Slyck.com
 
Slyck Chatbox - And More

BearShare Lite , Are You Really Lite ?

Discussion of the Gnutella network and the Gnutella clients such as Gnucleus, XoloX, Shareaza, LimeWire and BearShare
Forum rules
PLEASE READ BEFORE POSTING: Slyck Forum Rules

BearShare Lite , Are You Really Lite ?

Postby SharedHolder » Wed Jul 21, 2004 7:43 am

BearShare Lite 4.5.1.8 .

Installed on :

OS > Win98 & WIN XP Home
Ad-aware 6.181 ( up to date )
SpySweeper 3.0 build 113 ( up to date )
Spybot & Search & Destroy ( up to date )

Spybot & Ad-aware results = 000

SpySweeper 3.0 results :

BearShare Lite 4.5.1.8

Spyware Name :SaveNow - WhenUSave

Location:
c:\programs\bearshare\webstats.bat
c:\programs\bearshare\webstats.exe
c:\programs\bearshare\webstats.ini

Fingerprint Type : Name Match

Category : Ad-aware

WhenUSave is an adware program capable of displaying pop-up advertisements on your computer.

09.07 : Sweep initiated using definitions version 365
09.07 : Full sweep on all local drives initiated.
09.07 : Now sweeping drive C:
09.08 : Found Adware: SaveNow - WhenUSave, version 1.6.0.1, c:\programs\bearshare\webstats.bat
09.08 : Found Adware: SaveNow - WhenUSave, version 1.6.0.1, c:\programs\bearshare\webstats.exe
09.08 : Found Adware: SaveNow - WhenUSave, version 1.6.0.1, c:\programs\bearshare\webstats.ini
09.08 : Found: 3 file traces.
09.08 : Full Sweep has completed. Elapsed time 00.00.53
5.802 files swept
3 spyware traces located
09.13 : Removal process initiated
09.13 : Quarantining: SaveNow - WhenUSave
09.13 : File: c:\programs\bearshare\webstats.bat
09.13 : File: c:\programs\bearshare\webstats.exe
09.13 : File: c:\programs\bearshare\webstats.ini
09.13 : Cleaning Traces
09.13 : Removing file: c:\programs\bearshare\webstats.ini
09.13 : Removing file: c:\programs\bearshare\webstats.exe
09.13 : Removing file: c:\programs\bearshare\webstats.bat
09.13 : Removal process completed. Elapsed time 00.00.00
1 items (3 traces) quarantined.

Enjoy the new Bearshare '' LITE '' .
User avatar
SharedHolder
 
Posts: 165
Joined: Mon Jan 05, 2004 8:23 am

Postby martin.ca » Thu Jul 22, 2004 7:14 am

So it does contain spyware and they lied.
martin.ca
 
Posts: 63
Joined: Mon Mar 15, 2004 6:06 pm
Location: Canada

Postby bittorrent108 » Thu Jul 22, 2004 7:21 am

thieving liaring p2p wankstas 8)
...for everything else there's bittorrent! ;)
User avatar
bittorrent108
 
Posts: 84
Joined: Tue Jun 29, 2004 6:54 am

Postby SlyckTom » Thu Jul 22, 2004 7:28 am

I dont know if you cleaned your computer up prior, but there is NO spyware in BearShare. My sweep using Ad-aware yeilded no spyware.
SlyckTom
 
Posts: 5713
Joined: Fri Jul 26, 2002 7:22 pm
Location: New York City

Postby SharedHolder » Thu Jul 22, 2004 7:35 am

Sorry SlyckTom to dissapoint you but i have installed the program in two pc's both VERY CLEAN and i got the same results.If you pay more attention to the SpySweeper log file you will see that Ad-aware & Spybot mised the thing , and the result is on the Bearshare folder , so i don't believe that other program ''contamined'' the Bearshare , and i like i said before both pc's are extremly clean .

Found Adware: SaveNow - WhenUSave, version 1.6.0.1, c:\programs\bearshare\webstats.bat
09.08 : Found Adware: SaveNow - WhenUSave, version 1.6.0.1, c:\programs\bearshare\webstats.exe
09.08 : Found Adware: SaveNow - WhenUSave, version 1.6.0.1, c:\programs\bearshare\webstats.in
User avatar
SharedHolder
 
Posts: 165
Joined: Mon Jan 05, 2004 8:23 am

Postby SlyckTom » Thu Jul 22, 2004 7:48 am

I did not use spy sweeper, therefore cannot comment on it (I will tonight.) Did you sweep your computer's prior, then use spy sweeper?
SlyckTom
 
Posts: 5713
Joined: Fri Jul 26, 2002 7:22 pm
Location: New York City

Postby SharedHolder » Thu Jul 22, 2004 7:53 am

Everytime i test a new p2p program, i update and run first all 3 removal spyware tools, NOD32 antivirus , The Cleaner Antitrojan.
User avatar
SharedHolder
 
Posts: 165
Joined: Mon Jan 05, 2004 8:23 am

Postby SlyckTom » Thu Jul 22, 2004 8:09 am

Well, its not that I don't believe you, its just that I have not run my own tests using spy sweeper. If you prove to be right, which I am sure you are, then the story will either be revised, or a completely new story will be written. Im surprised that Ad-aware does not pick up When-u-save, however.

Tom
Last edited by SlyckTom on Thu Jul 22, 2004 8:14 am, edited 1 time in total.
SlyckTom
 
Posts: 5713
Joined: Fri Jul 26, 2002 7:22 pm
Location: New York City

Postby bittorrent108 » Thu Jul 22, 2004 8:10 am

run first all 3 removal spyware tools, NOD32 antivirus , The Cleaner Antitrojan.


what are the 3 removal spyware tools?
what is NOD32 antivirus and the cleaner antitorjan#?
...for everything else there's bittorrent! ;)
User avatar
bittorrent108
 
Posts: 84
Joined: Tue Jun 29, 2004 6:54 am

Postby SharedHolder » Thu Jul 22, 2004 8:16 am

More Info about SaveNow :

http://www.kephyr.com/spywarescanner/li ... ndex.phtml

http://www.pestpatrol.com/PestInfo/s/savenow.asp


@SliyckTom , i don't want you to understand me wrong , i don't have nothing against Bearshare , i just don't like spyware like the others.
User avatar
SharedHolder
 
Posts: 165
Joined: Mon Jan 05, 2004 8:23 am

Postby SlyckTom » Thu Jul 22, 2004 8:21 am

I dont like spyware either...and this is a very deceptive case, but I will give BearShare a chance to comment before I write a follow up.
SlyckTom
 
Posts: 5713
Joined: Fri Jul 26, 2002 7:22 pm
Location: New York City

Postby SharedHolder » Thu Jul 22, 2004 8:21 am

bittorrent108 wrote:
run first all 3 removal spyware tools, NOD32 antivirus , The Cleaner Antitrojan.


what are the 3 removal spyware tools?
what is NOD32 antivirus and the cleaner antitorjan#?



Spyware Removal tools :

SpySweeper > shareware
http://www.webroot.com/wb/products/spysweeper/index.php

Ad-aware > freeware
http://www.lavasoftusa.com/software/adaware/

Spybot > freeware
http://www.safer-networking.org/en/index.html

Nod32 Antivirus > shareware
http://www.nod32.com/news/awards.htm

The Cleaner Pro > shareware
http://www.moosoft.com/
User avatar
SharedHolder
 
Posts: 165
Joined: Mon Jan 05, 2004 8:23 am

Postby bittorrent108 » Thu Jul 22, 2004 8:33 am

i use adaware and spybot. whats teh difference with spysweeper?

whats does cleaner pro do?
...for everything else there's bittorrent! ;)
User avatar
bittorrent108
 
Posts: 84
Joined: Tue Jun 29, 2004 6:54 am

Postby tm, » Thu Jul 22, 2004 8:58 am

Very strange that both Spybot and Ad-Aware would miss these well-known spyware components. Any chance this could be a false positive?
tm,
 
Posts: 1192
Joined: Wed Apr 21, 2004 12:23 am

Postby SlyckTom » Thu Jul 22, 2004 9:44 am

I find that very odd also. I emailed BearShare and they contend that it does not have any spyware or adware. SharedHolder, are you absolutely sure you are running BearShare lite? There are only 3 download sites (bearshare.com is not one of them)

PC World
http://www.pcworld.com/downloads/file_d ... 062,00.asp

CNET Download.com
http://www.download.com/BearShare-Lite/ ... &tag=sptlt

MP3 Music Machine
http://www.mp3machine.com/software/Bear_Share/
SlyckTom
 
Posts: 5713
Joined: Fri Jul 26, 2002 7:22 pm
Location: New York City

Postby Trev0r269 » Thu Jul 22, 2004 12:04 pm

Direct Link to file:
http://www.bearshare.com/lite/downloads ... NSTALL.exe
Link to Bearshare page with info on lite:
http://www.bearshare.com/lite/

Bearshare does host BearShare Lite. There it is above. I do not believe that this page cannot be found through their homepage. Odd.
Trev0r269
 
Posts: 584
Joined: Mon Feb 23, 2004 7:53 pm
Location: Slow - hio

Postby napho » Thu Jul 22, 2004 12:57 pm

If lite isn't really lite you might as well just install the regular Bearshare and clean out the spyware. I've done that and in side by side tests it performs way better than Limewire Pro and the BS Lite which they say isn't as good as their regular version.
User avatar
napho
 
Posts: 497
Joined: Wed Jun 11, 2003 3:31 am
Location: The Great White North

Postby SharedHolder » Thu Jul 22, 2004 1:28 pm

I downloaded from here :

http://www.bearshare.com/lite/downloads ... NSTALL.exe

The build is 4.5.1.8 if someone want to verify my words i will upload the installer tommorow ( now i',m at work ).

@tm

A false positive ? i don't think so , too many conicidence , SaveNow its used particulary on Bearshare installers .Also who read this threat must MAKE the diference between AD-AWARE & SPYWARE , are not the same thing . Opera browser is AD-AWARE too , but displays only ADS . SPYWARE is something different and very harmfull for pc's.
Last edited by SharedHolder on Thu Jul 22, 2004 2:22 pm, edited 1 time in total.
User avatar
SharedHolder
 
Posts: 165
Joined: Mon Jan 05, 2004 8:23 am

Postby SlyckTom » Thu Jul 22, 2004 1:38 pm

Ok....I have downloaded spysweeper...

I am doing a full system sweep now. I used Ad-aware and spybot and found nothing. I am about half way through using spysweeper and it has already found about a dozen items. This is a bit disconcerting..

I will then reinstall Bearshare lite and then do another system sweep...If you see a news story up today then you know I found savenow....
SlyckTom
 
Posts: 5713
Joined: Fri Jul 26, 2002 7:22 pm
Location: New York City

bearshare lite is fake

Postby fire01 » Thu Jul 22, 2004 1:40 pm

they're is no bearshare lite cause when i installed bearshare lite 4.5.1 which was written at the top left of my screen and when i logged in i could still see the ads just like in the regular version. The only true version is bearshare professional which doesn't contain any spyware and ad-aware. The only problem is you have to pay to get the software. Even when you search whitin the regular version of bearshare to look for it the software is either full of viruses or the codes don't work.
fire01
 
Posts: 18
Joined: Tue Jun 15, 2004 12:50 am

Postby ashton » Thu Jul 22, 2004 2:12 pm

There is no included software in bearshare lite. I DASM'd the installer to reveal references to webstats.exe, this is in fact webalizer an open source log analyzer, http://www.mrunix.net/webalizer/download.html The false positive turned up by some programs is because they are only matching the filename which is bad, it is removing a core part of bearshare if you choose to enable the internal server logging. I also md5 sum'd webstats.exe and DASM'd it to confirm that it is what it is. So, bearshare lite is in fact CLEAN. :wink:

The following code is from WebStats.exe installed from bearshare lite:
Code: Select all
.data:0042F3E0 aHttpWww_fsf_or db '<!--           (http://www.fsf.org)           -->',0Ah,0
.data:0042F3E0                                         ; DATA XREF: sub_405290+CBo
.data:0042F413                 align 4
.data:0042F414 aFightMicroOftS db '<!--    Fight Micro$oft,  support the FSF!    -->',0Ah,0
.data:0042F414                                         ; DATA XREF: sub_405290+C0o
.data:0042F447                 align 4
.data:0042F448 aGiveThePowerBa db '<!--  Give the power back to the programmers  -->',0Ah,0
.data:0042F448                                         ; DATA XREF: sub_405290+B5o
.data:0042F47B                 align 4
.data:0042F47C aHttpWww_mrunix db '<!--     http://www.mrunix.net/webalizer/     -->',0Ah,0
.data:0042F47C                                         ; DATA XREF: sub_405290+9Fo
.data:0042F4AF                 align 4
.data:0042F4B0 aFullTextMayBeF db '<!--        Full text may be found at:        -->',0Ah,0
.data:0042F4B0                                         ; DATA XREF: sub_405290+91o
.data:0042F4E3                 align 4
.data:0042F4E4 aDistributedUnd db '<!-- Distributed under the GNU GPL  Version 2 -->',0Ah,0
.data:0042F4E4                                         ; DATA XREF: sub_405290+86o
.data:0042F517                 align 4
.data:0042F518 aBrad@mrunix_ne db '<!-- (brad@mrunix.net  http://www.mrunix.net) -->',0Ah,0
.data:0042F518                                         ; DATA XREF: sub_405290+70o
.data:0042F54B                 align 4
.data:0042F54C aCopyright19972 db '<!-- Copyright 1997-2000 Bradford L. Barrett  -->',0Ah,0
.data:0042F54C                                         ; DATA XREF: sub_405290+65o
.data:0042F57F                 align 4
.data:0042F580 asc_42F580      db '<!--                                          -->',0Ah,0
.data:0042F580                                         ; DATA XREF: sub_405290+5Ao
.data:0042F580                                         ; sub_405290+7Bo ...
.data:0042F5B3                 align 4
.data:0042F5B4 aGeneratedByThe db '<!-- Generated by The Webalizer  Ver. %s-%s-%s -->',0Ah,0
.data:0042F5B4                                         ; DATA XREF: sub_405290+4Fo
.data:0042F5E8 aS_3            db '%s',0Ah,0           ; DATA XREF: sub_405290+25o
.data:0042F5E8                                         ; sub_405290+12Bo ...
.data:0042F5EC aDoctypeHtmlPub db '<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN'
.data:0042F5EC                                         ; DATA XREF: sub_405290+10o
"There is a very thin line between genius and madness"
-Julian
User avatar
ashton
 
Posts: 290
Joined: Thu Nov 20, 2003 5:22 pm
Location: New York City

Postby ashton » Thu Jul 22, 2004 2:20 pm

tm wrote:Very strange that both Spybot and Ad-Aware would miss these well-known spyware components. Any chance this could be a false positive?
It is a false postive based on a filename match, that is all. Rename anything to WebStats.exe and scan and it will show up with sucky programs that do this type of matching. So in fact SpySweeper needs some improvement. :P
"There is a very thin line between genius and madness"
-Julian
User avatar
ashton
 
Posts: 290
Joined: Thu Nov 20, 2003 5:22 pm
Location: New York City

Postby ToM » Thu Jul 22, 2004 2:27 pm

Good work ashton. :)

I believe PestPatrol is another program notorious for reporting things wrongly or by file/foldername alone.
Pirate.
ToM
©
 
Posts: 1424
Joined: Sat Jul 27, 2002 6:57 am

Postby SharedHolder » Thu Jul 22, 2004 2:30 pm

Ok, so where is the filematch on the code from WebStats.exe ? Where is SaveNow on the code ?
User avatar
SharedHolder
 
Posts: 165
Joined: Mon Jan 05, 2004 8:23 am

Postby ashton » Thu Jul 22, 2004 2:33 pm

SharedHolder wrote:Ok, so where is the filematch on the code from WebStats.exe ? Where is SaveNow on the code ?

There is no SaveNow in bearshare lite, SpySweeper only matched the name of the file "WebStats.exe" and did not bother to bitprint match it, so this is SpySweepers fault for being a sucky system. Next time do "extended" research before you post. :wink:
"There is a very thin line between genius and madness"
-Julian
User avatar
ashton
 
Posts: 290
Joined: Thu Nov 20, 2003 5:22 pm
Location: New York City

Next

Return to Gnutella

Who is online

Users browsing this forum: No registered users and 0 guests

© 2001-2008 Slyck.com