[ Outline ] · Standard · Linear+ Try to detect a fake server, sending bogus search results

[AraldoL]

since some days I noticed on nearly every search I get one single fake search result (obviously a dangerous executable) with a very high number of sources so it's always on first position on the search results. The filename is always built of my search term and "_ShareAccelerator.exe", i.e. if I do a global search on "schafkopf" (a german cards game, there are several freeware versions floating around) I get "schafkopf_Shareaccelerator.exe" with about 6500 full sources. There must be at least one bogus server that builds this filename from my search term.

Of course I use a big and weekly updated ipfilter.dat! And I use a self compiled version of current CVS with an self made addition to prevent adding any servers which are located in the United States according to ip2country. So I have no US servers in my list.

To investigate which server it is I tried to find the location in source where the server results are added to the list. I wanted to write a debug line with the server's ip to the debug log to find out which server it is as a first step.

Can someone point me to the proper file and function in source where both server ip and filename from global search results are available?

Araldo

[muleteer]

Yes, yes, we know all that, but the problem is different. We dn't know which server has sent which batch of results.

Let me give an illustration of a procedure that works:
Instead of doing the global search, do a server search.
Examine the results.
Then connect to another server and do the search again.
Repeat with every server in the list.
Now you know which servers are the bad ones.

Unfortunately, to do this automatically with the global search means changing the way we handle search results. That makes it a big, complicated change, not something that one of the devs can run up in a couple of hours. Big, complicated changes to the engine take time; every step has to be taken with great care - we don't want anything getting broken.

I hope you appreciate the complexity of the matter. We like it, and we will probably do it, but it is a big job and not likely to be at the top of the list of things to do.