Re: Trojan Hunter : forum down; strange update in Security

Re: Trojan Hunter : forum down; strange update

Mon, 09 Jun 2008 02:39:26 EDT

siliconman01 : 09-June-08

The European server is now working and is in synch with the USA server.

Re: Trojan Hunter : forum down; strange update

Sun, 08 Jun 2008 03:57:09 EDT

Name Game : That's what it appeared to me also..thanks for the confirmation.

Re: Trojan Hunter : forum down; strange update

Sun, 08 Jun 2008 02:22:38 EDT

siliconman01 : The original cause of the jrb2's (and others) problem with THGuard.exe and TrojanHunter.exe reverting to different versions is that the update from the European server includes these two files along with the Ruleset updates. This is incorrect in the European server. Something is significantly out-of-synch in the European server. The proper version of THGuard.exe is V5.0.0.278 which comes in the TrojanhunterSetup.exe installer.

And this is still happening from the European server. I have contacted Magnus about this via e-mail.

PLEASE only use the USA server for LiveUpdate until further notice.

If you check your version of THGuard.exe and it is V5.0.0.277, please do the following:

- Download the latest TrojanHunterSetup.exe installer from
»www.misec.net/products/TrojanHunterSetup.exe

- Unload THGuard.exe.

- Close TrojanHunter scanner if it is open.

- Just run the TrojanHunterSetup.exe installer and let it install right over the top of the current TH installation.

- In LiveUpdate, switch to the USA server and run LiveUpdate. The rulesets will update to the latest versions.

This should put everything back to the proper state and versions with THGuard.exe being V5.0.0.278.

Re: Trojan Hunter : forum down; strange update

Sat, 07 Jun 2008 16:21:21 EDT

Jrb2 :

quote:
This thread has coming to its end now.

I did speak too soon, and it is not up to me to say whether a thread is coming to its end or not.
I do apologize !

quote:
So then tell is what the site being down had to do with your TH problem..did you ever figure out what happened in the first place and why ??

I cannot because I don't know. I only offered a solution, that's all.

Re: Trojan Hunter : forum down; strange update

Fri, 06 Jun 2008 00:25:29 EDT

Name Game : So then tell is what the site being down had to do with your TH problem..did you ever figure out what happened in the first place and why ??

Re: Trojan Hunter : forum down; strange update

Thu, 05 Jun 2008 22:16:45 EDT

Jrb2 : This thread has coming to its end now.

I would like to thank the mods and owners of the DSLR board for allowing it. Thank you very much guys!!!!!

Of course I would like to thank also everyone else participating in the thread. If I may name two of you, Gavin and Tom. Thanks guys !

Thanks to all of you !
Best regards,
Jan.

Re: Trojan Hunter : forum down; strange update

Wed, 04 Jun 2008 18:00:09 EDT

Jrb2 : - Cross-posted at DSLR and TH forum -

OK, I have re-installed TH again and now it is fine :)

My system: XP-home SP2 Dutch.

The install-file I used for the first and second re-installation is
exactly the same as the one that can now be downloaded from the TH-site.
The file TrojanHunterSetup.exe has the following Checksum(s)
MD5 - 04833D6C9BC8E49CF264F191CBC32DC2

What I did different comparing my first and second re-install:
1.
On the second re-install:
After de-install I manually removed the whole TH-folder.
And then I rebooted.
And then I did the re-install.
(I should have done this also with my first re-install).
2.
I only used the US server to get the latest defs;
I didn't use the EU server this time.

My files THGuard.exe and TrojanHunter.exe are what they should be,
and are the same as siliconman posted:

The file C:\Program Files\TrojanHunter 5.0\THGuard.exe has the following Checksum(s)
MD5 - E3A386AFBE97F4D2919395E5D3FCC7A5
Version: 5.0.0.278
Size: 1047712

The file C:\Program Files\TrojanHunter 5.0\TrojanHunter.exe has the following Checksum(s)
MD5 - 0EA94DE726F604D7B85C48CEB6E3B6E1
Version: 5.0.0.962
Size: 2418336

The defs my TH is showing:
Ruleset datestamp : 2008-06-03
Scan kernel : 5.0 (Aurelius)
Ruleset entries : 174289
Trojan definitions : 66752
Detection rules : 174289

Re: Trojan Hunter : forum down; strange update

Wed, 04 Jun 2008 14:40:13 EDT

Name Game : Been there done that..the sales rep always popsup the chat window to help me..and all I could remember was your unlisted phone number :D

Re: Trojan Hunter : forum down; strange update

Wed, 04 Jun 2008 14:17:04 EDT

EGeezer :

said by Name Game :

..Phil will get all your data transfered before you lose all your cookies. :D

My super magnifying digital enhancer showed the labels on the tapes he threw away -
CCINFO
CUSTDATA
TRANSACT
TUBFILE
CMR
CITIXACT
CHASECUST
AUTHSRVR
:D

Here's a fun read..
--
If dogs travel in space at the speed of light, do they reach their destination in dog-light years?

Re: Trojan Hunter : forum down; strange update

Wed, 04 Jun 2008 07:43:46 EDT

whizkid3 :

said by dannyboy 950 :

My hat is off to them. That they are restoreing service as quick as they are is a near miracle or great disaster planning on their part.

Quite the opposite. Horrible design and planning of a mission critical data center, if I ever heard it. All eggs in one basket. To have a substation transformer located in a room without 3 or 4 hour fire-rated walls (typically made of reinforced masonry) was a big mistake, and an easily avoidable risk. The result was a complete outage of the data center, a financial loss, and a loss of reputation that you can't even put a price on. In comparison, the masonry walls would have been cheap.

Re: Trojan Hunter : forum down; strange update

Wed, 04 Jun 2008 03:17:10 EDT

siliconman01 : That's very odd.

I'm using the USA server. THGuard and TrojanHunter scanner are not being changed. This is referencing both my Vista SP1 and XP-SP3 computers.

Re: Trojan Hunter : forum down; strange update

Wed, 04 Jun 2008 02:56:14 EDT

Jrb2 : There are new definitions updates.

But alas, the exact same problem with the files THGuard.exe and TrojanHunter.exe is back again when updating from the US server.

I got again:

The file C:\Program Files\TrojanHunter 5.0\THGuard.exe has the following Checksum(s)
MD5 - 2CD163244A3AB1C25DCC41EAB640BEFA
(and its version: 5.0.0.277 )

The file C:\Program Files\TrojanHunter 5.0\TrojanHunter.exe has the following Checksum(s)
MD5 - 6C31C51AE9A1D99BB0897BB1EEC06149

Re: Trojan Hunter : forum down; strange update

Tue, 03 Jun 2008 20:35:12 EDT

La Luna :

said by Telly Boot :

said by La Luna :

I need to renew my TH subscription. I guess this isn't a good time to attempt doing that. :o

TrojanHunter forum and website up and running again . :)

Cool, thanks! :)
--
11,181 DEADLY TERROR ATTACKS SINCE 9/11~~TEAM DISCOVERY
Can't feel you anymore, don't need you anymore, don't believe you anymore, I don't need you anymore

Re: Trojan Hunter : forum down; strange update

Tue, 03 Jun 2008 19:20:59 EDT

Telly Boot :

said by La Luna :

I need to renew my TH subscription. I guess this isn't a good time to attempt doing that. :o

TrojanHunter forum and website up and running again . :)
--
Dawn,n,The time when men of reason go to bed. (Ambrose Bierce.)

Re: Trojan Hunter : forum down; strange update

Tue, 03 Jun 2008 17:03:04 EDT

Name Game : Hang in there Aaron..Phil will get all your data transfered before you lose all your cookies. :D

»www.youtube.com/watch?v=1pv9psLQ92M

»blog.theplanet.com/flickr/

Cookie crumbs in the Keyboard ?? hmm might be the problem.
»blog.theplanet.com/flickr/album/···ter.html

»blog.theplanet.com/the-planet-videos/

»blog.theplanet.com/flickr/album/···ers.html
--
Gladiator Security Forum »www.gladiator-antivirus.com/
*
A fun/friendly/informative forum for the mature elder crowd
»www.theover50goldengroup.net

Re: Trojan Hunter : forum down; strange update

Tue, 03 Jun 2008 15:38:36 EDT

ahulett : What can I say? I am a Power User after all... I guess I was just using too much. :P

Apparently we are both on the first floor of this data center, as I'm offline again as well. (Hi Magnus if you're lurking.)

Re: Trojan Hunter : forum down; strange update

Tue, 03 Jun 2008 15:38:15 EDT

La Luna : I need to renew my TH subscription. I guess this isn't a good time to attempt doing that. :o

Re: Trojan Hunter : forum down; strange update

Tue, 03 Jun 2008 13:31:12 EDT

Name Game :

said by ahulett :

said by Name Game :

In the mix of things..this forum is also down because of that

LandzDown Forum
»www.landzdown.com/

No wonder that data center can't get back on it's feet..you and the family have been plugging in that Magnum XL-200 with too long a power cable.

About time you give it up and head over to Myrtle Beach and take some real rides. ;)
--
Gladiator Security Forum »www.gladiator-antivirus.com/
*
A fun/friendly/informative forum for the mature elder crowd
»www.theover50goldengroup.net

Re: Trojan Hunter : forum down; ...

Tue, 03 Jun 2008 12:40:28 EDT

Telly Boot : TH Forum and Website down again: further outages due to generator breakdowns:
From ThePlanet Forum -

"...This morning at approximately 2:45 a.m. CST, the temporary generator supplying power to the servers and environmental control systems located in Phase 1 of our H1 facility shut down. This was caused by some faulty current sensors in the output breaker. The sensors detected an out of balance current condition that did not exist.

Technicians from the generator company were onsite within 15 minutes. After working on the breaker for an hour, they believed the issue was remedied, and the generator was restarted. As the servers and environmental control systems were brought back online, the breaker again caused the generator to trip offline.

At this time we have a replacement breaker in route to the site and will get power restored as soon as physically possible.

We understand the difficult situation this causes for our customers. As such, we are offering to move all H1 Phase 1 customers to our H2 data center here in Houston. This requires physically moving servers to our data center, which is approximately three miles away from the H1 data center. It also requires IP address changes for all servers relocated to H2."
--
Dawn,n,The time when men of reason go to bed. (Ambrose Bierce.)

Re: Trojan Hunter : forum down; strange update

Tue, 03 Jun 2008 12:11:03 EDT

siliconman01 : I sent an e-mail to Magnus on this. It may be awhile before he responds because it looks like the Texas servers are down again...along with his email.

Re: Trojan Hunter : forum down; strange update

Tue, 03 Jun 2008 06:54:55 EDT

Jrb2 :

quote:
Jrb2,

Did your THG and TH scanner go back to the proper files?

The file C:\Program Files\TrojanHunter 5.0\THGuard.exe has the following Checksum(s)

MD5 - E3A386AFBE97F4D2919395E5D3FCC7A5
---------------------------------------------------
The file C:\Program Files\TrojanHunter 5.0\TrojanHunter.exe has the following Checksum(s)

MD5 - 0EA94DE726F604D7B85C48CEB6E3B6E1

Hi Tom,

No, it didn't; but see point 2 below.

1.
Here is the report from NISFileCheck together with MD5 checksums (which NISFileCheck doesn't use):

Application: c:\program files\trojanhunter 5.0\thguard.exe
Status: Changed
Version old: 5.0.0.278
Version new: 5.0.0.277
Size old: 1047712
Size new: 1046688
Date old: 2008-03-25 19:08:16
Date new: 2008-06-01 10:45:18
RMD160 Hash old: ECF767E6F6BCD6FB2621BBFA9758F2129A77C649
RMD160 Hash new: 5591691619F1A10E7CCF6047ED1FC2DC455879AA

The file C:\Program Files\TrojanHunter 5.0\THGuard.exe has the following Checksum(s)
MD5 - 2CD163244A3AB1C25DCC41EAB640BEFA

Application: c:\program files\trojanhunter 5.0\trojanhunter.exe
Status: Changed
Version old: 5.0.0.962
Version new: 5.0.0.962
Size old: 2418336
Size new: 2417824
Date old: 2008-03-25 19:08:14
Date new: 2008-06-01 10:45:22
RMD160 Hash old: B1F385FC54AB053FFDF7B93028AF99BC35F27992
RMD160 Hash new: 772038290E904357D62E7E77C4298955BA5D5F2E

The file C:\Program Files\TrojanHunter 5.0\TrojanHunter.exe has the following Checksum(s)
MD5 - 6C31C51AE9A1D99BB0897BB1EEC06149

2.

I re-installed TH, using the install-file which I downloaded in March.
And that gave me the right files back :) :

Application: c:\program files\trojanhunter 5.0\thguard.exe
Status: Changed
Version old: 5.0.0.277
Version new: 5.0.0.278
Size old: 1046688
Size new: 1047712
Date old: 2008-06-01 10:45:18
Date new: 2008-03-25 19:08:16
RMD160 Hash old: 5591691619F1A10E7CCF6047ED1FC2DC455879AA
RMD160 Hash new: ECF767E6F6BCD6FB2621BBFA9758F2129A77C649

The file C:\Program Files\TrojanHunter 5.0\THGuard.exe has the following Checksum(s)
MD5 - E3A386AFBE97F4D2919395E5D3FCC7A5

Application: c:\program files\trojanhunter 5.0\trojanhunter.exe
Status: Changed
Version old: 5.0.0.962
Version new: 5.0.0.962
Size old: 2417824
Size new: 2418336
Date old: 2008-06-01 10:45:22
Date new: 2008-03-25 19:08:14
RMD160 Hash old: 772038290E904357D62E7E77C4298955BA5D5F2E
RMD160 Hash new: B1F385FC54AB053FFDF7B93028AF99BC35F27992

The file C:\Program Files\TrojanHunter 5.0\TrojanHunter.exe has the following Checksum(s)
MD5 - 0EA94DE726F604D7B85C48CEB6E3B6E1

3.

Then I used LiveUpdate, using the EU-server, to get the last definitions:

Ruleset datestamp : 2008-05-30
Scan kernel : 5.0 (Aurelius)
Ruleset entries : 174080
Trojan definitions : 66668
Detection rules : 174080

4.

PS: I don't understand why different "versions" (they have different size) of the main-file TrojanHunter.exe have the same build-number.

Re: Trojan Hunter : forum down; strange update

Tue, 03 Jun 2008 02:46:16 EDT

ahulett :

said by Name Game :

In the mix of things..this forum is also down because of that

LandzDown Forum
»www.landzdown.com/

I rent the box this site lives on (along with my own personal websites and some other friends' and family's sites) - it's in that datacenter, and it, like everything else in there, is now back online. I'm very appreciative to The Planet's fast response to what happened, and more importantly, I'm glad no one was hurt.
--
Aaron Hulett | Senior Spyware Researcher | Microsoft Malware Protection Center
This posting is provided "AS IS" without warranty, and confers no rights.

Re: Trojan Hunter : forum down; strange update

Tue, 03 Jun 2008 00:55:36 EDT

siliconman01 : Jrb2,

Did your THG and TH scanner go back to the proper files?

The file C:\Program Files\TrojanHunter 5.0\THGuard.exe has the following Checksum(s)

MD5 - E3A386AFBE97F4D2919395E5D3FCC7A5
---------------------------------------------------
The file C:\Program Files\TrojanHunter 5.0\TrojanHunter.exe has the following Checksum(s)

MD5 - 0EA94DE726F604D7B85C48CEB6E3B6E1

Re: Trojan Hunter : forum down; strange update

Mon, 02 Jun 2008 19:55:39 EDT

Jrb2 : Thanks Name Game. Yes, I can go now to the TH-forum :)

Yes dannyboy 950, I fully agree: my hat too is off to the folks at the datacenter. Thanks !!!

Re: Trojan Hunter : forum down; strange update

Mon, 02 Jun 2008 19:47:20 EDT

dannyboy 950 : Mannnn I am glad I was not on that crew what a mad house it must have been.

I mean several years ago a client had a forklift crash thru a wall and take out a little equipment. I know what a mess that was but it was not near what those people faced.

My hat is off to them. That they are restoreing service as
quick as they are is a near miracle or great disaster planning on their part.

Re: Trojan Hunter : forum down; strange update

Mon, 02 Jun 2008 19:28:36 EDT

Name Game : I think they are all back up now..

Re: Trojan Hunter : forum down; strange update

Mon, 02 Jun 2008 11:44:36 EDT

Name Game : In the mix of things..this forum is also down because of that

LandzDown Forum
»www.landzdown.com/

Re: Trojan Hunter : forum down; strange update

Mon, 02 Jun 2008 10:30:07 EDT

Jrb2 : Thanks Gavin for coming here and keeping us informed; much appreciated!

As for the changes I noticed: I could have posted detailed info from my file-integrity-checker NISFileCheck but thought that it would not make much sense.

Best regards,
Jan.

Re: Trojan Hunter : forum down; strange update

Mon, 02 Jun 2008 07:59:21 EDT

FriscoTX : Thanks for posting this. I was wondering about the update I received yesterday. This explains it.

Re: Trojan Hunter : forum down; strange update

Mon, 02 Jun 2008 03:27:16 EDT

Gavin_TH : Mail is down as is FTP so I am having an unexpected couple of days off, which is nice :)

Some functionality is restored, the problems continue to be fixed after a fire at the datacenter (7500 customers servers were affected! ouch..)

Your update must be the last one that was mirrored by the US server ? strange about the EXE change as well, Magnus may need to change something there

Re: Trojan Hunter : forum down; strange update

Mon, 02 Jun 2008 01:17:52 EDT

Jrb2 : Thanks EGeezer for that link !

quote:
Backup server locations may not have current data.

Yes, I was thinking that too.

I guess we can use the European TH-server for updates.

Re: Trojan Hunter : forum down; strange update

Mon, 02 Jun 2008 01:10:42 EDT

EGeezer : See »tech.slashdot.org/article.pl?sid···/1715247

Backup server locations may not have current data.

Trojan Hunter : forum down; strange update

Mon, 02 Jun 2008 01:02:57 EDT

Jrb2 : For the TH-users:

1.
The forum is temporarily down. The forum site tells:

quote:
Forums are currently down --
data center in Texas has experienced an explosion in a transformer affecting about 9000 servers.
We hope to have the forums back up late Sunday.

2.
Whether the following is related to that, I don't know but I guess it is.

I got a little bit strange update on Sunday 1 June 2008 using LiveUpdate:
I noticed that some files were reverted back to previous versions:

thguard.exe
I had version 5.0.0.278 with size 1047712.
It is now version 5.0.0.277 with size 1046688.

trojanhunter.exe
I had version 5.0.0.962 with size 2418336.
It is now version 5.0.0.962 with size 2417824.