How BugHunter Works; for those interested.

"pcbutts1" <pcbutts1 DeleteThis @leythosthestalker.com> wrote in
news:f98qdm$fac$1@blackhelicopter.databasix.com:

> If a file called xxx.exe is sitting in the root of C how is that file
> going to execute without the user selecting it? I call them feeder
> files, it could be a perfectly safe file but when executed will create
> it's own bad stuff. My Vista version of Remove-it creates, modifies
> and then removes some registry keys as needed in order to function
> properly and execute some commands. My XP/2000 version does this with
> a batch file. Remove-it only deletes the registry keys associated with
> the detected Malware.
>

If the file is renamed to explorer.exe and left in the root directory,
windows will autoexecute it. You knew that right?

I refer to those files as droppers. I usually get them and the files they
drop.


--
Dustin Cook
Author of BugHunter - MalWare Removal Tool - v2.2c
email: bughunter.dustin DeleteThis @gmail.com.removethis
web..: http://bughunter.it-mate.co.uk
Pad..: http://bughunter.it-mate.co.uk/pad.xml
 >> Stay informed about: How BugHunter Works; for those interested. 

kurt wismer <kurtw.DeleteThis@sympatico.ca> wrote in news:f99lch$d94$3@aioe.org:

> Dustin Cook wrote:
>> kurt wismer <kurtw.DeleteThis@sympatico.ca> wrote in news:f97g09$8m5$5@aioe.org:
>>> pcbutts1 wrote:
> [snip]
>>>> The registry keys are
>>>> what causes re-infection on reboot.
>>> no, failing to remove all the bad programs is what causes
>>> re-infection on reboot...
>>
>> It's a bit scary to see how many people think the registry keys play
>> more of a role then they actually do.
>>
>> False advertising claims made by other products? Who knows...
>
> well, i'm confident that it is technically possible for malware to
> reside/persist fully within the registry (as i discussed once in the
> past), but i've never heard of it being done in practice so for all
> intents and purposes the registry is a no-go for the time being...

I agree, via scripting and url references, it is. It's just not a very
feasable method of attack. The malicious trojans are short lived as it
is.

> (and no, i have no intention of developing a poc to explore the
> possibility)

I won't develop anything to exploit machines any further than I already
did years ago.



--
Dustin Cook
Author of BugHunter - MalWare Removal Tool - v2.2c
email: bughunter.dustin.DeleteThis@gmail.com.removethis
web..: http://bughunter.it-mate.co.uk
Pad..: http://bughunter.it-mate.co.uk/pad.xml
 >> Stay informed about: How BugHunter Works; for those interested. 

"Kerry Brown" <kerry RemoveThis @kdbNOSPAMsys-tems.c*a*m> wrote in
news:DeIti.35736$rX4.32872@pd7urf2no:

> "Dustin Cook" <spamfilterineffect.see.sig RemoveThis @nowhere.com> wrote in
> message news:Xns998452D06FD0FHHI2948AJD832@69.28.186.121...
>> "Kerry Brown" <kerry RemoveThis @kdbNOSPAMsys-tems.c*a*m> wrote in
>
>>
>> It's incapable of many of the things he claims it'll fix. It relies
>> on filenames and locations, not file content. If you have a good file
>> in what it considers to be the wrong place with a name it knows,
>> it'll delete it, no backups, no options for not doing it.
>>
>
> I'm well aware of how his program works, where it comes from, and the
> history of pcbutts1. I was being sarcastic. I don't post to this
> newsgroup very often but I couldn't resist poking him with a sharp
> stick for a bit of fun.

Careful where you poke. Lest you be accused of troll feeding. LoL.

> Good point about the home page in the registry. I'd forgotten about
> that possible means of attack. I'm used to manually cleaning malware.
> Fixing the home page then updating Windows and programs that might be
> exploited is always part of the process to make sure that a drive by
> attack is not likely to re-occur. It's so second nature that I had
> forgotten about it

HEHEHE. No problem. It's one of those things you don't even think about,
since you do it so often you have a routine, it's just part of it. hehe.




--
Dustin Cook
Author of BugHunter - MalWare Removal Tool - v2.2c
email: bughunter.dustin RemoveThis @gmail.com.removethis
web..: http://bughunter.it-mate.co.uk
Pad..: http://bughunter.it-mate.co.uk/pad.xml
 >> Stay informed about: How BugHunter Works; for those interested. 

kurt wismer <kurtw.DeleteThis@sympatico.ca> wrote in news:f99lcd$d94$2@aioe.org:

> Dustin Cook wrote:
>> kurt wismer <kurtw.DeleteThis@sympatico.ca> wrote in news:f97g06$8m5$3@aioe.org:
>>> Andy Walker wrote:
> [snip]
>>>> I was just asking the question because you seemed to want to
>>>> discuss your programs capabilities, which are not all that
>>>> impressive.
>>> compared to those that have tens or hundreds of thousands of
>>> man-hours worth of development in them, i suppose not...
>>
>> Which capabilities is it either of you seem to think BugHunter is
>> missing? aside from resident protection... It scans, it can rename,
>> it can delete, it can be told to do nothing but scan. What feature(s)
>> am I not including that everyone else is then?
>
> there are all sorts of more generic detection techniques out there
> that you don't try to implement but more commercial products do - but
> as i said, those products have a lot more time/effort/money behind
> them...

Hueristics etc? No, I don't implement them. Many of the generic detection
methods that worked great for viruses don't work so well for trojans.
Behavior blocking etc works for everything, but that would require
BugHunter to remain resident, and it's really not designed for that.
I certainly do understand your point. Thanks for speaking up.

I didn't intend to confuse anyone by trying to say BugHunter is a
replacement for what you already use. It's not a replacement, it's an
addition to what you already use in the fight against malware. No single
program, commercial or not is going to get them all. It's somewhat unique
in the aspect that it can be executed even when windows is down for the
count.

>> Commercial interest has never been what drives me. And as far as
>> someones opinion of commercial quality; I personally wouldn't have
>> thought hijackthis or cwssearch were commercial quality but guess
>> what? They're both commercial now.
>
> and one of them is now being called spyware...

Yes, saddened to see this. I quit using cwssearch years ago, but I'm
still an avid fan of the older HiJackthis utility.





--
Dustin Cook
Author of BugHunter - MalWare Removal Tool - v2.2c
email: bughunter.dustin.DeleteThis@gmail.com.removethis
web..: http://bughunter.it-mate.co.uk
Pad..: http://bughunter.it-mate.co.uk/pad.xml
 >> Stay informed about: How BugHunter Works; for those interested. 

"C J." <no.reply DeleteThis @example.invalid> wrote in
news:AcLti.12839$eY.8927@newssvr13.news.prodigy.net:

> I know exactly how BUGHUNTER works... just fine. Was able to save a
> neighbor lady's badly infected harddrive with it over the weekend.
> The confidence that his utility works, is all I - or anyonelse need to
> have 4Q. Thanks again Dustin.

Your very welcome C.J. Glad it was helpful to you.

--
Dustin Cook
Author of BugHunter - MalWare Removal Tool - v2.2c
email: bughunter.dustin DeleteThis @gmail.com.removethis
web..: http://bughunter.it-mate.co.uk
Pad..: http://bughunter.it-mate.co.uk/pad.xml
 >> Stay informed about: How BugHunter Works; for those interested. 

4Q <paul_zest.DeleteThis@hushmail.com> wrote in
news:1186432550.052441.313480@b79g2000hse.googlegroups.com:

> C J. wrote:
>> I know exactly how BUGHUNTER works... just fine.
>

> Okay idiot let's have it, blow by blow
> technical analysis "exactly how BUGSHIT
> works..."

flunkyQ, You've been telling us what a lousy programmer I am, and how you
are so much better than myself. If that's the case, you should already
know in very technical detail how it works; including how the numbers are
generated. You shouldn't need my help, the source code, samples of the
source code, nor anyone elses help in getting this information. The
executable is freely available for your inspection as well as everyone
elses. I don't see the problem here. Either you can do it, or you can't.

> I'm going to get one of my research buddies to help me with the
> mathematical proof, just so we can verify your findings. We'll give you

You don't need to get anyone to help you with anything if your as good as
you'd like us to believe. You have the skillset to disassemble and
analyze it yourself. I personally, don't think you can, but I won't try
to dispute it any further than I already have. I've told you how it flags
files, and essentially repeated what the documentation mentioned from day
one, crc generation, not string scanning is how it works. It's been that
way since day 1. Where you got the silly notion of string scanner is
beyond me.

> I'm Ready, you can start sending the
> information over now!

For once in your sorry life, I think you should do your own homework.

--
Dustin Cook
Author of BugHunter - MalWare Removal Tool - v2.2c
email: bughunter.dustin.DeleteThis@gmail.com.removethis
web..: http://bughunter.it-mate.co.uk
Pad..: http://bughunter.it-mate.co.uk/pad.xml
 >> Stay informed about: How BugHunter Works; for those interested. 

You don't remove the legit dll file you delete the bad reference to it from
the registry.


--

Newsgroup Trolls. Read about mine here http://www.pcbutts1.com/downloads
The list grows. Leythos the stalker http://www.leythosthestalker.com, David
H. Lipman, Max M Wachtell III aka What's in a Name?, Fitz,
Rhonda Lea Kirk, Meat Plow, F Kwatu F, George Orwell



"Dustin Cook" <spamfilterineffect.see.sig.TakeThisOut@nowhere.com> wrote in message
news:Xns99855C8CB63B5HHI2948AJD832@69.28.186.121...
> "pcbutts1" <pcbutts1.TakeThisOut@leythosthestalker.com> wrote in
> news:f98oq4$77k$1@blackhelicopter.databasix.com:
>
>> The files are generated by the registry entries you idiot. Random
>> generated file names don't just appear out of nowhere. Those registry
>> entries can call various dll's, If a call is made incorrectly meaning
>> it calls a legit dll and the function it asks for, because it was
>> deleted, a General Protection Fault (BSOD) may occur.
>
> generated by the registry entries? WTF have you been smoking? I'm sure
> it's
> not pot.
>
> Why would I intentionally delete a legit dll? BugHunter does have false
> alarms I'm sure, but I usually correct those when I'm notified or when I
> discover them on my own.
>
> And aside from some very specific software, a BSOD will NOT usually occur.
>
>
>
>
> --
> Dustin Cook
> Author of BugHunter - MalWare Removal Tool - v2.2c
> email: bughunter.dustin.TakeThisOut@gmail.com.removethis
> web..: http://bughunter.it-mate.co.uk
> Pad..: http://bughunter.it-mate.co.uk/pad.xml
>
 >> Stay informed about: How BugHunter Works; for those interested. 

Dustin Cook wrote:
> kurt wismer <kurtw.RemoveThis@sympatico.ca> wrote in news:f99lcd$d94$2@aioe.org:
>> Dustin Cook wrote:
>> [snip]
>>> Which capabilities is it either of you seem to think BugHunter is
>>> missing? aside from resident protection... It scans, it can rename,
>>> it can delete, it can be told to do nothing but scan. What feature(s)
>>> am I not including that everyone else is then?
>> there are all sorts of more generic detection techniques out there
>> that you don't try to implement but more commercial products do - but
>> as i said, those products have a lot more time/effort/money behind
>> them...
>
> Hueristics etc? No, I don't implement them. Many of the generic detection
> methods that worked great for viruses don't work so well for trojans.

i know, i wasn't thinking of generic *virus* detection techniques, just
generic techniques...

> Behavior blocking etc works for everything, but that would require
> BugHunter to remain resident, and it's really not designed for that.
> I certainly do understand your point. Thanks for speaking up.

there are other generic techniques that wouldn't necessarily require
residency... cross-view diffs, for example, or change detection
(especially for those areas involved in startup)...

i've also seen some generic manual malware removal instructions on the
net which say things like look in process explorer/autoruns for things
that don't have a publisher - probably qualifies as a heuristic, actually...

and of course it's easy enough to use a whitelist in a non-resident
manner and say if it's not on the whitelist then it's suspicious and the
user might want to investigate it further or send it in for analysis...
not sure that qualifies as generic, however...

--
"it's not the right time to be sober
now the idiots have taken over
spreading like a social cancer,
is there an answer?"
 >> Stay informed about: How BugHunter Works; for those interested. 

"pcbutts1" <pcbutts1.TakeThisOut@leythosthestalker.com> wrote in
news:f9au7u$a8q$1@blackhelicopter.databasix.com:

> You don't remove the legit dll file you delete the bad reference to it
> from the registry.

PcButts, please provide an example with a registry key so that I'll know
what your talking about. ok?


--
Dustin Cook
Author of BugHunter - MalWare Removal Tool - v2.2c
email: bughunter.dustin.TakeThisOut@gmail.com.removethis
web..: http://bughunter.it-mate.co.uk
Pad..: http://bughunter.it-mate.co.uk/pad.xml
 >> Stay informed about: How BugHunter Works; for those interested. 

Dustbin Cook wrote:
> Klaatu <klaatu.RemoveThis@nospam.invalid> wrote in
> news:Xns9986860E88ADklaatunospaminvalid@127.0.0.1:
>
> > On Wed, 08 Aug 2007 02:39:06 GMT, Dustin Cook posted to
> > alt.comp.freeware:
> >
> > Sorry, Justin, this was just too juicy to pass up. Pot-kettle-black
> time:
>
> Typo or intentional? It's Dustbin.
>

Dustbin hates people spelling his name
with a J. Also don't call his moms
basement a basement, it's a childs
"dungeon".


> >> PcButts has absolutely *no* credibility, none whatsoever. Your
> >> *desperate* trolling hasn't gone unnoticed. Sticking up for PcButts,
> >> attempted thread hijacking to artificially inflate your bugshit
> >> keyword attack (your not as bright as you claim you are), and
> >> continued efforts to cross-post into auk.
> >
> > Don't you mean: "You're not as bright as you claim you are"?
>
> Well, you got the point of the post, right? That's all that matters
> then.
>
> > Like I said, sorry. Couldn't resist.
>
> Understood, I'm used to trolls and people like you.

You're lucky Dustbin doesn't go off on
one of his death threat tirades for
correcting his spelling!


> Some things don't ever change.
>

You'll never change Dustbin ;]]


4Q
 >> Stay informed about: How BugHunter Works; for those interested. 

On Wed, 08 Aug 2007 02:39:06 GMT, Dustin Cook posted to
alt.comp.freeware:

Sorry, Justin, this was just too juicy to pass up. Pot-kettle-black time:

> PcButts has absolutely *no* credibility, none whatsoever. Your
> *desperate* trolling hasn't gone unnoticed. Sticking up for PcButts,
> attempted thread hijacking to artificially inflate your bugshit
> keyword attack (your not as bright as you claim you are), and
> continued efforts to cross-post into auk.

Don't you mean: "You're not as bright as you claim you are"?

Like I said, sorry. Couldn't resist.

--
I try to take one day at a time, but sometimes, several days attack me
at once.
 >> Stay informed about: How BugHunter Works; for those interested. 

Klaatu <klaatu DeleteThis @nospam.invalid> wrote in
news:Xns9986860E88ADklaatunospaminvalid@127.0.0.1:

> On Wed, 08 Aug 2007 02:39:06 GMT, Dustin Cook posted to
> alt.comp.freeware:
>
> Sorry, Justin, this was just too juicy to pass up. Pot-kettle-black
time:

Typo or intentional? It's Dustin.

>> PcButts has absolutely *no* credibility, none whatsoever. Your
>> *desperate* trolling hasn't gone unnoticed. Sticking up for PcButts,
>> attempted thread hijacking to artificially inflate your bugshit
>> keyword attack (your not as bright as you claim you are), and
>> continued efforts to cross-post into auk.
>
> Don't you mean: "You're not as bright as you claim you are"?

Well, you got the point of the post, right? That's all that matters
then.

> Like I said, sorry. Couldn't resist.

Understood, I'm used to trolls and people like you. Some things don't
ever change.




--
Dustin Cook
Author of BugHunter - MalWare Removal Tool - v2.2c
email: bughunter.dustin DeleteThis @gmail.com.removethis
web..: http://bughunter.it-mate.co.uk
Pad..: http://bughunter.it-mate.co.uk/pad.xml
 >> Stay informed about: How BugHunter Works; for those interested. 

On Wed, 08 Aug 2007 21:48:01 GMT, Dustin Cook posted to alt.comp.freeware:

> Understood, I'm used to trolls and people like you. Some things don't
> ever change.

Yep, and people like you with no sense of humor. GFY.

--
Q: How many of you believe in telekinesis? Raise my hand...
 >> Stay informed about: How BugHunter Works; for those interested.