The registry cleaner in ASC and ASC Ultimate has serious issues with false positives

[roger_m]

The registry cleaner is is identifying some valid registry entires as being bad - an issue which ASC has suffered from for many years.

 

Here some details which should allow you fix the issues:

 

@="%SystemRoot%\\system32\\myfile /flags""

The above is identified as an error, becuase there is there file named myfile in C:\Windows\System32, however the above registry entry is valid becuase there is a file named myfile.exe in the system32 folder.

 

Another issue:

@="%SystemRoot%\\System32\myfile.exe,-1"

The file myfile.exe does exist in the system32 folder, but it would seem ASC does not ignore the ",-1" at the end of the filename and becuase of this thinks registry key is an error.

[Cicely]

Hi roger_m,

 

Please send us the related screenshots for us to look into.

 

Guide for taking screenshot.

 

http://graphicssoft.about.com/cs/general/ht/winscreenshot.htm

 

Besides, please download the tool from http://testdemo.iobit.com/InfoHelperV8.exe

 

Then double click to run this tool and click “Save report to Desktop”. You will get a zipped file IObit_Debug_Info.zip on your desktop, please send it to us so that we can get the detailed information to look into.

 

Looking forward to hearing from you.

 

[roger_m]

Here is the debug file and two screenshots from the Rescue Center, showing the valid registry keys that were deleted.

 

[ATTACH=CONFIG]n208397[/ATTACH] [ATTACH=CONFIG]n208398[/ATTACH] [ATTACH]temp_14837_1435648004034_977[/ATTACH]

[Cicely]

Hi roger_m,

 

Please take the steps below to see whether the issue can be solved:

 

1. Download demo from http://wikisend.com/download/291944/Suc11_RegistryCleaner.exe

2. Replace the original Suc11_RegistryCleaner.exe under the installation folder of ASC 8 with the downloaded file. To open installation folder of ASC 8, please right click on its desktop shortcut and select Open file location.

3. Double click to run the new Suc11_RegistryCleaner.exe to see whether the issue continues.

 

If the issue continues, please again run the InfoHelperV8.exe and send us the debug info.

 

Thanks for your time.

 

 

 

[clippittee]

@="%SystemRoot%\\system32\\myfile /flags""

The above is identified as an error, becuase there is there file named myfile in C:\Windows\System32, however the above registry entry is valid becuase there is a file named myfile.exe in the system32 folder.

 

Quick one please. How does ASC know that it's a threat. Is it just by a file name? Or the file integrity, or signature or something else?

[roger_m]

@Cicely I tried the new version, and it still has major issues with false positives. It quite possibly it does have the same issues with the same false positives as before. it's not easy to check since many detect edregistry keys, show N/A for the registry value and the actual registry data is not shown until you click on the detected issue. Once you've done that the registry key value is shown in the Data: field.

 

Perhaps you should add a registry data column slongside the registry value column so that it is easy to see all the found problems.

 

I did not find the same false positives. But, I did not click on every found error showing N/A. It would seem that the false positives I found have been added to the ignore list. This is a really bad idea, as ASC should be able to handle all cases of incomplete file names, or file names wih extra data at the end of the file name. Until that is done, the registry cleaner will remain unsafe to use, which is a shame as the rest of the program is excellent.

[roger_m]

@clippitte These are registry errors, not threats.

[Cicely]

@Cicely I tried the new version, and it still has major issues with false positives. It quite possibly it does have the same issues with the same false positives as before. it's not easy to check since many detect edregistry keys, show N/A for the registry value and the actual registry data is not shown until you click on the detected issue. Once you've done that the registry key value is shown in the Data: field.

 

Perhaps you should add a registry data column slongside the registry value column so that it is easy to see all the found problems.

 

I did not find the same false positives. But, I did not click on every found error showing N/A. It would seem that the false positives I found have been added to the ignore list. This is a really bad idea, as ASC should be able to handle all cases of incomplete file names, or file names wih extra data at the end of the file name. Until that is done, the registry cleaner will remain unsafe to use, which is a shame as the rest of the program is excellent.

 

Hi roger_m,

 

Would you please kindly sent us the related screenshots with the false results shown in the new Suc11_RegistryCleaner.exe, and also run the http://testdemo.iobit.com/InfoHelperV8.exe again and send us the debug info?

 

Thanks in advance.

[roger_m]

I wll not send you screenshots, so you don't add any more data to the ignore list. What you need to do is update the scan engine so that any data after a file name will be ignored. For example,take the registry key "%SystemRoot%\\System32\myfile.exe,-1" You should not ignore that particular registry key, you should ignore the "," and the data following it for any file name with a comma after it.

 

Also, do you plan to add a registry data column?

[Cicely]

Hi roger_m,

 

Sorry for the situation. I have forwarded your concerns to our product team. They will check and make improvements.

 

We appreciate your understanding.:-)

[roger_m]

Cicely thanks for the reply. I presume you will post back when there have further changes to the registry cleaner?

[Cicely]

@ roger_m, yes, we will surely keep on improving our product for your better experience.

 

Have a good day!