Malware code found in window blinds
Friday, December 19, 2008 by Jazzmin | Discussion: WindowBlinds
I just ran a scan on my machine and was notified of this threat:
HeurEngine.Packed.Execryptor
The heuristics engine has identified unknown code that is found to be highly suspicious. This file is packed with the same run-time compression that is commonly used by malware and thus, could be a potentially unknown threat.
Process
winlogon.exe (C:\program files\stardock\object destop\WindowBlinds\wbsrv.dll)
File
c:\program files\stardock\object desktop\windowblinds\wbsrv.dll
Startup
String is too long to type but it's in the registry...
Anybody know anything about this?
Thanks.
Reply #2 Friday, December 19, 2008 3:03 AM
I would imagine it's a false positive, and your AV is just picking up, as you said, a similar compression method as something in it's database.
I wouldn't worry too much about it, Stardock isn't out to get us. 
Reply #3 Friday, December 19, 2008 5:07 AM
i havent had any similair virus error messeges..but i trust WB and its creators , the skinners.
Reply #5 Friday, December 19, 2008 11:19 AM
What app produced that error message?
It's PC Tools Spyware Doctor.
I wasn't worried but thought it was strange to have this type of warning over software I've been using for years. Thanks to everyone who responded, I appreciate it!
Reply #6 Friday, December 19, 2008 11:24 AM
Jazzmin could you please send a copy of the Spy Doctor report to [email protected]? We would like to track these messges and work with the company to provide a more friendly enviroment. Thank you very much for the heads up!
Reply #7 Friday, December 19, 2008 12:55 PM
Sure thing Seabass... just forwarded to the email you provided.
I have since allowed the software to run but had to reinstall window blinds to get it to work correctly again.
Reply #8 Friday, December 19, 2008 6:04 PM
My mistake....I should have requested that, too...
It's unfortunately not uncommon for similar issues to arise...as both the programs and the spyware/AV checkers are updated.
Once the 'false-positive' is flagged the company is contacted to amend their signature updates/exclusions...
Please login to comment and/or vote for this skin.
Welcome Guest! Please take the time to register with us.
There are many great features available to you once you register, including:
- Richer content, access to many features that are disabled for guests like commenting on the forums and downloading skins.
- Access to a great community, with a massive database of many, many areas of interest.
- Access to contests & subscription offers like exclusive emails.
- It's simple, and FREE!
Reply #1 Friday, December 19, 2008 3:02 AM
It is not malware. The message is just saying that execryptor was used on the dll which is true, but execryptor is a perfectly legitimate tool.
What app produced that error message?