Some people might find that these pages are too long so I created a quick Summary. It would be best to start from the beginning though.

A Message to Huntersoft

I think I'll start out with this...

Now why do I say this? Wondering what they have done now?

Blackmail:

I recently found out about a forum that Jerry Rawdon of JerMar Software Corp., the author of a program called WinDriversBackup. While I'm unsure if the program itself was stolen, the source wasn't provided, but the webpage for Huntersoft's WinDriver Expert was a direct rip of his webpage. Took the layout, awards and even the user comments and changed the name to his. The same thing he did with my program and my webpage. Rawdon was able to get Huntersoft's Share-it merchant account closed.

What this forum talks about is a letter he received from Jacques Dubois of Huntersoft, the same person who "wrote" Unknown Device Identifier. He demanded that he get his share-it account reactivated or he will sue and hack him.

From http://www.aota.net/forums/showthread.php?threadid=14842

"...A suit against you for your SLANDER and VIOLATION of the order of my business." Your business being stealing other people's software and ideas, posting misleading newsgroup posts, and threatening to sue and hack someone.

Stealing:

You can find more information on this previous SOTW about Huntersoft's thief of my program.

Alt.comp.freeware:

Jacques apparently reads newsgroups and posts items about his programs like on alt.comp.freeware. He has several posts where he "finds" his own software and recommends it to others. Even going as far as saying "If I had more money, I would rather register the 'My Drivers' for a change."

Pricelessware.org has documented some of his posts and put up an advisory at http://www.pricelessware.org/2003/huntersoft.htm

Guestbook:

On August 21th I got a guestbook entry for a "Peter Haberfield" in the "UK" that just smacks of Jacques's work...

I'm sure the first thing your thinking is how do I know it's Huntersoft and not some legit user? First the entry says he's located in the UK, looking at his IP (211.233.72.119) is actually in Seoul, Korea. The message matches his MO, post as if you're a 3rd party. "Peter" writes that my version was writen in c++ builder, which I state on my webpage, but goes on to say that Unknown Device Identifier is now in Delphi. How would they know that, it's not mentioned on the webpage? The source hasn't been released. In a previous email Jacques ask if we can join up and work on a more informational version, the same sentiment is show here.

He makes a comparison to my Unknown Devices 1.2 and Unknown Devices Identifier 3.01. When I first saw that I thought it was a typo because UDI version 2.0 came out two days previous. I hit the webpage and find that there was yet a new version. This new version came out that day. I don't think it's a coincidence. I checked the Last Modified header for the UDI webpage and it's listed at 5:37 GMT which is 2-1/2 hours after the guest book entry although I can't be sure of that since he might have just fixed a spelling mistake.

I have no doubt in my mind that it was Jacques writing the entry. So what does that tell me?

He says he has "good faith that they...have rewritten the part of codes or translating the code into native Delphi codes." He did do this then. C++ Builder is Delphi but instead of using Object Pascal uses C++, "translating the code into native Delphi" isn't that much work, all the objects are the same.

"so their Freeware is more competitive to Freebies." Huh?

"I don't suppose that building a SOFT RIP section will do any good to you." So it has been effecting him.

"Since they have rewrittened the code, and moved on to add new features...to the freeware and now it seems to your visiters that rip is only a past history like previous commitment of crime of those people." As far as I'm concerned any derived works is still ripping my program. As a friend said, "gotta love such flexible morals." It is also another admission that he did steal it.

The Message:

To Huntersoft...

You have stolen Jerald's webpage just as you stolen my webpage AND my program. And you didn't just based your program on mine, you STOLE it, slapped your name on it and said it was yours.

Please! Hack me, flood me, poke me with little pins. He thinks you might have some HaCkeInG 5ki11z but I've seen better threats from 10 year olds on IRC. Hack my server, nice easy target for you. Here, I'll help you out. This server has an ip of 66.92.75.116, it's running Win2k Pro. If it would make you feel better put my email address on a bunch of spam lists, it's catfish@halfdone.com.

Oh and sue me, I'll love to see that.

Did I mention that...

Update - Oct 5th, 2003

It's not fair! Susan Bugher at pricelessware.org who wrote a Huntersoft Alert got a complaint from Jacques Dubois. Why can't I get one! Not even a quick email, another guestbook entry, or even lots of spam. He's no fun! I want "Evil Wishes" too.

Following is a quote of the email Susan reported on alt.comp.freeware.

By the way, Unknown Device Identifier 3.01 now just _reports_ all devices and only detects PCI/AGP like before. If windows doesn't know what the 1394, ISA P&P, USB...etc is, neither does this program.

Update - Oct 12th, 2003

I was partly wrong in that last statement. The program does comtain a USB device/vender list it looks up with. It hides the list in c:\windows\system32\trunk32.tds. The list comes from the Linux USB website. Huntersoft again removed all the header info so you don't know where it came from. I wasn't aware of this list.

When I tested the program for USB detection I picked a device that this list does not contain, "Palm Handheld." If you modify DriverDesc and ProviderName entries in the registry it changes the entry in the program. I made an assumption that it didn't check any of them. The program doesn't let you know if the device is Unknown or not.

I originaly didn't add USB device support in my program because I wasn't aware there was such a list out there. Personally I haven't run into a unknown USB device under windows. It always seems to know exactly what it is. It makes me think that this info is passed along via the USB device or something. I will be looking at this some more.

Update 6:30pm

Ok, it appears that atleast Unknown Devices Identifier 3.01 is boobytrapped. Under certain conditions that I'm not quite sure about, the program creates and runs this batch file:

This batch script tries to delete several files, likely tring to break windows itself.

I don't know what causes it to get into this deleting mode. Likely when I try to uncompress (upx -d) and run monitoring tools on the program (filemon, regmon..etc). The program creates a mini9temp.cab file (cabs are like zip files), likely extracted from the program itself which contains the txt.bat shown above. A friend verified that "txt.bat" is mentioned in the uncompressed program from the website.

This caught me off guard. I didn't expect him to actually act like a virus and attempt to destroy the system with his program. Luckly he didn't do the batch file too well. He must have assumed that you would run the program from the windows folder or something. I only lost my desktop files and had to repair my startup files.

They are obviously more stupid than I though. Be extremely careful using their software. I'll post more details as I figure it out.

I locked the mini9temp.cab file with ntfs perms and UDI reports:

I locked the txt.bat file with ntfs perms and UDI reports: (FDI is a cabinet API, it says that it can't extract the files)

Update 8:00pm

Huntersoft stored the batch file in his program using the TAHMFileHolder component. He stored it on his D:\chess folder as txt.cab but gets copied to the user's system as mini9temp.cab. You can check this out using Resource Tuner to look at RCDATA->TFORM1->Form1->AHMFileHolder5->files.

Update - Oct 23th, 2003

The Cleaner and McAfee can now detect Unknown Device Identifier [3.01] as a trojan. The Cleaner detects it compressed or uncompressed while McAfee only does uncompressed.

Update - Oct 31th, 2003

Sophos now also detects UDI as Troj/Hanz-A. Also if Huntersoft is wondering, yes I'm submiting your program as a trojan.

I also want to thank the people at Moosoft, McAfee Avert, and Sophos for finding out that the trigger is.

If the file is over 1,201,600 bytes under Win2k-XP (Win03 too?) it will run the deleting batch file. I checked it out and even if the file is kept compressed but you add 345,025 or more bytes to the .exe it will trigger. In most cases that would only happen if you uncompress the .exe which will than be 2,203,136 bytes. You can replicate this easily.

NOTE!!!

By doing the following Unknown Device Identifier will make windows unusable. If you reboot it will not startup again without repair. Do this ONLY if you have a test system you don't care to wipe and reinstall or if you run it in a virtual computer. Do NOT yell at me later if you wiped out your system by doing this, yell at Huntersoft instead.

You need a system running Win2k or XP. Win2003 was untested but likely works, it does not seem to work in Win9x-Me. Download the (currently) latest version of Unknown Device Identifier version 3.01. I tried it 10 minutes ago, I know Huntersoft has been saying it was an older version but that is not true currently. Copy this download somewhere like c:\udiTest\ and copy some other unneeded files into that same folder.

Now you need to make the .exe file more than 1,201,600 bytes. Easiest way is to just append junk to the end of the file. Opening a command prompt and running:
COPY /B UnknownDeviceIdentifier.exe+UnknownDeviceIdentifier.exe+UnknownDeviceIdentifier.exe new.exe
would create a new program new.exe which is UDI appended two more times to itself making it 2,615,322 bytes.

Open up the root of the C: drive and look up for the files ntldr and ntdetect.com. These are usually hidden. Keep this window and the new.exe containing folder open. Now run new.exe. you will see that ntldr, ntdetect.com and other files you added into the test folder are now gone (due to del /q *.*). The UDI window did not showup and Task Manager shows the program using more than 90% of the cpu in use. You have to force close the program. If you reboot windows right now it wouldn't start and report that NTLDR is missing.

Note, you don't have to do exactly what I said, as long as your running Win2k-XP and the program is more than 2,203,136 bytes it will happen.

Update - Nov 2nd, 2003

Symantec (Norton) apparently thinks that if they don't know about a virus/trojan, it doesn't exist.

I also found the original version of Unknown Device Identifier 1.60 on the net along with screenshot.

Update - Nov 3rd, 2003

Huntersoft released a new version of Unknown Device Identifier, version 4.0. He removed the deleting batch file and now just shuts down the system. Other than that and adding to the clutter on your desktop with a new shortcut to his webpage I see no difference.

You can find the 3.01 version of the software at ftp://ftp4.atfile.com/download/UnknownDeviceIdentifier/3.01/UnknownDeviceIdentifier.exe.

Update - Dec 5th, 2003

Kagi, an order process company, has removed Huntersoft's account with them due to their bad reputation and fake information on their site.

Update - Dec 8th, 2003

Today I got 114 emails from the "Police," "COP Boston," and "ARRESTED GUYS." Of course the Boston Police use an email server in China.

I got three different types of messages, all along the same lines:

21 copies, 5:15am, Dec 8th, 2003

72 copies, 5:20am, Dec 8th, 2003

24 copies, 5:31am, Dec 8th, 2003

Update - Jan 2nd, 2004

I got some new Guestbook entries claiming that I stole Unknown Device Identifier instead of the other way around. The entries are kinda interesting. Entries from "Alexander Monado," "Jorge Argentina," "Hello from India," "William Doche" and the merry fellow himself "Santa Clause." The IP address are all different from around the world but somehow all 5 people complained within 10 minutes and all with a 2-4minute gap without overlap. Even odder is that these five people all put spaces before their exclamation points. Kinda reminds me of someone else I know.

Btw, I can confirm that atleast the IP for "Santa Cause" is an open web proxy. [Update - It's been fixed it seems]

Update - Mar 11th, 2004

I got an email from Michael Lee, the author of Driver Magician dealing with Huntersoft:

Heh, now Jacques Dubois is a lawyer affiliated with "International Lawyer's Union Corporation" and he's representing himself in the 3rd person. It is also the first time I've heard of Youngzsoft.net. I'm going to have to look into that one, the layout is almost exactly the same as Huntersoft's and even the title background is the same as his old title which you can find with the Wayback Machine.

Update - Apr 25th, 2004

CPCW Magazine in China wrote an article about Unknown Devices and Copyright issues. Here is some comments I have about it

UDI Trojan aware:

Rather than just keep adding new Updated Dates here I'll just update the following list when new Antivirus/trojan programs detect UDI:

• (3.01) The Cleaner: UDI
• (3.01) McAfee: DEL-409
• (3.01) Sophos: Troj/Hanz-A.
• (3.01) Bitdefender: Trojan.SysDeler.A
• (3.01) F-Prot
• (3.01) eTrust EZ Antivirus: Win32.UDIDel
• (3.01) kaspersky Labs: Trojan.Win32.KillFiles.cx
• (3.01) Norton: Trojan.horse (generic)