I don’t know if it was posted before, so if it was then delete this thread.
Hi, I have discovered weird bug which links to the process location.
I have recorded a video to show how the bug works.
I have recorded it on virtual machine an my PC couldn’t handle it so every operation has take some time.
Video link:
BTW. I think this bug might be used by some malware so that if it changes the location the file cannot be analysed any more I think, I have’t test it with a malware though.
EDIT: 18/01/2011
Can anyone confirm this? Is it a bug? Will it be fixed in the next release? ^^
I watched your video and I could reproduce this on Win 7 SP1 x86.
Your video can be divided in two parts:
Part 1 which shows the Error not found message by using Killswitch and Unlocker as examples
Part 2 which shows further implications when trying to delete the application from disk.
I will focus on part 1 and not part 2.
In part 1 Killswitch is running and will show Killswitch and Unlocker in the list of running processes and iirc the properties for the running files are shown. Killswitch is then closed.
Now comes the crucial step. The name of the installation folder is changed. In the video the names of the installation folders of CCE and Unlocker is changed and the programs are started from the newly named folder. I will only follow the step where we change the CCE folder’s name to CCE 1.
Now we start Killswitch from the CCE1 folder, we look at the Killswitch Pane and ask for the Properties for the Killswitch executable. We now see two things:
The Rating of Killswitch.exe file states “Error not found”
The properties of Killswitch.exe show a discrepancy. It will falsely report the path under Image File Name to be in the CCE folder. It will report correctly the path under Command Line and Current Directory stating Killswitch sits in CCE 1 folder. See attached image
That seems to suggest Killswitch is remembering the Image File name rather than establishing it. This seems like a bug to me.
May be the topic starter can give a recap of the implications of this.
After this experiment I started CCE from its regular folder again and found that CIS is suffering from the same problem. It does not recognise CCE because it think it still is in the CCE 1 folder and not in the CCE folder. See attached image.
Thanks for reviewing the video, really appreciate your whole detailed explanation, I just couldn’t be bothered to do it after dealing with this laggy virtual machine (I am keep asking myself why did I use virtual machine for this).
Does this happen after closing down Killswitch, renaming the folder Killswitch is in and then starting Killswitch again?
If not then we may be looking at a different error. In that case it would be better to start your own topic with a more extensive description of the situation where the error occurs.
I renamed it and now Killswitch showed an error “not found” also with killswitch.exe. And stickies.exe was not found and several other well-known processes like PopPeepr ja Npkia applications.
I donn’t think this is a very serious error because all malware processes I have tested have been marked as infected.
