UBCD4Win Forums > Ewido Anti-spyware Micro

n5uxu

Sep 8 2007, 02:34 AM

Ewido's online scanner uses Active-X, but for users with other browsers a standalone scanning engine is available.

Even though Ewido was bought by AVG this is still supported with current definition updates.

Ewido Anti-spyware Micro (149kb)
When ran, this little program automatically downloads all available updates and allows you to scan you computer.

I created a plugin for this simple program that works. (Don't shoot me if I didn't code it properly)

Plugin and Ewido Micro (just unzip and drop in your plugins folder)
--- removed link to plugin with files ----

And just in case (I can't stand when I want a plugin and the link doesn't work anymore)

Manual method:

Direct Download from Ewido.net
http://downloads.ewido.net/ewido_micro.exe

Download the program and place it in a "files" folder
Place the "files" folder along with "ewido.inf" and "ewido_nu2menu.xml" in any folder and drop it in your plugins.

Ewido.inf

CODE

; Ewido.inf
;
; Created by BC

[Version]
Signature= "$Windows NT$"

[PEBuilder]
Name="Anti-Spyware: Ewido Scanner"
Enable=1

[WinntDirectories]
a="PROGRAMS\Ewido",3

[SourceDisksFiles]
files\ewido_micro.exe=a,,1

[Append]
nu2menu.xml, ewido_nu2menu.xml

ewido_nu2menu.xml

CODE

<NU2MENU>
    <MENU ID="Programs">
        <MITEM TYPE="POPUP" MENUID="Anti-Spyware Tools">Anti-Spyware Tools</MITEM>
    </MENU>
    <MENU ID="Anti-Spyware Tools">
        <MITEM TYPE="ITEM" DISABLED="@Not(@FileExists(@GetProgramDrive()\Programs\Ewido\ewido_micro.exe))" CMD="RUN" FUNC="@GetProgramDrive()\Programs\ewido\ewido_micro.exe">Ewido Anti-Spyware</MITEM>
    </MENU>
</NU2MENU>

Enjoy

rdsok

Sep 8 2007, 03:26 PM

@n5uxu

Thanks for the post and the plugin...

BTW.... don't ever post a complete plugin that includes the files UNLESS you also have the authors/owners permission to distribute them. Without permission, even if its a free download, it copyright infringment.

I also removed your duplicate post suggesting it as a included plugin for a few reasons. The copyright one of course ( we would need Grisoft's permission and they already have indicated they weren't interested when we had asked previously ) and because you shouldn't cross post like that ( start multiple posts on the same subject ) .

Just a note about your plugin. If you don't use runscanner.exe to redirect to the proper registry it would be unwise to use this from the booted project. Removing malware without also removing the corresponding registry entries can be problematic in many cases. It may leave the system unbootable, may break the LSP chain breaking the network/internet access and other issues. Of course further testing from within UBCD4Win and using runscanner would also be wise to make sure it works good.

Running the plugin from the booted Windows would still work just fine.

n5uxu

Sep 9 2007, 11:27 PM

Second attempt (without breaking the rules this time)

OK, I took your advice on runscanner.exe and used the adaware plugin as a template.

This will execute runscanner from the booted project and bypass it from the booted windows.

Comments and suggestions are appreciated.

Easy method

Download the Ewido scanner from Ewido.net
http://downloads.ewido.net/ewido_micro.exe

Download the plugin (does not contain ewido_micro.exe)
http://rapidshare.com/files/54602052/Ewido.zip

Place ewido_micro.exe in "files" folder and drop in plugins folder.

Here are the files included in the Plugin

Ewido.inf

CODE

; Ewido.inf
;
; Created by BC

[Version]
Signature= "$Windows NT$"

[PEBuilder]
Name="Anti-Spyware: Ewido Scanner"
Enable=1

[WinntDirectories]
a="PROGRAMS\Ewido",3

[SourceDisksFiles]
files\ewido_micro.exe=a,,1
files\ewido.cmd=a,,1

[Append]
nu2menu.xml, ewido_nu2menu.xml

Ewido_nu2menu.xml

CODE

<NU2MENU>
    <MENU ID="Programs">
        <MITEM TYPE="POPUP" MENUID="Anti-Spyware Tools">Anti-Spyware Tools</MITEM>
    </MENU>
    <MENU ID="Anti-Spyware Tools">
        <MITEM TYPE="ITEM" DISABLED="@Not(@FileExists(@GetProgramDrive()\Programs\Ewido\ewido.cmd))" CMD="RUN" VISIBILITY="@Shl(@Not(@FileExists(@GetWinDir()\system32\PreShell.exe)),'1')" FUNC="@GetProgramDrive()\Programs\Ewido\ewido.cmd">Ewido Anti-Spyware</MITEM>
        <MITEM TYPE="ITEM" DISABLED="@Not(@FileExists(@GetProgramDrive()\Programs\Ewido\ewido_micro.exe))" CMD="RUN" VISIBILITY="@Shl(@FileExists(@GetWinDir()\setupldr.bin),'1')" FUNC="@GetProgramDrive()\Programs\Ewido\ewido_micro.exe">Ewido Anti-Spyware</MITEM>
    </MENU>
</NU2MENU>

Ewido.cmd (this goes in the "files" folder)

CODE

@echo off
rem -------------------------------------------------------------------------
rem ewido.cmd - Script to start Ewido from BartPE
rem Adapted by BC
rem
rem Created by adapting the script from AdawareSE for BartPE by Bart Lagerweij.
rem -------------------------------------------------------------------------
echo EWIDO.CMD: Starting...
setlocal
if "%temp%" == "" goto _err
if exist "%temp%\Ewido\ewido_micro.exe" goto _run
mkdir "%temp%\ewido"
xcopy /s "%~dp0*.exe" "%temp%\ewido\"
xcopy /s "%~dp0*.cmd" "%temp%\ewido\"
:_run
start %SystemDrive%\Programs\RunScanner\RunScanner.exe %temp%\Ewido\ewido_micro.exe
goto _end
:_err
echo.
echo EWIDO.CMD: No temp variable set...
echo EWIDO.CMD: Try adding a ramdrive...
echo.
pause.
:_end
endlocal

rdsok

Sep 10 2007, 12:29 AM

Currently this would also require that the booted UBCD4Win or from Windows to also have internet access available so that the plugin could download the definition files. The definition files would then be placed in %temp%\ewido_signatures if internet access was available.. otherwise it will fail to run since no definition files would be available to the program.

agel

Nov 17 2007, 03:00 AM

work great, thank you

n5uxu

Dec 2 2007, 01:48 AM

Version 3.10 Changes -Released:11/25/07

* Added- AVG AntiSpyware

I haven't done a build with 3.10 yet, but if AVG antispyware has been added then no need for my plugin.

Ewido scanner is the engine that is now AVG antispyware.

rdsok

Dec 2 2007, 12:28 PM

QUOTE (n5uxu @ Dec 2 2007, 12:48 AM)

Version 3.10 Changes -Released:11/25/07

* Added- AVG AntiSpyware

I haven't done a build with 3.10 yet, but if AVG antispyware has been added then no need for my plugin.

Ewido scanner is the engine that is now AVG antispyware.

I'm not so certain that I would say AVG AS is as good or not... it does work well but it takes forever to actuall start AVG AS in some situations...