tag:blogger.com,1999:blog-5349803995745917014.post223388800656677157..comments2024-03-25T14:13:15.190-07:00Comments on eMule MoDs: RatioMaster 1.8.5 by moofdevReconhttp://www.blogger.com/profile/06503028238011791604noreply@blogger.comBlogger3125tag:blogger.com,1999:blog-5349803995745917014.post-19100556539880125282009-06-10T05:38:46.394-07:002009-06-10T05:38:46.394-07:00Since seba without having permision stolen and cha...Since seba without having permision stolen and changed the files from SB-I to look like he did them, yes the files are the same.<br><br>i dont think that there is a trojan inide because that would be the end of this tool.Anonymousnoreply@blogger.comtag:blogger.com,1999:blog-5349803995745917014.post-24558382558771736202009-06-10T07:19:48.443-07:002009-06-10T07:19:48.443-07:00so why do it connect to the homepage server by pro...so why do it connect to the homepage server by program start and sometimes between?<br>I will not call it trojan but what for should it be good that the program send by start outgoing connection to it's homepage host? Things I do now is record the data stream to this servers when its idle and by using it in action with login to an tracker. The first new feature is such stupid using these proxy tools with P2P which builds 28plus connections by startup init to svr connect, you found a army base around which helps people to access websites. I wont use this in combination with filesharing.IlLusioNnoreply@blogger.comtag:blogger.com,1999:blog-5349803995745917014.post-57039692650816883362009-06-10T08:19:22.260-07:002009-06-10T08:19:22.260-07:00ok ok did the following as the firewall pop up by ...ok ok did the following as the firewall pop up by program start and show ratiomaster.exe want outgoing connection on port 80 to apache2-moon.brisk.dreamhost.com<br><br>Googled: <a href="http://www.google.com/search?q=apache2-moon.brisk.dreamhost.com" rel="nofollow">http://www.google.com/search?q=apache2-moon.brisk.dreamhost.com</a><br><br>came out here:<br><a href="http://forum.netbynet.ru/?showtopic=63252" rel="nofollow"><br>http://forum.netbynet.ru/?showtopic=63252</a><br><br>did google translate the site<br>with this text:<br><br>вопрос на счет Ratio Master...<br>почему при его запуске, он сразу же пытается обратиться на hosting.netbynet.ru 80 port и apache2-moon.brisk.dreamhost.com (208.97.175.93) 80 port ???<br><br>А при проверке через сайт касперского файла RatioMaster.exe, дядькак касперский говорит, что файл инфицирован...<br><br>Trojan-PSW.Win32.LdPinch.fsq<br><br>and remember it was once as virus listed. <br><br>reverse host lookup show its the homepage of ratiomaster.<br><br>Might be autoupdate check goes on by every program start and contact the url's. However, removed the update check in the exe now. <br><br>About this .client files I think just edit the existent files content right, save it and newer client soft work on the same way sending the right request to trackers. Thats all.IlLusioNnoreply@blogger.com