Guest BanKai Posted October 2, 2007 Report Share Posted October 2, 2007 poate trebuia sa le aratzi programul the hard way daca tot era indetectabil trebuia sa ii infectezi pe acesti trojan happy boys si apoi sa aratzi nishte screenuri aici . evident trebuia sa ceri permisiunea unui admin sa faci asta Quote Link to comment Share on other sites More sharing options...
wrm Posted October 2, 2007 Report Share Posted October 2, 2007 poate trebuia sa le aratzi programul the hard way daca tot era indetectabil trebuia sa ii infectezi pe acesti trojan happy boys si apoi sa aratzi nishte screenuri aici . evident trebuia sa ceri permisiunea unui admin sa faci asta Tie ti-ar fi convenit sa ti se intample asta ? Sau voi vorbiti fara sa stiti ce vorbiti ? De ce sa ne fi infectat ? Ca sa ia un VIP ? Sau aici asa se ia VIP ? Am sa o hacksoresc si eu pe bunica, pun screen, si vip Quote Link to comment Share on other sites More sharing options...
Nytro Posted October 15, 2007 Author Report Share Posted October 15, 2007 )) v1.1 Quote Link to comment Share on other sites More sharing options...
hackedss Posted October 16, 2007 Report Share Posted October 16, 2007 cand postezi v1,1 ca aia de mai sus e 1,0 ? Quote Link to comment Share on other sites More sharing options...
Nytro Posted October 16, 2007 Author Report Share Posted October 16, 2007 pai uitate pe aici ca e un link de download la v1.1 uitate mai sus ... Quote Link to comment Share on other sites More sharing options...
hackedss Posted October 16, 2007 Report Share Posted October 16, 2007 ca aia de mai sus e 1.0 Quote Link to comment Share on other sites More sharing options...
Nytro Posted October 16, 2007 Author Report Share Posted October 16, 2007 http://www.coolfilehost.biz/79Dem0nyc%20Trojan%20v1.1.rar e pe pagina 2 ... Quote Link to comment Share on other sites More sharing options...
hackedss Posted October 16, 2007 Report Share Posted October 16, 2007 Da frate de ala vorbeam si eu doar nu postam de geaba dar uite fratelo .... aici in progam scrie 1.0v si am dat de inteles ca e greseala e apoi ai zis u ca e nedetectabil e uite dovada ca e ... Antivirus Version Last Update ResultAVG 7.5.0.488 2007.10.16 BackDoor.Generic8.PIIFortinet 3.11.0.0 2007.10.16 W32/Agent.BTX!trF-Secure 6.70.13030.0 2007.10.16 Trojan.Win32.Agent.btxIkarus T3.1.1.12 2007.10.16 Trojan-Dropper.Win32.Agent.AIYKaspersky 7.0.0.125 2007.10.16 Trojan.Win32.Agent.btxNorman 5.80.02 2007.10.16 W32/MalwareVBA32 3.12.2.4 2007.10.16 Trojan.Win32.Agent.btx apropo cu cate ai incercat sa il packuesti dar tot degeaba MD5: 8a6ddba28d36ac5727459f0962131f74SHA1: d069a0f9fc4e2256355cad20f8b7299d327aed90packers: RARnorman sandbox: [ General information ] * **IMPORTANT: PLEASE SEND THE SCANNED FILE TO: [email]ANALYSIS@NORMAN.NO[/email] - REMEMBER TO ENCRYPT IT (E.G. ZIP WITH PASSWORD)**. * Applications uses MSVBVM60.DLL (Visual Basic 6). * Form uses id Form. * Creating several executable files on hard-drive. * File length: 191828 bytes. [ Changes to filesystem ] * Creates directory C:. * Creates directory C:\WINDOWS. * Creates directory C:\WINDOWS\TEMP. * Creates directory C:\WINDOWS\TEMP\RarSFX0. * Creates file C:\WINDOWS\TEMP\RarSFX0\need.exe. * Creates file C:\WINDOWS\TEMP\RarSFX0\MSWINSCK.OCX. * Creates file C:\WINDOWS\TEMP\RarSFX0\smss.exe. [ Changes to registry ] * Creates key \"HKCU\Software\WinRAR SFX\". * Sets value \"C%%WINDOWS\"=\"C:\WINDOWS\TEMP\RarSFX0\" in key \"HKCU\Software\WinRAR SFX\". [ Process/window information ] * Attemps to NULL C:\WINDOWS\need.exe NULL. * Creates a COM object with CLSID {FCFB3D23-A0FA-1068-A738-08002B3371B5} : VBRuntime. * Creates a COM object with CLSID {E93AD7C1-C347-11D1-A3E2-00A0C90AEA82} : VBRuntime6. * Modifies other process memory. * Modifies execution flow of a remote process.oricum marfa progam si la mai multe apropo vezi prv... Quote Link to comment Share on other sites More sharing options...
Nytro Posted October 17, 2007 Author Report Share Posted October 17, 2007 pai lam packuit cu un crypter privat ... si serverul e o arhiva SFX ... ce dracu am scanat ieri ? ...Pai v1.1 e v1.0 cryptata ... un timp a fost 100% UD ...File Dem0nyc_Trojan_Server_v1.1.exe received on 10.17.2007 08:06:53 (CET)Current status: Loading ... queued waiting scanning finished NOT FOUND STOPPED Result: 7/32 (21.88%)Loading server information... Your file is queued in position: 1.Estimated start time is between 39 and 56 seconds.Do not close the window until scan is complete. The scanner that was processing your file is stopped at this moment, we are going to wait a few seconds to try to recover your result.If you are waiting for more than five minutes you have to resend your file. Your file is being scanned by VirusTotal in this moment,results will be shown as they're generated. Compact Print results Your file has expired or does not exists. Service is stopped in this moments, your file is waiting to be scanned (position: ) for an undefined time.You can wait for web response (automatic reload) or type your email in the form below and click "request" so the system sends you a notification when the scan is finished. Email: Antivirus Version Last Update Result AhnLab-V3 2007.10.17.0 2007.10.16 - AntiVir 7.6.0.23 2007.10.17 - Authentium 4.93.8 2007.10.17 - Avast 4.7.1051.0 2007.10.17 - AVG 7.5.0.488 2007.10.16 BackDoor.Generic8.PII BitDefender 7.2 2007.10.17 - CAT-QuickHeal 9.00 2007.10.16 - ClamAV 0.91.2 2007.10.16 - DrWeb 4.44.0.09170 2007.10.17 - eSafe 7.0.15.0 2007.10.15 - eTrust-Vet 31.2.5216 2007.10.17 - Ewido 4.0 2007.10.16 - FileAdvisor 1 2007.10.17 - Fortinet 3.11.0.0 2007.10.17 W32/Agent.BTX!tr F-Prot 4.3.2.48 2007.10.17 - F-Secure 6.70.13030.0 2007.10.17 Trojan.Win32.Agent.btx Ikarus T3.1.1.12 2007.10.17 Trojan-Dropper.Win32.Agent.AIY Kaspersky 7.0.0.125 2007.10.17 Trojan.Win32.Agent.btx McAfee 5142 2007.10.16 - Microsoft 1.2908 2007.10.16 - NOD32v2 2596 2007.10.17 - Norman 5.80.02 2007.10.16 W32/Malware Panda 9.0.0.4 2007.10.16 - Prevx1 V2 2007.10.17 - Rising 19.45.21.00 2007.10.17 - Sophos 4.22.0 2007.10.17 - Sunbelt 2.2.907.0 2007.10.16 - Symantec 10 2007.10.17 - TheHacker 6.2.8.093 2007.10.16 - VBA32 3.12.2.4 2007.10.16 Trojan.Win32.Agent.btx VirusBuster 4.3.26:9 2007.10.16 - Webwasher-Gateway 6.6.1 2007.10.17 - Additional information File size: 191828 bytes MD5: 8a6ddba28d36ac5727459f0962131f74 SHA1: d069a0f9fc4e2256355cad20f8b7299d327aed90 packers: RAR norman sandbox: [ General information ] * **IMPORTANT: PLEASE SEND THE SCANNED FILE TO: ANALYSIS@NORMAN.NO - REMEMBER TO ENCRYPT IT (E.G. ZIP WITH PASSWORD)**. * Applications uses MSVBVM60.DLL (Visual Basic 6). * Form uses id Form. * Creating several executable files on hard-drive. * File length: 191828 bytes. [ Changes to filesystem ] * Creates directory C:. * Creates directory C:\WINDOWS. * Creates directory C:\WINDOWS\TEMP. * Creates directory C:\WINDOWS\TEMP\RarSFX0. * Creates file C:\WINDOWS\TEMP\RarSFX0\need.exe. * Creates file C:\WINDOWS\TEMP\RarSFX0\MSWINSCK.OCX. * Creates file C:\WINDOWS\TEMP\RarSFX0\smss.exe. [ Changes to registry ] * Creates key \"HKCU\Software\WinRAR SFX\". * Sets value \"C%%WINDOWS\"=\"C:\WINDOWS\TEMP\RarSFX0\" in key \"HKCU\Software\WinRAR SFX\". [ Process/window information ] * Attemps to NULL C:\WINDOWS\need.exe NULL. * Creates a COM object with CLSID {FCFB3D23-A0FA-1068-A738-08002B3371B5} : VBRuntime. * Creates a COM object with CLSID {E93AD7C1-C347-11D1-A3E2-00A0C90AEA82} : VBRuntime6. * Modifies other process memory. * Modifies execution flow of a remote process. Quote Link to comment Share on other sites More sharing options...
-LuckYann- Posted October 17, 2007 Report Share Posted October 17, 2007 E misto acest trojan am facut treaba buna cu el Quote Link to comment Share on other sites More sharing options...
Nytro Posted October 18, 2007 Author Report Share Posted October 18, 2007 ms .. pacat ca e detectabil ... Quote Link to comment Share on other sites More sharing options...
