Re: Spyerase Update.

[Dustin Cook]

"pcbutts1" <pcbutts1@leythosthestalker.com> wrote in
newsd-dndsxtdv0uSXYnZ2dnUVZ_r6dnZ2d@giganews.com:

> I am an MVP, an MCSE and I have a lifetime access to MS TechNet. I can
> get anything I want from MS can you? But considering TSkill is free

Well, since we're being snobbish...

I'm A+/Network+, Soon will be Xerox/HP/Lexmark Certified (printers...
heh) (I don't care for MCSE, I pass the offer up every 6 months.. hehe).
I work for a Microsoft Certified Professional Center. A fancy word for
saying we're "certified" to fix your junk. We ehh, know microsoft
software. Oh Hum. I'm unable to verify your MVP status.

I have access to MS TechNet via work, thanks. As for anything I want from
MS, yes... I can, I can get anything I want that's available on the net,
if I so desired. Oh wait, we're talking "legal" right? *grin*

From a legal standpoint, I can go that route as well, of course.

> and MS could care less what I or anybody does with it makes that a
> mute point. You are so hell bent on proving me a thief you didn't even
> bother to check did you? I'm sure David Lipman and the rest of the
> gang is firing off emails to MS right now. WATCH when nothing happens.

I'm not hell bent on proving anything. Others have already proven you are
a thief, They don't need me to confirm it. I doubt anybody is firing off
emails to MS concerning your usage of the program. It's not a big deal to
them, I was simply asking if you had bothered to even try getting
permission. I suppose not?

> As far as Spyerase goes what you think I just make up those file names
> and locations. You know they are all valid (except the ones in the

I'm sure you don't make up the names and locations, because you wouldn't
know where they were without others doing it for you. Seriously. I do not
know they are all valid, no. I don't trust anything that relies on a
filename to determine if it's bad software.

> stolen Stuart version) I proved you wrong about 2000 and all you can
> ***** about is signature detections. Tell me something, when your
> "Signature detection" detects something what does it do? how does it
> know where the file is and what file to delete? Once it verifies that
> that file is bad it deletes it right? I use these detections to find

You proved me wrong? BugHunter doesn't automatically know where any
files are, It builds a small file that tells it all the
folders/directories available on your computer. BugHunter then takes a
look inside each one listed in the previously created file. Filename
isn't important, it's unique signature is. Files of interest are scanned,
some math is performed, some numbers generated and a comparison occurs.
If said numbers match what they should for the initial hit on the record
lookup, BugHunter looks up the record for text ID, and names the malware
should it find a name available, otherwise that routine reports back,
"Full Match!"

It's database based, Pcbutts, I could get more technical, but I don't
think you'd understand... heh.

I don't need to know filenames, the malware can change it's name and
location all it wants. If it retains the same signature, BugHunter still
gets it.

> the files then I add them to spyerases database. This is why Spyerase

You don't have a database... Ahh, I suspected a detailed explanation and
perhaps even some source code to Bughunter would be a waste on you..

> is only a lightweight removal 2 minute effective tool not an hours
> long pretty looking resource hog. Keep it simple. Keep it small.

Hours long pretty looking resource hog? Keep it simple and small you
says? k...

Directory of C:\test

01/23/2007 05:06 PM <DIR> .
01/23/2007 05:06 PM <DIR> ..
01/23/2007 01:58 AM 16,061 BUGHUNT.TXT
01/04/2007 01:07 AM 2,443 BUGHUNT.INI
01/13/2007 01:29 AM 9,722 BUGHUNT.EXE
01/13/2007 01:34 AM 18,961 CHANGES.TXT
01/23/2007 05:05 PM 3,799 BUGFAQ.TXT
01/23/2007 05:02 PM 969 NEWSIG.TXT
01/23/2007 01:56 AM 8,493 PARTLIST.TXT
01/22/2007 11:40 PM 48,764 BUGSIG.1
01/23/2007 04:56 PM 9,068 BUGSIG.2
01/22/2007 11:40 PM 12 BUGIDX.1
01/23/2007 04:56 PM 12 BUGIDX.2
01/23/2007 04:58 PM 20,502 BUGINFO.DAT
06/02/2006 05:35 PM 846 FIXSPY.REG
12/08/2003 08:31 PM 11,254 LOCATE.COM
12/08/2003 08:31 PM 47,191 LOCATE.TXT
07/16/2006 03:25 AM 482 FIXES.ZIP
07/22/2006 06:56 PM 1,003 NTFILES.ZIP
01/25/2007 12:03 AM 0 doh.txt
18 File(s) 199,582 bytes
2 Dir(s) 1,377,058,816 bytes free

Those are kilobytes, not megabytes. Unzipped bughunter is under
200kilobytes fully operational as is, No "installation" required.

Your script alone is huge by comparison, not even including your
supporting files written by other people.

As for keeping it simple... :
So how do I use it?

BugHunter has a simple and straight forward menu system which normally
requires only one keypress from you. The hot key is normally shown in
brackets [] with a description to the right of the key.

BugHunter supports 4 modes of operation. These are:

[A] - Scan Only
[B] - Scan and rename found files
[C] - Scan and remove (delete) found files
[D] - Scan and ask what to do with found files.
[Q] - Quit the program

Make your selection and BugHunter will display the directories that are
configured for scanning. Press Y (or y) and BugHunter will do what you
selected previously.

As BugHunter is scanning, it will let you know when it has found files
to take a closer look at and when it's looking for files deserving of a
closer look. This information stays in one place, and depending on your
system configuration can be very fast.

> Spyerase does a lot more then what you see it that bat file, which is
> why you were wrong about windows 2000. You don't know my program stop
> acting like you do.

Spyerase tries to do only the things listed in that bat file, nothing
more, nothing less. It has bugs and fails to do everything... I'm not
faulting you for that, as I know you didn't write the code.

> To duplicate the bug in Bughunter let it scan for
> about 5-10 minutes then cancel the scan by closing it using the X in
> the corner.

Okay, besides running a serious risk of file corruption, what should I
expect bughunter to do? You really shouldn't forcably terminate any
program that's actively accessing files. As you've done this? You might
want to run chkdsk /f and have it run on your next boot, as you could
have damaged a bughunt.log file.

Luckily for you, The engine was designed for stupid moves like this, and
the only file you run the risk of messing up is the log file. You'll also
cause a bughunt.dat file to be left in your root directory if you don't
let BugHunter terminate the way it's designed too. I hope you don't think
the fact it left a temp file behind when you killed it's process is a
"bug" on my part? LOL!





--
Dustin Cook
Author of BugHunter - MalWare Removal Tool - V2.1
web: http://bughunter.it-mate.co.uk
email: bughunter.dustin@gmail.com.removethis
Last updated: January 23rd, 2007

[Dustin Cook]

Leythos <void@nowhere.lan> wrote in
news:MPG.2021defd32ee554798986f@adfree.Usenet.com:

> In article <Xns98C2D6FB9AFF7HHI2948AJD832@69.28.186.121>,
> spamfilterineffect.see.sig@nowhere.com says...
>> Incidently, as Leythos already pointed out.
>
> Yea, and now he's posting as Tina Feygan in the MS groups, but the are
> on to him now.
>

I noticed this....


--
Dustin Cook
Author of BugHunter - MalWare Removal Tool - V2.1
web: http://bughunter.it-mate.co.uk
email: bughunter.dustin@gmail.com.removethis
Last updated: January 23rd, 2007

[pcbutts1]

If you cancel bughunter in mid scan it can cause two files, desktop.ini and
thumbs.db, to become visible in almost every folder on the computer. These
files by default are normally hidden so what ever hack method you are using
to scan or display them is corrupting them. When I looked at the files they
all still had the hidden attribute including the containing folder on some
yet the files are visible. I was able to duplicate this bug.


--

Newsgroup Trolls. Read about mine here http://www.pcbutts1.com/downloads
The list grows. Leythos the stalker http://www.leythosthestalker.com, David
H. Lipman, Max M Wachtell III aka What's in a Name?, Fitz,
Rhonda Lea Kirk, Meat Plow, F Kwatu F, George Orwell



"Dustin Cook" <spamfilterineffect.see.sig@nowhere.com> wrote in message
news:Xns98C322AA1DE3HHI2948AJD832@69.28.186.121...
> "pcbutts1" <pcbutts1@leythosthestalker.com> wrote in
> newsd-dndsxtdv0uSXYnZ2dnUVZ_r6dnZ2d@giganews.com:
>
>> I am an MVP, an MCSE and I have a lifetime access to MS TechNet. I can
>> get anything I want from MS can you? But considering TSkill is free
>
> Well, since we're being snobbish...
>
> I'm A+/Network+, Soon will be Xerox/HP/Lexmark Certified (printers...
> heh) (I don't care for MCSE, I pass the offer up every 6 months.. hehe).
> I work for a Microsoft Certified Professional Center. A fancy word for
> saying we're "certified" to fix your junk. We ehh, know microsoft
> software. Oh Hum. I'm unable to verify your MVP status.
>
> I have access to MS TechNet via work, thanks. As for anything I want from
> MS, yes... I can, I can get anything I want that's available on the net,
> if I so desired. Oh wait, we're talking "legal" right? *grin*
>
> From a legal standpoint, I can go that route as well, of course.
>
>> and MS could care less what I or anybody does with it makes that a
>> mute point. You are so hell bent on proving me a thief you didn't even
>> bother to check did you? I'm sure David Lipman and the rest of the
>> gang is firing off emails to MS right now. WATCH when nothing happens.
>
> I'm not hell bent on proving anything. Others have already proven you are
> a thief, They don't need me to confirm it. I doubt anybody is firing off
> emails to MS concerning your usage of the program. It's not a big deal to
> them, I was simply asking if you had bothered to even try getting
> permission. I suppose not?
>
>> As far as Spyerase goes what you think I just make up those file names
>> and locations. You know they are all valid (except the ones in the
>
> I'm sure you don't make up the names and locations, because you wouldn't
> know where they were without others doing it for you. Seriously. I do not
> know they are all valid, no. I don't trust anything that relies on a
> filename to determine if it's bad software.
>
>> stolen Stuart version) I proved you wrong about 2000 and all you can
>> ***** about is signature detections. Tell me something, when your
>> "Signature detection" detects something what does it do? how does it
>> know where the file is and what file to delete? Once it verifies that
>> that file is bad it deletes it right? I use these detections to find
>
> You proved me wrong? BugHunter doesn't automatically know where any
> files are, It builds a small file that tells it all the
> folders/directories available on your computer. BugHunter then takes a
> look inside each one listed in the previously created file. Filename
> isn't important, it's unique signature is. Files of interest are scanned,
> some math is performed, some numbers generated and a comparison occurs.
> If said numbers match what they should for the initial hit on the record
> lookup, BugHunter looks up the record for text ID, and names the malware
> should it find a name available, otherwise that routine reports back,
> "Full Match!"
>
> It's database based, Pcbutts, I could get more technical, but I don't
> think you'd understand... heh.
>
> I don't need to know filenames, the malware can change it's name and
> location all it wants. If it retains the same signature, BugHunter still
> gets it.
>
>> the files then I add them to spyerases database. This is why Spyerase
>
> You don't have a database... Ahh, I suspected a detailed explanation and
> perhaps even some source code to Bughunter would be a waste on you..
>
>> is only a lightweight removal 2 minute effective tool not an hours
>> long pretty looking resource hog. Keep it simple. Keep it small.
>
> Hours long pretty looking resource hog? Keep it simple and small you
> says? k...
>
> Directory of C:\test
>
> 01/23/2007 05:06 PM <DIR> .
> 01/23/2007 05:06 PM <DIR> ..
> 01/23/2007 01:58 AM 16,061 BUGHUNT.TXT
> 01/04/2007 01:07 AM 2,443 BUGHUNT.INI
> 01/13/2007 01:29 AM 9,722 BUGHUNT.EXE
> 01/13/2007 01:34 AM 18,961 CHANGES.TXT
> 01/23/2007 05:05 PM 3,799 BUGFAQ.TXT
> 01/23/2007 05:02 PM 969 NEWSIG.TXT
> 01/23/2007 01:56 AM 8,493 PARTLIST.TXT
> 01/22/2007 11:40 PM 48,764 BUGSIG.1
> 01/23/2007 04:56 PM 9,068 BUGSIG.2
> 01/22/2007 11:40 PM 12 BUGIDX.1
> 01/23/2007 04:56 PM 12 BUGIDX.2
> 01/23/2007 04:58 PM 20,502 BUGINFO.DAT
> 06/02/2006 05:35 PM 846 FIXSPY.REG
> 12/08/2003 08:31 PM 11,254 LOCATE.COM
> 12/08/2003 08:31 PM 47,191 LOCATE.TXT
> 07/16/2006 03:25 AM 482 FIXES.ZIP
> 07/22/2006 06:56 PM 1,003 NTFILES.ZIP
> 01/25/2007 12:03 AM 0 doh.txt
> 18 File(s) 199,582 bytes
> 2 Dir(s) 1,377,058,816 bytes free
>
> Those are kilobytes, not megabytes. Unzipped bughunter is under
> 200kilobytes fully operational as is, No "installation" required.
>
> Your script alone is huge by comparison, not even including your
> supporting files written by other people.
>
> As for keeping it simple... :
> So how do I use it?
>
> BugHunter has a simple and straight forward menu system which normally
> requires only one keypress from you. The hot key is normally shown in
> brackets [] with a description to the right of the key.
>
> BugHunter supports 4 modes of operation. These are:
>
> [A] - Scan Only
> [B] - Scan and rename found files
> [C] - Scan and remove (delete) found files
> [D] - Scan and ask what to do with found files.
> [Q] - Quit the program
>
> Make your selection and BugHunter will display the directories that are
> configured for scanning. Press Y (or y) and BugHunter will do what you
> selected previously.
>
> As BugHunter is scanning, it will let you know when it has found files
> to take a closer look at and when it's looking for files deserving of a
> closer look. This information stays in one place, and depending on your
> system configuration can be very fast.
>
>> Spyerase does a lot more then what you see it that bat file, which is
>> why you were wrong about windows 2000. You don't know my program stop
>> acting like you do.
>
> Spyerase tries to do only the things listed in that bat file, nothing
> more, nothing less. It has bugs and fails to do everything... I'm not
> faulting you for that, as I know you didn't write the code.
>
>> To duplicate the bug in Bughunter let it scan for
>> about 5-10 minutes then cancel the scan by closing it using the X in
>> the corner.
>
> Okay, besides running a serious risk of file corruption, what should I
> expect bughunter to do? You really shouldn't forcably terminate any
> program that's actively accessing files. As you've done this? You might
> want to run chkdsk /f and have it run on your next boot, as you could
> have damaged a bughunt.log file.
>
> Luckily for you, The engine was designed for stupid moves like this, and
> the only file you run the risk of messing up is the log file. You'll also
> cause a bughunt.dat file to be left in your root directory if you don't
> let BugHunter terminate the way it's designed too. I hope you don't think
> the fact it left a temp file behind when you killed it's process is a
> "bug" on my part? LOL!
>
>
>
>
>
> --
> Dustin Cook
> Author of BugHunter - MalWare Removal Tool - V2.1
> web: http://bughunter.it-mate.co.uk
> email: bughunter.dustin@gmail.com.removethis
> Last updated: January 23rd, 2007

[Dustin Cook]

"pcbutts1" <pcbutts1@leythosthestalker.com> wrote in
news:RsSdnXUmp_9NziTYnZ2dnUVZ_u6dnZ2d@giganews.com :

> If you cancel bughunter in mid scan it can cause two files,
> desktop.ini and thumbs.db, to become visible in almost every folder on
> the computer. These files by default are normally hidden so what ever
> hack method you are using to scan or display them is corrupting them.
> When I looked at the files they all still had the hidden attribute
> including the containing folder on some yet the files are visible. I
> was able to duplicate this bug.

BugHunter v2.1 Released January 13th, 2007
1. BugFix: BugHunter reset attributes on every file, and
didn't set them back. My apologies for any problems
this may have caused people. The most reported problem
was desktop.ini opening with notepad when you logged into
windows. From now on, the only time attributes are changed
is if BugHunter is attempting to delete the file.
2. Cosmetic Change: BugHunter doesn't display "Now Checking..."
followed by folder/directory names. Instead your greeted with
"Checking: "and the full path of the file in question.
3. Engine Update: BugHunter will now report when it has completed
Checking and has resumed Searching. Previously it would appear
to have locked up when it was searching the whole time.

As you can see, PCButts, this problem was already fixed on the 13th, and
it affected all files attributes. You lied when you claimed the files
retained them, none did. *heh*. Also, this bug was present regardless of
whether or not you prematurely terminated BugHunter.

The most common symptom reported was desktop.ini opening via notepad when
a user logged in. And, according to BUGFAQ.TXT:

Q: I have notepad opening desktop.ini when I start my computer, How do I
fix
this?
A: An easy way is to search for desktop.ini, and delete the ones found
under
documents and settings/usernames/start menu/programs/startup.
* This problem was corrected in v2.1, Please update your version
if this is happening to you.

All files pcbutts were affected by this Bug, BugHunter changed them for
scan (relic code from the previous scanning engine, the new engine thats
been in service since v1.9 doesn't require this step) and never changed
them back.

As for the hack to see the files... ehh, I'm using findfirst/findnext
function calls, hardly what anybody would call hacking.

Granted, you have found a bug, but I already knew about it, AND fixed it.
, You misdiagnosed it however.. hehe.



--
Dustin Cook
Author of BugHunter - MalWare Removal Tool - V2.1
web: http://bughunter.it-mate.co.uk
email: bughunter.dustin@gmail.com.removethis
Last updated: January 25th, 2007

[Chaz]

pcbutts1 wrote:

> And another thing you ****ing dumbass. I was going to wait for mr smarty
> pants Dustin to answer but I might as well say it now. Spyerase installs the
> TSKILL utility on Windows 2000 during the setup process which makes it fully
> functional on windows 2000. It will even install it on XP if the file is not
> already there. You want to test it yourself simply rename the tskill.exe to
> something else, it's in the system32 folder dumbass, then reinstall Spyerase
> and check the file again. Now all you ****ing dumbass trolls can kiss my ass
> and f--k off. I wrote spyerase see if the stolen roguefix will do that.

Oh yeah right... Fully functional ? NOPE !!

c:\>ver

Microsoft Windows 2000 [Version 5.00.2195]

c:\>tskill qttask.exe
This utility needs Terminal Services to be running.

DUMB4SS !