Strange problem with spysubtract and outlook

Published by: admin 2009-01-07

Computer Help Thread v3.0 [Archive] - Page 8 - Shoryuken::
catch though, that it had problems with turning it on. Alright, quick problem with my like Netscape, Eudora, or Outlook to send and read your
http://forums.shoryuken.com/archive/index.php/t-65951-p-8.htmlHOME

I find this a bit odd... i am having error messages with spysubtract since installing outpost pro ( trial verison - latest ).
What is even stranger is it seems that trojanhunter 4.1 has something to do with this problem or is involved somehow?
I have recently used a trial version of trojanhunter 4.1 which run out a few days ago before installing outpost pro.

I have uploaded the error messages so that you can see - spysubtract says it has a damaged network configeration while outpost says one of more componants have changed ( spysubtract ), but the componants point to trojan hunter 4.1?

Is this normal?

I did have nod32 installed but uninstalled it and now i am using kaspersky.

Trojan hunter4.1 is still on my system but the trial has run out - also the trial of spysubtract have also run out.

I can't afford to pay for both these programs to determine if this will fix the problem or it there is a compatablitly problem with outpost.

Does anyone here use outpost with both trojan hunter4.1 and spysubtract on their system?
If so... do you get the same problem at boot up?

Hello tim,

I use OutPost and Trojan Hunter 4.1 on all of my computers with out any problems. I have never used Spysubtract. I am not sure what Spysubtract does but there are free antispyware programs.

The "Shared Components" setting is to cover DLLs that are injected into every application - for example mouse or touchpad drivers often work by having a DLL injected into every application run on your system. Specifying them as Shared would avoid Outpost prompting about them for every program - however it will still alert you if Shared components change.

Please review the 1 FAQ for more details.

ThSec.dll changes every time you restart your system I believe - so Outpost should prompt for it once after every reboot.

I thought that was the point of putting it into the shared componants.. so that if it changes i would have no longer got the warning messages?

Have i got the wrong end of the stick?

Thsec.dll is part of Trojan Hunter Guard. If I do not make it a Shared Component in OutPost then I will get this for more than one program. I usually get the Thsec.dll only after rebooting my computer and starting THGuard or I install a newer version of OutPost or a new program.

Thanks Chris.

Chris i already did make it shared... it had no effect whatsoever.ThSec.dll changes every time you restart your system I believe - so Outpost should prompt for it once after every reboot.

Say, P2K, just for my edification, do you use any imaging tools to backup your OS?

Its not warning you about thsec.dll but trojanhunter guard which is thguard.exe.They are different.Thguard works like boclean..scanning memory for trojans.Thsec,dll is the file responsible to stop trojans terminating trojanhunter/trojanhunter guard.There are issues with thsec.dll and other software such as process guard and its logging.It may be best to post at trojanhunter forums as well as here ,as trojanhunters developer visits often and answers any problems.He would probably be able to explain further.
http://forum.misec.net/
me

I think your spysubtract popup and outpost thsec.dll are probably not related.Outpost will always pop up if you have component control and thsec.dll running.You may even find that opening a programe such as yahoo messenger may initiate outpost popping up the thsec.dll component change.You will either need to turn off component control in outpost (not recommeneded) , or delete or rename thsec.dll (in safe mode).The spysubtract popup in my view is just reporting that the network configuration is not the "default" or what it expects it to be.Possibly because nod or another programe has altered it .Xcleaner (which i use)for example always says that that errors were detected during verification of "layered service providor" settings , and that xcleaner should attempt to repair them.Nod does alter them ..but they are not damaged and dont need repairing.Im wondering whether xcleaners description and spysubtracts are basically the same thing.
me

Well here is what I think may be happening. TrojanHunter is actively checking your system, when SpySubtract attempts to connect, Outpost Component Control detects either the first use of thsec.dll or that is has changed and blocks the connection. Since thsec.dll is part of TrojanHunter and more than likely will be called by more that one application, select the "Make changed component shared" option on the Outpost "Warning: Components Have Changed" pop-up. This should allow SpySubtract to connection normally, avoiding the SpySubtract pop-up and "The page cannot be displayed" IE error.

Computer Tech Support -::
Outlook Xp problem. Posts(2) May 5, 2005, 4:48 pm. ZoneAlarm Strange cold boot probs. Posts(4) May 3, 2005, 11:48 pm. SpySubtract any good? Posts(1)
http://hardware.mcse.ms/archive84-2005-5-p8.htmlHOME

However don't take my word for it, do a goggle search for thsec.dll and also read Component Control in Outpost 2.5 (http://outpostfirewall.com/forum/showthread.php?t=12233) FAQ for more information.

WinAdCtl (HiJackThis log attached) - Free Antivirus Forum::
Im having problems with my computer. It gets very slow. HiJackThis log to see if someone can help me getting rid of all the strange bugs.
http://www.bullguard.com/forum/10/WinAdCtl-HiJackThis-log-attach_4779.htmlHOME

I thought that was the point of putting it into the shared componants.. so that if it changes i would have no longer got the warning messages?

Have i got the wrong end of the stick?
The point of sharing a component is that it may be used by many pieces of software. However, if a chance is made to that componenent then a warning is given. This is by design. Since that dll is changing every time you will continue to see warnings. Your choices are to disable component control or stop using that file.

Spysubtract is a antispyware program, it is made by the same people that brought CWS Shredder and has CWS Shredder build into it.

I was using it because i had a problem with a nasty variant of cws along with the vx2 and a whole host of other nasties. Have a look at this thread for more info ( http://www.wilderssecurity.com/showthread.php?t=63397 ).

I plan to wipe this system anyhow but i am looking to tighten up my secuirty after which is why i am playing with outpost in trial mode. I want to make sure that outpost works ok for me and that i can operate it ok so that when i wipe the system i can install it as my new firewall... i am having some problems getting to grips with it and with some strange errors like the one mentioned here.

This doesnt make sense... if i have added thsec.dll to the shared componants list why would outpost continue to warn me about changes made by it?
Isnt that the point of adding it to the shared componants list?
I have added both thsec.dll, trojanhunter.exe and theguard.exe all part of trojan hunter.
Theguard.exe seems to be running around my sytem modifying the memory of all my programs which may explain why i have been having so much trouble trying to work out how to operate outpost... it keeps telling me componants have changed all the time.
Why would it do this if i have added it to the shared componants list?

thsec.dll is trojanhunters "self protect"file.It stops malware from shutting it down,and "alters" frequently.You can safely delete or rename the file to say thsec.txt (in safe mode) so that it wont run.It doesnt alter trojanhunters detection /cleaning abilities, whatsoever but its "shutdown" protection by malware will be disabled .If you have system safety monitor or process guard in stalled ,these will stop that anyway.Be aware that spysubtract may give "network damaged" errors when an AV such as nod 32 is installed.Nod implants itself at network levels to intercept malware etc and some scanners ...xcleaner for defenite and possibly the one you are using that scans network integrity may show an "error"
me

Rather then using Spysubtract try IE-SpyAd if you use IE or any of its overlays: https://netfiles.uiuc.edu/ehowes/www/resource.htm . Also nice is JavaCool's Spyware Blaster. Both are free and very effective.

If you have added thsec.dll to the shared components list, outpost will not warn you again unless thsec.dll changes.

In your initial post, it was SyySubtract Program.EXE that triggered Outpost Component Control when it loaded thsec.dll for the first time. No response to the prompt will block by default attempts to connect, thus triggering the SpySubtract pop-up display and the IE "This page cannot be displayed.

FYI, thsec.dll appears to be a system level called dll, i.e., loaded my every program, making it shared should prevent any further Component Control action unless the dll changes.

Of course now that you have removed TrojanHunter, the problem should take care of it self. ;)

Say, P2K, just for my edification, do you use any imaging tools to backup your OS?Yes, Drive Snapshot (http://www.drivesnapshot.de/en/) (trial download available with time-limited backup and unlimited restore function). This can take a full backup in the background while you are doing other things and is very simple to use. Images can be verified and also mounted as "virtual" drives if you want to retrieve specific files.

It requires Administrator access to run and loads a driver (which you need to permit if using Process Guard or System Safety Monitor).

I plan to wipe this system anyhow but i am looking to tighten up my secuirty after which is why i am playing with outpost in trial mode. I want to make sure that outpost works ok for me and that i can operate it ok so that when i wipe the system i can install it as my new firewall... i am having some problems getting to grips with it and with some strange errors like the one mentioned here.It is possible to disable TrojanHunter's shutdown protection by renaming ThSec.dll which would avoid future Outpost Component Control warnings. In this case, using process protection software like Process Guard (http://www.diamondcs.com.au/processguard/) (the free version will protect programs, the full one can prevent malicious software from installing also) would be a good idea and this has the advantage that you could protect Outpost and other security programs from malware also - this does involve installing, using and learning yet another application but Process Guard is quite simple (much more so than Outpost in my view).

If you are trialling several items of security software at once, you will have co-existance issues (feature overlap, program conflicts, etc) so do be prepared to take extra time configuring everything - a secure system can save hours (if not days) of grief from future exploits.

Ok.. well its defintely part of trojan hunter... i followed your advise and made the componant shared but i still get the error messages each time i boot up?

Its defintely shared... i even checked in outpost options, applications and componants.. its there as shared but makes no difference.

Any ideas?

Hello timnicebutdim,

I notice that in your first thread

I have recently used a trial version of trojanhunter 4.1 which run out a few days ago before installing outpost pro.

Did you uninstall Trojan Hunter after the Trial of did you purchase it. If you still have it on your system after the trial and it has expired I believe you lose usage of it and cannot update. Could this be causing your error.

Chris i already did make it shared... it had no effect whatsoever.

I had enough of it... i uninstalled trojan hunter4.1 ... the trial had run out anyhow and i don't intend to use it again after i wipe my system. Spysubtract still gave me the error on boot up though... however i think this is because outpost stopped its internet access... i had to create another rule for it even though i had done this before.

Outpost seems to be running much better now that trojan hunter is off my system, i will know for sure over the next few days but it seems to me that trojan hunter was causing serious problems with outpost.