1. - What is NetBus and NetBuster? First of all you will have to know what NetBus is. NetBus is a program that allows people to access your computer via internet. Is consists of TWO parts, one client part and one server part. The client part is the part the 'intruder' uses to control your computer if you have the SERVER installed. The server is usually called sysedit.exe, patch.exe or explore.exe. Somebody might install it to your computer without your knowledge, or you might run a program that installs it. One of these programs is a game called Whack-a-mole, it installs a file called explore.exe, which is a NetBus server. Explore.exe is the official NetBus 1.60 server called patch.exe renamed. This version installs itself to the autostart registry so that it will be autostarted everytime you reboot windows. To protect yourself against NetBus is no problem, just check the registry for unknown files and remove. But to me this isn't enough, i want to know WHO is trying to NetBus me, and fool with the guy NetBusing me instead. So i made NetBuster. NetBuster emulates the serverversion of NetBus so that people can connect you and believe they're fooling around with you. Instead all their actions will be logged, together with their IP adress, date and time. As if this wasn't enough you can fool with them instead. Unfortunately you can't do the same actions to them as they're trying to do to you, but you can send them multiply messages which could be very irritating. And you can select files to be transmitted as screendump, recording or other files on requests. For example, they want a screendump of your screen. If you've selected a JPG image this will be sent as a 'screendump' image. They will probably get chocked when they get's a picture showing a fat ass with the text kiss me or something like that. Or a wavefile saying something rude when they try to record. You can also select an executable file to be sent when they try to download a file from you. But how do they know what file to download? Well, there is a file called drive.dsk which is a faked directory tree. They might want some 'files' from this dir, and if they try to download anything they will get the file you selected, and they will get the same filename as they wanted! This file could be anything, perhaps a netbus server, or a program crashing their computer. You can't edit this directory tree file from NetBuster, but if you have a Hex-Editor you can make changes to it if you want a personal directory file. 2. - How does it work? When starting NetBuster it first scans the memory for known versions of NetBus servers. If not found then it activates itself and the activate button will change name to 'Inactivate'. I guess most of the functions doesn't need to be explained, Fooling with volume might need explanation. When turned on and user tries to record his balance-controls of the volume will jump around for about 10 seconds. If Check if NetBus is installed on remote IP is checked then it checks the IP adress of the connected intruder for NetBus servers. If found you will get through EVEN when password protected! You can then set the password to whatever you want, and connect him via your own NetBus if you have it. You will also be able to do some 'nice' things to him direct from NetBuster, if you want to do anything else you will have to connect him via NetBus. 3. - What's new in version 1.12? Fixed the 'list index out of bound' bug on filetransfer. It now works under NT systems. Trayicon and hidden from taskbar when minimized. Notify signal on connect. Finds more versions of NetBus servers. View the autostart registry to find possible NetBus servers. Checks if NetBus server is running on remote IP. Better log handling. Better user-interface. 3. - Error Messages If you get an error message saing 'Error on API-bind (10048)' it means that NetBuster can't allocate port 12345 because it's already allocated by another program. Most surely this is a NetBus server. NetBuster checks the memory for usuall versions of NetBus servers and removes it if found. If not found then this error message appears. To solve it you can check the autostart registry under the tab SCAN. Be carefull, don't remove anything unless sure it's a NetBus server. If there is a file with the parameter /nomsg then check it out, it might be a netbus 1.60 server. After removing a file from the registry you will have to restart your computer. If you still get the error message, you've deleted the wrong file. If you need help, then mail me together with the list of your registry. For bug reports or anything else contact me at gibby@swipnet.se Latest version can be found at http://surf.to/netbuster