nZEDb

nZEDb => Support => Topic started by: rehatiel on 2014-03-30, 07:34:22 pm

Title: Battling that a$$hole codec poster
Post by: rehatiel on 2014-03-30, 07:34:22 pm
So I expanded a bit on the blacklist that was added in the last update.. I've looked around and found most of the emails this douchebag uses.. Feel free to add more if you guys see one that I missed.

Group
Code: [Select]
alt\.binaries\.(boneless|blu-ray|movies\.divx|movies|ath)
Code: [Select]
((Frkz|info)@XviD2?|x?VIDZ?@pwrpst|movies@movies?)\.net|(hsv\.stoned@hotmail|unequal87@gmail|ilove@movies)\.com|XviD@world\.net|XviD@movies\.net|Movie@post\.com|Power@post\.com|Power@post\.com|Movie@ZL\.net|Xvidz@video\.net|CPP-gebruiker@domein\.nl|Ran@Movies\.com|RD@mov\.net|Moviez@XviD\.com|HD@movies\.com|Movz@rel\.com|moviess@movies\.net|Para@tropz\.com|Mov@ing\.com|HD@love\.com|HDM@love\.com|HDMovies@love\.com|MV@ing\.com|HDMOVIEWORLD@love\.com|Daco@Co\.com|Xvido@Co\.com|assis@debout\.com|movies@montain\.com|skyfall@slain\.net|mo@ntain\.com|personxyz@hotmail\.com|Underscore@dcs\.net|abcd@ef\.com|lafin@dumonde\.com|Laamatrens@fred\.com|hedgehog@hotmail\.com|Movie@world\.com|movies@mov\.com|Xvid@movie\.com|mov@movies\.com|Movie@time\.com|0Day@gmail\.com|Xvid2@Go\.com|App@gmail\.com|The@movies\.com|Moviezz@film\.com|TopMovie@movie\.com|mov@gogo\.com|Movie@gmail\.com|Movie@movie\.com|movie@movies\.com|movies@movie\.com|mov@iez\.com|Movie@german\.com|plexmast@gmail\.com|mov@ies\.com|Simon@yahoo\.co\.uk|Moviemania@gmail\.com|Movies1@gmail\.com|Paulo@gmail\.com|0day@apps\.com|AceOfSpades54@Uploader\.com|Warez11@gmail\.com|Jibjab23@gmail\.com|T4@movies\.com|Cinema@providers\.com
Message field: Poster
Title: Re: Battling that a$$hole codec blocker
Post by: BeZazz on 2014-04-01, 03:49:41 pm
Thank you :)
Title: Re: Battling that a$$hole codec blocker
Post by: sooti on 2014-04-03, 06:41:18 am
Guys add this  CPP-USER@domain.com (CPP-USER)
in a.b.movies
This spammer uses .wmv files to download virus codecs
Title: Re: Battling that a$$hole codec blocker
Post by: rehatiel on 2014-04-03, 07:40:49 am
Guys add this  CPP-USER@domain.com (CPP-USER)
in a.b.movies
This spammer uses .wmv files to download virus codecs

Yea.. be careful with this blacklist.. Looks like he's assuming the identity of legit posters.  If you run this blacklist, make sure it's for the past like 96 hours.  There are legit releases from this poster that would be removed if you do a full database blacklist scan.
Title: Re: Battling that a$$hole codec blocker
Post by: Bart39 on 2014-04-03, 04:52:03 pm
Guys add this  CPP-USER@domain.com (CPP-USER)
in a.b.movies
This spammer uses .wmv files to download virus codecs

dont blacklist this usre thats the default user from one of the posting programs (forget which)
Title: Re: Battling that a$$hole codec blocker
Post by: justme on 2014-04-04, 02:17:24 pm
Guys add this  CPP-USER@domain.com (CPP-USER)
in a.b.movies
This spammer uses .wmv files to download virus codecs

dont blacklist this usre thats the default user from one of the posting programs (forget which)

Camel PowerPost
Title: Re: Battling that a$$hole codec blocker
Post by: sooti on 2014-04-05, 03:26:51 am
Then how do i remove his crappy wmv files?
Title: Re: Battling that a$$hole codec blocker
Post by: w33ty on 2014-04-06, 04:48:31 am
Thanks for the heads up new he was using proper user names too this guy is a pain in the ass  >:(
Title: Re: Battling that a$$hole codec blocker
Post by: rehatiel on 2014-04-06, 12:22:44 pm
Would it be possible to request an addition to removecrap to include WMV files? Not sure there are that many people releasing stuff with that extension these days.. mostly it's MKV, AVI and MP4 files..

One thing I have noticed is that all these releases have one thing in common.  None of them will actually pull any media info since I guess they're not really movie files.  I wonder if it'd be possible to have a script or something read for Media info under certain groups and if none can be obtained, they're classified as 'Unverified' or 'High Risk'.. Something that basically warns the user that these are most likely potential viruses or fakes.  Wish I had the expertise to write something like this, but it'd be a great addition to the nzedb software.
Title: Re: Battling that a$$hole codec blocker
Post by: dizant on 2014-04-06, 05:36:31 pm
Here's the sql that will return the release id's for the crap wmvs being posted.  Maybe someone better at php than me can add it to ReleaseRemover.php

Code: [Select]
SELECT DISTINCT r.ID FROM releasefiles rf INNER JOIN releases r ON (rf.releaseID = r.id) WHERE rf.name REGEXP 'x264.*\.wmv$';
Title: Re: Battling that a$$hole codec blocker
Post by: gennavar on 2014-04-08, 09:07:07 am
Ok, this guy is annoying me  >:(

As I can't remember the last time I pulled down a WMV file to watch, I've decided to delete all WMV files every day. Before I do this though, I just wanted to check the process in case I cause some issues for myself :)

1. Run SQL:
Code: [Select]
DELETE FROM releases where id in
(SELECT DISTINCT r.ID FROM releasefiles rf
INNER JOIN releases r ON (rf.releaseID = r.id)
WHERE rf.name REGEXP 'x264.*\.wmv$'
AND rf.createddate > DATE_SUB(NOW(), INTERVAL 1 WEEK);

2. Not sure if the above will cascade delete the files from "releasefiles" but if not, delete the same records from there too, I.E.
Code: [Select]
DELETE FROM releasefiles
WHERE name REGEXP 'x264.*\.wmv$'
AND createddate > DATE_SUB(NOW(), INTERVAL 1 WEEK);

3. Clean up the NZBs:
/var/www/nZEDb/misc/testing/Dev/clean_nzbs.php true

Does this sound like it would work?
NB. The above would do the last week's worth - I'd probably run that for the last couple of weeks tbh - can't quite remember when he started posting cr*p ......

[Update: The above was based on dizant's post - thanks dizant!]
Title: Re: Battling that a$$hole codec blocker
Post by: kevin123 on 2014-04-08, 09:58:08 am
It's better to use the deletereleases script, it will get rid of nzb files / everything else tied to that release.
Title: Re: Battling that a$$hole codec blocker
Post by: gennavar on 2014-04-08, 10:07:30 am
It's better to use the deletereleases script, it will get rid of nzb files / everything else tied to that release.

I did have a look at that Kevin but I couldn't see any way of using it to check for release file names, only name/searchname (which may not have WMV in it) ?
Title: Re: Battling that a$$hole codec blocker
Post by: kevin123 on 2014-04-08, 11:13:18 am
Sorry, I meant removecrapreleases, there is a wmv option.

https://github.com/nZEDb/nZEDb/commit/cfb1c5d15dc045d07660cfb508282a111aa04ce9
Title: Re: Battling that a$$hole codec blocker
Post by: gennavar on 2014-04-08, 12:01:23 pm
Brill! I hadn't noticed the addition of WMV to this util - nice one :)
Cloning the VM and giving it a whirl!
Title: Re: Battling that a$$hole codec blocker
Post by: dizant on 2014-04-08, 10:54:11 pm
[Update: The above was based on dizant's post - thanks dizant!]

 Glad I could contribute. :) A friend sent the sql my way, so I can't really take the credit.
Title: Re: Battling that a$$hole codec blocker
Post by: Darius on 2014-04-09, 12:17:21 am
Damn, i wrote your nick wrong. Sorry, dizant.
Title: Re: Battling that a$$hole codec blocker
Post by: rehatiel on 2014-05-23, 07:13:50 am
I've continued to add to the original post when I see new codec posters pop up.  Just FYI if you're looking to block this guy.
Title: Re: Battling that a$$hole codec blocker
Post by: kevin123 on 2014-05-23, 09:50:52 am
DejaVu has a list on newznabforums too, might be some you guys don't have there.
Title: Re: Battling that a$$hole codec blocker
Post by: rehatiel on 2014-05-26, 07:47:31 am
Awesome :) Thanks Kevin!
Title: Re: Battling that a$$hole codec blocker
Post by: kevin123 on 2014-05-26, 07:56:50 am
Code: [Select]
info@XviD.net (XviD)
Frkz@XviD.net (XviDFrkz)
XviD@MOvIEs.net (XviDLove)
XviD@movies.net (XviDMovies)
XviD@world.net (XvidWorld)
Firm@DVD.net (DVDFirm)
Movie@Freaks.net (Movie)
DVD@MOvIEs.net (MOvIEs)
Power@post.com (Powerpost)
peruzza@gmail.com (omnik)
sxomy82@yahoo.com (pixell)
Ran@Movies.com (RanMovies)
Movies@movie.net (Movies)
CPP-USER@domain.com (CPP-USER)
USER@domain.com (USER)
ilove@movies.com (Ilovemovies)
Movie@ZL.net (MovieZL)
Movie@post.com (Movie)
Xvidz@video.net (XvidZ)
CPP-gebruiker@domein.nl (CPP-Gebruiker)
Movie@post.com (Movie)
RD@mov.net (RDMOV)
Moviez@XviD.com (XviD)
HD@movies.com (HDM)
VIDZ@pwrpst.net (VIDZ)
info@xvid2.net (XviD)
info@dvd.net (DVD)
Xvid@pwrpst.net (PwrPost)
hsv.stoned@hotmail.com (vaughnisto)
unequal87@gmail.com (owerburn)
Xvidz@video.net (XvidZ)
Firm@DVD.net (DVDFirm)
rocky5@hotmail.com (Nimbus)
moviess@mov.net (Movie)
DVD@Hookie.com (Hookie)
Movz@rel.com (Movz)


Reposted here (from DejaVu's posts).
Title: Re: Battling that a$$hole codec blocker
Post by: slypknot on 2014-06-03, 08:34:03 pm
Extremely glad to have been pointed to this thread.

One thing I've noticed is this jerk is not only posting wmv's but avi's as well... Wouldn't it make more sense for the codec option (removeCrapReleases.php) to simply look for that folder and Setup.exe?  This would kill the lot of em rather than only wmv's.

I personally would never expect a movie release to include an exe and if it did I'd want it purged...
Title: Re: Battling that a$$hole codec blocker
Post by: Darius on 2014-06-04, 02:52:55 am
removeCrapReleases IS looking for those folders.
Title: Re: Battling that a$$hole codec blocker
Post by: kevin123 on 2014-06-04, 03:20:24 am
When you grab 500KB of a 4GB RAR set of files, sometimes that's not enough to get the whole list of contents within the RAR.
Title: Re: Battling that a$$hole codec blocker
Post by: slypknot on 2014-06-04, 05:02:12 am
removeCrapReleases IS looking for those folders.

True, but the code appeared to be looking for that folder AND a .wmv... I changed the .wmv to .avi and got a different set of results to purge, they also having the codec folder present.   
Title: Re: Battling that a$$hole codec blocker
Post by: Darius on 2014-06-05, 02:07:29 am
I have made a pull request with changes, to include avi (but it might catch some legit releases) and XXX categories, as that spammer is posting there too.
Title: Re: Battling that a$$hole codec blocker
Post by: slypknot on 2014-06-05, 11:37:57 am
I have made a pull request with changes, to include avi (but it might catch some legit releases) and XXX categories, as that spammer is posting there too.

Kick ass!  Now will be interesting to see how quickly he/she jumps to mkv's to keep us chasing...
Title: Re: Battling that a$$hole codec blocker
Post by: NZBmets on 2014-06-05, 03:02:14 pm
Just a thought (probably more relevant to an archive import)...it might be a consideration to include a post date in conjunction with the poster username. It would obviously add to the load but it might prevent losing some valid releases prior to this codec guy's efforts.
Title: Re: Battling that a$$hole codec blocker
Post by: bobtongue on 2014-06-06, 11:03:05 am
Found a new email for the poster today.
Mov@ing.com (MovinG)
You may want to add this one to your blacklist
Title: Re: Battling that a$$hole codec blocker
Post by: slypknot on 2014-06-10, 08:27:13 pm
Ok so I have some odd results using the latest 'codec' option.... I see you added in wmv|avi and this is indeed catching more results.
Not being a guru such as yourself, please let me know if my understanding of your work is accurate:

The query is looking in the categories specified, for releases with wmv OR avi with filenames which contain \Codec\Setup.exe OR 'If_you_get_error.txt'

I put together a test VM - pulled down ONLY movie categories, then expanded your work  by changing only the   wmv|avi   to   wmv|avi|mp4|mpg|mkv

This caught a TON of valid releases...which makes me wonder, why?  If none of them contained either search term - how or why would valid releases be included?  It's just weird - I also did a search against releasefiles and looked for %Setup.exe% - I had 3 hits yet using the script hand close to 200....

Title: Re: Battling that a$$hole codec blocker
Post by: Darius on 2014-06-11, 05:03:26 am
removeCrapReleases.php codec looks for releases containing x264 wmv and x264 avi releases OR the files included. If i was in your place, i would not include  mp4, mpg or mkv as the codec spammer is not using those, and you are removing valid releases. For now the codec spam is using only wmv and avi extensions.
Title: Re: Battling that a$$hole codec blocker
Post by: david_ritterhous on 2014-06-11, 05:29:47 am
Ok so I have some odd results using the latest 'codec' option.... I see you added in wmv|avi and this is indeed catching more results.
Not being a guru such as yourself, please let me know if my understanding of your work is accurate:

The query is looking in the categories specified, for releases with wmv OR avi with filenames which contain \Codec\Setup.exe OR 'If_you_get_error.txt'

I put together a test VM - pulled down ONLY movie categories, then expanded your work  by changing only the   wmv|avi   to   wmv|avi|mp4|mpg|mkv

This caught a TON of valid releases...which makes me wonder, why?  If none of them contained either search term - how or why would valid releases be included?  It's just weird - I also did a search against releasefiles and looked for %Setup.exe% - I had 3 hits yet using the script hand close to 200....


I think it was with what you did "by changing only the   wmv|avi   to   wmv|avi|mp4|mpg|mkv"
Title: Re: Battling that a$$hole codec blocker
Post by: slypknot on 2014-06-11, 06:34:16 am
removeCrapReleases.php codec looks for releases containing x264 wmv and x264 avi releases OR the files included. If i was in your place, i would not include  mp4, mpg or mkv as the codec spammer is not using those, and you are removing valid releases. For now the codec spam is using only wmv and avi extensions.

arrgh... and this is why I'm not a DBA.  I somehow missed the OR and thought of it as an AND.  Glad it was a VM ;)
Title: Re: Battling that a$$hole codec blocker
Post by: rehatiel on 2014-06-18, 05:38:08 pm
Added hd@love.com
Title: Re: Battling that a$$hole codec poster
Post by: bobtongue on 2014-07-17, 01:18:11 pm
Now I see a new twist to the codec crap. The release now has a folder named vlc media player new version

Read me says if the file doesn't play then install new version of vlcmedia player.

The file in the folder is vlc.media.player.2.1.4.exe.

You know its not vlcmedia player.
Title: Re: Battling that a$$hole codec poster
Post by: rehatiel on 2015-02-17, 07:00:01 pm
Been a little while.. updated my list.
Title: Re: Battling that a$$hole codec poster
Post by: BeZazz on 2015-02-19, 10:23:28 pm
Been a little while.. updated my list.

Thanks for taking the time.