Mal...where?

3 views
Skip to first unread message

Alex Clark

unread,
Apr 6, 2009, 1:47:33 PM4/6/09
to
Hi All,

I'm trying in vain to clean up an XP Home (w/ SP3) machine for someone and
I'm having some curious problems.

I'm fairly sure it's infected with malware. If I try to run the installer
for MBAM, I get the "Please select language" option, and then as soon as I
get to the next screen it instantly vanishes. AVG installer behaves in a
similar manner, briefly flashes up on screen and then vanishes. I've
checked Task Manager and can confirm that the process exists for a split
second before vanishing. Oddly enough, exactly the same thing happens even
with SysInternals Process Explorer tool.

Other apps run fine though, and that can be anything from regedit to
Computer Management to a command prompt. To me, this sounds like classic
malware behaviour, as something is killing any processes that it believes
may pose a threat to it. This occurs even if I've started in safe mode
with a command prompt, and even if I rename the AVG or mbam installers to
something else. I just cannot get around it.

So with that in mind, I took the hard drive out and hooked it up to my
machine where I then ran a full scan using MBAM. This found about 4
infected files, all of which seemed to be in the \System Restore folders
which made me think they couldn't be doing much harm from there. That was
all it found, though naturally it couldn't scan the registry. I reinstalled
the disc, booted the machine and... exactly the same as before - cannot
install any anti virus apps.

Then I downloaded the latest Avira rescue CD, burned & booted off that and
did a full scan. Avira scanned the registry and went through every file.
Number of infections? Zero. Did not find a single thing wrong.

So I've got antivirus apps telling me the disc is clean, but it doesn't take
a genius to figure out it's still infected. I tried looking through the non
PnP devices in Device Manager as I'd read of a few root kits installing as
TD***.sys, but nothing matched that particular pattern.

Could it be that a virus left behind some kind of software policy
restriction to prevent these apps from running, and the machine is truly
clean? Or do you guys think it's infected with something that MBAM and
Avira just can't find?

Any ideas?

Thanks in advance,
Alex


PA Bear [MS MVP]

unread,
Apr 6, 2009, 1:54:46 PM4/6/09
to
Assuming no anti-virus application was installed when the machine got
infected and/or when you started working on the machine, backup the personal
data, then do a format & clean install of Windows. Please note that a
Repair Install (AKA in-place upgrade) will NOT fix this!

After the clean install, you'll have the equivalent of a "new computer" so
take care of everything on the following page before otherwise connecting
the machine to the internet or a network and before using a USB key that
isn't brand-new or hasn't been freshly formatted:

5 steps to help protect your new computer before you go online
http://www.microsoft.com/protect/computer/advanced/xppc.mspx

Also see.

Steps To Help Prevent Spyware
http://www.microsoft.com/protect/computer/spyware/prevent.mspx
--
~Robear Dyer (PA Bear)
MS MVP-IE, Mail, Security, Windows Client - since 2002

Alex Clark

unread,
Apr 6, 2009, 2:20:13 PM4/6/09
to
I'm planning on a complete reinstall anyway; it's clearly been too badly
infected to recover, but I'm just wondering if anyone knew of anything that
caused these symptoms? It sounds like a rootkit to me but (surprise
surprise) I can't run RootKit Revealer or GMER as the dang thing won't let
me.

Is there any way, in XP, to get some kind of process autopsy? What I mean
is, I would like to know the exact details of why a specific process ended,
what sent the kill signal to it, and what its exit code was.

Thanks,
Alex

"PA Bear [MS MVP]" <PABe...@gmail.com> wrote in message
news:OBDMUDut...@TK2MSFTNGP02.phx.gbl...

smlunatick

unread,
Apr 6, 2009, 3:11:48 PM4/6/09
to
On Apr 6, 7:20 pm, "Alex Clark" <qua...@noemail.noemail> wrote:
> I'm planning on a complete reinstall anyway; it's clearly been too badly
> infected to recover, but I'm just wondering if anyone knew of anything that
> caused these symptoms?  It sounds like a rootkit to me but (surprise
> surprise) I can't run RootKit Revealer or GMER as the dang thing won't let
> me.
>
> Is there any way, in XP, to get some kind of process autopsy?  What I mean
> is, I would like to know the exact details of why a specific process ended,
> what sent the kill signal to it, and what its exit code was.
>
> Thanks,
> Alex
>
> "PA Bear [MS MVP]" <PABear...@gmail.com> wrote in messagenews:OBDMUDut...@TK2MSFTNGP02.phx.gbl...

Not sure but you might want to check for possible infestations in Safe
Mode, However, most applications will not install in Safe Mode.

Kelly

unread,
Apr 6, 2009, 3:32:29 PM4/6/09
to
Hi Alex,

I have written some checkpoints for you to consider:
http://www.kellys-korner-xp.com/xp_c.htm#cleanup

--

All the Best,
Kelly (MS-MVP/DTS&XP)

Taskbar Repair Tool Plus!
http://www.kellys-korner-xp.com/taskbarplus!.htm


"Alex Clark" <qua...@noemail.noemail> wrote in message
news:uPbfD$ttJHA...@TK2MSFTNGP06.phx.gbl...

Troll Buster

unread,
Apr 6, 2009, 5:17:55 PM4/6/09
to
Download the Remove-it software from here
http://www.ms-mvp.org/ this file works. I have now used
this fix on several computers and it does work.


--
Too many Trolls in this NG bashing each other. The
Information I post has been verified by me and is Authentic.

"Alex Clark" <qua...@noemail.noemail> wrote in message

news:uBN1SRut...@TK2MSFTNGP03.phx.gbl...

sgopus

unread,
Apr 6, 2009, 5:54:10 PM4/6/09
to
nice that you say it works, but what does it remove? I wouldn't trust
something as generic as this myself.

PA Bear [MS MVP]

unread,
Apr 6, 2009, 6:12:58 PM4/6/09
to
Ignore this imposter, Alex! He's stolen just about everything in that
utility from others and Microsoft. And he most certainly is NOT an MS MVP
(cf. www.mvps.org & http://msmvps.com versus the link he posted).

Also see
http://hphosts.blogspot.com/2009/02/pcbutts-now-serving-malware-via-ms.html
--
~Robear Dyer


MS MVP-IE, Mail, Security, Windows Client

https://mvp.support.microsoft.com/default.aspx/profile/robear.dyer


Troll Buster wrote:
> Download the Remove-it software from here
> http://www.ms-mvp.org/ this file works. I have now used
> this fix on several computers and it does work.
>
>
>

Daave

unread,
Apr 6, 2009, 6:27:02 PM4/6/09
to
"smlunatick" <yve...@gmail.com> wrote in message
news:1b7b890a-7631-4e69...@c9g2000yqm.googlegroups.com...

On Apr 6, 7:20 pm, "Alex Clark" <qua...@noemail.noemail> wrote:

>> I'm planning on a complete reinstall anyway; it's clearly been too
>> badly
>> infected to recover, but I'm just wondering if anyone knew of
>> anything that
>> caused these symptoms? It sounds like a rootkit to me but (surprise
>> surprise) I can't run RootKit Revealer or GMER as the dang thing
>> won't let
>> me.
>>
>> Is there any way, in XP, to get some kind of process autopsy? What I
>> mean
>> is, I would like to know the exact details of why a specific process
>> ended,
>> what sent the kill signal to it, and what its exit code was.

> Not sure but you might want to check for possible infestations in Safe


> Mode, However, most applications will not install in Safe Mode.

Not in OP's case. I've seen this before. What worked for me was changing
the name of the installation file.


The Real Truth [MS MVP]

unread,
Apr 6, 2009, 6:36:34 PM4/6/09
to
Here is a list of everything my Remove-it software removes including all
variants. Ignore the troll MVP Pa Bear he is jealous of me. The list is
always changing.

Alcan
404Search
7FaSSt
AccessPlugin
Accoona
AceSpy
Aconti dialer
ActiveSearch
ACXInstall Dialer
Adbars
AdBlaster
Adbreak
Adclicker
AdsInContext
AdWare Pro
AdwareDelete
Adwarepunisher
adwaresheriff
Agent.yf
Alemod
Alemod
Allaple
alloversafety.com
Alphacleaner
Alureon
Anti-Leech
Antinny
AntiSpyCheck
antispykit
antispylab
antispynet
AntispyStorm
AntiSpywareBot
antispywarebox
AntispywareSoldier
AntiSpywareSuite
AntispywareXP2009
Antispyzone
AntiVermeans
AntiVermins
AntiVerminser
AntiVerminsPro
AntiVirGear
Antivirus 2008
Antivirus 2009
Antivirus 2010
Antivirus 360
Antivirus Gold
Antivirus Golden
AntiVirusLab 2009
AntivirusMaster
AntiVirusPCSuite
AntivirusTrigger
AntiWorm2008
asafetyproject.com
asecuritydesktop
AsianRaw Dialer
Atak
AviCodecEX
Awola
AzeSearch
Badtrans
Bagle
Bagz
Bancos
Banker
Banload
Beenut
Berbew
BestOffersNetworks
bestsafetyguide.net
bestsecurityguide.com
Bizves
Blaster
Bobax
Bofra
Brain Codec
BraveSentry
BreakSpyware
Brontok
Bropia
Browserad(TX-4)
Bugbear
Busky
Captiya
CashDeluxe
Ceekat
Chir
Cimuz
Cissi
CnsMin
Codbot
Codec Pack - All In 1
Conficker
Conhook
ContraVirus
Corripio
Crystalys Media
Cutwail
Daily Weather Forecast
DcomSrv
DealBar
Delf
Deskwizz
dflnl
DHIJACK
DigiKeygen
digipass
DioCleaner
Dloadr-DM
dns404.net (404 errors)
DNSCHANGER
DollarRevenue
DoomJuice
Dumaru
DVDCodec
eCodec
elitecodec
EMediaCodec
emediacodec
Error Safe Free
ErrorSafe
Esbot
EShopee
Evaman
ExpertAntivirus
Eyeveg
ezPorn
EZVideo
F4IRootkit
FAKEALE
Fake-Alert
FakeSecSen
Fakespy
Fakevir
FakeXPA
Favadd
Fizzer
flush
Fotomoto
FreeVideo
Frethog
Funner
Gael
Ganda
Gaobot
Gibe
Gimmiv
Gold Codec
Goweh
guarduptodate.com
Hacker Defender
Hacty
Harnig
harnig
Haxdoor
Horst
HQ_codec
HQvideoCodec
Hupigon
icodecpack
icodecpack
IE AntiVirus
IE Defender
IEhelper
IE-Security
image access activex object
Image ActiveX Object
Image Add-on
image ax object
IntCodec
Internet Antivirus
InternetSecurityDeluxe
IRCBot
Ispro
IVideoCodec
iwatchnow
Jeefo
JPEG Encoder
JustPorn
Kelvir
Key Generator
KeyCodec
KeyToPorn
Koobface
Korgo
Ldpinch
Locksky
Locksky(worm)
Lolyda
Lovgate
lowzones
loxoscam
LPVideoPlugin
Mabutu
Magistr
Malware Bell
MalwareAlarm
MalwareCore
MalwareCrush
MalwareStopper
MalwareWar
Malwarewipe
MalwareWiped
malwarewipeds
MalwareWipePro
Malwarewiper
Maslan
Matcash
media-codec
MediaTickets
MicroAntivirus 2009
Mimail
mirrarsearch
Mitglieder
MMediaCodec
moneygainer
mpvideocodec
MrAntispy
MSAntivirus 2008
MultiDefender
My Pass Generator
Mydoom
MyGeek/CPVFeed
Mytob
Mywife
Nachi
Need2find
needupdate.com
NetProject
Netpumper
Netsky
Newacc
newdial
NewMediaCodec
Nsag
Nsaq
Nuwar
Oderoor
Oemji toolbar
online video add-on
onlinesecurityguard.net
Onlinesecurityworld.com
onlinestability.com
Opaserv
Optix
Optixpro
Parite
Passalert
Pcodec
PCPrivacyToo
PCTurboPro
Perfect Codec
Perfect Defender 2009
perfectedsecurity
Perflog (keylogger)
PestCapture
PestTrap
Plexus
popupwall
PornMagPass
Power-Antivirus-2009
powercodec
privacy_danger
PrivacyKit
PrivacyProtectorFree
Protection Bar
proxy fz
puper
Purstiu
QualityCodec
Randex
Rapid Antivirus
Rbot
Reatle
RegistryCleaner
RegistryCleanerXP
RemedyAntispy
Renos
RichVideoCodec
Rjump
RuPass
Rustock
Ryknos
safe-strip-download.com
Safety Bar
safetydefender.com
safetyuptodate.com
Sasser
Sdbot
Search Maid
SearchPorn
searchspy
SecureMYpc
security toolbar
Security Troubleshootin
securitybulletin
securitycaution.com
securityfeature.com
securitysafeguards.net
SelectiveAdmission
Silver Codec
Sinowal
Slenfbot
small
Smart Antivirus 2009
Sober
Sobig
Softcodec
Spy officer
SpyAway
spyaxe
Spybot
Spyboter
SpyBrowser
SpyCrush
SpyDawn
Spyfalcon
Spyguard
SpyHeal
SpyHealer
SpyHeals
spykiller
SpyLax
SpyLocked
SpyMaxx
SpyQuake2
Spysheriff
SpyShield
Spy-Shield
SpyShield Demo
SpyShredder
Spyspotter
Spywad
Spyware Guard 2008
Spyware Preventer
Spyware Wizard
Spywareaxe
SpywareBot
SpywareHeal
SpywareLocked
SpywareQuake
SpywareSoftstop
SpywareStrike
spywarewall
Srizbi
Startpage
Storark
Stration
StrCodec
Super Codec
surf sidekick
sv-codec
svideocodec
Swen
SysAntivirus2009
syserrors.com
syshomepage.com
System Guard 2009
SystemDoctor 2006
systemwarning.com
Taterf
Tibs
Tilcun
TitanShield Antispyware
topantispyware
topsecuritysite.com
Torvil
Total Secure 2009
TrueCodec
Trust Cleaner
Trustin bar
Ultimate Defender
updatescenter.com
updatesearches.com
updateyoursystem.com
Valla
VAX codec
vcodec
vidcodecs
Video Access ActiveX Object
Video ActiveX Object
Video AX Object
video icodec
VideoBox
VideoCompressionCodec
VideoKey
VideoKeyCodec
VideoPorn
VideosCodec
Virtual Maid
Virtumonde
Virus heat
virusblast
VirusBlasters
Virusburst
Virusburster
Virusbursters
Virus-bursters
Virusheal
VirusLocker
VirusProtect
VirusProtectPro
virusranger
VirusRay
VirusRescue
VirusResponseLab 2009
VirusTrigger
Virut
Vixup
Vundo
WatchPorn
WebMediaViewer
WebSpyShield
Win32.Renos
Win32.VB.vc
windows antivirus 2008
Windowssecuritycenter.com
WinMediaCodec
Wootbot
Wukill
xxx.security-look.cc
xxx.syssecuritysite.com
xxx.theguardservices.com
XP antivirus
XPPoliceAntivirus
XXXAccess
XXXPlugin
xxxVideo Access ActiveX Object
Yaha
Yektel
yoursystemupdate.com
Zafi
Zindos
zipcodec
Zlob
Zlob
Zonebac
Zotob
Zuten


--
The Real Truth http://pcbutts1-therealtruth.blogspot.com/
*WARNING* Do NOT follow any advice given by the people listed below.
They do NOT have the expertise or knowledge to fix your issue. Do not waste
your time.
David H Lipman, Malke, PA Bear, Beauregard T. Shagnasty, Leythos.


"sgopus" <sgo...@discussions.microsoft.com> wrote in message
news:03939AE5-BBBA-4918...@microsoft.com...

Alex Clark

unread,
Apr 6, 2009, 7:09:02 PM4/6/09
to
Indeed. I've tried installing MBAM, AVG et al in Safe Mode but the same
symptoms persist.

Whatever's got a hold of it, it's a nasty piece of work - and a scan of the
disc via another machine (and via Avira rescue boot CD) doesn't show any
infection at all. Crazy...

"Daave" <dcwash...@myrealboxXYZ.invalid> wrote in message
news:e%23XCRbwt...@TK2MSFTNGP05.phx.gbl...

The Real Truth [MS MVP]

unread,
Apr 6, 2009, 7:15:55 PM4/6/09
to
Use my Remove-it software, it will remove that malware from your system.
Choose yes for all options when prompted. Download it here
http://www.ms-mvp.org/

--
The Real Truth http://pcbutts1-therealtruth.blogspot.com/
*WARNING* Do NOT follow any advice given by the people listed below.
They do NOT have the expertise or knowledge to fix your issue. Do not waste
your time.
David H Lipman, Malke, PA Bear, Beauregard T. Shagnasty, Leythos.

"Alex Clark" <qua...@noemail.noemail> wrote in message

news:uhEDPyw...@TK2MSFTNGP06.phx.gbl...

PA Bear [MS MVP]

unread,
Apr 6, 2009, 7:23:10 PM4/6/09
to
Same MVP imposter, Alex. Ignore him, please.
--
~Robear Dyer

MS MVP-IE, Mail, Security, Windows Client
https://mvp.support.microsoft.com/default.aspx/profile/robear.dyer

The Real Truth [MS MVP] wrote:
> Use my Remove-it software, it will remove that malware from your system.
> Choose yes for all options when prompted. Download it here
> http://www.ms-mvp.org/
>
>

Randem

unread,
Apr 6, 2009, 8:55:17 PM4/6/09
to
These procedures may help a bit http://www.randem.com/virusproblems.html


--
Randem Systems
Your Installation Specialist
The Top Inno Setup Script Generator
http://www.randem.com/innoscript.html
Disk Read Error Press Ctl+Alt+Del to Restart
http://www.randem.com/discus/messages/9402/9406.html?1236319938

"Alex Clark" <qua...@noemail.noemail> wrote in message

news:uPbfD$ttJHA...@TK2MSFTNGP06.phx.gbl...

Leythos

unread,
Apr 6, 2009, 9:04:50 PM4/6/09
to
In article <E2wCl.13630$hc1....@flpi150.ffdc.sbc.com>, t...@void.com
says...

> Choose yes for all options when prompted.
>

And you will be blocked from reputable anti-mawlare sites.

Not a single ethical person will support Butt's pilfering of code that
others worked to create.

--
- Igitur qui desiderat pacem, praeparet bellum.
- Calling an illegal alien an "undocumented worker" is like calling a
drug dealer an "unlicensed pharmacist"
spam9...@rrohio.com (remove 999 for proper email address)

Tim Meddick

unread,
Apr 6, 2009, 9:34:54 PM4/6/09
to
Hi Bear,
Being a curious sort I visited the page. Question: where can I
get hold of the original software that I've been told this guy has
plagiarized. Some of it looks good but am TERRIFIED of having anything to
do with his reversed-engineered versions.
--

Cheers, Tim Meddick, Peckham, London.


"PA Bear [MS MVP]" <PABe...@gmail.com> wrote in message

news:%23HVcIWw...@TK2MSFTNGP05.phx.gbl...

Alex Clark

unread,
Apr 6, 2009, 10:18:56 PM4/6/09
to
Yeah, every time he posts here under a new alias I add it to my OE killfile.
I've lurked here on and off for a couple of weeks - easily long enough to
know he's a troll selling spyware.

"PA Bear [MS MVP]" <PABe...@gmail.com> wrote in message

news:%23HVcIWw...@TK2MSFTNGP05.phx.gbl...

The Real Truth [MS MVP]

unread,
Apr 7, 2009, 6:16:42 PM4/7/09
to
That's a very good question, he will probably pretend he did not see the
question and not answer when the real reason is he does not know. I will
answer it for him. There is a fake stolen knock off of my Remove-it software
here http://www.internetinspiration.co.uk/roguefix.htm it was stolen more
then a few years back. I have since, as you will see when you compare them,
made numerous changes and upgrades to Remove-it that can no longer get
pirated by anyone. If you would like a list just let me know.


--
The Real Truth http://pcbutts1-therealtruth.blogspot.com/
*WARNING* Do NOT follow any advice given by the people listed below.
They do NOT have the expertise or knowledge to fix your issue. Do not waste
your time.
David H Lipman, Malke, PA Bear, Beauregard T. Shagnasty, Leythos.


"Tim Meddick" <timme...@gawab.com> wrote in message
news:%23FnCuIy...@TK2MSFTNGP04.phx.gbl...

Troll Buster

unread,
Apr 7, 2009, 6:28:45 PM4/7/09
to
I would like a list, I want to compare it to what I've already found between
the two.


--
Too many Trolls in this NG bashing each other. The
Information I post has been verified by me and is Authentic.

"The Real Truth [MS MVP]" <t...@void.com> wrote in message
news:YaQCl.16176$D32....@flpi146.ffdc.sbc.com...

Leythos

unread,
Apr 7, 2009, 7:16:11 PM4/7/09
to
In article <YaQCl.16176$D32....@flpi146.ffdc.sbc.com>, t...@void.com
says...

> it was stolen more
> then a few years back. I have since, as you will see when you compare them,
> made numerous changes and upgrades to Remove-it that can no longer get
> pirated by anyone. If you would like a list just let me know.
>

And yet each time he updates his application the changes show up in
yours LATER, not to mention that the numerous fake entries that were put
into HIS that show up in yours, still today.

Leythos

unread,
Apr 7, 2009, 7:16:51 PM4/7/09
to
In article <9fKdnRLJ38UKTkbU...@giganews.com>,
tr...@buster.gio says...

>
> I would like a list, I want to compare it to what I've already found between
> the two.

LOL, talking to yourself is not showing any stability.

The Real Truth [MS MVP]

unread,
Apr 7, 2009, 7:21:10 PM4/7/09
to
http://pcbutts1.com/downloads/Features.htm


--
The Real Truth http://pcbutts1-therealtruth.blogspot.com/
*WARNING* Do NOT follow any advice given by the people listed below.
They do NOT have the expertise or knowledge to fix your issue. Do not waste
your time.
David H Lipman, Malke, PA Bear, Beauregard T. Shagnasty, Leythos.


"Troll Buster" <tr...@buster.gio> wrote in message
news:9fKdnRLJ38UKTkbU...@giganews.com...

Leythos

unread,
Apr 7, 2009, 7:25:05 PM4/7/09
to
In article <ydRCl.11691$%54....@nlpi070.nbdc.sbc.com>, t...@void.com
says...

> *WARNING* Do NOT follow any advice given by the people listed below.
> They do NOT have the expertise or knowledge to fix your issue. Do not waste
> your time.
>

And each time yo post you're stalking David and myself as well as
others, showing how unethical you are.

PA Bear [MS MVP]

unread,
Apr 7, 2009, 9:21:15 PM4/7/09
to
Stop talking to yourself!

What's the "real truth" about pcbutts1? Read on...

. Is he an MS MVP? No!
cf. http://mvp.support.microsoft.com/communities/mvp.aspx

. Are his downloads safe? No!
cf. http://msmvps.com/blogs/hostsnews/archive/2009/02/25/1673723.aspx

. If xxx.ms-mvp.org redirects to xxx.pcbutts1.com, why doesn't he post that
link to begin with?

. Is he a proven thief? Yes!
cf.
http://msmvps.com/blogs/hostsnews/archive/2006/11/10/pcbutts1-_2E00__2E00_.-the-saga-continues-_2E00__2E00__2E00_.aspx
cf.
http://groups.google.com/group/microsoft.public.security.homeusers/msg/213247814fb4d61e
cf.
http://groups.google.com/group/microsoft.public.security.homeusers/msg/e19fce884897662f

. What do real experts have to say about him? It ain't pretty.
cf. http://www.siteadvisor.com/sites/pcbutts1.com (Reviews)

. Does he have all his marbles?
cf. http://en.wikinews.org/wiki/NASA_van_rolls_off_California_mountain

Ignore this MVP imposter!

PA Bear [MS MVP]

unread,
Apr 7, 2009, 9:19:26 PM4/7/09
to
<ROFL> Now pull the other one, you maroon!

The Real Truth [MS MVP] wrote:
> That's a very good question, he will probably pretend he did not see the
> question and not answer when the real reason is he does not know. I will
> answer it for him. There is a fake stolen knock off of my Remove-it
> software
> here http://www.internetinspiration.co.uk/roguefix.htm it was stolen more
> then a few years back. I have since, as you will see when you compare
> them,
> made numerous changes and upgrades to Remove-it that can no longer get
> pirated by anyone. If you would like a list just let me know.
>
>
>

Troll Buster

unread,
Apr 7, 2009, 10:30:12 PM4/7/09
to
Can you answer my question or not? or you would rather keep trolling.

--
Too many Trolls in this NG bashing each other. The
Information I post has been verified by me and is Authentic.

"PA Bear [MS MVP]" <PABe...@gmail.com> wrote in message
news:OFm01h%23tJH...@TK2MSFTNGP05.phx.gbl...

PA Bear [MS MVP]

unread,
Apr 8, 2009, 10:36:23 AM4/8/09
to
Are you taking your meds, Chris? Why is your version of "Roguefix" always
updated a day or two after the real one is?

Troll Buster wrote:
> Can you answer my question or not? or you would rather keep trolling.
>

The Real Truth [MS MVP]

unread,
Apr 8, 2009, 11:41:17 AM4/8/09
to
Why don't you answer the question asked by TB. Ask Leythos how to check
headers you should know how but you don't because you are a troll. Prove
what you just said about my Remove-it updates and when you can't I once
again will prove you a liar and a troll and that goes for anyone of you
trolls. PA Bear you need to answer the questions asked by TB and prove to
everyone what you said about my updates. If what you say is true then it
should very easy to prove. troll.

--
The Real Truth http://pcbutts1-therealtruth.blogspot.com/
*WARNING* Do NOT follow any advice given by the people listed below.
They do NOT have the expertise or knowledge to fix your issue. Do not waste
your time.
David H Lipman, Malke, PA Bear, Beauregard T. Shagnasty, Leythos.

"PA Bear [MS MVP]" <PABe...@gmail.com> wrote in message

news:uKdpBgFu...@TK2MSFTNGP02.phx.gbl...

Alex Clark

unread,
Apr 8, 2009, 1:10:30 PM4/8/09
to
All drama aside...

I think I've cracked it. I removed the disc again and hooked it up to my
PC. Then downloaded AVG 8.5 and made sure MBAM was absolutely up-to-date,
then ran scans on the disc with both programs (separately of course). They
found some infected files (which Avira's Rescue waste-of-time CD missed
completely) and cleaned them.

Lo and behold, after re-installing the disc and booting XP, it *will*
actually let me install anti-virus apps. All of them.


Oh, and I'm really glad I downloaded AVG 8.5 as well. It gave me a chance
to check it out, because I haven't used it at all since I uninstalled v8
from my computer.

What a pile of crap. Reminded me why I uninstalled 8, and why I will NOT be
using 8.5. Too bad they ruined a good product.


PA Bear [MS MVP]

unread,
Apr 8, 2009, 1:46:26 PM4/8/09
to
Posting in the middle of the day? Did you lose your job or...?

Leythos

unread,
Apr 8, 2009, 3:40:13 PM4/8/09
to
In article <oA3Dl.28664$ZP4....@nlpi067.nbdc.sbc.com>, t...@void.com
says...

> Prove
> what you just said about my Remove-it updates
>

We've all shared the updates being put in the source authors application
many weeks ahead of your updates, and then they show up in your pirated
code.... Since we've been tracking this for close to 3 years, there have
been instances of fake trackers installed in the source authors
application that appear in 3 days to 2 weeks in yours. Since the fake
entries are not related to ANY known malware, there is no way you could
have "accidentally" created the same signature - since they are fake
entries.

The entire community laughs at you each time you repost your pirateware
showing the tracking markers that were inserted to prove you are a
pirate.

Troll Buster

unread,
Apr 8, 2009, 5:35:26 PM4/8/09
to
Can you answer my question or not?

--

Too many Trolls in this NG bashing each other. The
Information I post has been verified by me and is Authentic.

"PA Bear [MS MVP]" <PABe...@gmail.com> wrote in message
news:uMc1rLHu...@TK2MSFTNGP04.phx.gbl...

Troll Buster

unread,
Apr 8, 2009, 7:23:01 PM4/8/09
to
Why is it always we said she said he said with you, is that all you have?
why not post proof. You run your mouth all say talking about tracking her
for 3 years and fake entries that means you have proof, where is it?. I say
you are full of $hit a Troll that does not know when to quit. I get it
now... you think if you watch her long enough she is bound to make a mistake
right? You are a lost soul. One more thing I noticed, you keep claiming in
your obsessive-ness that she is stalking you yet I have not found any post
by her talking to you or any replies by her to any of your posts but you
constantly keep replying to her posts. No who is stalking who?You are the
stalker.


--
Too many Trolls in this NG bashing each other. The
Information I post has been verified by me and is Authentic.

"Leythos" <spam9...@rrohio.com> wrote in message
news:MPG.2446c7aab...@us.news.astraweb.com...

Mott the Hoople

unread,
Apr 8, 2009, 8:53:27 PM4/8/09
to
Troll Buster wrote:
> Why is it always we said she said he said with you, is that all you
> have? why not post proof. You run your mouth all say talking about
> tracking her for 3 years and fake entries that means you have proof,
> where is it?. I say you are full of $hit a Troll that does not know when
> to quit. I get it now... you think if you watch her long enough she is
> bound to make a mistake right? You are a lost soul. One more thing I
> noticed, you keep claiming in your obsessive-ness that she is stalking
> you yet I have not found any post by her talking to you or any replies
> by her to any of your posts but you constantly keep replying to her
> posts. No who is stalking who?You are the stalker.
>
>

let us see...

pcbutts1 impersonates leythos
pcbutts1 creates web page called leythosthestalker.com
pcbutts1 has placed statements about leythos in "his" signature

ergo, pcbutts1 actually stalks leythos

you don't have to be a card carrying member of mensa to know that
pcbutts1 is chris butts. those who have taken the time to do a little
research have noted much through historical information including the
registration of the web site pcbutts1.com and domicile. there are so
many public and private records to choose from.

historically pcbutts1 posts about HIS accident and says he knew the
driver fell asleep. the news article states christopher butts was
airlifted from the scene.
http://en.wikinews.org/wiki/NASA_van_rolls_off_California_mountain

hospital records show a male was airlifted from the scene and he is
black and has the same address as the address registered for
pcbutts1.com - coincidence?

hey in a few years you can join aarp as you are just about 46 now.

lets see, court records on butts and belch (no not a joke) and is a
public record. of course those camera shots weren't public but they are
on record. did you miss the camera in the court room? seems like the
pictures of you closely resemble those taken by the the news crew. and
the court order DEFENDANT SHALL REMOVE PLAINTIFF'S LIKENESS FROM ANY
SITES WHERE HE HAS PLACED IT. wow he, not she...

btw, do you shave your head or are you naturally bald? and you know
brian is so much taller than your mom. are all the men in the butts
family bald? do those scars around your right eye still hurt?

oh ** right, back on course

so did you know that if you read enough of the postings of pcbutts1 it
easy to tell your writing style?

yes patrick (ok, i know you really don't like being called that) we know
that this is just another 'nym of yours and many would call a "sock puppet."

the evidence is there in abundance it just isn't available to the
public. your problem patrick is before you had your accident, and i'm
really sorry you got hurt, you left a trail on the internet and a few
hundred euros and data mining did pay off.

and you have pissed off a few too many. a couple with deep pockets.
you know you can lie and cheat all you want but, it will come back to you.

btw; how is dear old mr. scott shafer?

are we having fun yet?

MTH


Leythos

unread,
Apr 8, 2009, 9:58:45 PM4/8/09
to
In article <spKdnTSie7pRrEDU...@giganews.com>,
tr...@buster.gio says...

> she is stalking you yet I have not found any post
> by her talking to you or any replies
>

Chris, your "talking to" and "replies" are in your sig, if you don't
like my defending myself then remove my name from your sig. When every
post by butts contains my name, in an attack, it's stalking.

Twayne

unread,
Apr 9, 2009, 10:09:23 AM4/9/09
to
Leythos wrote:
> In article <spKdnTSie7pRrEDU...@giganews.com>,
> tr...@buster.gio says...
>> she is stalking you yet I have not found any post
>> by her talking to you or any replies
>>
>
> Chris, your "talking to" and "replies" are in your sig, if you don't
> like my defending myself then remove my name from your sig. When every
> post by butts contains my name, in an attack, it's stalking.

But he is advertising who the better responders are that way at last.
Want to really piss it off? Everyone suddenly decide to ignore "it".
Won't happen, I know, but ... it does work. It gets madder first and
then just sort of fades away as it starves for attention & food.


Twayne

unread,
Apr 9, 2009, 10:20:57 AM4/9/09
to

IF that much is really known about him and it's accurate, then the sum
of the offended/stalked/etc. here could easily report him to his ISPs
and have his accounts closed.

I have my doubts about the validity of this information because it's
typed on a machine with no Shift key and if an online presence were
actually known, it would already be signed up to Warez accounts and so
much spam/malware its machine would have tumbled by now. Its posts have
at least collected several trolls into one place making them easy to ID
here and on Google for anyone wishing to avoid the trash. In the first
place nothing online can bother me at all, and in the second place I
could care less but I do check now & then for the entertainment value of
the idiots, trolls and suckers it draws together. Just let it die of
starvation.

Crash

unread,
Apr 9, 2009, 10:35:58 AM4/9/09
to

On Mon, 6 Apr 2009, The Real Truth [MS MVP] said about:
Re: Mal...where?


> Here is a list of everything my Remove-it software removes including all
> variants. Ignore the troll MVP Pa Bear he is jealous of me. The list is
> always changing.
>
> Alcan
> 404Search
> 7FaSSt
> AccessPlugin
> Accoona
> AceSpy
> Aconti dialer
> ActiveSearch
> ACXInstall Dialer
> Adbars
> AdBlaster
> Adbreak
> Adclicker
> AdsInContext
> AdWare Pro
> AdwareDelete

.....................big snip
Every known active malware?
So it's the magic bullet?
But no Agent.pz?

> Zafi
> Zindos
> zipcodec
> Zlob
> Zlob
> Zonebac
> Zotob
> Zuten


>
>
> --
> The Real Truth http://pcbutts1-therealtruth.blogspot.com/
> *WARNING* Do NOT follow any advice given by the people listed below.
> They do NOT have the expertise or knowledge to fix your issue. Do not waste
> your time.
> David H Lipman, Malke, PA Bear, Beauregard T. Shagnasty, Leythos.
>
>
>
>

> "sgopus" <sgo...@discussions.microsoft.com> wrote in message
> news:03939AE5-BBBA-4918...@microsoft.com...
> > nice that you say it works, but what does it remove? I wouldn't trust
> > something as generic as this myself.


> >
> > "Troll Buster" wrote:
> >
> >> Download the Remove-it software from here
> >> http://www.ms-mvp.org/ this file works. I have now used
> >> this fix on several computers and it does work.

.....................big snip

Well I'm just barely paying attention, so I'm
not sure which one of you is the crook.
Obviously one of you is a claim jumper and
horse thief, and should be dealt with
accordingly. I would gladly volunteer for
any such clean up duties after the trial.
But perhaps a more "Biblical" form of Justice
is warranted here.

In any case, the forums at Bleeping Computer
should quickly set the unsure to rest.
I believe Spybot has a similar, more specific
forum...probably slightly less esteemed.
(I would specifically ask about these specific
questionable software.)

After a recent bout with malware, I am sure
that everybody needs a backup installed browser
(such as Netscape7.2 or Opera) and a list of trusted
sites for both 1) downloading and 2) advice.

One of these guys (to the casual observer) has
ruined this forum for that. No doubt this info
gives him a little sticky boner, probably in his
mother's underwear. One can only hope that the
completion of puberty will cure his puerile fantasies
and petty perversions. ...or that his mother will
give the brat the good spanking he's obviously been
deprived of.



--
"Fascism should more properly be called
corporatism, since it is the merger
of state and corporate power."
- Benito Mussolini, father of fascism.

Leythos

unread,
Apr 9, 2009, 12:27:23 PM4/9/09
to
In article <#neMl5Ru...@TK2MSFTNGP05.phx.gbl>,
nob...@devnull.spamcop.net says...

> IF that much is really known about him and it's accurate, then the sum
> of the offended/stalked/etc. here could easily report him to his ISPs
> and have his accounts closed.
>

It's not that simple, and some things have worked for a period of time.

The hosting company has a generic TOS, the victim files a complaint, the
criminal is notified, the criminal only has to respond with "I dispute
the claim" and then the Hosting company washes its hands until a court
case orders them to remove the content, but they don't drop the
customer.

Many porn hosting companies have this method down well, they know
exactly what they have to do in order to follow the law exactly while
not following the intent, they have no honor or ethics, and that's why
people host at those locations.

PA Bear [MS MVP]

unread,
Apr 9, 2009, 12:44:56 PM4/9/09
to
<applause>

The Real Truth [MS MVP]

unread,
Apr 9, 2009, 4:48:09 PM4/9/09
to
The information is not true. Leythos the stalker thinks it is and has tried
too many times. Not he is blocked by my ISP why do you think he constantly
complains here. He's got nowhere else to go. That goes for everybody who
believes that crap and tries to complain about it.

--
The Real Truth http://pcbutts1-therealtruth.blogspot.com/
*WARNING* Do NOT follow any advice given by the people listed below.
They do NOT have the expertise or knowledge to fix your issue. Do not waste
your time.
David H Lipman, Malke, PA Bear, Beauregard T. Shagnasty, Leythos.


"Twayne" <nob...@devnull.spamcop.net> wrote in message
news:%23neMl5R...@TK2MSFTNGP05.phx.gbl...

Leythos

unread,
Apr 9, 2009, 6:36:00 PM4/9/09
to
In article <2atDl.22995$c45....@nlpi065.nbdc.sbc.com>, t...@void.com
says...

> The information is not true. Leythos the stalker thinks it is and has tried
> too many times. Not he is blocked by my ISP why do you think he constantly
> complains here. He's got nowhere else to go. That goes for everybody who
> believes that crap and tries to complain about it.
>

More lies and disinformation Chris.

I've never been blocked by any ISP/Provider, ever, and I've never had an
account canceled or terminated in my life.

I wasn't the one that wrote what you are commenting about, but you keep
stalking me in your sig lines, which is a crime and shows that you are
unethical.

My only complaints are your stalking me in your posts and your lying
about your actions.

Unknown

unread,
Apr 10, 2009, 11:52:48 AM4/10/09
to
Why do you insist on making an ass of yourself?

"The Real Truth [MS MVP]" <t...@void.com> wrote in message
news:2atDl.22995$c45....@nlpi065.nbdc.sbc.com...

Mike Torello

unread,
Apr 10, 2009, 12:57:52 PM4/10/09
to
"Unknown" <unk...@unknown.kom> wrote:

>Why do you insist on making an ass of yourself?

Step in front of a mirror and ask yourself why you bother to ask these
kind of questions? Who are you trying to impress? Him? Others you
ask? Everyone else? Or is it just that you are unable to curb your
self-righteous urges?

It's time for you to turn on the boob tube and watch Judge Joe Brown,
or are you more of a Martha Steward guy?

Tom [Pepper] Willett

unread,
Apr 10, 2009, 2:02:53 PM4/10/09
to

"Mike Torello" <tore...@chicoplt.com> wrote in message
:
: Step in front of a mirror and ask yourself why you bother to ask these

: kind of questions? Who are you trying to impress? Him? Others you
: ask? Everyone else? Or is it just that you are unable to curb your
: self-righteous urges?

More Hoopleheadedness.


Twayne

unread,
Apr 10, 2009, 7:16:52 PM4/10/09
to
Said troll unknown to the troll/poser dummy.

Twayne

unread,
Apr 10, 2009, 7:18:32 PM4/10/09
to
Mike Torello wrote:
> "Unknown" <unk...@unknown.kom> wrote:
>
>> Why do you insist on making an ass of yourself?
>
> Step in front of a mirror and ask yourself why you bother to ask these
> kind of questions? Who are you trying to impress? Him? Others you
> ask? Everyone else? Or is it just that you are unable to curb your
> self-righteous urges?
>
> It's time for you to turn on the boob tube and watch Judge Joe Brown,
> or are you more of a Martha Steward guy?

Are you even sure it's a guy? "It" seems to fit the best lately.
Absoutely no redeeming value except for the occasional entertainment
flare.

Unknown

unread,
Apr 10, 2009, 4:04:13 PM4/10/09
to

"Mike Torello" <tore...@chicoplt.com> wrote in message
news:oduut4dbrn8tbibai...@4ax.com...

> "Unknown" <unk...@unknown.kom> wrote:
>
>>Why do you insist on making an ass of yourself?
>
> Step in front of a mirror and ask yourself why you bother to ask these
> kind of questions?

To indicate to this particular poster that he's nuts in the hopes he ceases.

Who are you trying to impress?

No-one.


Him?
Most certainly not.---See first answer.
Others you ask?
No!

Everyone else?
Certainly not especially you.

Or is it just that you are unable to curb your
> self-righteous urges?

Nope! You just don't get it do you?

Is that why you just post insults?


>
> It's time for you to turn on the boob tube and watch Judge Joe Brown,
> or are you more of a Martha Steward guy?

There is a beach very close to where you live.
It is called North Avenue Beach.
There is a pier on that beach.
May I suggest yo go to that beach
Walk out on the pier and jump.

Reply all
Reply to author
Forward
0 new messages