Gmail Calendar Documents Reader Web more »
Recently Visited Groups | Help | Sign in
Google Groups Home
Message from discussion Weird copy/paste situation - virus?
The group you are posting to is a Usenet group. Messages posted to this group will make your email address visible to anyone on the Internet.
Your reply message has not been sent.
Your post was successful
 
From:
To:
Cc:
Followup To:
Add Cc | Add Followup-to | Edit Subject
Subject:
Validation:
For verification purposes please type the characters you see in the picture below or the numbers you hear by clicking the accessibility icon. Listen and type the numbers you hear
 
David H. Lipman  
View profile  
 More options Sep 12 2008, 6:58 am
Newsgroups: microsoft.public.security.virus, microsoft.public.security.homeusers
From: "David H. Lipman" <DLipman~nosp...@Verizon.Net>
Date: Fri, 12 Sep 2008 06:58:53 -0400
Local: Fri, Sep 12 2008 6:58 am
Subject: Re: Weird copy/paste situation - virus?
From: "~BD~" <BoaterD...@nospam.invalid>

| I somehow missed this post of yours Dave - my apologies for not responding earlier.

| In no way do I doubt what you say but, for any 'newbies' reading this, how can one be
| certain that
| internetinspiration.co.uk is a/the bonio-fido source?

| You mention a Stuart Saunder - but I've so far failed to spot that name on the site;
| perhaps I've
| simply missed it!

| You say that the OP posted an illegitimate link here and that Pcbutts1 has stolen
| RogueFix and
| re-invented it. That is (probably <wink>) true, but it's only your say-so, isn't it?
| What is needed
| is some global body with responsibility to check all web sites where 'help and advice'
| is being
| offered to the public at large. Expensive? Of course. Maybe a project for
| http://www.gatesfoundation.org/default.htm

| Dave

Look BoaterDave you are just plain clueless and you don't take the time for investigating
things for your self.

If you did your homework you could easily find out who the Registrant of
www.internetinspiration.co.uk  is
and if you continued that work you would easily determine the email of the Registrant.

This takes some knowledge that lack and so you question things.  Well here's a hint on the
idea how to do some investigation.  I'll start with YOU..

NNTP-Posting-Host: 92.22.178.225

% Information related to '92.16.0.0 - 92.23.255.255'

inetnum:        92.16.0.0 - 92.23.255.255
netname:        CPWBBSERV-NET
descr:          Carphone Warehouse Broadband Services
country:        GB
admin-c:        GJB18-RIPE
admin-c:        PM58-RIPE
tech-c:         GJB18-RIPE
tech-c:         PM58-RIPE
status:         ASSIGNED PA
mnt-by:         OPAL-MNT
source:         RIPE # Filtered

person:         Gareth J Bowen
address:        Opal Telecommunications Plc
address:        Northbank Industrial Estate
address:        Irlam
address:        Manchester
address:        United Kingdom
address:        UK
phone:          +44 161 2222000
fax-no:         +44 161 2222003
e-mail:         gbo...@opaltelecom.co.uk
nic-hdl:        GJB18-RIPE
mnt-by:         OPAL-MNT
source:         RIPE # Filtered

person:       Phill Magill
address:      Opal Telecommunications Plc
address:      Northbank Industrial Estate
address:      Irlam
address:      Manchester
address:      M44 5BL
address:      United Kingdom
phone:        +44 161 222-2000
fax-no:       +44 161 222-2008
e-mail:       pmag...@opaltelecom.co.uk
nic-hdl:      PM58-RIPE
mnt-by:       OPAL-MNT
source:       RIPE # Filtered

% Information related to '92.0.0.0/11AS13285'

route:          92.0.0.0/11
descr:          Carphone Warehouse Broadband Services Autonomous System
origin:         AS13285
mnt-by:         OPAL-MNT
source:         RIPE # Filtered

% Information related to '92.20.0.0/14AS43234'

route:          92.20.0.0/14
descr:          CPW-BS-Subscribers-LOH-2
origin:         AS43234
mnt-by:         OPAL-MNT
source:         RIPE # Filtered

Using the same investigational concept one can determine WHOIS information on
www.internetinspiration.co.uk

As for the theft of RogueFix.  Well in the anti malware community this was HIGHLY
documented.  I am just one of group of individuals who have investigated this plagiarism
from the start.  The fact is I first posted a URL of RogueFix in a.c.v  Butts read my post
and found the RougeFix BAT and at that point all of a sudden was posting SuperFix on his
web site around 9/'06 and it was RogueFix's code.  By Jan '07 it was renamed and branded
as SpyErase and was using an Inno Setup package.  By March '07 it was again re-branded as
Remove-It.  While this was going on Butts was password protecting the installer.  You
couldn't install it w/o a password.  The anti malware community, from the POV of different
countries, played with Butts and obtained several passwords.  For example ...
A british investagator got Butts to give him a password arounf 11/19/06 which was ...
IdFqmTh~:_/AjyD!>-O^%Om.?m]Cg+0kItz4jZ?"YHc`s;ujS4>lu<_

Another investigator from Belgium arount 11/27/06
I't$>:xn&5(5CW}6sju^8~W3Fw[@)%wM>BT=\n-I_u= 2^!R/"g}b7|

By Ja 7, 07 the password for SpyErase was

}z+q9%}@ne1h)SE=\Q+]em.a4>L0<t&Tv[^SSFpmkoiq0R~3<s+*ar5

I could go on and on...

The anti malware community has highly documented the plagiarism of RogueFix to what is now
Remove-It.

In fact in January '07 the anti malware community joined with Stuart Saunders and the
community create a false code marker and inserted it in RogueFix.

By Jan 13, '07 Butts posted...

"Anybody want to test a modification to Spyerase that I just put together.
There is a strange issue I am trying to fix that I think may be machine
specific so I need someone to test it for me. The glitch will not harm your
system. Email me, Trolls need not apply."

By Jan 15' 07
Butts posted...

"New Spyerase version 10, it's fast and free. It now has over 1700 signatures
to remove  All variants of Virusburst, Spy sheriff and others. New Feature, Spyerase
will now update your hosts file. This tool is designed to Specifically remove all
variants.
Scan time is about 2 minutes. Designed for Windows 2000/XP only. Password is still
required.
First read this page http://www.pcbutts1.com/downloads  then download
Spyerase from here http://www.pcbutts1.com/downloads/spyerasesetup.zip"

The password was...
H/G/^u5`f` YNb.4&MJZXS1w5 -kkpsxk47b\CdkB<-u]~U>to'naA4

And the false code marker was found in SpyErase.

So to answer...
"but it's only your say-so, isn't it?"

No, there is a whole community who has documented this !

--
Dave
http://www.claymania.com/removal-trojan-adware.html
Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp


    Forward  
You must Sign in before you can post messages.
To post a message you must first join this group.
Please update your nickname on the subscription settings page before posting.
You do not have the permission required to post.

Create a group - Google Groups - Google Home - Terms of Service - Privacy Policy
©2010 Google