How BugHunter Works; for those interested.

Dustin Cook wrote:
> 4Q <paul_zest.RemoveThis@hushmail.com> wrote in
> news:1186178765.339064.121310@19g2000hsx.googlegroups.com:
>
> > Dustbin Cook wrote:
> >> BugHunter uses a proprietary checksum algorithm that I developed over
> >> 14 years ago.

<snip>

>
> Come back with substance, lamer.
>

Okay, how about this.

> Oh, and you might as well update your page, unless you like being punched
> repeatedly in the nose, not to mention how stupid you now appear to be,
> what with your claims of string scanning.. HAHAHA. I told you originally
> it's not a string scanner. The algorithm is clearly more advanced than
> your capable of understanding. Haha.
>

You stated I had no understanding of
how checksummers worked a while back,
along with this assumption you also
assummed I didn't know anything about
code (I think Assembly language might
have been mention a few times too).

So I published Assembly code I authored
with a system that used a checksummer
algorithm. The code I wrote was developed
from first principles understanding of
how the "algorithm" works. Does that
have enough substance for you?

I can give you a reference to a very
good book if you like, this book
is quiet old (1987) but it clearly
explains how industry standard algorithms
are translated into working code.
Lookup chapter 19 "CRC Calculations"
it explains the maths and principles
behind a 'proven' checksumming system.

"C Programmer's Guide to Serial Communications"
by Joe Campbell, published by
Howard W Sams & Company

Also, here is a book that can still be
got hold of, even a numpty like you
can hand over cash and get it. So rather
than trying to reinvent the wheel here
is a computer science / mathematics
cookbook full of "algorithms"

"Numerical Recipes in C: The Art of
Scientific Computing"
by William H. Press et al,
published by Cambridge University Press


See if you can get one of your groundhog
friends to put on a Harry Potter wizards
outfit and teach you how to look for
the mystical proven "algorithms", it's
not magic!, just good old solid CS ;]]

4Q
 >> Stay informed about: How BugHunter Works; for those interested. 

Dustbin Cook wrote:
> 4Q <paul_zest.DeleteThis@hushmail.com> wrote in
> news:1186178765.339064.121310@19g2000hsx.googlegroups.com:
>
> > Dustbin Cook wrote:
> >> BugHunter uses a proprietary checksum algorithm that I developed over
> >> 14 years ago.

<snip>


> Come back with substance, lamer.
>

Okay, how about this.

> Oh, and you might as well update your page, unless you like being punched
> repeatedly in the nose, not to mention how stupid you now appear to be,
> what with your claims of string scanning.. HAHAHA. I told you originally
> it's not a string scanner. The algorithm is clearly more advanced than
> your capable of understanding. Haha.
>

You stated I had no understanding of
how checksummers worked a while back,
along with this assumption you also
assummed I didn't know anything about
code (I think Assembly language might
have been mention a few times too).

So I published Assembly code I authored
with a system that used a checksummer
algorithm. The code I wrote was developed
from first principles understanding of
how the "algorithm" works. Does that
have enough substance for you?

I can give you a reference to a very
good book if you like, this book
is quite old (1987) but it clearly
explains how industry standard algorithms
are translated into working code.
Lookup chapter 19 "CRC Calculations"
it explains the maths and principles
behind a 'proven' checksumming system.

"C Programmer's Guide to Serial Communications"
by Joe Campbell, published by
Howard W Sams & Company

Also, here is a book that can still be
got hold of, even a numpty like you
can hand over cash and get it. So rather
than trying to reinvent the wheel here
is a computer science / mathematics
cookbook full of "algorithms"

"Numerical Recipes in C: The Art of
Scientific Computing"
by William H. Press et al,
published by Cambridge University Press


See if you can get one of your groundhog
friends to put on a Harry Potter wizards
outfit and teach you how to look for
the mystical proven "algorithms", it's
not magic!, just good old solid CS ;]]

4Q
 >> Stay informed about: How BugHunter Works; for those interested. 

Dustin Cook wrote:
> BugHunter uses a proprietary checksum algorithm that I developed over 14
> years ago. In an effort to reduce scantime, BugHunter scans files ONLY
> if they have a known filelength; IE: Known to BugHunter as potentially
> being malicious. Once BugHunter takes a scan of the suspect file, it
> gets two 32bit numbers in a specific order. If the numbers match the
> record as well as the filelength in the correct order, BugHunter
> considers it a valid match and looks the information up to give it a
> more descriptive name, of course that depends on the record having a
> matching description in one of the buginfo files.
>
>
> I hope this will help with any questions you may have about what
> BugHunter is, and what it is not. If you have any questions, I will
> monitor this thread; you may respond here or in email.
>
> Thanks for reading!

Thanks Dustin. Great little program..


--
Lew/+Silat
 >> Stay informed about: How BugHunter Works; for those interested. 

Jack <gone RemoveThis @gonegone.com> wrote in
news:mn.1ba47d783ac2b8e0.70004@gonegone.com:

>
> thanks Dustin
> I just LOVE that prog, as do many others.

Your welcome, and thanks for your support. If you'd like to be placed on
the mailing list so that you recieve an email when updates are available
feel free to contact me. I do not keep uptodate posts here all the time. I
do it as a convenience to people, but I don't make much effort to keep
usenet informed. Hence the mailing list.


--
Dustin Cook
Author of BugHunter - MalWare Removal Tool - v2.2c
email: bughunter.dustin RemoveThis @gmail.com.removethis
web..: http://bughunter.it-mate.co.uk
Pad..: http://bughunter.it-mate.co.uk/pad.xml
 >> Stay informed about: How BugHunter Works; for those interested. 

"Dustin Cook" <> wrote in message news:
> BugHunter uses a proprietary checksum algorithm that I developed over 14
> years ago. In an effort to reduce scantime, BugHunter scans files ONLY
> if they have a known filelength; IE: Known to BugHunter as potentially
> being malicious. Once BugHunter takes a scan of the suspect file, it
> gets two 32bit numbers in a specific order. If the numbers match the
> record as well as the filelength in the correct order, BugHunter
> considers it a valid match and looks the information up to give it a
> more descriptive name, of course that depends on the record having a
> matching description in one of the buginfo files.
>
>
> I hope this will help with any questions you may have about what
> BugHunter is, and what it is not. If you have any questions, I will
> monitor this thread; you may respond here or in email.
>
> Thanks for reading!
>
Question comes to mind. Where do you get samples to get your ID CRC and
length? Someone at one of the AV vendors?
 >> Stay informed about: How BugHunter Works; for those interested. 

"Russg" <russgilb.TakeThisOut@MUNGEsbcglobal.net> wrote in
news:%DRsi.12542$eY.8974@newssvr13.news.prodigy.net:

>
> "Dustin Cook" <> wrote in message news:
>> BugHunter uses a proprietary checksum algorithm that I developed over
>> 14 years ago. In an effort to reduce scantime, BugHunter scans files
>> ONLY if they have a known filelength; IE: Known to BugHunter as
>> potentially being malicious. Once BugHunter takes a scan of the
>> suspect file, it gets two 32bit numbers in a specific order. If the
>> numbers match the record as well as the filelength in the correct
>> order, BugHunter considers it a valid match and looks the information
>> up to give it a more descriptive name, of course that depends on the
>> record having a matching description in one of the buginfo files.
>>
>>
>> I hope this will help with any questions you may have about what
>> BugHunter is, and what it is not. If you have any questions, I will
>> monitor this thread; you may respond here or in email.
>>
>> Thanks for reading!
>>
> Question comes to mind. Where do you get samples to get your ID CRC
> and length? Someone at one of the AV vendors?
>
>
>

Sorry russ old buddy, but you didn't know the difference between a
gopher and a groundhog; you do I'm sure, you were just being a wiseass
about it. Since your trolling then and now, I'm not going to tell you how
the samples arrive, except to say that I can acquire them just as easily
as anybody else; Surf to unsafe sites and allow programs to "install" in
a virtual environment. Various others arrive via different means, but
alas, it's no real big secret. I have access to the same material that I
always have. It's one of those ex-vxer benefits, you might say.

Now, if you have any real questions about the program, I'd be happy to
answer them.


--
Dustin Cook
Author of BugHunter - MalWare Removal Tool - v2.2c
email: bughunter.dustin.TakeThisOut@gmail.com.removethis
web..: http://bughunter.it-mate.co.uk
Pad..: http://bughunter.it-mate.co.uk/pad.xml
 >> Stay informed about: How BugHunter Works; for those interested. 

I googled gopher and ground hog.
It isn't real clear, ground hog is bigger, gopher is smaller.
There are ~100 types of gophers in N. Amer.
Some are called marmots, but some groundhogs are also called marmots. Then
there's woodchucks (ground hogs) and whistlepigs (also ground hogs).
Wikipedia says groundhogs are large squirels, which doesn't make much sense.
This isn't the place for rodent identification, but, no, I didn't know the
difference between gophers and groundhogs.
Both are under ground living pests in people's yards.
I do know a prairy dog when I see one.
 >> Stay informed about: How BugHunter Works; for those interested. 

Russg wrote:

>I didn't know the
>difference between gophers and groundhogs.
>Both are under ground living pests in people's yards.

Not really. A groundhog spends most of its time above ground
foraging. Gophers live mostly underground, but do come up for a bit
of fresh air from time to time.
 >> Stay informed about: How BugHunter Works; for those interested. 

Dustin Cook wrote:
> 4Q <paul_zest.TakeThisOut@hushmail.com> wrote in
> news:1186210186.934565.261110@q75g2000hsh.googlegroups.com:
>
> > Dustin Cook wrote:
> >> 4Q <paul_zest.TakeThisOut@hushmail.com> wrote in
> >> news:1186178765.339064.121310@19g2000hsx.googlegroups.com:
> >>
> >> > Dustbin Cook wrote:
> >> >> BugHunter uses a proprietary checksum algorithm that I developed
> >> >> over 14 years ago.
> >
> > <snip>
>
>
> >>
> >> Come back with substance, lamer.
> >>
> >
> > Okay, how about this.
>
> Hahahaha. Okay then.
>
> >> Oh, and you might as well update your page, unless you like being
> >> punched repeatedly in the nose, not to mention how stupid you now
> >> appear to be, what with your claims of string scanning.. HAHAHA. I
> >> told you originally it's not a string scanner. The algorithm is
> >> clearly more advanced than your capable of understanding. Haha.
> >>
> >
> > You stated I had no understanding of
> > how checksummers worked a while back,
> > along with this assumption you also
>
> Are you having trouble comprehending what's written or something? Your
> getting very sloppy in your attempts to skate around my righteous
> assaults. *grin*. I said you claimed BugHunter is a string scanner and
> later you said it was a checksummer or a string scanner, basically you
> didn't know. I've been able to prove that with your own doing, dummy.
>
> I said substance dummy, bring it!
>
>
> > is a computer science / mathematics
> > cookbook full of "algorithms"
>
> Out of curiosity, what concern is it really of yours how it works
> specifically? I don't see symantec or anyone else providing such
> information to anonymous persons. Why do you think I should treat you any
> differently? What makes you think your entitled or special in some
> fashion?
>
> > See if you can get one of your groundhog
> > friends to put on a Harry Potter wizards
>
> *awe*. I 0wned you when I explained the lighting situation and my amusing
> nickname for this area. Give it up, I got you with your own medicine.
> Laugh as I laugh.
>
> Once again, your efforts to troll and derail this thread aren't going so
> well. You wanted to know how it worked, you didn't have the mental
> capacity to figure it out, obviously. So I've told you in a general
> fashion what's going on. I've provided you more information in fact than
> anyone else who writes software like this would. I really don't
> understand why you think your entitled to access to it's source code, or
> specific knowledge of how it works? The general description should be
> adequate. It's more detailed than symantec would offer an anonymous
> person such as yourself.
>

You forgot to include AUK. I thought
the content of your kookie post would
be of interested for future reference
so I've kindly reposted it for you.


4Q
 >> Stay informed about: How BugHunter Works; for those interested. 

Andy Walker <awalker RemoveThis @nspank.invalid> wrote in news:46b3eafd.12865171
@news.webtv.com:

> Dustin Cook wrote:
>
>> If you have any questions, I will
>>monitor this thread; you may respond here or in email.
>
> Ok, say I'm a malware writer and want to evade your program. It seems
> to me that all I have to do is pad a few kilobytes of garbage into my
> program and randomly modify the size every now an then. I could evade
> your program for a very long time under that scenario. Is that
> correct?
>

That's correct. That's exactly why we can't detect them all. Thousands upon
thousands of similiar varients, all written in HLL languages, so you have
to be very careful in IDing them.

It's not a flaw alone to BugHunter per say, thats the same tricks used to
evade virus scanners too.


--
Dustin Cook
Author of BugHunter - MalWare Removal Tool - v2.2c
email: bughunter.dustin RemoveThis @gmail.com.removethis
web..: http://bughunter.it-mate.co.uk
Pad..: http://bughunter.it-mate.co.uk/pad.xml
 >> Stay informed about: How BugHunter Works; for those interested. 

Dustin Cook wrote:

>Andy Walker <awalker RemoveThis @nspank.invalid> wrote in news:46b3eafd.12865171
>@news.webtv.com:
>
>> Dustin Cook wrote:
>>
>>> If you have any questions, I will
>>>monitor this thread; you may respond here or in email.
>>
>> Ok, say I'm a malware writer and want to evade your program. It seems
>> to me that all I have to do is pad a few kilobytes of garbage into my
>> program and randomly modify the size every now an then. I could evade
>> your program for a very long time under that scenario. Is that
>> correct?
>>
>
>That's correct. That's exactly why we can't detect them all. Thousands upon
>thousands of similiar varients, all written in HLL languages, so you have
>to be very careful in IDing them.
>
>It's not a flaw alone to BugHunter per say, thats the same tricks used to
>evade virus scanners too.

I understand what your saying, but some scanners take into account
other metrics like the existence of certain registry keys, or even the
structure of supporting files used as databases for the malware. A
complete deconstruction of the offending malware *could* produce
enough information to snare all its variants. Heh! but then who's got
the time...
 >> Stay informed about: How BugHunter Works; for those interested. 

Andy Walker <awalker.RemoveThis@nspank.invalid> wrote in
news:46b6205d.9107531@news.webtv.com:

> Dustin Cook wrote:
>
>>Andy Walker <awalker.RemoveThis@nspank.invalid> wrote in news:46b3eafd.12865171
>>@news.webtv.com:
>>
>>> Dustin Cook wrote:
>>>
>>>> If you have any questions, I will
>>>>monitor this thread; you may respond here or in email.
>>>
>>> Ok, say I'm a malware writer and want to evade your program. It
>>> seems to me that all I have to do is pad a few kilobytes of garbage
>>> into my program and randomly modify the size every now an then. I
>>> could evade your program for a very long time under that scenario.
>>> Is that correct?
>>>
>>
>>That's correct. That's exactly why we can't detect them all. Thousands
>>upon thousands of similiar varients, all written in HLL languages, so
>>you have to be very careful in IDing them.
>>
>>It's not a flaw alone to BugHunter per say, thats the same tricks used
>>to evade virus scanners too.
>
> I understand what your saying, but some scanners take into account
> other metrics like the existence of certain registry keys, or even the
> structure of supporting files used as databases for the malware. A
> complete deconstruction of the offending malware *could* produce
> enough information to snare all its variants. Heh! but then who's got
> the time...
>

Alas.. another person who doesn't read the included documentation.. So
here goes:

http://bughunter.it-mate.co.uk/BUGFAQ.TXT

"Q: Why does BugHunter detect so few compared to others?
A: BugHunter *only* detects executables, and various vb, htm files.
it doesn't detect registry keys, subkeys, cookies or urls stored
in your favorites folder. As such, the amount of items BugHunter does
detect is very small in comparison."



--
Dustin Cook
Author of BugHunter - MalWare Removal Tool - v2.2c
email: bughunter.dustin.RemoveThis@gmail.com.removethis
web..: http://bughunter.it-mate.co.uk
Pad..: http://bughunter.it-mate.co.uk/pad.xml
 >> Stay informed about: How BugHunter Works; for those interested. 

"Lew/+Silat" <Drafted1970number54SPAM.RemoveThis@Invalid.com> wrote in
news:38ednSW5j8VFrinbnZ2dnUVZ_hGdnZ2d@comcast.com:

> Dustin Cook wrote:
>> BugHunter uses a proprietary checksum algorithm that I developed over
>> 14 years ago. In an effort to reduce scantime, BugHunter scans files
>> ONLY if they have a known filelength; IE: Known to BugHunter as
>> potentially being malicious. Once BugHunter takes a scan of the
>> suspect file, it gets two 32bit numbers in a specific order. If the
>> numbers match the record as well as the filelength in the correct
>> order, BugHunter considers it a valid match and looks the information
>> up to give it a more descriptive name, of course that depends on the
>> record having a matching description in one of the buginfo files.
>>
>>
>> I hope this will help with any questions you may have about what
>> BugHunter is, and what it is not. If you have any questions, I will
>> monitor this thread; you may respond here or in email.
>>
>> Thanks for reading!
>
> Thanks Dustin. Great little program..
>
>

Thank You. A rather large update will be on the site withen 20 minutes
from the time this post goes live.


--
Dustin Cook
Author of BugHunter - MalWare Removal Tool - v2.2c
email: bughunter.dustin.RemoveThis@gmail.com.removethis
web..: http://bughunter.it-mate.co.uk
Pad..: http://bughunter.it-mate.co.uk/pad.xml
 >> Stay informed about: How BugHunter Works; for those interested.