Is 7TSP really safe? (it does 'deposit' 'suicide.bat' temporarily)

icekool · 20 Jan 2015

Hello all, it's been a while since I posted on here.

I thought I would ask you guys about the well known and often used 7TSP. I have just used it again and everything is 100% fine, no probs no errors, I have a great looking theme with icons, wmp patched etc.

However, I did notice that it does 'deposit' a file called "suicide.bat" in appdata/local/temp, there is also a "c.i.c.exe" which is quickly picked up by antivirus and then removed (diagnosed as a specific trojan).

Am I being paranoid or is it all ok.

I have scanned with Malwarebytes, Norton (my main AV) and a standalone version of HitManPro which uses the Kaspersky & Bitdefender engines in the cloud. All ok.

Tookeri · 20 Jan 2015

How can you not be paranoid after you had a trojan on your computer?! Not to scare you but removing malware is never 100% safe because it's simply impossible for anti-virus products to detect them all. A lot of users here, me included, would advice to do a clean install or restore a system image backup to be on the safer side.
Again, not to scare you, but if it was me I'd think: if one malicious file was detected, what's to say there aren't other files that may be undetected? But that's just me, call me paranoid

Never heard of 7TSP but I did a search and found questionable results, so I tried to download it but it was blocked by my AV (F-Secure). Assuming I tried to download the same program, from/by "Fixit".

If you prefer to scan with an additional product: https://www.f-secure.com/en/web/home...online-scanner

For more ways to check for malware see my tutorials in my signature below.

ThrashZone · 20 Jan 2015

Hi and welcome to SevenForums,
I suppose it depends where you downloaded from as most items like this,
Also was this a free or paid for theme and from where did you download both items,
7tsp Theme Packs Installation Tutorial
[Tutorial] How to patch your system with 7tsp - Se7en Theme Source Patcher - XPtsp.com Community

I don't know if it's safe or not
But doesn't sound good to me but the installer has to be aggressive otherwise the themes will not install if it's a trogon or not Tookeri obviously a download he picked was tagged as such so please give more details,

Themes are a great way to pick up corrupted files or more than your expecting

icekool · 21 Jan 2015

Thanks for the replies above.
Tookeri, I'm surprised you haven't heard of 7tsp, I would of thought this was familier to anyone or everyone coming into the customization sub forum.

Thrashzone, the only theme I have used for several years now is one of Mr Grims, it's the H2O blue theme and it was a paid one but became free some time ago. Whilst I am paranoid, there could be a good reason for suicide.bat, possibly to remove something during a genuine patching (for the theming processes).

My copy of 7TSP passes all scans with various scanners and was downloaded via the virtualcustoms site quite a long time ago, I have kept it since.

Just to clarify, the posible Trojan as recognised by Norton could have been a false positive, but of course I'll never be sure.

There must be many hundreds or thousands of folks on this very forum that have used 7tsp many a time, I guess my question is how many folks took a quick peep into the user/appdata/temp folder before doing the double reboots.

ThrashZone · 21 Jan 2015

Hi,
No telling I don't use it personally
I would ask on the 7tps forum to see what replies you get,
I'm not sure if they have a paid version or if it's just donation ware ?
I haven't really checked into it until you questioned it
Cheers.

Tookeri · 21 Jan 2015

Well I'm not into customization, I picked up on the "trojan" part

I have no idea what 7TSP is and picked the first link that came up on a search. Maybe that was a completely different app and my mistake? It was this site which clearly hosts malware so don't try it:

HTML Code:

www.xptsp.com/fixit/7tsp.php

ThrashZone · 21 Jan 2015

Yea most themes make far to may changes for me
Just classic shell seemed to mess with things by default I didn't like so it didn't last very long either
Best place to ask is the developers website but I'm sure the response is predictable

Cheers.

icekool · 22 Jan 2015

Well, having posted on the virtualcustoms forum, apparently, 7tsp does indeed generate a 'suicide.bat' file to specifically delete the many temp files generated by the theming process (7tsp itself) and then to revoke a reboot. this is apparently deliberate

ThrashZone · 22 Jan 2015

Yep what's in a name,
Except it's creators mind :)

icekool · 22 Jan 2015

For anyone interested in explanations about some of the processes & files associated with 7TSP useage, here is the thread I started, in which the creator of the app replies several times. There is also an updated version (4) at RC stage but will go official in about 2 weeks time.

Here's the link 7TSP and the 'suicide bat' file

Thank again for replies above, this will always be my 1st stop for Win7 issues, I havent posted much because I use Linux quite a bit, but still use Win 7 on my main machine.
Regards