RunScanner

[JohnW]

RunScanner is essentially a startup and hijack analyzer. Arguably an improvement on 'Hijack This'
You can use RunScanner to detect autostart programs, spyware, adware, homepage hijackers, unverified drivers and other problems.

You can import and export your results and let other people help you to solve your problems.

Features:

100+ start/hijack locations
Fixing of invalid entries.
Saving and importing of .run files (all information available)
{A user with problems can save the .run file, an expert can mark the items that need fixing and send the .run file back to the user. }
Online malware analysis
Import and export of .run files
Powerful process killer
Save to text log file
Marking of items.
Powerful file filtering
Kill and rename
Kill and delete
Delete at next reboot
Host file editor
History backup / restore
Explorer jump
Analysis of file certificates
Verification of file signatures.
MD5 hash calculation of files.
Bit9 FileAdvisor MD5 lookup
CastleCops MD5 lookup
Upload file to VirusTotal
Analyze loaded modules
Fixing of invalid entries.
Saving and importing of .run files (all information available)
Online lookup of scanned entries.
Google lookup
Runscanner MD5 lookup
Regedit jump

There are 3 main 'Usage Modes' --

#Beginner mode
This is for novice users that want to do a scan and upload their results to a malware specialist forum.
# Classic mode
Classic scan mode with easy click and fix all. This mode only shows non whitelist items and it's primary use is to remove malware.
# Expert mode
This is for advanced users, all startup tweaks, scanning, reporting, filtering and delete features are available.

Available from ...

Code: Select all

http://www.runscanner.net/default.aspx

v 1.6.3

I hope we get some comments on this one!

[Ameri-CAIN]

I just ran this. I didn't check but it must have left little bits of itself in the registry, because it registered the .run file it created to work with the RunScanner.exe. I guess that can be avoided, but it makes it easier for the average computer user to use the way it works currently. I like the concept of this program. Help me help you sort of concept. It makes it easier for the helper to help the helpee in that the helper can create a .run file that the helpee just executes to fix their system. I can see where this could be abused though. Interesting program... Has anyone confirmed just how much of itself RunScanner.exe leaves in the registry?

[JohnW]

@Ameri-CAIN
I did actually do a Regshot. As far as I could make out the Registry entries were transients and trivial.
However I did notice later that some sort of data file was stored somewhere other than the app folder.

Glad to get some sort of response though!

[Queue]

Well, first off, it associates the file extension .run with itself every time you run Runscanner.

It also has it's own minor registry ntry at HKLM/Software/Runscanner.net.

It stores ''undo'' entries in the local Application Data folder in a Runscanner.net subfolder.

---

Honestly, the only real flaw is the two spots in the registry it touches; the undo's in the AppData folder make perfect sense as they're specific to the machine Runscanner was used on, so you wouldn't want to bring those with you.

An NSIS wrapper makes short work of the registry entries, and I cooked one up in about 30 seconds for this, but I'm not on the machine where I left said wrapper so it'll be a little while before I can upload it somewhere.

It's a fantastic program and I've already had some great fun with it. It's a lot like HijackThis but with handy right-click search-the-internet-for-x shortcuts.

Queue

[guinness]

I saw a review on Ghacks for this application and they claimed it was Portable so I decided to test it, this is what I found.

Tested: Not Portable

Creates the following registry keys HKLM\SOFTWARE\Classes\.run & HKLM\SOFTWARE\Runscanner.net as well as storing back files in %APPDATA%\Runscanner.net.

[webfork]

Update: this was last updated on 6 March 2021 to version 2.0.0.60. Unfortunately, the main website doesn't appear to be online any longer so so here's the archive.org and softpedia links:

https://web.archive.org/web/20211019111 ... anner.net/
https://www.softpedia.com/get/Security/ ... nner.shtml (listed as adware)