PowerGREP 3.5.5

Details: Program Name: PowerGREP 3.5.5 Release Date: September 6, 2009 Author: Just Great Software Website: http://www.powergrep.com/ Files: PowerGREP_3.5.5_setup.exe PowerGREP_3.5.5_screenshot.png ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ This torrent is a ***CLEAN RE-POST*** of http://thepiratebay.se/torrent/4347444/JGSoft_PowerGrep_3, which contained a malicious rootkit. I extracted the *ACTUAL* setup program from the wrapper executable, so this version should be (and is, to the best of my knowledge) CLEAN and VIRUS-FREE. My computer became infected after running the original setup program, and it literally took 51 different virus/malware scanners and utilities to finally track the nasty little son-of-a-bitch down. NONE of the major programs caught it. The one tool that finally found and removed it was Hitman Pro 3.5, a program I HIGHLY recommend if you have a rootkit that evades detection by all other programs. The original .exe *looks* like a setup program for PowerGREP 3, but it's not - it's a wrapper executable that contains the actual setup program as well as a number of virus files. When executed, the virus installs rootkits in various places across the system, including the %TEMP% directory and the %WINDOWS%/System32/DRIVERS directory. The rootkit then downloads additional virus files from malicious servers in France and Germany. One of the many programs it installed was the infamous "Internet Security 2010" virus. Joy. I set up a VMware Virtual Machine running Windows XP Professional with Service Pack 3 and installed a number of free virus/malware scanners to try and catch the rootkit. I then ran the infected setup program to learn how it works. Here are some screenshots: Rootkit Installation: http://bayimg.com/kaJjLAaco Legitimate Installation: http://bayimg.com/lajjIAaCo Executable Comparison: http://bayimg.com/LajjbAaCO Background Process: http://bayimg.com/KAJJnAAcO Wireshark Capture: http://bayimg.com/lAjJfaaCo Hitman Pro Scan: http://bayimg.com/LAjJdaaCO The good news is that the infected .exe extracts the *real* setup program to the %TEMP% directory, so I was able to copy it and run it independently to verify that it wasn't also infected. I noticed that the extracted setup program contains a valid digital signature (security certificate), but the wrapper executable doesn't. Anyway, I hope someone finds this useful. Please let me know in the comments if you have any questions about this bad boy. - drsquirlz

udp://tracker.openbittorrent.com:80
udp://open.demonii.com:1337
udp://tracker.coppersurfer.tk:6969
udp://exodus.desync.com:6969

hiseenu (2010-01-31)

I have this list of about 100,000 phrases that I need to find keywords in often, for the work I do. Word's search doesn't give me a simple list of all the instances a word occurs in the document. It only highlights them one at a time. It can be a real pain when I look for a phrase with the word I need, and I get 400 results. I need to click Alt + F 400 times. With the PowerGREP you've given me,I get the list I want, and it helps me work immeasurably faster. Thank you a million. And thanks for the work you did to make it virus-free. It installs and works wonderfully.

blahtsk (2011-04-20)

@hiseenu - if you use it for work and find it useful, I encourage you to get your company to purchase a license!