[ Outline ] · Standard · Linear+ Try to detect a fake server, sending bogus search results

[AraldoL]

since some days I noticed on nearly every search I get one single fake search result (obviously a dangerous executable) with a very high number of sources so it's always on first position on the search results. The filename is always built of my search term and "_ShareAccelerator.exe", i.e. if I do a global search on "schafkopf" (a german cards game, there are several freeware versions floating around) I get "schafkopf_Shareaccelerator.exe" with about 6500 full sources. There must be at least one bogus server that builds this filename from my search term.

Of course I use a big and weekly updated ipfilter.dat! And I use a self compiled version of current CVS with an self made addition to prevent adding any servers which are located in the United States according to ip2country. So I have no US servers in my list.

To investigate which server it is I tried to find the location in source where the server results are added to the list. I wanted to write a debug line with the server's ip to the debug log to find out which server it is as a first step.

Can someone point me to the proper file and function in source where both server ip and filename from global search results are available?

Araldo

[AraldoL]

Now I think BiG BanG 12 was a false alert. Seems like things are running asynchronous so my debug lines don't show the correct server Now on an installation without BB12 I get a debug log that BB5 is sending this filename.

I need to take a deeper look into the code to get it working properly (in UDPSocket.cpp I get server name and IP as Aw3 showed me above and store it, in CSearchList::AddToList I check the filename and report the last stored server name but seems like this doesn't correspondend.

So I would say that BB12 is innocent and I have to search again which one it is. I'll be back when I get it working.

Araldo