How BugHunter Works; for those interested.

[Dustin Cook]

"Russg" <russgilb@MUNGEsbcglobal.net> wrote in
news:6ctti.2192$ox5.1190@nlpi068.nbdc.sbc.com:

>
> "Dustin Cook" <> wrote in message news:
>> "Russg" <> wrote in > news:>
>> > I haven't dealt with a virus/trojan for a long time.
>> > My question is general. BugHunter and other AV programs identify
>> > malicious files, but don't get rid of them.
>>
>> BugHunter does, and I know others do as well. If they re-infect you,
>> that's not BugHunter's fault.
>> Please, Please read the documentation sir:
>>
>> http://bughunter.it-mate.co.uk/BUGHUNT.TXT
>>
>>
>>
>> > Question:
>> > After BugHunter finds a malware, what does it do to keep it from
>> > coming back, clear out the registry and startup stuff, un-read
>> > only, system the file, prevent system restore from re-inserting it?
>> > Or is it general procedure, once a malware is found, search for a
>> > specific removal tool?
>>
>> Damn... I'm really surprised nobody reads doc files at all?
>> anymore... Seriously... Okay then, To answer your question.
>>
>
> snip BugHunter documentation
>
>>
>> So how do I use it?
>>
>> BugHunter has a simple and straight forward menu system which
>> normally requires only one keypress from you. The hot key is
>> normally shown in brackets [] with a description to the right of the
>> key.
>>
>> BugHunter supports 4 modes of operation. These are:
>>
>> [A] - Scan Only
>> [B] - Scan and rename found files
>> [C] - Scan and remove (delete) found files
>> [D] - Scan and ask what to do with found files.
>> [Q] - Quit the program
>>
>> Make your selection and BugHunter will display the directories that
>> are configured for scanning. Press Y (or y) and BugHunter will do
>> what you selected previously.

> I have read that documentation before, and I can explain myself
> better. Viruses/Trojans/malware are not just simple files that can be
> identified, the permissions altered and deleted.

BugHunter does *not* scan for viruses, it's not designed to deal with
viruses, in any way. Worms are an exception.

> They are usually multiple files, in multiple directories, with entries
> into the registry and system startup and sometimes

Indeed, lots of malware installs into various folders. And BugHunter
scans all folders that it can, including various startup locations. Any
files that are known to BugHunter with your permission will be
disabled/removed.

> the Master Boot Record. I don't know exactly how they work, probably

I do not know of any spyware/adware trojans that are interested in your
boot record. If you have one that is, I'd like a sample.


> varies, but I see the BugHunter documentation
> mentioning removing found files, but not removing all the nefarious
> stuff that viruses install that allows them to be

BugHunter doesn't scan for viruses, and cannot offer you any kind of
protection against them.

> persistent and self replicating. I know only Klez from experience,

viruses do not require registry keys for self-replication, they are able
to do that on there own. Self replication is a requirement to fit the
definition of a virus.

> I've avoided porn sites, opening e-mail files,
> not allowing html, I don't disable Java, but keep it up to date. But
> back to Klez. It installed a program called
> winkxx.exe. That program caught calling out by Zone Alarm. Simple
> removing of winkxx didn't work. I had to run a removal program, this
> was with a WinME machine, so I guess system restore restored it.

Klez isn't something BugHunter is designed to handle. Klez has worm
properties, but it also has self replication routines. It is indeed,
viral. This is beyond the intended scope of BugHunter.

System restore is well known for restoring infected system files. A virus
removal program should have deleted those files from the restore folder.


> There are complexities to files, such as many executable file
> extensions, other than .com .exe .msi, etch.

BugHunter isn't fooled by extensions, it doesn't care what you name the
file or where you put the file. If the file is malware and BugHunter has
a signature for it, no hiding is going to save it. That includes whatever
attributes and name the file may have at the time.

> What I'm getting at, is I don't understand what malware does, but am
> aware it isn't just simple files that can
> be identified and removed. Just like the extensive procedures that

Actually, in most cases, it's really that easy. You kill the host
programs/processes, remove any trojanized windows system files, replace
with clean copies, clean up registry entries if you wish, but even that's
not always necessary. Depending on the malware in question, you may have
to run lspfix to fix a broken stack in the tcpip chain, BugHunter can't
help you with that, as it's something broken in the registry and a tool
dedicated for such things already exists. Same with the registry startup
keys, optional to remove. If the file(s) in question are dead, a runkey
for them isn't important. Windows won't run what it can't find.

Viruses are another breed entirely. Infected files must be disinfected if
at all possible and replaced if not possible.

It's important to use the right tools for the task your trying to
perform. BugHunter isn't suitable for dealing with viruses. If you have
browser hijacking trojans and things of that nature, it's good for it.

> I understand a clean boot, even with a universal boot cd (BartPE will
> trash a Win98/ME MBR in my experience)

> I can boot to command prompt and use a DOS AV like f-prot or BugHunter
> to identify offending programs,


You do understand that f-prot and BugHunter are two entirely different
programs right? and that they aren't really designed to scan for the same
items?

> but it isn't as simple as just removing a file/files.
> I'm repeating myself.

Actually, it can be.


--
Dustin Cook
Author of BugHunter - MalWare Removal Tool - v2.2c
email: bughunter.dustin@gmail.com.removethis
web..: http://bughunter.it-mate.co.uk
Pad..: http://bughunter.it-mate.co.uk/pad.xml

[pcbutts1]

"Dustin Cook" <spamfilterineffect.see.sig@nowhere.com> wrote in message
news:Xns9983B2AE42C73HHI2948AJD832@69.28.186.121.. .
> BugHunter does not edit the registry of the system in any way, it
> simply identifies and optionally removes found files. As BugHunter
> relies on dat file technology similar to that of a virus scanner,
> updates to the datafile and the program itself will be released from
> time to time on the Website.
>
> For NTFS based operating systems, BugHunter can be run from a BartPE
> cdrom. BugHunter will run under NTFSDOS, but odd results have been
> reported using it. For example, the date/time stamp of the log file
> will be wrong. Scanning does not seem to be affected.

That makes it a crappy program. How can you completely remove malware
without modifying the registry keys they generate? The registry keys are
what causes re-infection on reboot. my program Remove-it does modify the
registry it completely removes all targeted malware/Spyware and every known
variant and it has no problems with NTFS.



--

Newsgroup Trolls. Read about mine here http://www.pcbutts1.com/downloads
The list grows. Leythos the stalker http://www.leythosthestalker.com, David
H. Lipman, Max M Wachtell III aka What's in a Name?, Fitz,
Rhonda Lea Kirk, Meat Plow, F Kwatu F, George Orwell



"Dustin Cook" <spamfilterineffect.see.sig@nowhere.com> wrote in message
news:Xns9983B2AE42C73HHI2948AJD832@69.28.186.121.. .
> "Russg" <russgilb@MUNGEsbcglobal.net> wrote in
> news:94qti.3614$Yz6.2428@newssvr22.news.prodigy.ne t:
>
>> I haven't dealt with a virus/trojan for a long time.
>> My question is general. BugHunter and other AV programs identify
>> malicious files, but don't get rid of them.
>

[kurt wismer]

pcbutts1 wrote:
> "Dustin Cook" <spamfilterineffect.see.sig@nowhere.com> wrote in message
> news:Xns9983B2AE42C73HHI2948AJD832@69.28.186.121.. .
>> BugHunter does not edit the registry of the system in any way, it
>> simply identifies and optionally removes found files. As BugHunter
>> relies on dat file technology similar to that of a virus scanner,
>> updates to the datafile and the program itself will be released from
>> time to time on the Website.
>>
>> For NTFS based operating systems, BugHunter can be run from a BartPE
>> cdrom. BugHunter will run under NTFSDOS, but odd results have been
>> reported using it. For example, the date/time stamp of the log file
>> will be wrong. Scanning does not seem to be affected.
>
> That makes it a crappy program.

i suppose that means you have no intention of ripping it off and passing
it off as your own then... i'm sure dustin will be happy to hear that...

> How can you completely remove malware
> without modifying the registry keys they generate?

the registry keys are references to programs already on the disk - if
you remove the programs the keys reference then those keys are
effectively neutered...

> The registry keys are
> what causes re-infection on reboot.

no, failing to remove all the bad programs is what causes re-infection
on reboot...

--
"it's not the right time to be sober
now the idiots have taken over
spreading like a social cancer,
is there an answer?"

[Kerry Brown]

"pcbutts1" <pcbutts1@leythosthestalker.com> wrote in message
news:f963ph$si$1@blackhelicopter.databasix.com...
> "Dustin Cook" <spamfilterineffect.see.sig@nowhere.com> wrote in message
> news:Xns9983B2AE42C73HHI2948AJD832@69.28.186.121.. .
>> BugHunter does not edit the registry of the system in any way, it
>> simply identifies and optionally removes found files. As BugHunter
>> relies on dat file technology similar to that of a virus scanner,
>> updates to the datafile and the program itself will be released from
>> time to time on the Website.
>>
>> For NTFS based operating systems, BugHunter can be run from a BartPE
>> cdrom. BugHunter will run under NTFSDOS, but odd results have been
>> reported using it. For example, the date/time stamp of the log file
>> will be wrong. Scanning does not seem to be affected.
>
> That makes it a crappy program. How can you completely remove malware
> without modifying the registry keys they generate? The registry keys are
> what causes re-infection on reboot. my program Remove-it does modify the
> registry it completely removes all targeted malware/Spyware and every
> known variant and it has no problems with NTFS.


How can a registry key cause a re-infection if the files it refers to don't
exist? It is impossible for a registry key by itself to cause an infection.
I guess technically it's possible for a registry key to cause a legitimate
program to execute with a parameter that caused a stack overflow or
something but have you ever seen this? If a re-infection happens on a reboot
there are still some malware files on the computer.

Your program can run from a WinPE environment, load the registry from the OS
on the hard drive, including all the user portions, and remove every trace
of malware? How come we're not all using it? I'd actually pay money for a
program that could do that. I have to do it manually now.

Removing malware registry keys is a nice feature but not required to get rid
of malware.

--
Kerry Brown

[Dustin Cook]

"pcbutts1" <pcbutts1@leythosthestalker.com> wrote in
news:f963ph$si$1@blackhelicopter.databasix.com:

> "Dustin Cook" <spamfilterineffect.see.sig@nowhere.com> wrote in
> message news:Xns9983B2AE42C73HHI2948AJD832@69.28.186.121.. .
>> BugHunter does not edit the registry of the system in any way, it
>> simply identifies and optionally removes found files. As BugHunter
>> relies on dat file technology similar to that of a virus scanner,
>> updates to the datafile and the program itself will be released from
>> time to time on the Website.
>>
>> For NTFS based operating systems, BugHunter can be run from a BartPE
>> cdrom. BugHunter will run under NTFSDOS, but odd results have been
>> reported using it. For example, the date/time stamp of the log file
>> will be wrong. Scanning does not seem to be affected.
>
> That makes it a crappy program. How can you completely remove malware
> without modifying the registry keys they generate? The registry keys
> are what causes re-infection on reboot. my program Remove-it does

Re-infection can't occur if the files mentioned in the registry are no
longer present. If your talking about registry keys which control your
homepage, that's still, not actually a file present on your computer; and
it's outside the scope of BugHunter. Files on the other hand are
targetted and removed, this includes the assistance files some malware
downloads. For BugHunter's intended use sir, it's by no means crappy.

> modify the registry it completely removes all targeted malware/Spyware
> and every known variant and it has no problems with NTFS.

BugHunter has no issues with NTFS either. Your remove it is a pirated
batch file, BugHunter is a bit more complicated.


--
Dustin Cook
Author of BugHunter - MalWare Removal Tool - v2.2c
email: bughunter.dustin@gmail.com.removethis
web..: http://bughunter.it-mate.co.uk
Pad..: http://bughunter.it-mate.co.uk/pad.xml

[Dustin Cook]

"Kerry Brown" <kerry@kdbNOSPAMsys-tems.c*a*m> wrote in
news:BRxti.34003$rX4.27744@pd7urf2no:

> "pcbutts1" <pcbutts1@leythosthestalker.com> wrote in message
> news:f963ph$si$1@blackhelicopter.databasix.com...
>> "Dustin Cook" <spamfilterineffect.see.sig@nowhere.com> wrote in
>> message news:Xns9983B2AE42C73HHI2948AJD832@69.28.186.121.. .
>>> BugHunter does not edit the registry of the system in any way, it
>>> simply identifies and optionally removes found files. As BugHunter
>>> relies on dat file technology similar to that of a virus scanner,
>>> updates to the datafile and the program itself will be released from
>>> time to time on the Website.
>>>
>>> For NTFS based operating systems, BugHunter can be run from a BartPE
>>> cdrom. BugHunter will run under NTFSDOS, but odd results have been
>>> reported using it. For example, the date/time stamp of the log file
>>> will be wrong. Scanning does not seem to be affected.
>>
>> That makes it a crappy program. How can you completely remove malware
>> without modifying the registry keys they generate? The registry keys
>> are what causes re-infection on reboot. my program Remove-it does
>> modify the registry it completely removes all targeted
>> malware/Spyware and every known variant and it has no problems with
>> NTFS.
>
>
> How can a registry key cause a re-infection if the files it refers to
> don't exist? It is impossible for a registry key by itself to cause an
> infection. I guess technically it's possible for a registry key to
> cause a legitimate program to execute with a parameter that caused a
> stack overflow or something but have you ever seen this? If a
> re-infection happens on a reboot there are still some malware files on
> the computer.

It's the little things people don't seem to notice, eh Kerry?
maybe I'm just not clear enough on what BugHunter is for... I just don't
know.

> Your program can run from a WinPE environment, load the registry from
> the OS on the hard drive, including all the user portions, and remove
> every trace of malware? How come we're not all using it? I'd actually
> pay money for a program that could do that. I have to do it manually
> now.

No, his program is a stolen batch file that he doesn't even author. See
here: http://www.viruslist.com/en/weblog?weblogid=197597102

It's incapable of many of the things he claims it'll fix. It relies on
filenames and locations, not file content. If you have a good file in
what it considers to be the wrong place with a name it knows, it'll
delete it, no backups, no options for not doing it.


> Removing malware registry keys is a nice feature but not required to
> get rid of malware.

No, it's not. In fact, it's a nice way to artificially inflate the
numbers of malware you scan for, if you count registry keys.




--
Dustin Cook
Author of BugHunter - MalWare Removal Tool - v2.2c
email: bughunter.dustin@gmail.com.removethis
web..: http://bughunter.it-mate.co.uk
Pad..: http://bughunter.it-mate.co.uk/pad.xml

[Leythos]

In article <BRxti.34003$rX4.27744@pd7urf2no>, kerry@kdbNOSPAMsys-
tems.c*a*m says...
> Removing malware registry keys is a nice feature but not required to get rid
> of malware.

Don't confuse Butts, he only knows what he can cut/paste.

--
Leythos - spam999free@rrohio.com (remove 999 to email me)

Learn more about PCBUTTS1 and his antics and ethic and his perversion
with Porn and Filth. Just take a look at some of the FILTH he's created
and put on his website: http://www.webservertalk.com/message1907860.html
3rd link shows what he's exposed to children (the link I've include does
not directly display his filth). You can find the same information by
googling for 'PCBUTTS1' and 'exposed to kids'.

[Dustin Cook]

kurt wismer <kurtw@sympatico.ca> wrote in news:f97g09$8m5$5@aioe.org:

> pcbutts1 wrote:
>> "Dustin Cook" <spamfilterineffect.see.sig@nowhere.com> wrote in
>> message news:Xns9983B2AE42C73HHI2948AJD832@69.28.186.121.. .
>>> BugHunter does not edit the registry of the system in any way, it
>>> simply identifies and optionally removes found files. As BugHunter
>>> relies on dat file technology similar to that of a virus scanner,
>>> updates to the datafile and the program itself will be released from
>>> time to time on the Website.
>>>
>>> For NTFS based operating systems, BugHunter can be run from a BartPE
>>> cdrom. BugHunter will run under NTFSDOS, but odd results have been
>>> reported using it. For example, the date/time stamp of the log file
>>> will be wrong. Scanning does not seem to be affected.
>>
>> That makes it a crappy program.
>
> i suppose that means you have no intention of ripping it off and
> passing it off as your own then... i'm sure dustin will be happy to
> hear that...

BugHunter isn't a batch file, it's an actual executable. Beyond PcButts
ability to plagurize. Well, let me put it this way. He wouldn't be able
to do anything to BugHunter on his own.

>> How can you completely remove malware
>> without modifying the registry keys they generate?
>
> the registry keys are references to programs already on the disk - if
> you remove the programs the keys reference then those keys are
> effectively neutered...

Indeed. No file, nothing happens.

>> The registry keys are
>> what causes re-infection on reboot.
>
> no, failing to remove all the bad programs is what causes re-infection
> on reboot...

It's a bit scary to see how many people think the registry keys play
more of a role then they actually do.

False advertising claims made by other products? Who knows...




--
Dustin Cook
Author of BugHunter - MalWare Removal Tool - v2.2c
email: bughunter.dustin@gmail.com.removethis
web..: http://bughunter.it-mate.co.uk
Pad..: http://bughunter.it-mate.co.uk/pad.xml

[Dustin Cook]

kurt wismer <kurtw@sympatico.ca> wrote in news:f97g06$8m5$3@aioe.org:

> Andy Walker wrote:
>> Dustin Cook wrote:
>>
>>> BugHunter is not the only program which can be defeated using the
>>> tricks Andy specified.
>>
>> And there are many programs that aren't as easy to defeat. I don't
>> need a lesson from any of you on how to defeat anti-malware programs.
>
> you seem to have an agenda here... the weakness you pointed out is
> shared by most anti-malware programs... only behaviour-based detectors
> would be resistant to it...

His agenda was targetting me. It had nothing to do with BugHunter. If
you'll continue reading the thread, he's already re-killfiled me for
answering his questions, "arrogance" style I guess.

>> I was just asking the question because you seemed to want to discuss
>> your programs capabilities, which are not all that impressive.
>
> compared to those that have tens or hundreds of thousands of man-hours
> worth of development in them, i suppose not...

Which capabilities is it either of you seem to think BugHunter is
missing? aside from resident protection... It scans, it can rename, it
can delete, it can be told to do nothing but scan. What feature(s) am I
not including that everyone else is then?

>> That
>> said, I'm sure some people can use your program to help them clean
>> their system. I just don't see a commercial use for it in its
>> present state of development.
>
> then it's a good thing it's free...

Commercial interest has never been what drives me. And as far as someones
opinion of commercial quality; I personally wouldn't have thought
hijackthis or cwssearch were commercial quality but guess what? They're
both commercial now.




--
Dustin Cook
Author of BugHunter - MalWare Removal Tool - v2.2c
email: bughunter.dustin@gmail.com.removethis
web..: http://bughunter.it-mate.co.uk
Pad..: http://bughunter.it-mate.co.uk/pad.xml

[Kerry Brown]

"Dustin Cook" <spamfilterineffect.see.sig@nowhere.com> wrote in message
news:Xns998452D06FD0FHHI2948AJD832@69.28.186.121.. .
> "Kerry Brown" <kerry@kdbNOSPAMsys-tems.c*a*m> wrote in

>
> It's incapable of many of the things he claims it'll fix. It relies on
> filenames and locations, not file content. If you have a good file in
> what it considers to be the wrong place with a name it knows, it'll
> delete it, no backups, no options for not doing it.
>

I'm well aware of how his program works, where it comes from, and the
history of pcbutts1. I was being sarcastic. I don't post to this newsgroup
very often but I couldn't resist poking him with a sharp stick for a bit of
fun.

Good point about the home page in the registry. I'd forgotten about that
possible means of attack. I'm used to manually cleaning malware. Fixing the
home page then updating Windows and programs that might be exploited is
always part of the process to make sure that a drive by attack is not likely
to re-occur. It's so second nature that I had forgotten about it :-)

--
Kerry Brown