others that they use PSPV without problems. And NirSoft themselves warn that PSPV will be detected by AV programs as a HackTool. But I wonder what the downside of that is unless some other malware got control of PSPV.
I have checked/scanned my PC fairly rigorously and find no traces of the PSPV files mentioned, so my earlier removal seems effective. But I will try Kaspersky.
Last edited by Welshjim; 14th August 2006 at 00:25.
Hi Jim
Don't think this really apples to you because you dL it yourself, verses coming upon it randomly on your machine.
But it wouldn't hurt to check.....
"Protected Storage PassView 1.50 is one of Password Cracker spywares.
Finding it on your computer means that your computer is infected with Password Cracker and crucial data could be endangered or even lost.
This Password Cracker is also known as:
•TrojanDropper.Win32.PVStealth.b - named by Kaspersky."
Thanks to all for your help.
The problem is indeed caused by one of the August 9 Windows Updates. Specifically 921398 (MS06-045).
I uninstalled almost all the August 9 updates, individually. When I uninstalled 921398 the problem message no longer appeared. When I reinstalled, the message was back.
Now I have the problem--Do I go without the Update or install it and get the message?
A secondary problem is that all the August 9 Updates are already downloaded to my harddrive (and this remains the case even after uninstalling them) so possibly when I am offered any future Updates, there is no way to pick and choose. At least I saw no option to not include one Update's installation (from the already downloaded files) and pick only the rest.
Of course I could install all and then again uninstall 921398. (Or maybe I could uninstall the WindowsXP-KB921398-x86-ENU.psm file so Windows Update does not think I already have the download?? I cannot remember if that then still gives the opportunity to choose which Windows Update to install and which to ignore. I have no outstanding Windows Updates at the moment.)
I am glad to have exonerated NirSoft's Protected Storage PassView.
Geri--Others have told me that PassView is not malware, but in any event, I have run Kaspersky, Norton AV, AdAware, SkywareBlaster and Windows Defender. Before I removed PassView the only one to detect it was NAV. And what was said is that it is a "Hack Tool", which, of course it is.
Now, none detect it. So it seems to no longer be on my harddrive.
Hi Jim
Just wanted to share what I found, incase it would maybe help
Quote:
The problem is indeed caused by one of the August 9 Windows Updates. Specifically 921398 (MS06-045).
Could you not contact MS and see if this has been a problem with others as well? and see if they have a work-around?
I DL'ed the updates shortly after the release and have not had this problem? It could be that you have your security settings set higher then I do??
I always woundered why a update would effect some and not others, Don't really understand that
Well at least it is nice to know "what" the problem is, I would try MS and see what they say anyway.
Geri--Sorry to hear you do not have the problem.
Thanks for the suggestion. I will contact MS.
BTW--If I was not clear, the problem occurs only when I try to open a Content.IE5 folder. C:\Documents and Settings\UserName\Local Settings\Temporary Internet Files\Content.IE5
I can open all other folders and files with no problems.
Just my two cents, I have used the Protected Storage PassView, and it isn't dangerous. What I believe does come up as dangerous is the code used to decrypt the passwords stored by IE.
Geri--I love Favicons, and Content.IE5 is where they go when you create a Favorite. However, they will be deleted when you clean your cache, so you have to get them out of Content.IE5 and save them somewhere else.
markp62--I have no reason anymore to think that Protected Storage PassView was the problem. Thanks for your reassurance.
I called MS and it took them the better part of a week to "resolve" the problem. The update in question (KB921398 -- MS06-045) deals with "drag & drop" and FOLDERS with GUID (Globally Unique IDs) extensions. (You may recall a patch that dealt with FILES with GUIDs as extensions.)
In my case, the problem did not occur when I "navigated" to the folder but ONLY when I used a "shortcut" to get there. When MS called with the resolution, I asked if this had anything to do with the internals of how the OS handles the Content.IE5 folders (and we all know what a pain in the "A" Microsoft has made of their OSes as far as accessing those folders!). The tech confirmed that this is the case.
IMHO, the ultimate solution is for MS to begin treating these folders like all other folders (i.e., via "standard security mechanisms"), but that is too easy! After all, MS knows what is good for me and I just have to believe them. (My apoologies for the sarcasm if anyone finds it offensive.)
At any rate, the solution they provided simply turns off messages from being issued to the user for the specific security zone involved.
My case number is/was SRX060809600084 if anyone wants to ask for the solution. I personally am hesitant to pass it along for three reasons:
1) The solution only masks the problem of the patch being buggy
2) MS has caused this problem because they insist they know better than I do as far as what is good for me, how my system should be administered, and what I should be allowed to access (almost as if it were THEIR system!)
3) I am not entirely pleased with the solution (although it certainly provides relief from the messagebox popping up) and do not particularly recommend it because I am not certain that it will not negate the value of the patch itself.
The MS tech indicated that the patch also made changes to shell32.dll and assured me that those changes would "protect me". I guess I have chosen to believe him, but I cannot recommend others have the same level of confidence that I do.
VicMax--Thank you so much.
Your post is a blockbuster. So I am not so crazy after all.
And, yes, I also use a shortcut to get to an open Content.IE5 folder. At least I did before installing the 921398 Update. But once I click off the first error message (which finally opens the Content.IE5 folder), I must also click off another of the same message when I try to open each of the alphanumeric folders.
I am into my fourth day of emails with MS. So far the usual "do this and that" from a script.
If you have no objection, I plan to tell MS about case SRX060809600084 without elaboration other than to say that others apparently are having the same problem.
Last edited by Welshjim; 17th August 2006 at 23:15.
