Voodooman's BLOG

Well not every suspect is actualy murderer, i mean that Antivirus that uses byte check signature, also possibly its catching technique i used (runing not exe but dll files which downloading file from intrnet) that usualy u can c in malware (actualy trojan downloaders works in same way), but anyway 70% of aniviruses i know catching programs that arent malware at all but have some similiarities.

Another reason possibly is packer and manualy edited signatures of that packer.

Anyway i can give u my word that its 100% false report (i rechecke myself with Kaspersky and Dr Web with maximum level of security and nothing suspicious was found) u can check online both files here http://www.kaspersky.com/scanforvirus

Updater consist from 4 main components, popup dll that shows ending message of success or failure, downloader dll that downloading Update.rar file from my site, unrar dll that unpacking update.rar, and sublauncher with joined closeapp.exe (console tool that termination UBCP process to overright patch if ut still runing .. i did that sublauncher for one purpose - to unload original GetUBCPupdate.exe so unrar module could be able to overrite both updater and patch. After u clicking ok on popup window that sublauncher unloading everything and cleaning temorary files.

Can u tell me more details on that? Whats was that antivirus and what was exacly that file in report and additional info?

I thought so.

I'm using Kaspersky 6.0.

Kaspersky reports Trojan.Win32.Small.apn in

_SYSTEMUSER_\Local Settings\Temp\20.tmp\b2e.exe making me unable to update the application using GetUBCPupdater.exe

Well, just downloaded the new version and it works perfectly as always! Thanks a lot for your work!

TADAAAAAAAA!!!

Thats the respond from Kaspersky lab that prove that my patch absolutly SAFE !!!

No viruses and no trojans!!!!

about B2E inside getUBCPupdate.exe

> Attachment: b2e.zip

> False positive.

Hello.

Sorry,this was a false detection

it will be fixed in the next updates

thank you for your help

-----------------

Virus Analyst, Kaspersky Lab.

Now if everyone ask u can show them this quote and refer to future virus database updates where b2e will be removed))

But there few others antivirs still got it in list, also some got CLOSEAPP in in list so beware for few more False positives

Guy there HIT_HAT tiped me with his found that peer-id isnt variable string and showed me how its generated.

Its generated during initialisation of Bitcomet.exe by using separate Strings '-' 'B' 'C', then there are few pointers to version strings, but these version string are program wide (uses everywhere from caption and about) so its not good idea to change them, but there is another solution, replace pointers in peed id generatin opcode with fixed values in stack.