i survived from banwawe, all my 22accounts

[demonbudd]

i survived from banwawe, all my 22accounts. Many paragon 100, have been botting 24/7 many months, have automated batch scripts and so.. But how to do it ->

Just simply get hexeditor, and do the renaming job again.
Yes renaming the demonbuddy.exe file helps, but it means that you must RENAME also all the plain text in the file, so text data inside demonbuddy.exe, MUST be changed! replace Demonbuddy -> Itwillwork or something similar.

Now you are running program Itwillwork.exe and if you look the properties you have Itwillwork in there.
Also remember to change dll file names to correct ones demonbuddy.sadasda.dll inside folder wheres your db is located. or some other file, When you do the renaming to itwillwork it also renames the file paths. So those must be "synchronized"

 

[Tony]

Yes renaming the demonbuddy.exe file helps

thats a theory of yours

 

[joni]

survived too, mine was named demonbuddy.exe!

 

[antrox]

i survived from banwawe, all my 22accounts. Many paragon 100, have been botting 24/7 many months, have automated batch scripts and so.. But how to do it ->

Just simply get hexeditor, and do the renaming job again.
Yes renaming the demonbuddy.exe file helps, but it means that you must RENAME also all the plain text in the file, so text data inside demonbuddy.exe, MUST be changed! replace Demonbuddy -> Itwillwork or something similar.

Now you are running program Itwillwork.exe and if you look the properties you have Itwillwork in there.
Also remember to change dll file names to correct ones demonbuddy.sadasda.dll inside folder wheres your db is located. or some other file, When you do the renaming to itwillwork it also renames the file paths. So those must be "synchronized"

everyone who read your post is now dumber. god may have mercy with your soul -_-

 

[ChunkyMonkey]

i survived from banwawe, all my 22accounts. Many paragon 100, have been botting 24/7 many months, have automated batch scripts and so.. But how to do it ->

Just simply get hexeditor, and do the renaming job again.
Yes renaming the demonbuddy.exe file helps, but it means that you must RENAME also all the plain text in the file, so text data inside demonbuddy.exe, MUST be changed! replace Demonbuddy -> Itwillwork or something similar.

Now you are running program Itwillwork.exe and if you look the properties you have Itwillwork in there.
Also remember to change dll file names to correct ones demonbuddy.sadasda.dll inside folder wheres your db is located. or some other file, When you do the renaming to itwillwork it also renames the file paths. So those must be "synchronized"

Apparently he also thinks the end of the world is coming today. #mayancalendariscircular

 

[ag0ny]

thats a theory of yours

well if his 22 bots survived its kinda obvious that hes done smthg right oO

 

[secureit]

well if his 22 bots survived its kinda obvious that hes done smthg right oO

Well if you were to read his join date, 11/12/2012. You do the math... He's trolling

 

[ag0ny]

Well if you were to read his join date, 11/12/2012. You do the math... He's trolling

I use db longer since my join date oO dates doesnt say anything ....

 

[xwozone]

i survived from banwawe, all my 22accounts. Many paragon 100, have been botting 24/7 many months, have automated batch scripts and so.. But how to do it ->

Just simply get hexeditor, and do the renaming job again.
Yes renaming the demonbuddy.exe file helps, but it means that you must RENAME also all the plain text in the file, so text data inside demonbuddy.exe, MUST be changed! replace Demonbuddy -> Itwillwork or something similar.

Now you are running program Itwillwork.exe and if you look the properties you have Itwillwork in there.
Also remember to change dll file names to correct ones demonbuddy.sadasda.dll inside folder wheres your db is located. or some other file, When you do the renaming to itwillwork it also renames the file paths. So those must be "synchronized"

If this DID work, i sure as shit wouldnt be telling people...

 

[packetloss]

If this DID work, i sure as shit wouldnt be telling people...

Well it is based on the same premise that a lot of viruses use. Basically randomly generate a new executible every time with various nop/do nothing statements randomly intermingled within the code. This way no single signature can be produced to detect it.

At this point no one knows for sure all the detection methods they are using, however one this is for sure, they have a pretty solid way to detect botting.

 

[ZenLulz]

From what Tony said (his sources is certainly Apoc and Nesox), the detection is server side.
These two people are godmod in assembly. If they say it's server, we can trust them.

 

[darkfriend77]

we had this pattern again and again

- daoc unleashed radar
- easyplay gold (D2) & D2JSP
- innerspace isxwow/ismods & wowglider
- riftbuddy
- demonbuddy

... it can be a client detection ... it can be serverside ... we will never know ...

... the only thing important to us shoud be the timespan from banwave to banwave ... if it gets to short the community dies ...

 

[Master_Cirroji]

thats a theory of yours

all mine have always been re-named. still got hit.

re-naming the .exe doesn't change the Running process ID. Which says "demonbuddy" because the dev team didn't seem like that would be any issue :|

 

[Makiss]

If that was the problem, and I do not think so, the developer of db could release a daily update on mini exe db going to change the process name taken from a random list or implement the name change by another program ..
Put like that it sounds easy but I think it's much more difficult ..

 

[Mammon]

U can easily see what they are sending in the special error reports if you send the reports to yourself and replace the agent and errorreporter with a renamed wordpad.

They see all the hexes and dll files loaded.

 

[demonnbuddy]

if this works, BLZ will have much bigger problem than some bot.

 

[botleone]

And the funny thing is, my botting enviroment is fully automated. I have maximum 3min wait time, (includes full computer restart if necessary), new mac address if mac banned, they sometimes do this, and the bots keep running all day long. My friends who didnt have those files renamed/edited got banned. They called me instantly that they have been banned. I came to my computers and see all my bots running fine. They even didnt ban my oldest account that has been selling over 4000 million gold, and i sell gold + items everyday, alot in rmah and gold ah. My pickup list stashes only items worth over 50million, and sells rest to merchant, cause it takes too much time to control all those bots otherwise. Every bot is surely been linked to other, because those all are in friend list. And they are always online. Doing Act3.
So believe it or not, i have been doing something right. I have 4 English account, and 18 Russian accounts. All are running in vmware 9, and are controlled by batch scripts. If i survive next wave, then its absolutely sure, that those god damn junkies are scanning our comps.

 

[demonnbuddy]

if BLZ really do so, bossland can just sue BLZ and get millions euro.

 

[botleone]

I could send my db, but because its against this forum policy i cant. But atleast i have told u!

 

[urn357]

i survived from banwawe, all my 22accounts. Many paragon 100, have been botting 24/7 many months, have automated batch scripts and so.. But how to do it ->

Just simply get hexeditor, and do the renaming job again.
Yes renaming the demonbuddy.exe file helps, but it means that you must RENAME also all the plain text in the file, so text data inside demonbuddy.exe, MUST be changed! replace Demonbuddy -> Itwillwork or something similar.

Now you are running program Itwillwork.exe and if you look the properties you have Itwillwork in there.
Also remember to change dll file names to correct ones demonbuddy.sadasda.dll inside folder wheres your db is located. or some other file, When you do the renaming to itwillwork it also renames the file paths. So those must be "synchronized"

mind elaborating how to changed text data inside demonbuddy.exe. I looked into using a hexeditor and I'm not seeing any text data to change inside there.