DiamondCS License Buyers Beware(?) filestrings.zip > fstrings.exe

Last night I purchased another Port Explorer license from DiamondCS so I can legally use the utility in my laptop.

The email that contained my serial number for the license contained a link to a "Restricted Access FREE bonus downloads!" area at the diamondcs.com.au web site specifically for new purchases of DiamonCS licenses where I currently have "20 days Restricted Area access remaining. "

There were three small zip files offered:

• FileStrings (24 KB filestrings.zip containing fstrings.exe and license.txt)
• Process Freezer (19 KB procfreeze.zip containing procfreeze.exe and license.txt)
• BusCheck (27 KB buscheck.zip containing buscheck.exe and license.txt)

NOTE: When I used WinZip to extract the contents of filestrings.zip, Norton AntiVirus (virus definitions 2008.03.30.003) alerted me that "Auto-Protect has detected Trojan.Nebuler ".

I attempted to use DiamondCS's Contact form to report the alert with the file as an attachment and got an "Internal Server Error ". Then I sent an email to DiamonCS's webmaster to report the "Internal Server Error ". I included the text from my Contact form message and attached the filestrings.zip and password (zipped) to that message. I am still waiting for a response from DiamondCS.

I Googled fstrings.exe and came up empty. I also Googled filestrings.zip and came up empty.

I added fstrings.exe to Norton's Exclusion list and then extracted the fstrings.exe from the filestrings.zip file.

I uploaded fstrings.exe to Jotti's Online Malware Scan and got the following results.

I uploaded fstrings.exe to VIRUSTOTAL and got the following results.
http://www.virustotal.com/analisis/2eae79fdaf4ef7da12487d60948dfb02#

Here is what the Prevx Info: link from the VIRUSTOTAL scan information says.

The license.txt file states I may

Therefore, I will provide the filestrings.zip file and password to any Windows BBS staff member (such as TeMerc or noahdfear) or others as a Windows BBS staff member requests.

 

Likely just the packing mechanism. Please send me a copy.

 

I've tried several times to buy a license to PE and have never been able to complete the transaction, can you tell me how you did it?

I know the company has been very shifty and shady and recently its site was redesigned and then disappeared, now I see it's back up again.

Any help would be great mailma--........ohhh....whaaa??...oohhhh...looky at the bottom of mailman's post:

Send it to me brother!!........

 

Dave, I sent the ZIP password and DiamondCS's description of what ftrings.exe is supposed to do in an email message to you titled as follows.

Please let us know what you discover.

Tom, please PM the email address you would like me to send the same message and filestrings.zip to. I was going to send it to your cox.net email address (addressed to temercsite) that is given on your TeMerc Internet Countermeasures site but I don't know whether others would have access to the file or not. I don't want to chance the file getting into the wrong hands in case it is indeed malicious.

I used the "Purchase" link on the Port Explorer page I linked above.

I used the PayPal link on the one of the subsequent pages which automatically directed me to a PayPal login screen that prompted me for my PayPal password. My Firefox browser also asked me for my Firefox Master Password to use the PayPal password I have stored in Firefox. Therefore, I assumed it was legitimate (though now I wonder).

I almost immediately received the usual PayPal e-mail notice that I paid for Port Explorer. The message headers look legitimate too (as far as I can tell).

I received my looooooooong "serial number" via e-mail several hours later in a separate e-mail. I applied the serial number in my laptop installation of Port Explorer and it now correctly displays as registered in my name.

Since the file version I already have is the same as the version advertised at DiamondCS, I did not download Port Explorer from the DiamondCS web site. The Port Explorer I installed in my laptop is the same one I installed in my desktop back in August 2006. I just used a USB thumb drive to copy the installation file from my desktop to my laptop.

Shifty? Shady? Care to elaborate?

 

The filestrings.exe file is fine. It's a GUI version of a similar app named Peek, which adds a right click context menu to view strings in notepad. I'm quite surprised at the number of detections in your submission results, only because I would have expected DiamondCS to have previously submitted it to all of the AVs for whitelisting. It would be naive IMO, to believe they weren't aware of at least the possibility of detection.

 

Mailman, there are a couple of threads about the company but the best one is here @ Wilders. It goes back a while but has someone who just purchased it this last week and is waiting to see what they get in return.

I tried to purchase it last year using credit card option and I even tried to email support, but no reply, very much like the many people you'll read about in the above mentioned thread.

And yes, you can use the email from the site, it's safe, only I have access.

Thanks, you're doing me a huge favor, I've been clamoring for this thing for a while. I was even offered a a 'cracked' serial number(not sure how the guy did it) but declined.

Tom

 

I think the license referred to above (free to redistribute) is for filestrings.exe, not PE itself.

 

I don't know, the info mailman provided said 'software product' which in my eyes means the whole product, not just one part. If they only wanted part of it to be distributed, I'd think the lawyers would make that pretty clear, don't you think??

 

THANKS, Dave! Whew!

I am still going to wait awhile before I run any of those "bonus" apps from DiamondCS at least until I hear about fstrings.exe from TeMerc too. (CERTAINLY no offense to you. You BOTH are wizards. )

If I get a reply from DiamondCS, then I will give them the URL for this thread so they have more details and have an opportunity to clear this up with everyone.


Tom, I'll send the filestrings.zip and ZIP password to you as soon as I'm done with this post (the same e-mail I sent to Dave with the same subject string). Will be nice to get a "2nd opinion" analysis from another malware research expert.

Dave's assumption about the license is correct. The license.txt information I quoted above is from the filestrings.zip package. The Port Explorer license prohibits me from distributing the "fully licensed version" (or my serial number) of Port Explorer. The serial number apparently has code for my name embedded anyway since my name appears in Port Explorer's "About" information in my laptop install.

Relevant Portions of Port Explorer's License Agreement (accessed from Port Explorer's Help file):

EDIT: BTW, thanks for the Wilder's forum link. I will read it and, perhaps, I'll post a link there to this thread.

E-mail with filestrings.zip attachment SENT to TeMerc at his cox.net address.

 

While reading the hubbub at Wilders about DiamondCS and confusion about available versions of their apps, I decided to download Port Explorer and use FileAlyzer to compare with the installer I already have (v2.110) from August 2006.

Here is FileAlyzer information for the August 2006 pesetup.exe:

Code:

********************************************************************
FileAlyzer © 2003-2006 Safer Networking Ltd. All Rights Reserved.
********************************************************************


File: D:\DL\UTILITIES\Port Explorer\pesetup.exe
Date: 3/31/2008 11:09:32 AM


***** General ******************************************************
           Location: D:\DL\UTILITIES\Port Explorer\
               Size: 1089164
            Version: 2.1.1.0
             CRC-32: BD56F7C6
                MD5: 4059F0945DFE9522E5B6F64F55F2792C
               SHA1: 5334C4E89F007969EB8553C27F948F76BC3D164E
          Read only: No
             Hidden: No
        System file: No
          Directory: No
            Archive: Yes
      Symbolic link: No
         Time stamp: Thursday, August 31, 2006 7:47:49 AM
           Creation: Thursday, August 31, 2006 7:45:14 AM
        Last access: Monday, March 31, 2008 11:09:16 AM
         Last write: Thursday, August 31, 2006 7:47:50 AM


***** Version ******************************************************
Supported languages:: English (United States) (1033/1252)
--- Version --------------------------------------------------------
       File version: 2.110               
       Company name: DiamondCS                                                   
      Internal name: 
           Comments: This installation was built with Inno Setup: http://www.innosetup.com
    Legal copyright: Copyright © 2002-2005 DiamondCS                                                                     
   Legal trademarks: 
  Original filename: 
       Product name: 
    Product version: 
   File description: Installs DiamondCS Port Explorer v2.110                     
      Private build: 
      Special build: 


***** Resources ****************************************************
--- Icon -----------------------------------------------------------
  1                                                                 
  2                                                                 
  3                                                                 
  4                                                                 
--- String Table ---------------------------------------------------
  4089                                                              
  4090                                                              
  4091                                                              
  4093                                                              
  4094                                                              
  4095                                                              
--- RCData ---------------------------------------------------------
  11111                                                             
--- Icon Group -----------------------------------------------------
  MAINICON                                                          
--- Version Info ---------------------------------------------------
  1                                                                 
--- XP Manifest ----------------------------------------------------
  1                                                                 


***** PE Header ****************************************************
                    Signature: 00004550
                      Machine: 014C - Intel 386
           Number of sections: 0008
              Time/Date stamp: 2A425E19
      Pointer to symbol table: 00000000
            Number of symbols: 00000000
      Size of optional header: 00E0
              Characteristics: 818F - Relocs Stripped, Executable, Line Numbers Stripped, Local Symbols Stripped, Bytes Reversed Lo, Bytes Reversed Hi, 32bit Machine Expected
                        Magic: 010B
       Linker version (major): 02
       Linker version (minor): 19
                 Size of code: 00009000
     Size of initialized data: 00004200
   Size of uninitialized data: 00000000
       Address of entry point: 000097F0
                 Base of code: 00001000
                 Base of data: 0000A000
                   Image base: 00400000
            Section alignment: 00001000
               File alignment: 00000200
           OS version (major): 0001
           OS version (minor): 0000
        Image version (major): 0000
        Image version (minor): 0000
   Sub system version (major): 0004
   Sub system version (minor): 0000
                Win32 version: 00000000
                Size of image: 00013000
              Size of headers: 00000400
                     Checksum: 00000000
                   Sub system: 0002 - Windows graphical user interface (GUI) subsystem
          DLL characteristics: 0000
        Size of stack reserve: 00100000
         Size of stack commit: 00004000
         Size of heap reserve: 00100000
          Size of heap commit: 00001000
                 Loader flags: 00000000
                Number of RVA: 00000010


***** PE Sections **************************************************
             CRC-32: 85429B4C
                MD5: B6A61FA1B1FBDAD049EFCAFC7F5AF6A8
----- PE Sections --------------------------------------------------
 Section VirtSize VirtAddr PhysSize PhysAddr    Flags 
    CODE 00008F14 00001000 00009000 00000400 60000020
    DATA 00000248 0000A000 00000400 00009400 C0000040
     BSS 00000E34 0000B000 00000000 00009800 C0000000
  .idata 00000942 0000C000 00000A00 00009800 C0000040
    .tls 00000008 0000D000 00000000 0000A200 C0000000
  .rdata 00000018 0000E000 00000200 0000A200 50000040
  .reloc 00000880 0000F000 00000000 0000A400 50000040
   .rsrc 00002800 00010000 00002800 0000A400 50000040


***** Import/Export table ******************************************
--- Export table ---------------------------------------------------
--- Import table ---------------------------------------------------
  advapi32.dll                                                      
    AdjustTokenPrivileges                                           
    LookupPrivilegeValueA                                           
    OpenProcessToken                                                
    RegCloseKey                                                     
    RegOpenKeyExA                                                   
    RegQueryValueExA                                                
  comctl32.dll                                                      
    InitCommonControls                                              
  kernel32.dll                                                      
    CloseHandle                                                     
    CloseHandle                                                     
    CreateDirectoryA                                                
    CreateFileA                                                     
    CreateFileA                                                     
    CreateProcessA                                                  
    DeleteCriticalSection                                           
    DeleteFileA                                                     
    EnterCriticalSection                                            
    ExitProcess                                                     
    FindResourceA                                                   
    FormatMessageA                                                  
    GetCommandLineA                                                 
    GetCommandLineA                                                 
    GetCurrentProcess                                               
    GetEnvironmentVariableA                                         
    GetExitCodeProcess                                              
    GetFileAttributesA                                              
    GetFileSize                                                     
    GetFileSize                                                     
    GetFileType                                                     
    GetFullPathNameA                                                
    GetLastError                                                    
    GetLastError                                                    
    GetLocaleInfoA                                                  
    GetModuleFileNameA                                              
    GetModuleHandleA                                                
    GetModuleHandleA                                                
    GetProcAddress                                                  
    GetStdHandle                                                    
    GetSystemDefaultLCID                                            
    GetSystemInfo                                                   
    GetSystemTime                                                   
    GetUserDefaultLangID                                            
    GetVersionExA                                                   
    GetWindowsDirectoryA                                            
    InitializeCriticalSection                                       
    InterlockedExchange                                             
    IsDBCSLeadByte                                                  
    LeaveCriticalSection                                            
    LoadLibraryA                                                    
    LoadResource                                                    
    LocalAlloc                                                      
    LocalFree                                                       
    LockResource                                                    
    MultiByteToWideChar                                             
    RaiseException                                                  
    ReadFile                                                        
    ReadFile                                                        
    RemoveDirectoryA                                                
    RtlUnwind                                                       
    SetEndOfFile                                                    
    SetEndOfFile                                                    
    SetErrorMode                                                    
    SetFilePointer                                                  
    SetFilePointer                                                  
    SetLastError                                                    
    SizeofResource                                                  
    Sleep                                                           
    TlsGetValue                                                     
    TlsSetValue                                                     
    VirtualAlloc                                                    
    VirtualAlloc                                                    
    VirtualFree                                                     
    VirtualFree                                                     
    VirtualProtect                                                  
    VirtualQuery                                                    
    WideCharToMultiByte                                             
    WriteFile                                                       
    WriteFile                                                       
  oleaut32.dll                                                      
    SysAllocStringLen                                               
    SysStringLen                                                    
    VariantChangeTypeEx                                             
    VariantClear                                                    
    VariantCopyInd                                                  
  user32.dll                                                        
    CallWindowProcA                                                 
    CharPrevA                                                       
    CreateWindowExA                                                 
    DestroyWindow                                                   
    DispatchMessageA                                                
    ExitWindowsEx                                                   
    LoadStringA                                                     
    MessageBoxA                                                     
    MessageBoxA                                                     
    MsgWaitForMultipleObjects                                       
    PeekMessageA                                                    
    SetWindowLongA                                                  
    TranslateMessage                                                


***** Archive preview **********************************************
            Modified     Size Ratio    CRC32 File name 

Here is FileAlyzer information for today's download of pesetup.exe:

Code:

********************************************************************
FileAlyzer © 2003-2006 Safer Networking Ltd. All Rights Reserved.
********************************************************************


File: D:\DL\UTILITIES\DiamondCS\Port Explorer\pesetup.exe
Date: 3/31/2008 11:08:19 AM


***** General ******************************************************
           Location: D:\DL\UTILITIES\DiamondCS\Port Explorer\
               Size: 1258185
            Version: 2.0.0.0
             CRC-32: D5785883
                MD5: D697BAE39F02E6E9D2F0AB237D313BCB
               SHA1: DA5C4AAEA6EA978507D4FCE3184202EBFAB1E26D
          Read only: No
             Hidden: No
        System file: No
          Directory: No
            Archive: Yes
      Symbolic link: No
         Time stamp: Monday, March 31, 2008 11:04:04 AM
           Creation: Monday, March 31, 2008 11:00:36 AM
        Last access: Monday, March 31, 2008 11:06:58 AM
         Last write: Monday, March 31, 2008 11:04:06 AM


***** Version ******************************************************
Supported languages:: English (United States) (1033/1252)
--- Version --------------------------------------------------------
       File version: 2.000               
       Company name: DiamondCS                                                   
      Internal name: 
           Comments: This installation was built with Inno Setup: http://www.innosetup.com
    Legal copyright: 
   Legal trademarks: 
  Original filename: 
       Product name: 
    Product version: 
   File description: Advanced network utility                                    
      Private build: 
      Special build: 


***** Resources ****************************************************
--- Icon -----------------------------------------------------------
  1                                                                 
  2                                                                 
  3                                                                 
  4                                                                 
--- String Table ---------------------------------------------------
  4089                                                              
  4090                                                              
  4091                                                              
  4093                                                              
  4094                                                              
  4095                                                              
--- Icon Group -----------------------------------------------------
  MAINICON                                                          
--- Version Info ---------------------------------------------------
  1                                                                 
--- XP Manifest ----------------------------------------------------
  1                                                                 


***** PE Header ****************************************************
                    Signature: 00004550
                      Machine: 014C - Intel 386
           Number of sections: 0008
              Time/Date stamp: 2A425E19
      Pointer to symbol table: 00000000
            Number of symbols: 00000000
      Size of optional header: 00E0
              Characteristics: 818F - Relocs Stripped, Executable, Line Numbers Stripped, Local Symbols Stripped, Bytes Reversed Lo, Bytes Reversed Hi, 32bit Machine Expected
                        Magic: 010B
       Linker version (major): 02
       Linker version (minor): 19
                 Size of code: 00008A00
     Size of initialized data: 00004200
   Size of uninitialized data: 00000000
       Address of entry point: 0000916C
                 Base of code: 00001000
                 Base of data: 0000A000
                   Image base: 00400000
            Section alignment: 00001000
               File alignment: 00000200
           OS version (major): 0001
           OS version (minor): 0000
        Image version (major): 0000
        Image version (minor): 0000
   Sub system version (major): 0004
   Sub system version (minor): 0000
                Win32 version: 00000000
                Size of image: 00014000
              Size of headers: 00000400
                     Checksum: 00000000
                   Sub system: 0002 - Windows graphical user interface (GUI) subsystem
          DLL characteristics: 0000
        Size of stack reserve: 00100000
         Size of stack commit: 00004000
         Size of heap reserve: 00100000
          Size of heap commit: 00001000
                 Loader flags: 00000000
                Number of RVA: 00000010


***** PE Sections **************************************************
             CRC-32: 75131204
                MD5: 073F1CEB54D4369B30196547B2B1A8F6
----- PE Sections --------------------------------------------------
 Section VirtSize VirtAddr PhysSize PhysAddr    Flags 
    CODE 00008918 00001000 00008A00 00000400 60000020
    DATA 0000021C 0000A000 00000400 00008E00 C0000040
     BSS 000010B8 0000B000 00000000 00009200 C0000000
  .idata 0000084E 0000D000 00000A00 00009200 C0000040
    .tls 00000008 0000E000 00000000 00009C00 C0000000
  .rdata 00000018 0000F000 00000200 00009C00 50000040
  .reloc 00000830 00010000 00000000 00009E00 50000040
   .rsrc 00002800 00011000 00002800 00009E00 50000040


***** Import/Export table ******************************************
--- Export table ---------------------------------------------------
--- Import table ---------------------------------------------------
  advapi32.dll                                                      
    AdjustTokenPrivileges                                           
    LookupPrivilegeValueA                                           
    OpenProcessToken                                                
    RegCloseKey                                                     
    RegOpenKeyExA                                                   
    RegQueryValueExA                                                
  comctl32.dll                                                      
    InitCommonControls                                              
  kernel32.dll                                                      
    CloseHandle                                                     
    CloseHandle                                                     
    CreateDirectoryA                                                
    CreateFileA                                                     
    CreateProcessA                                                  
    DeleteCriticalSection                                           
    DeleteFileA                                                     
    EnterCriticalSection                                            
    ExitProcess                                                     
    FormatMessageA                                                  
    GetCommandLineA                                                 
    GetCommandLineA                                                 
    GetCurrentProcess                                               
    GetEnvironmentVariableA                                         
    GetExitCodeProcess                                              
    GetFileAttributesA                                              
    GetFileSize                                                     
    GetFileType                                                     
    GetFullPathNameA                                                
    GetLastError                                                    
    GetLastError                                                    
    GetLocaleInfoA                                                  
    GetModuleFileNameA                                              
    GetModuleHandleA                                                
    GetModuleHandleA                                                
    GetProcAddress                                                  
    GetStdHandle                                                    
    GetSystemDefaultLCID                                            
    GetSystemInfo                                                   
    GetSystemTime                                                   
    GetUserDefaultLangID                                            
    GetVersionExA                                                   
    GetWindowsDirectoryA                                            
    InitializeCriticalSection                                       
    LeaveCriticalSection                                            
    LocalAlloc                                                      
    LocalFree                                                       
    MultiByteToWideChar                                             
    RaiseException                                                  
    ReadFile                                                        
    RemoveDirectoryA                                                
    RtlUnwind                                                       
    SetEndOfFile                                                    
    SetErrorMode                                                    
    SetFilePointer                                                  
    SetLastError                                                    
    Sleep                                                           
    TlsGetValue                                                     
    TlsSetValue                                                     
    VirtualAlloc                                                    
    VirtualAlloc                                                    
    VirtualFree                                                     
    VirtualFree                                                     
    VirtualProtect                                                  
    VirtualQuery                                                    
    WideCharToMultiByte                                             
    WriteFile                                                       
  oleaut32.dll                                                      
    SysAllocStringLen                                               
    SysStringLen                                                    
    VariantChangeTypeEx                                             
    VariantClear                                                    
    VariantCopyInd                                                  
  user32.dll                                                        
    CallWindowProcA                                                 
    CharNextA                                                       
    CharPrevA                                                       
    CreateWindowExA                                                 
    DestroyWindow                                                   
    DispatchMessageA                                                
    ExitWindowsEx                                                   
    LoadStringA                                                     
    MessageBoxA                                                     
    MessageBoxA                                                     
    MsgWaitForMultipleObjects                                       
    PeekMessageA                                                    
    SetWindowLongA                                                  
    TranslateMessage                                                


***** Archive preview **********************************************
            Modified     Size Ratio    CRC32 File name 

I am also confused.

 

Did this transaction ever get thru??

I'm very willing to buy the product even tho there are any number of other products which are similar.

 

If you're referring to my purchase of another Port Explorer license, then yes. I received my "serial number" which appears to be from "sales@diamondcs.com.au" on March 30. My payment was directly from my checking account via PayPal and $29.95 was debited from my checking account on March 31 as "PAYPAL INST XFER ACH ". I have not seen any unusual activity with my checking account (yet).

However, the person I think you referred to in the Wilders forum thread (Threedog) stated (s)he received a "license" e-mail but stated no license code was included in the message. I don't recall which DiamondCS product Threedog ordered.

It appears if one tries a purchase from DiamondCS, it's a gamble.

 

Appears the DiamondCS developer (Wayne) is back after recovering from a car accident.

http://www.wilderssecurity.com/showthread.php?t=185994&page=9

Starting with Post #205.