![Cobalt Zin[cave]](https://skins15.wincustomize.com/0/1/1354/20/5/preview-20-5-100x75.jpg?d=991713824.453)
Trojan.Packed.Execryptor warnings
Monday, May 5, 2008 by FrodoOfTheShire | Discussion: Object Desktop
I have been using PCTools Spyware Doctor for the past years. I rarely received false positive but, lately, when uninstalling a version and then going to the latest build of that antispyware program, I receive warnings on “deskscape.dll” and “WBSrv.dll”. The latest build identifies processes, file and start-up infections (Trojan.Packed.Execryptor) related to those two DLLs.
I refused Spyware Doctor to block them and added those files to its exclusion list.
Has anybody received similar warnings on those files with other Spyware or Anti-Virus Program?
If I were Stardock, I would certainly have a chat with PCTools and have them cleanup their detection routines. Having its software being pointed as infected would not please me at all.
Reply #2 Wednesday, May 7, 2008 9:30 AM
This has been identified as a false positive and we have reported it to PC Tools who have acknowledged it and have escalated it internally.
Hopefully this can be sorted out fairly quickly.
Reply #3 Wednesday, May 7, 2008 9:37 AM
Also, these security apps can be working fine with our software, then an update to it occurs and it's trojan this, and trojan that.
Reply #4 Wednesday, May 7, 2008 6:23 PM
These issues occur from time to time.
Once discovered we pass them on for appropriate resolution....in this case it affected more than just ourselves [Stardock]. This entails the to-ing and fro-ing of notification emails, etc...the last of which was from Koop to me letting me know the same info as what Neil posted above in #2.
It should be corrected in a future/subsequent build/release from PCTools...
Reply #5 Thursday, May 8, 2008 7:38 AM
Now PC Tools’ Spyware Doctor (even with exclusions specified, Anti-Virus and On-Guard Protection disabled) systematically kills wbsrv.dll and quarantine it. So, Spyware Doctor now needs to be totally disabled for WindowBlinds to work ... ... ...
Happy to know you have been in contact with them. This new situation (refusing to take into account the user’s white listing) has nothing to do with you. I have to get out for work right now, but I will Email them a detailed report (along with my personal thoughts ...) tonight.
Regards
Reply #6 Friday, May 9, 2008 5:17 AM
The reason Spyware Doctor was killing WindowBlinds and apparently not following my exclusion list was simple: WindowBlinds now appears under two different folders Program files\Stardock\WindowBlinds and also Program Files\Stardock\Deskscapes\WindowsBlinds. The first path is a newer one its wbsrv.dll full path was not in the exclusion list.
This raises a different question: since I use Stardock Central to install/uninstall the application, why is it that two different folders are created for WindowBlinds? Furthermore, isn’t it strange that under Program Files\Stardock\DeskScapes are sub-folders for DeskScapes, DesktopX, LogonStudio, SoundPakager, TweakVista and WindowBlinds? Why are they under DeskScapes?
And, talking about DeskScapes, the Premium Dreams that I bought (Winter Snow, Photo Dream, Liquid Dream) which I particularly like because of their content and of the very low CPU resources used, do not work anymore, all others work.
Reply #7 Friday, May 9, 2008 9:22 AM
FrodoOfTheShire : What build of Deskscapes do you have installed?
Did you install it from SDC or Impulse?
Reply #8 Friday, May 9, 2008 5:48 PM
They now just won't do anything, not even give an error message. Regular Dreams work fine. I have never used Impulse.
Reply #9 Thursday, May 15, 2008 5:34 AM
Maybe something was disabled by Spyware Doctor (now out of my system until a new build is released) or by a DeskScapes update. We'll see.
Reply #10 Thursday, May 15, 2008 12:06 PM
Please login to comment and/or vote for this skin.
Welcome Guest! Please take the time to register with us.
There are many great features available to you once you register, including:
- Richer content, access to many features that are disabled for guests like commenting on the forums and downloading skins.
- Access to a great community, with a massive database of many, many areas of interest.
- Access to contests & subscription offers like exclusive emails.
- It's simple, and FREE!
Reply #1 Monday, May 5, 2008 8:21 PM
You are not wrong. From time to time AV proggies get an update which gives false-positives for legitimate software, and Stardock's is often one of them. It's annoying to say the least.
I'll pass this on to the 'back-room-boys' and they can light a fire under PCTools...