Check Browsers LNK Changelog

What's new in Check Browsers LNK 2.2.0.42

Jun 11, 2023
  • Disabled USN reset (takes too long)
  • Added command line switch /resetUSN - reset USN log
  • Added multi-language resource for describing file properties

New in Check Browsers LNK 2.2.0.32 (Sep 14, 2018)

  • The / noGUI key is added - start in hidden mode.

New in Check Browsers LNK 2.2.0.27 (Mar 8, 2018)

  • The simlink check engine is improved. MFT mode is disabled when checking the targets

New in Check Browsers LNK 2.2.0.24 (Oct 18, 2017)

  • Method of folder tree creation while finding shortcuts has been changed (more demanding to CPU, less to HDD).
  • File reading function has been improved.
  • Obtaining environment variables has been improved.
  • Some analysis rules has been changed.
  • Some errors has been fixed.

New in Check Browsers LNK 2.2.0.16 Alpha (Jun 24, 2017)

  • Improved file search engine (less conflict to protection software)
  • Added additional engine of regular expressions
  • Removed replacing of special characters by xDD
  • Toughening of rules to obfuscated bat-files
  • Updated whitelists of scripts and browsers
  • Fixed crashes when resources were freed
  • Improved OS version detection.

New in Check Browsers LNK 2.2.0.12 Beta (Mar 14, 2017)

  • Fixed bug with path information damage when working with arrays.
  • Fixed bug when MFT-based search worked on systems with installed MS Office only.
  • Fixed bug which cause app. crash when checking integrity level.
  • Fixed bug related to checking file codepage.
  • Fixed bug with re-encoding target of appref-ms.
  • Fixed several bugs in analysis rules.
  • Fixed error when log file doesn't open automatically on some OS.
  • Fixed error with identifying codepage of URL-addresses.
  • OS info: added ReleaseId for Windows 10.
  • /Favorites/.../Интернет.lnk added to Black list.
  • Expanded .appref-ms scan to profiles of every users.
  • Browsers whitelist database has been updated.

New in Check Browsers LNK 2.2.0.9 Beta (Feb 15, 2017)

  • It fixes a bug with Unicode data corruption when checking the ways of the array.
  • Fix bug when not working on the MFT-search without MS Office applications.
  • It fixes a bug that caused the program to fall, while checking the integrity level.
  • It fixes a bug related to the definition of the file encoding.
  • about OS info: for Windows 10 added output ReleaseId.

New in Check Browsers LNK 2.2.0.8 Beta (Nov 14, 2016)

  • Added support with Windows 2000 and Windows Server with Terminal services.
  • File search engine replaced by MFT version (NTFS only). Scan speed will have been significantly increased on machines with slow drives and drives with large number of files.
  • Added key /allDrives - to check all hard drives of PC.
  • Added translation into German. You can forcibly switch to this language by specifying key /Lang DE or by renaming program file into "Check Browsers LNK_DE.exe".
  • Added recognising of user profiles root folder if it was moved during OS installing stage by 'sysprep' or by symlink method.
  • Fixed false marks "NOT profile".
  • Fixed bug when mounted disk is recognised as disconnected. Added getting target of associated network resource.
  • [LNK] Fixed bug with parsing of unicode name of folder for FTP-LNK.
  • [LNK] Improved parsing of shortcuts with 64-bit environment variables.
  • [LNK] To the sub-section "Target does not exist" added description "wrong prefix of protocol" for 'MSITStore' shortcuts with unfinished prefixes like http:/, http:
  • [PIF] Fixed bug with parsing Cyrillic characters in paths of PIF shortcuts.
  • [PIF] Fixed bug with differentiation of PIF target into target and argument.
  • [PIF] Added marks and hash sum, if PIF file is PE EXE.
  • [ URL ] Fixed parser of URL shortcut with UTF-8 format address.
  • [ URL ] Maximum length of URL target is increased from 254 to 1000 characters. More longer target will be specified in log with mark of its real size.
  • [ URL ] Changed order of paths to shortcuts in section "Internet shortcuts". Full path will be specified in log at first place. Next is 8.3 path (for unicode paths).
  • Command line keys manual has been updated in program /? and on official site.
  • Fixed a lot of small errors.
  • Fixed false positives.
  • Updated databases.

New in Check Browsers LNK 2.0.0.12 Beta (Oct 28, 2016)

  • [bug] Reconfigured module of emergency closing the program when launched via AutoLogger (timeout was mistakenly set to 15 seconds).
  • [Bug] Fixed error of 64 bitness paths interpretation of browser database.
  • Simplified rules for certain shortcuts created by user.
  • Database updated.

New in Check Browsers LNK 2.0.0.11 Beta (Oct 28, 2016)

  • Major changes:
  • Added section "default browser". Legitimate entries are marked with the prefix [OK]. The base is on filling stage.
  • Added support of shortcuts: .WEBSITE, .APPREF-MS (ClickOnce), .PIF, some specific malicious formats of LNK with HTTP/FTP on the target.
  • Added shortcuts disclosure .WEBSITE, .APPREF-MS (ClickOnce), .PIF, some malicious LNK to HTTP / FTP to the target.
  • Checking the legitimacy of the digital signature of unidentified browsers and suspicious objects from Start menu.
  • Increased average speed of searching. This rate will continue increase with each new update.
  • Many bug fixes including some critical errors that may hang the program.
  • Browser-based shortcuts are also considered any of shortcut names whose target lead to a browser (database match).
  • Secondary:
  • Added command line keys -sign, -timeout X, -debug, -nodebug, scanfolder "way" (details on FAQ on the main resource page)
  • From the section "The target is not exist" derived a separate section "Target on removable / network device".
  • Truncated reports should no longer exist (if launched via AutoLogger) - a program will automatically end when exceeding the timeout
  • (including the the time spent in the antivirus sandbox) and adds a report to the extended debug information.
  • The checksum of the report will always be = FFFFFFFF.
  • All file functions are translated into Unicode.
  • Removed dependency on library scrrun.dll
  • If the programm will crash, polymorphic version of the logs collector AutoLogger is able to create crash reports, which will greatly help in the analysis

New in Check Browsers LNK 1.1.0.47 Beta (Oct 28, 2016)

  • Fixed a problem with the recognition of launching from archive.
  • Added time spent in the sandbox antivirus program. It is a field "AV Sanbox" on the log. It only works when you run program inside the AutoLogger.
  • Added command line key -sign - checking legitimacy of browser's EXE digital signature (if their pathes are present on the shortcuts). Errors will be marked by prefix [sign].
  • Added command line key -debug - to display extended debug information on the log.
  • Update and cleaned database, removed false positives.
  • [bug] Part of the shortcuts wasn't checked on the basis of the white URL database and is not used heuristic analysis.
  • [bug] Shortcuts with 0 bytes do not always displayed on the log and displayed as "The target is unknown."
  • [Report] Subsection "Cloud storage" moved to the section "Other shortcuts".
  • [optimization] Added caching of EDS checks, PE EXE format checks and checking whether a file exists.
  • [Bug] Fixed a bug where an empty argument to profile path could lead to the verification of the whole disc.
  • [Report] Improved verification procedure of launching with elevated privileges. It will be specified in the "Elevated" field of log (thanks to Oleg Zaytsev).
  • [Report] Added information about a user's groups (Administrator, Power User, Limited User, or Guest).
  • [Report] Language system dialogue ... is now displayed completely and are not abbreviated.
  • Removed code with low-level functions, which sometimes led to hang program during anti-virus scan.
  • Created debug version of the program (now integrated into the regular one and can be controlled via keys -debug, -nodebug)
  • [bug] Fixed a bug in determining of object of some cloud storage shortcuts which could lead to a freeze of scanner.
  • When you launch program from archive it will ask you a permission to copy itself to the desktop and restart.
  • [Optimization] The speed of analysis is increased by replacing "Scripting.Dictionary / scrrun.dll" with a class of hash table by Anatoliy Krivous.

New in Check Browsers LNK 1.1.0.39 Beta (Oct 28, 2016)

  • [bug] Missed flag "Target is exists" for some system shortcuts which was expanding using Wow64 compensation (thanks for the help to Lawrence Abrams).
  • [bug] 64-bitness redirection was not correctly resumed. It could potentially cause the program crash.
  • [bug] Safe shortcuts of MS Installer was not displayed in the list of removed RO attributes.
  • [bug] File names which consists of characters outside the range of ASCII is defined correctly now (It affect on necessity to show alterative name on format 8.3).
  • [analysis] Added detection of undocumented switch used by Adware (for Internet Explorer).
  • [analysis] Added detection of damaging 'DropHandler' (mechanism Drag & Drop) for EXE-files. It display in the section "Errors".
  • [base] Added browser Comodo Chromodo, white lists was updated.
  • [report] OS Build is always displayed now.
  • [report] Section "Profiles" renamed into "Been verified" (verified directories).
  • [report] In the section "Been verified" added display of fact: whether it is a user profile folder and also alternative path in format 8.3 in case when the name consists of characters outside the range ASCII.
  • Added checking of policy of short file names creation '8.3' (it doesn't work as described in MSDN. Thanks for confirmation of bug to Liviu).
  • Functions of reading of registry, expanding of environment variables, getting size of file names, was replaced with unicode analogues.

New in Check Browsers LNK 1.1.0.38 Beta (Oct 28, 2016)

  • [Analysis] Added handling of URL-addresses with a backslashes.

New in Check Browsers LNK 1.1.0.37 Beta (Oct 28, 2016)

  • [Bug] Fixed a bug in the logic of shortcuts modifications analyzer (thanks to Sandor).

New in Check Browsers LNK 1.1.0.36 Beta (Oct 28, 2016)

  • [Interface] Added French localization (thanks to Fr33tux (fr33tux.org)).
  • [Interface] Added command line switches -Lang XX forced to switch the interface language, where XX - is the language of RU, EN or FR.
  • Alternatively, you can rename the file of the program "Check Browsers LNK_EN.exe", _RU or _FR.
  • [Analysis] Fixed a false positive on a modified shortcuts (the other case with Wow64).
  • [Bug] Fixed conflict between attribute "hidden / system" and the label "to treat" (>>>) when checking on the blacklist of shortcuts.
  • [Report] Removed labels "(system), (hidden attribute)" because of losing of meaning after adding [s] and [h] prefixes.