8 replies to this topic

[Sidewinder]

I ran version 6.01 of this utility and happened to glance at the files it was picking up and removing. They were all legit! I tried hitting the abort button and finally got it to stop. Immediately upon exiting the program autocad started to re-install itself. I canceled that and restarted Windows XP. I get a HAL is missing and XP no longer starts up. Needless to say I'm extremely disappointed. How could this have happened? There was nothing to backup any settings or files to reverse the process.

[RubbeR DuckY]

There is no way that AboutBuster could remove legit files. I have had it tested on Windows XP, NT, 2K, ME, 98, and 95. AboutBuster looks at a specific hex string that only exists in this sort of file.

The only logical way that i can think of is a previous infection in which infected legit files. If that is the case, i am extremely apologetic. But the blame is to put on the infection itself.

[lilly2874]

RubbeR DuckY, on Mar 15 2006, 10:28 PM, said:

There is no way that AboutBuster could remove legit files. I have had it tested on Windows XP, NT, 2K, ME, 98, and 95. AboutBuster looks at a specific hex string that only exists in this sort of file.

The only logical way that i can think of is a previous infection in which infected legit files. If that is the case, i am extremely apologetic. But the blame is to put on the infection itself.

i have to disagree! it deleted my system restore. and who knows what else. i was having problems with wwwcoolserach in my memory and i thought this would take care of it. i have had this problem for months! as soon as i downloaded this i have PORN pop ups which is not cool considering my 5 yr old daughter got an eyeful of girl on girl action. i hate this program and wish to reverse what it screwed up! i cannot give a hijack log because it has way too much information and it will not accept it. PLEEEEEEEEEESE help me reverse this. there must be a way! thanks, tracy

[RubbeR DuckY]

First off, the porn pop ups are from coolwebsearch, do not pin that on me. I did not do that to you, nor would i ever. Secondly, i believe what you believe to be 'removal of legit files' is actually removal of ADS. Which appears to be removing legit files, when it really isn't.

If you computer boots up, my program did no damage. I provide a free service that removes AboutBlank for a personal computer. You have the option to use my program or not. To my knowledge and 3 other coders knowledge this program will not remove legit files. I, along with others have checked and tested the code, word for word.

The reason i know this is not the work of my program is because yuo mentioned system restore. There is no physical nor possible way that AboutBuster could have done this.

If you need more information feel free to post here or e-mail me at marcin at malwarebytes dot org.

lilly2874, on Apr 6 2006, 06:36 PM, said:

i have to disagree! it deleted my system restore. and who knows what else. i was having problems with wwwcoolserach in my memory and i thought this would take care of it. i have had this problem for months! as soon as i downloaded this i have PORN pop ups which is not cool considering my 5 yr old daughter got an eyeful of girl on girl action. i hate this program and wish to reverse what it screwed up! i cannot give a hijack log because it has way too much information and it will not accept it. PLEEEEEEEEEESE help me reverse this. there must be a way! thanks, tracy

[synergycomputers]

I have to agree with Lilly. Last night I ran your program and watched it delete files in the system32 directory. During the deletion it rebooted by itself and keep rebooting. I am now having to reinstall WINXP.

RubbeR DuckY, on Apr 12 2006, 07:15 PM, said:

First off, the porn pop ups are from coolwebsearch, do not pin that on me. I did not do that to you, nor would i ever. Secondly, i believe what you believe to be 'removal of legit files' is actually removal of ADS. Which appears to be removing legit files, when it really isn't.

If you computer boots up, my program did no damage. I provide a free service that removes AboutBlank for a personal computer. You have the option to use my program or not. To my knowledge and 3 other coders knowledge this program will not remove legit files. I, along with others have checked and tested the code, word for word.

The reason i know this is not the work of my program is because yuo mentioned system restore. There is no physical nor possible way that AboutBuster could have done this.

If you need more information feel free to post here or e-mail me at marcin at malwarebytes dot org.

[RubbeR DuckY]

I continue to argue the point that AboutBuster DOES delete files from Windows directory and System directory. What you may think appears to be legit files is NOT! They may be ads. This is not a legit file.

C:\Windows\Explorer.exe:abdaw

The file is legit, the ADS is not, hence, it looks like AboutBuster is removing the file, yet it is not.

[Alereon]

synergycomputers, on Apr 27 2006, 04:26 AM, said:

I have to agree with Lilly. Last night I ran your program and watched it delete files in the system32 directory. During the deletion it rebooted by itself and keep rebooting. I am now having to reinstall WINXP.

Unfortunately I must agree with this individual. Moments ago Aboutbuster proceeded to scan as normal, then went on to attempt to delete EVERY file in C:\Windows\System32\. These were not ADS entries, these were the actual files. I aborted the scan when it reached M, after seeing it fail to remove lsass.exe as the file was in use. I browsed to the folder, and indeed all of the files above M that weren't in use at the time were gone. I saw in the window that it had deleted kerberos.dll, a known-good file. The windows installation was quite thoroughly destroyed and had to be restored from a backup.

Possibly related: The system had Norton Systemworks, thus Norton Goback and Norton Protected recycle bin, installed.

The system was not HEAVILY infected, but had a good amount of spyware on it. I had already run scan and removal with the McAfee command line scanner as well as a full scan and remove with Ad-Aware, which had a pending delete for 4 files. I had also run Dial-A-Fix, and a permission repair before performing any spyware removal.

I was running Aboutbuster 6.0, not 6.01. This is definitely a critical data loss bug that needs to be investigated and repaired. I've been running Aboutbuster for a long time without any problems and found it a useful tool,

[RubbeR DuckY]

I repeatedly have checked my code. I have put disclaimers also.. I mean, it might have been fixed in 6.01 but no code has been changed. What OS was it.. maybe you can help solve this problem. Everybody i ask here, does not come back ..

Can you give me more details, OS .. etc..

[Alereon]

RubbeR DuckY, on Apr 28 2006, 01:46 PM, said:

I repeatedly have checked my code. I have put disclaimers also.. I mean, it might have been fixed in 6.01 but no code has been changed. What OS was it.. maybe you can help solve this problem. Everybody i ask here, does not come back ..

Can you give me more details, OS .. etc..

The system was a Toshiba laptop running Windows XP Pro Service Pack 1. Prior to any software work I had run full hardware diagnostics including an Extended Drive Fitness Test. The HDD was formatted NTFS. Prior to running Aboutbuster, I had run Smitrem, a McAfee command line virus scan with the 4/28 BETA DATs, CWShredder, and Ad-Aware. I had also run Dial-A-Fix to fix permissions issues as well as When I ran Aboutbuster, it seemed to be running normally until it started scanning for infected files, at which point it went on to happily delete the contents of the C:\Windows\System32 directory. I could see it failing to delete certain files that were in use, including lsass.exe. I was able to go into the directory and verify that all the files up to where I aborted it were gone, aside from those that were in use.

The greatest oddity about the system was that it was running Norton GoBack. This is actually how I repaired the damage done.

I still have the system on my desk, so can provide you with any other information that you think would be helpful in tracking down the issue. I was running Aboutbuster 6.0, not 6.01, but as I see others reported the issue with 6.01 I don't think that's related.