🚀 go-pugleaf

Hello,

Use Unlocker to find out which process is preventing it from being deleted
http://ccollomb.free.fr/unlocker/

You can also use it to force-remove all file handles and delete the folder.

-- 
Regards,
Singapore Computer Home Repair Service
http://www.bootstrike.com/ComputerService/
Video Conversion VHS Video8 Hi8 Digital8 MiniDv MicroMv
http://www.bootstrike.com/VHSVideoConvert/
"Iapetus" <Iapetus@inbox.com> wrote in message news:h4pn9o$9pe$1@aioe.org...
>I have a unknown folder in the C:\ directory with 25 random capital 
>letters, currently VWJVFHNEGOVACCHMPVZEUOQJM.
>
> It's always empty and Windows will not delete it. If I erase it during 
> boot with any of several erase programs it will reappear again with 
> another 25 random capital letters.
>
> I've scanned the system with Avira, Avast and Malwarebytes with no 
> detection, apart from a false positive from Avira called 
> mikes-enhanced-dune2000-trainer.exe, downloaded from 
> http://michaelshadle.com/projects/dune2000/ and been using for a long time 
> without trouble.
>
>
> Anyone know what could be causing this directory to keep reappearing?
>
>
> Using XP Pro SP3.
> 

On 7/29/2009 8:15 PM, Iapetus wrote:
> I have a unknown folder in the C:\ directory with 25 random capital
> letters, currently VWJVFHNEGOVACCHMPVZEUOQJM.
>

You can try to track what is creating the folder with Process Monitor 
http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx which 
contains functionality of erstwhile sysinternals products filemon and 
regmon. Check out the page for a description.

HTH

--
Diabolic Preacher
As Is

From: "Diabolic Preacher" <dpreacher@helldrive.inc>

| On 7/29/2009 8:15 PM, Iapetus wrote:
>> I have a unknown folder in the C:\ directory with 25 random capital
>> letters, currently VWJVFHNEGOVACCHMPVZEUOQJM.


| You can try to track what is creating the folder with Process Monitor
| http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx which
| contains functionality of erstwhile sysinternals products filemon and
| regmon. Check out the page for a description.

| HTH

| --
| Diabolic Preacher
| As Is

Or use Process Explorer to do likewise.
http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx

-- 
Dave
http://www.claymania.com/removal-trojan-adware.html
Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp 

On Thu, 30 Jul 2009 02:41:43 +0800, Singapore Computer Service wrote:

> Hell

< http://www.anta.net/misc/nnq/nquote.shtml >

FYI

Singapore Computer Service wrote:
> Hello,
> 
> Use Unlocker to find out which process is preventing it from being deleted
> http://ccollomb.free.fr/unlocker/
> 
> You can also use it to force-remove all file handles and delete the folder.
> 

It says no handle found. When unlocker deletes the folder another appears.

David H. Lipman wrote:
> From: "Diabolic Preacher" <dpreacher@helldrive.inc>
> 
> | On 7/29/2009 8:15 PM, Iapetus wrote:
>>> I have a unknown folder in the C:\ directory with 25 random capital
>>> letters, currently VWJVFHNEGOVACCHMPVZEUOQJM.
> 
> 
> | You can try to track what is creating the folder with Process Monitor
> | http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx which
> | contains functionality of erstwhile sysinternals products filemon and
> | regmon. Check out the page for a description.
> 
> | HTH
> 
> | --
> | Diabolic Preacher
> | As Is
> 
> Or use Process Explorer to do likewise.
> http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx
> 

As it's created during the boot up Process Explorer or Monitor wont be 
able to say what program is causing its creation.

Iapetus <Iapetus@inbox.com> pinched out a steaming pile 
of<h4s6nm$t2i$1@aioe.org>:

>David H. Lipman wrote:
>> From: "Diabolic Preacher" <dpreacher@helldrive.inc>
>> 
>> | On 7/29/2009 8:15 PM, Iapetus wrote:
>>>> I have a unknown folder in the C:\ directory with 25 random 
capital
>>>> letters, currently VWJVFHNEGOVACCHMPVZEUOQJM.
>> 
>> 
>> | You can try to track what is creating the folder with Process 
Monitor
>> | http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx 
which
>> | contains functionality of erstwhile sysinternals products filemon 
and
>> | regmon. Check out the page for a description.
>> 
>> | HTH
>> 
>> | --
>> | Diabolic Preacher
>> | As Is
>> 
>> Or use Process Explorer to do likewise.
>> http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx
>> 
>
>As it's created during the boot up Process Explorer or Monitor wont be 
>able to say what program is causing its creation.
>
Rooot Kiiiiiiit.

^_^



-- 
http://www.youtube.com/watch?v=COaoYqkpkUA
cageprisoners.com|www.snuhwolf.9f.com|www.eyeonpalin.org
   _____  ____  ____ __ /\_/\ __      _ ______   _____
  / __/ |/ / / / / // // . . \\ \ |\ | / __ \ \  \  __\
 _\ \/    / /_/ / _  / \     / \ \| \| \ \_\ \ \__\  _\
/___/_/|_/\____/_//_/   \_@_/   \__|\__|\____/\____\_\

"Iapetus"  wrote

> As it's created during the boot up Process Explorer or Monitor wont be
> able to say what program is causing its creation.

maybe x-setup or another startup manager could help you.
http://www.x-setup.net/

Iapetus wrote:
> I have a unknown folder in the C:\ directory with 25 random capital
> letters, currently VWJVFHNEGOVACCHMPVZEUOQJM.
> 
> It's always empty and Windows will not delete it. If I erase it during
> boot with any of several erase programs it will reappear again with
> another 25 random capital letters.
> 
> I've scanned the system with Avira, Avast and Malwarebytes with no
> detection, apart from a false positive from Avira called
> mikes-enhanced-dune2000-trainer.exe, downloaded from
> http://michaelshadle.com/projects/dune2000/ and been using for a long
> time without trouble.
> 
> 
> Anyone know what could be causing this directory to keep reappearing?
> 
> 
> Using XP Pro SP3.

Hello Iapetus:

In the event that ���hw��f is correct, try running GMER:

             <http://www.gmer.net/#files>

HTH

Pete
-- 
1PW  @?6A62?FEH9:DE=6o2@=]4@> [r4o7t]

From: "Iapetus" <Iapetus@inbox.com>

| David H. Lipman wrote:
>> From: "Diabolic Preacher" <dpreacher@helldrive.inc>

>> | On 7/29/2009 8:15 PM, Iapetus wrote:
>>>> I have a unknown folder in the C:\ directory with 25 random capital
>>>> letters, currently VWJVFHNEGOVACCHMPVZEUOQJM.


>> | You can try to track what is creating the folder with Process Monitor
>> | http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx which
>> | contains functionality of erstwhile sysinternals products filemon and
>> | regmon. Check out the page for a description.

>> | HTH

>> | --
>> | Diabolic Preacher
>> | As Is

>> Or use Process Explorer to do likewise.
>> http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx


| As it's created during the boot up Process Explorer or Monitor wont be
| able to say what program is causing its creation.


Then it could be protected by a RootKit and is hidden by the OS such as in an ADS or at 
least controlled through priveledges.

Run a full scan with Gmer.
http://www.gmer.net/

-- 
Dave
http://www.claymania.com/removal-trojan-adware.html
Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp 

On Wed, 29 Jul 2009 15:45:08 +0100, Iapetus wrote:

> Stuff

I went to the grave of the unknown folder once. At least, I think that's 
what it was. Y'see I was young at the time and hadn't yet learnt to read.

On Thu, 30 Jul 2009 18:09:54 -0400, "David H. Lipman"
<DLipman~nospam~@Verizon.Net> wrote:

>Run a full scan with Gmer.
>http://www.gmer.net/

Pretty geeky! :) Have you found it more effective than others?

Art

From: "Art" <null@zilch.com>

| On Thu, 30 Jul 2009 18:09:54 -0400, "David H. Lipman"
| <DLipman~nospam~@Verizon.Net> wrote:

>>Run a full scan with Gmer.
>>http://www.gmer.net/

| Pretty geeky! :) Have you found it more effective than others?

| Art

Yes and I have contact with the author.
Gmer just recently updated his Anti RootKit scanner for the latest TDSS threats.

-- 
Dave
http://www.claymania.com/removal-trojan-adware.html
Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp 

On Fri, 31 Jul 2009 16:17:46 -0400, "David H. Lipman"
<DLipman~nospam~@Verizon.Net> wrote:

>From: "Art" <null@zilch.com>
>
>| On Thu, 30 Jul 2009 18:09:54 -0400, "David H. Lipman"
>| <DLipman~nospam~@Verizon.Net> wrote:
>
>>>Run a full scan with Gmer.
>>>http://www.gmer.net/
>
>| Pretty geeky! :) Have you found it more effective than others?
>
>| Art
>
>Yes and I have contact with the author.
>Gmer just recently updated his Anti RootKit scanner for the latest TDSS threats.

How do you use it? I downloaded it and ran a full scan. It filled the
scan window with hundreds of paths/filenames, but nothing seemed to be
highlighted as any kind of threat. Did I miss anything, or is that how
it is?

From: "Spriva" <tamaran@hivenine.org>

| On Fri, 31 Jul 2009 16:17:46 -0400, "David H. Lipman"
| <DLipman~nospam~@Verizon.Net> wrote:

>>From: "Art" <null@zilch.com>

>>| On Thu, 30 Jul 2009 18:09:54 -0400, "David H. Lipman"
>>| <DLipman~nospam~@Verizon.Net> wrote:

>>>>Run a full scan with Gmer.
>>>>http://www.gmer.net/

>>| Pretty geeky! :) Have you found it more effective than others?

>>| Art

>>Yes and I have contact with the author.
>>Gmer just recently updated his Anti RootKit scanner for the latest TDSS threats.

| How do you use it? I downloaded it and ran a full scan. It filled the
| scan window with hundreds of paths/filenames, but nothing seemed to be
| highlighted as any kind of threat. Did I miss anything, or is that how
| it is?


Most threats would be in Red.  Others listings are more subtle to recognize.  Limit them 
by closing as much running software as possible.
Read the Gmer example pages for hints.

-- 
Dave
http://www.claymania.com/removal-trojan-adware.html
Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp 

 Spriva <tamaran@hivenine.org> wrote:

>>Yes and I have contact with the author.
>>Gmer just recently updated his Anti RootKit scanner for the latest TDSS threats.

>How do you use it? I downloaded it and ran a full scan. It filled the
>scan window with hundreds of paths/filenames, but nothing seemed to be
>highlighted as any kind of threat. Did I miss anything, or is that how
>it is?

Do you read? http://en.wikipedia.org/wiki/Rootkit

Or would you rather a PayPal account be set up for you.

Of course you didn't run this Gmer program from your OS, use a USB
boot drive or BOOT CD, the HP program SP27213.exe can create a
bootable USB pen drive, freebies.
-- 

Wilt Chamberlain and Andre the Giant -- holding up Arnold Schwarzenegger (on the set of Conan).
http://theselvedgeyard.files.wordpress.com/2009/07/andreconanwilt.jpg

David H. Lipman wrote:
> From: "Spriva" <tamaran@hivenine.org>
> 
[...]| How do you use it? I downloaded it and ran a full scan. It filled the
> | scan window with hundreds of paths/filenames, but nothing seemed to be
> | highlighted as any kind of threat. Did I miss anything, or is that how
> | it is?
> 
> 
> Most threats would be in Red.  Others listings are more subtle to recognize.  Limit them 
> by closing as much running software as possible.
> Read the Gmer example pages for hints.
> 

I've installed Ubuntu, along with XP and Win7. GMER listed only MBR 
sectors, some were marked "rootkit like behaviour". I suspect GMER is 
picking up grub's replacement of the Windows MBR. I don't see any 
evidence of bad behaviour in Windows, so I don't think GMER's warnings 
are serious. Is this a reasonable inference?

TIA
wolf k.

From: "Wolf K" <wekirch@sympatico.ca>

| David H. Lipman wrote:
>> From: "Spriva" <tamaran@hivenine.org>

[...]|| How do you use it? I downloaded it and ran a full scan. It filled the
>> | scan window with hundreds of paths/filenames, but nothing seemed to be
>> | highlighted as any kind of threat. Did I miss anything, or is that how
>> | it is?


>> Most threats would be in Red.  Others listings are more subtle to recognize.  Limit
>> them
>> by closing as much running software as possible.
>> Read the Gmer example pages for hints.


| I've installed Ubuntu, along with XP and Win7. GMER listed only MBR
| sectors, some were marked "rootkit like behaviour". I suspect GMER is
| picking up grub's replacement of the Windows MBR. I don't see any
| evidence of bad behaviour in Windows, so I don't think GMER's warnings
| are serious. Is this a reasonable inference?

| TIA
| wolf k.

Yes.  A second opionion on the LOG wouldn't hurt.

-- 
Dave
http://www.claymania.com/removal-trojan-adware.html
Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp 

Wolf K wrote:
> David H. Lipman wrote:
>> From: "Spriva" <tamaran@hivenine.org>
>>
> [...]| How do you use it? I downloaded it and ran a full scan. It filled
> the
>> | scan window with hundreds of paths/filenames, but nothing seemed to be
>> | highlighted as any kind of threat. Did I miss anything, or is that how
>> | it is?
>>
>>
>> Most threats would be in Red.  Others listings are more subtle to
>> recognize.  Limit them by closing as much running software as possible.
>> Read the Gmer example pages for hints.
>>
> 
> I've installed Ubuntu, along with XP and Win7. GMER listed only MBR
> sectors, some were marked "rootkit like behaviour". I suspect GMER is
> picking up grub's replacement of the Windows MBR. I don't see any
> evidence of bad behaviour in Windows, so I don't think GMER's warnings
> are serious. Is this a reasonable inference?
> 
> TIA
> wolf k.

Hello Wolf & Dave:

The most recent GMER (1.0.15.15011), when run on my (GRUB) dual-boot
RHEL5/XP Pro SP3 x86 32bit system, fails to show any comments like
"rootkit like behaviour".

However, this might best be described as comparing apples to oranges
and could be inconclusive without further and much closer like
comparisons.

HTH

Pete
-- 
1PW  @?6A62?FEH9:DE=6o2@=]4@> [r4o7t]

From: "1PW" <barcrnahgjuvfgy@nby.pbz>


| Hello Wolf & Dave:

| The most recent GMER (1.0.15.15011), when run on my (GRUB) dual-boot
| RHEL5/XP Pro SP3 x86 32bit system, fails to show any comments like
| "rootkit like behaviour".

| However, this might best be described as comparing apples to oranges
| and could be inconclusive without further and much closer like
| comparisons.

| HTH

| Pete
| -- 
| 1PW  @?6A62?FEH9:DE=6o2@=]4@> [r4o7t]

Gmer has to run from within the possibly affected OS.

-- 
Dave
http://www.claymania.com/removal-trojan-adware.html
Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp 

Pennywise@DerryMaine.Gov wrote in
news:kug7759qr7o77vo2o2rulrab8uicpuvokv@4ax.com: 

>  Spriva <tamaran@hivenine.org> wrote:
> 
>>>Yes and I have contact with the author.
>>>Gmer just recently updated his Anti RootKit scanner for the latest
>>>TDSS threats. 
> 
>>How do you use it? I downloaded it and ran a full scan. It filled the
>>scan window with hundreds of paths/filenames, but nothing seemed to be
>>highlighted as any kind of threat. Did I miss anything, or is that how
>>it is?
> 
> Do you read? http://en.wikipedia.org/wiki/Rootkit
> 
> Or would you rather a PayPal account be set up for you.
> 
> Of course you didn't run this Gmer program from your OS, use a USB
> boot drive or BOOT CD, the HP program SP27213.exe can create a
> bootable USB pen drive, freebies.

Gmer should be run from the affected host. I don't know where your 
getting your information from.



-- 
Regards,
Dustin Cook
Malware Researcher
MalwareBytes - http://www.malwarebytes.org
  

David H. Lipman wrote:
> From: "1PW" <barcrnahgjuvfgy@nby.pbz>
> 
> 
> | Hello Wolf & Dave:
> 
> | The most recent GMER (1.0.15.15011), when run on my (GRUB) dual-boot
> | RHEL5/XP Pro SP3 x86 32bit system, fails to show any comments like
> | "rootkit like behaviour".
> 
> | However, this might best be described as comparing apples to oranges
> | and could be inconclusive without further and much closer like
> | comparisons.
> 
> | HTH
> 
> | Pete
> | -- 
> | 1PW  @?6A62?FEH9:DE=6o2@=]4@> [r4o7t]
> 
> Gmer has to run from within the possibly affected OS.

Hello Dave:

Yes.  During my above test, I booted into XP Pro where the latest GMER
ran unvirtualized.  I did /not/ run GMER under Red Hat Linux with
Wine.  I apologize if I hadn't made all as clear as I should.

Hence, my GMER (running totally under XP) was able to /see/ my
probable Red Hat Enterprise Linux modified boot block, but reported
nothing suspicious.

Warm regards to all,

Pete
-- 
1PW  @?6A62?FEH9:DE=6o2@=]4@> [r4o7t]

From: "G. Morgan" <usenet_abuse@gawab.com>

| David H. Lipman wrote:

>>Gmer has to run from within the possibly affected OS.

| Has the report gotten any easier to decipher for the layman?  I tried it 2
| years ago and had to email the author for his interpretation because frankly,
| I didn't understand it.


Because of the low level nature of its functionality, there are always areas that may need 
more expert interpretation.  Most well known malware and hooks will however be identified.

-- 
Dave
http://www.claymania.com/removal-trojan-adware.html
Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp 

On Sat, 01 Aug 2009 20:01:04 -0400, David H. Lipman wrote:

> From: "G. Morgan" <usenet_abuse@gawab.com>
> 
> | David H. Lipman wrote:
> 
>>>Gmer has to run from within the possibly affected OS.
> 
> | Has the report gotten any easier to decipher for the layman?  I tried
> it 2 | years ago and had to email the author for his interpretation
> because frankly, | I didn't understand it.
> 
> 
> Because of the low level nature of its functionality, there are always
> areas that may need more expert interpretation.  Most well known malware
> and hooks will however be identified.

Please set your newsreader's (ha-ha) configuration to use a caret (>) to 
mark the beginning of lines of quoted text. Because you are using the pipe 
symbol (|) to do this, it makes it difficult to decipher who said what for 
those of us who use proper newsreaders which colour code different depths 
of quotes. In my newsreader what the most recent poster wrote is coded 
black, what he has quoted of the previous post has lines beginning with a 
caret and colour coded green, what he has quoted of the post before that 
has lines beginning with two carets and coded orange and so on.

When I read a reply that you posted to someone, what you wrote is the same 
is in black text. Because you used the pipe symbol to quote lines a proper 
newsreader doesn't recognise that as quoted text and therefore it shows up 
black, just like yours. 

Half the time when I'm reading a posted reply from you, I'll read most of 
what you are quoting before I realise there's a pipe symbol somewhere in a 
line of text and that I'm reading the previous post again.

You'll notice that above, where I've quoted your post, my newsreader has 
placed a caret symbol in front of every quoted line of text. The only way 
for anyone to tell that some is what you wrote and that some possibly 
isn't is the fact that some of the lines of text contain pipe symbols in 
random places. At the beginning of lines of text I've quoted, if you wrote 
it, they should begin with one caret, anything written by a previous 
poster with two carets, three for quoted text from the poster before that 
and so on.

Thanks in advance for your consideration.

From: "Aardvark" <aardvark@youllnever.know>

| On Sat, 01 Aug 2009 20:01:04 -0400, David H. Lipman wrote:

>> From: "G. Morgan" <usenet_abuse@gawab.com>

>> | David H. Lipman wrote:

>>>>Gmer has to run from within the possibly affected OS.

>> | Has the report gotten any easier to decipher for the layman?  I tried
>> it 2 | years ago and had to email the author for his interpretation
>> because frankly, | I didn't understand it.


>> Because of the low level nature of its functionality, there are always
>> areas that may need more expert interpretation.  Most well known malware
>> and hooks will however be identified.

| Please set your newsreader's (ha-ha) configuration to use a caret (>) to
| mark the beginning of lines of quoted text. Because you are using the pipe
| symbol (|) to do this, it makes it difficult to decipher who said what for
| those of us who use proper newsreaders which colour code different depths
| of quotes. In my newsreader what the most recent poster wrote is coded
| black, what he has quoted of the previous post has lines beginning with a
| caret and colour coded green, what he has quoted of the post before that
| has lines beginning with two carets and coded orange and so on.

| When I read a reply that you posted to someone, what you wrote is the same
| is in black text. Because you used the pipe symbol to quote lines a proper
| newsreader doesn't recognise that as quoted text and therefore it shows up
| black, just like yours.

| Half the time when I'm reading a posted reply from you, I'll read most of
| what you are quoting before I realise there's a pipe symbol somewhere in a
| line of text and that I'm reading the previous post again.

| You'll notice that above, where I've quoted your post, my newsreader has
| placed a caret symbol in front of every quoted line of text. The only way
| for anyone to tell that some is what you wrote and that some possibly
| isn't is the fact that some of the lines of text contain pipe symbols in
| random places. At the beginning of lines of text I've quoted, if you wrote
| it, they should begin with one caret, anything written by a previous
| poster with two carets, three for quoted text from the poster before that
| and so on.

| Thanks in advance for your consideration.


-- 
Dave
http://www.claymania.com/removal-trojan-adware.html
Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp 

From: "Aardvark" <aardvark@youllnever.know>

| On Sat, 01 Aug 2009 20:01:04 -0400, David H. Lipman wrote:

>> From: "G. Morgan" <usenet_abuse@gawab.com>

>> | David H. Lipman wrote:

>>>>Gmer has to run from within the possibly affected OS.

>> | Has the report gotten any easier to decipher for the layman?  I tried
>> it 2 | years ago and had to email the author for his interpretation
>> because frankly, | I didn't understand it.


>> Because of the low level nature of its functionality, there are always
>> areas that may need more expert interpretation.  Most well known malware
>> and hooks will however be identified.

| Please set your newsreader's (ha-ha) configuration to use a caret (>) to
| mark the beginning of lines of quoted text. Because you are using the pipe
| symbol (|) to do this, it makes it difficult to decipher who said what for
| those of us who use proper newsreaders which colour code different depths
| of quotes. In my newsreader what the most recent poster wrote is coded
| black, what he has quoted of the previous post has lines beginning with a
| caret and colour coded green, what he has quoted of the post before that
| has lines beginning with two carets and coded orange and so on.

| When I read a reply that you posted to someone, what you wrote is the same
| is in black text. Because you used the pipe symbol to quote lines a proper
| newsreader doesn't recognise that as quoted text and therefore it shows up
| black, just like yours.

| Half the time when I'm reading a posted reply from you, I'll read most of
| what you are quoting before I realise there's a pipe symbol somewhere in a
| line of text and that I'm reading the previous post again.

| You'll notice that above, where I've quoted your post, my newsreader has
| placed a caret symbol in front of every quoted line of text. The only way
| for anyone to tell that some is what you wrote and that some possibly
| isn't is the fact that some of the lines of text contain pipe symbols in
| random places. At the beginning of lines of text I've quoted, if you wrote
| it, they should begin with one caret, anything written by a previous
| poster with two carets, three for quoted text from the poster before that
| and so on.

| Thanks in advance for your consideration.

I will give it due consideration.

-- 
Dave
http://www.claymania.com/removal-trojan-adware.html
Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp 

On Sat, 01 Aug 2009 20:48:48 -0400, David H. Lipman wrote:

>> Thanks in advance for your consideration.
> 
> I will give it due consideration.

It would seem that you didn't.

From: "Aardvark" <aardvark@youllnever.know>

| On Sat, 01 Aug 2009 20:48:48 -0400, David H. Lipman wrote:

>>> Thanks in advance for your consideration.

>> I will give it due consideration.

| It would seem that you didn't.


I wrote I would consider it.  I ddi NOT write nor in any way indicate that I would make 
the change ASAP.

Your reply has has thus lowered the consideration of the request in my queue.

-- 
Dave
http://www.claymania.com/removal-trojan-adware.html
Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp 

"David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote in
news:h52q470pbo@news7.newsguy.com: 

> From: "Aardvark" <aardvark@youllnever.know>
> 
>| On Sat, 01 Aug 2009 20:48:48 -0400, David H. Lipman wrote:
> 
>>>> Thanks in advance for your consideration.
> 
>>> I will give it due consideration.
> 
>| It would seem that you didn't.
> 
> 
> I wrote I would consider it.  I ddi NOT write nor in any way indicate
> that I would make the change ASAP.
> 
> Your reply has has thus lowered the consideration of the request in my
> queue. 
> 

It was already circling the drain wasn't it? :)


-- 
Regards,
Dustin Cook
Malware Researcher
MalwareBytes - http://www.malwarebytes.org
  

From: "Dustin Cook" <bughunter.dustin@gmail.com>

| "David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote in
| news:h52q470pbo@news7.newsguy.com:

>> From: "Aardvark" <aardvark@youllnever.know>

>>| On Sat, 01 Aug 2009 20:48:48 -0400, David H. Lipman wrote:

>>>>> Thanks in advance for your consideration.

>>>> I will give it due consideration.

>>| It would seem that you didn't.


>> I wrote I would consider it.  I ddi NOT write nor in any way indicate
>> that I would make the change ASAP.

>> Your reply has has thus lowered the consideration of the request in my
>> queue.


| It was already circling the drain wasn't it? :)


Right down the drain "Pan".  :-)


-- 
Dave
http://www.claymania.com/removal-trojan-adware.html
Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp 

"Dustin Cook" <bughunter.dustin@gmail.com> wrote in message 
news:Xns9C5ADC9C3F27HHI2948AJD832@69.16.185.250...
> "David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote in
> news:h52q470pbo@news7.newsguy.com:
>
>> From: "Aardvark" <aardvark@youllnever.know>
>>
>>| On Sat, 01 Aug 2009 20:48:48 -0400, David H. Lipman wrote:
>>
>>>>> Thanks in advance for your consideration.
>>
>>>> I will give it due consideration.
>>
>>| It would seem that you didn't.
>>
>>
>> I wrote I would consider it.  I ddi NOT write nor in any way indicate
>> that I would make the change ASAP.
>>
>> Your reply has has thus lowered the consideration of the request in 
>> my
>> queue.
>>
>
> It was already circling the drain wasn't it? :)

That "due consideration" took nanoseconds I'll bet. :oD 

 Dustin Cook <bughunter.dustin@gmail.com> wrote:

>Pennywise@DerryMaine.Gov wrote in
>news:kug7759qr7o77vo2o2rulrab8uicpuvokv@4ax.com: 
>
>>  Spriva <tamaran@hivenine.org> wrote:

>>>>Yes and I have contact with the author.
>>>>Gmer just recently updated his Anti RootKit scanner for the latest
>>>>TDSS threats. 
>> 
>>>How do you use it? I downloaded it and ran a full scan. It filled the
>>>scan window with hundreds of paths/filenames, but nothing seemed to be
>>>highlighted as any kind of threat. Did I miss anything, or is that how
>>>it is?

>> Do you read? http://en.wikipedia.org/wiki/Rootkit
>> 
>> Or would you rather a PayPal account be set up for you.
>> 
>> Of course you didn't run this Gmer program from your OS, use a USB
>> boot drive or BOOT CD, the HP program SP27213.exe can create a
>> bootable USB pen drive, freebies.

>Gmer should be run from the affected host. I don't know where your 
>getting your information from.

Run a few

IceSword122en
catchme.exe
mbr.exe
szfstxxx.exe
RootkitRevealer.zip
rku
Rootkit_RKU_Results.txt
ossec-agent-win32-2.0_RootKitFinder.exe
gmer.exe
DarkSpy105.exe
DarkSpy105Help.chm
RootkitRevealer.exe
RootkitRevealer.chm
Eula.txt
New Text Document_second_Try.txt
RootkitReveal_Reviels.txt
sanitySetup.exe

And done my reading

"The best, and most reliable, method for operating system-level
rootkit detection is to shut down the computer suspected of infection,
and then to check its storage by booting from an alternative trusted
medium (e.g. a rescue CD-ROM or USB flash drive)[citation needed]. A
non-running rootkit cannot actively hide its presence, and most
established antivirus programs will identify rootkits armed via
standard OS calls (which are often tampered with by the rootkit) and
lower level queries, which ought to remain reliable. If there is a
difference, the presence of a rootkit infection should be assumed.
Running rootkits attempt to protect themselves by monitoring running
processes and suspending their activity until the scanning has
finished; this is more difficult if the rootkit is not allowed to
run.[citation needed]"
http://en.wikipedia.org/wiki/Rootkit

Citations needed, if you have a problem with the answer, edit it.
-- 

Horse Ride
http://www.onahorse.com/

<Pennywise@DerryMaine.Gov> wrote in message 
news:76v975t7j3c2pghsjt66bo0vbpvo5g568v@4ax.com...

> "The best, and most reliable, method for operating system-level
> rootkit detection is to shut down the computer suspected of infection,
> and then to check its storage by booting from an alternative trusted
> medium (e.g. a rescue CD-ROM or USB flash drive)[citation needed].

[...]

Wikipedia is good, but this describes everyday malware detection, not 
rootkit activity. 

 "FromTheRafters" <erratic@nomail.afraid.org> wrote:

><Pennywise@DerryMaine.Gov> wrote in message 
>news:76v975t7j3c2pghsjt66bo0vbpvo5g568v@4ax.com...
>
>> "The best, and most reliable, method for operating system-level
>> rootkit detection is to shut down the computer suspected of infection,
>> and then to check its storage by booting from an alternative trusted
>> medium (e.g. a rescue CD-ROM or USB flash drive)[citation needed].

>[...]

>Wikipedia is good, but this describes everyday malware detection, not 
>rootkit activity. 

Dark Spy:

"4.run get script with boot CD -> Offline Analyze-> run set script
with boot CD:use this solution, you should have a boot CD. First
generate the boot scripts (e.g. if you select XX for the new file
name, and the script will be XX_get.cmd and XX_set.cmd). Then
successfully restart your computer, and run get script ( XX_get.cmd )
with the boot CD, at this time you will have two more files (XX,
XX.log), the non-log file ( XX )is the hive you want to deal with.
Edit and save, then restart the computer again and run set script (
XX_set.cmd )."

5.Offline Analyze:Analyze the saved hive file. usage: Click"Offline
Analyze",then select the hive to analyze (view and edit).


These are out of order, 5) is a part of the programs Functionalities
(sic), 4) is how to do it.
-- 

Horse Ride
http://www.onahorse.com/

On Sat, 01 Aug 2009 22:21:20 -0400, David H. Lipman wrote:

> From: "Dustin Cook" <bughunter.dustin@gmail.com>
> 
> | "David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote in |
> news:h52q470pbo@news7.newsguy.com:
> 
>>> From: "Aardvark" <aardvark@youllnever.know>
> 
>>>| On Sat, 01 Aug 2009 20:48:48 -0400, David H. Lipman wrote:
> 
>>>>>> Thanks in advance for your consideration.
> 
>>>>> I will give it due consideration.
> 
>>>| It would seem that you didn't.
> 
> 
>>> I wrote I would consider it.  I ddi NOT write nor in any way indicate
>>> that I would make the change ASAP.
> 
>>> Your reply has has thus lowered the consideration of the request in my
>>> queue.
> 
> 
> | It was already circling the drain wasn't it? :)
> 
> 
> Right down the drain "Pan".  :-)

Welcome to my bozo bin. If your words are too difficult to separate from 
words of others that you quote in their posts, I'm not going to make the 
effort. Life's too fucking short.

From: "Aardvark" <aardvark@youllnever.know>

| On Sat, 01 Aug 2009 22:21:20 -0400, David H. Lipman wrote:

>> From: "Dustin Cook" <bughunter.dustin@gmail.com>

>> | "David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote in |
>> news:h52q470pbo@news7.newsguy.com:

>>>> From: "Aardvark" <aardvark@youllnever.know>

>>>>| On Sat, 01 Aug 2009 20:48:48 -0400, David H. Lipman wrote:

>>>>>>> Thanks in advance for your consideration.

>>>>>> I will give it due consideration.

>>>>| It would seem that you didn't.


>>>> I wrote I would consider it.  I ddi NOT write nor in any way indicate
>>>> that I would make the change ASAP.

>>>> Your reply has has thus lowered the consideration of the request in my
>>>> queue.


>> | It was already circling the drain wasn't it? :)


>> Right down the drain "Pan".  :-)

| Welcome to my bozo bin. If your words are too difficult to separate from
| words of others that you quote in their posts, I'm not going to make the
| effort. Life's too f**king short.

Thank you !

Obviously the world revolves around you.

You have a problem with Pan you want me to change the way I post when YOU can fix Pan or 
use another NNTP client.

-- 
Dave
http://www.claymania.com/removal-trojan-adware.html
Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp 

On Sun, 02 Aug 2009 09:45:28 -0400, above the shrieking, whining & FUDding
of the trolls David H. Lipman was heard to say:

> From: "Aardvark" <aardvark@youllnever.know>
> 
> | On Sat, 01 Aug 2009 22:21:20 -0400, David H. Lipman wrote:
> 
>>> From: "Dustin Cook" <bughunter.dustin@gmail.com>
> 
>>> | "David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote in |
>>> news:h52q470pbo@news7.newsguy.com:
> 
>>>>> From: "Aardvark" <aardvark@youllnever.know>
> 
>>>>>| On Sat, 01 Aug 2009 20:48:48 -0400, David H. Lipman wrote:
> 
>>>>>>>> Thanks in advance for your consideration.
> 
>>>>>>> I will give it due consideration.
> 
>>>>>| It would seem that you didn't.
> 
> 
>>>>> I wrote I would consider it.  I ddi NOT write nor in any way
>>>>> indicate that I would make the change ASAP.
> 
>>>>> Your reply has has thus lowered the consideration of the request in
>>>>> my queue.
> 
> 
>>> | It was already circling the drain wasn't it? :)
> 
> 
>>> Right down the drain "Pan".  :-)
> 
> | Welcome to my bozo bin. If your words are too difficult to separate
> from | words of others that you quote in their posts, I'm not going to
> make the | effort. Life's too f**king short.
> 
> Thank you !
> 
> Obviously the world revolves around you.
> 
> You have a problem with Pan you want me to change the way I post when
> YOU can fix Pan or use another NNTP client.

X-Newsreader: Microsoft Outlook Express 6.00.2900.5512

Figures, an idiot that can't use his newsreader properly. 

In MS Outlook Express you need to select the <Tools> drop-down menu, and
from that select <Options>.  Click on the tab that says <Send> and make
sure that you have "Plain Text" selected under "Mail Sending Format". 
Click on <Plain Text Settings...> and make sure the box to the left of
"Indent the original text with" is checked, and ">" is selected in the
box to the right.  Click on <Apply> and then on <OK> and you are all set


Though he probably still won't bother.

<PLONK>


-- 
It takes time, this. One slight error in any of my thirteen billion 
calculations and we'll be blasted to smithereens. 
Here we go, then: 10, 9, 8, 6, 5--
--Holly - Red Dwarf--

Aardvark wrote:
[...]
> You'll notice that above, where I've quoted your post, my newsreader has 
> placed a caret symbol in front of every quoted line of text. 
[...]

Only in the Compose window (this one). In the Message window, I see 
vertical lines.

IOW, how a quotes are displayed depends on _your_ newsreader's settings.

Change them, if it matters that much to you.

wolf k.

On Sun, 02 Aug 2009 11:55:32 -0400, Wolf K wrote:

> Aardvark wrote:
> [...]
>> You'll notice that above, where I've quoted your post, my newsreader
>> has placed a caret symbol in front of every quoted line of text.
> [...]
> 
> Only in the Compose window (this one). In the Message window, I see
> vertical lines.
> 
> IOW, how a quotes are displayed depends on _your_ newsreader's settings.
> 
> Change them, if it matters that much to you.
> 

Why would I change my quote marks to a non-conforming, non-standard 
character?

< http://www.netmeister.org/news/learn2quote3.html >

"3. Quotationmarks
3.1 Which character should I use to mark the quoted text?

Use the "Greater-Than" character (">"). This character is recognized as a 
quotation mark by almost every newsreader and is mentioned in the 
netiquette as such for technical reasons (Son-Of-RFC 1036 and successors)."

It's up to users of applications which don't conform with accepted 
standards to reconfigure them to conform to standards, not for those who 
have conforming software to make it non-conforming.

"Aardvark" <aardvark@youllnever.know> wrote in message 
news:GGgdm.120696$OA1.29800@newsfe29.ams2...

> Welcome to my bozo bin. If your words are too difficult to separate 
> from
> words of others that you quote in their posts, I'm not going to make 
> the
> effort. Life's too fucking short.

You're the one  who's newsreader is using crayons to write with. 

"FromTheRafters" <erratic@nomail.afraid.org> wrote in
news:h5514v$cl6$1@news.eternal-september.org: 

> "Aardvark" <aardvark@youllnever.know> wrote in message 
> news:GGgdm.120696$OA1.29800@newsfe29.ams2...
> 
>> Welcome to my bozo bin. If your words are too difficult to separate 
>> from
>> words of others that you quote in their posts, I'm not going to make 
>> the
>> effort. Life's too fucking short.
> 
> You're the one  who's newsreader is using crayons to write with. 
> 
> 
> 

Ouch... Anybody keeping score? :)


-- 
Regards,
Dustin Cook
Malware Researcher
MalwareBytes - http://www.malwarebytes.org
  

Pennywise@DerryMaine.Gov wrote in
news:76v975t7j3c2pghsjt66bo0vbpvo5g568v@4ax.com: 

>  Dustin Cook <bughunter.dustin@gmail.com> wrote:
> 
>>Pennywise@DerryMaine.Gov wrote in
>>news:kug7759qr7o77vo2o2rulrab8uicpuvokv@4ax.com: 
>>
>>>  Spriva <tamaran@hivenine.org> wrote:
> 
>>>>>Yes and I have contact with the author.
>>>>>Gmer just recently updated his Anti RootKit scanner for the latest
>>>>>TDSS threats. 
>>> 
>>>>How do you use it? I downloaded it and ran a full scan. It filled
>>>>the scan window with hundreds of paths/filenames, but nothing seemed
>>>>to be highlighted as any kind of threat. Did I miss anything, or is
>>>>that how it is?
> 
>>> Do you read? http://en.wikipedia.org/wiki/Rootkit
>>> 
>>> Or would you rather a PayPal account be set up for you.
>>> 
>>> Of course you didn't run this Gmer program from your OS, use a USB
>>> boot drive or BOOT CD, the HP program SP27213.exe can create a
>>> bootable USB pen drive, freebies.
> 
>>Gmer should be run from the affected host. I don't know where your 
>>getting your information from.
> 
> Run a few
> 
> IceSword122en
> catchme.exe
> mbr.exe
> szfstxxx.exe
> RootkitRevealer.zip
> rku
> Rootkit_RKU_Results.txt
> ossec-agent-win32-2.0_RootKitFinder.exe
> gmer.exe
> DarkSpy105.exe
> DarkSpy105Help.chm
> RootkitRevealer.exe
> RootkitRevealer.chm
> Eula.txt
> New Text Document_second_Try.txt
> RootkitReveal_Reviels.txt
> sanitySetup.exe

Nice.. :)
 
> And done my reading

Cool. However, I can one up you. I've spoken with the author of Gmer, it
does best when run under the affected machine under it's affected
conditions. As most utilities of it's nature do, Otherwise, it would be
pointless to scan for something you know (if you run from outside the
host OS) won't be there; IE: memory resident rootkit modules. 
 
> Citations needed, if you have a problem with the answer, edit it.

Pointless endeavor. I had/have a problem with your answer. Obviously if
yours is a canned response, you haven't done all that much reading. 


-- 
Regards,
Dustin Cook
Malware Researcher
MalwareBytes - http://www.malwarebytes.org
  

Aardvark <aardvark@youllnever.know> wrote in
news:GGgdm.120696$OA1.29800@newsfe29.ams2: 

> On Sat, 01 Aug 2009 22:21:20 -0400, David H. Lipman wrote:
> 
>> From: "Dustin Cook" <bughunter.dustin@gmail.com>
>> 
>> | "David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote in |
>> news:h52q470pbo@news7.newsguy.com:
>> 
>>>> From: "Aardvark" <aardvark@youllnever.know>
>> 
>>>>| On Sat, 01 Aug 2009 20:48:48 -0400, David H. Lipman wrote:
>> 
>>>>>>> Thanks in advance for your consideration.
>> 
>>>>>> I will give it due consideration.
>> 
>>>>| It would seem that you didn't.
>> 
>> 
>>>> I wrote I would consider it.  I ddi NOT write nor in any way
>>>> indicate that I would make the change ASAP.
>> 
>>>> Your reply has has thus lowered the consideration of the request in
>>>> my queue.
>> 
>> 
>> | It was already circling the drain wasn't it? :)
>> 
>> 
>> Right down the drain "Pan".  :-)
> 
> Welcome to my bozo bin. If your words are too difficult to separate
> from words of others that you quote in their posts, I'm not going to
> make the effort. Life's too fucking short.

My newsreader has no trouble seperating his comments from those of other
individuals he has quoted. Why are you having such a problem? Perhaps
you should learn to use your newsreader properly? 


-- 
Regards,
Dustin Cook
Malware Researcher
MalwareBytes - http://www.malwarebytes.org
  

"Dustin Cook" <bughunter.dustin@gmail.com> wrote in message 
news:Xns9C5BBCA5BD43DHHI2948AJD832@69.16.185.247...
> "FromTheRafters" <erratic@nomail.afraid.org> wrote in
> news:h5514v$cl6$1@news.eternal-september.org:
>
>> "Aardvark" <aardvark@youllnever.know> wrote in message
>> news:GGgdm.120696$OA1.29800@newsfe29.ams2...
>>
>>> Welcome to my bozo bin. If your words are too difficult to separate
>>> from
>>> words of others that you quote in their posts, I'm not going to make
>>> the
>>> effort. Life's too fucking short.
>>
>> You're the one  who's newsreader is using crayons to write with.
>>
>>
>>
>
> Ouch... Anybody keeping score? :)

I couldn't help myself.

Actually, I like the color coded method - when it works. 

On Sun, 02 Aug 2009 22:26:54 +0000, Dustin Cook wrote:

> Aardvark <aardvark@youllnever.know> wrote in
> news:GGgdm.120696$OA1.29800@newsfe29.ams2:
> 
>> On Sat, 01 Aug 2009 22:21:20 -0400, David H. Lipman wrote:
>> 
>>> From: "Dustin Cook" <bughunter.dustin@gmail.com>
>>> 
>>> | "David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote in |
>>> news:h52q470pbo@news7.newsguy.com:
>>> 
>>>>> From: "Aardvark" <aardvark@youllnever.know>
>>> 
>>>>>| On Sat, 01 Aug 2009 20:48:48 -0400, David H. Lipman wrote:
>>> 
>>>>>>>> Thanks in advance for your consideration.
>>> 
>>>>>>> I will give it due consideration.
>>> 
>>>>>| It would seem that you didn't.
>>> 
>>> 
>>>>> I wrote I would consider it.  I ddi NOT write nor in any way
>>>>> indicate that I would make the change ASAP.
>>> 
>>>>> Your reply has has thus lowered the consideration of the request in
>>>>> my queue.
>>> 
>>> 
>>> | It was already circling the drain wasn't it? :)
>>> 
>>> 
>>> Right down the drain "Pan".  :-)
>> 
>> Welcome to my bozo bin. If your words are too difficult to separate
>> from words of others that you quote in their posts, I'm not going to
>> make the effort. Life's too fucking short.
> 
> My newsreader has no trouble seperating his comments from those of other
> individuals he has quoted. Why are you having such a problem? Perhaps
> you should learn to use your newsreader properly?

He isn't using a newsreader: "X-Newsreader: Microsoft Outlook Express 
6.00.2900.5512"

From: "Aardvark" <aardvark@youllnever.know>


| He isn't using a newsreader: "X-Newsreader: Microsoft Outlook Express
| 6.00.2900.5512"

Gee, you missed this...
FL-Build: Fidolook 2007 (HV) 6.0.6000.97 - 24/12/2008 20:32:05


-- 
Dave
http://www.claymania.com/removal-trojan-adware.html
Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp 

On Sun, 02 Aug 2009 19:07:37 -0400, above the shrieking, whining & FUDding
of the trolls FromTheRafters was heard to say:

<snip garbage>


 Microsoft Outlook Express 6.00. & eternal-september.

Very apt.



-- 
It takes time, this. One slight error in any of my thirteen billion 
calculations and we'll be blasted to smithereens. 
Here we go, then: 10, 9, 8, 6, 5--
--Holly - Red Dwarf--