Antivirus Pro

Greetings all...been a while since I've visited.

I have a question, I'm hoping someone might be able to help me with. I accidentally contracted the Antivirus pro trojan / spyware earlier today (oops). I got rid of it after a few minutes, but I saved the executable that was downloaded to my computer.

Does anyone know how I might be able to say unpack / decompile the file?

I'm wanting to take a peak on the inside of this lovely program and see what makes it run. Unfortunately, using a resource editor doesn't give me much of anything.

Thanks

Greetz Cheyenne. :)

Anyhow here are a few urls i have stashed away in my Bookmark collection.

http://www.woodmann.com/crackz/index.html#msgboards

http://forum.exetools.com/index.php <(Invite only, but i could organise a invitation to be sent.)


Also check out vxchaos file server, there are a ton of unpackers located there. :)

http://vxchaos.official.ws

Very cool..I'll have to check those out.

Is there anyway to find out what a .exe was coded in? For example..C++, .net etc etc?

Or is the best bet just to try some different unpackers / decompilers till one works?

Greetz.

I haven't dabbled in reverse engineering in awhile. :(

but usually it's just a matter of finding a decompiler/s that suit what you are trying to achieve, and stick with those.

and it also helps to know a little info about how the object was coded, what sort of packing algorithm etc etc.

also check out http://www.woodmann.com/forum/index.php

the forum is pretty useful, and there are a few more urls that may help.

a few stealth google searches may help you dig up more info about this Antivirus pro trjn.

Quote:

---

Originally Posted by cheyenne1212

Greetings all...been a while since I've visited.

I have a question, I'm hoping someone might be able to help me with. I accidentally contracted the Antivirus pro trojan / spyware earlier today (oops). I got rid of it after a few minutes, but I saved the executable that was downloaded to my computer.

Does anyone know how I might be able to say unpack / decompile the file?

I'm wanting to take a peak on the inside of this lovely program and see what makes it run. Unfortunately, using a resource editor doesn't give me much of anything.

Thanks

---

as i recall there is a fix tool for that particular piece of spy ware google antivirus pro removal tool that should point you in the right direction , i like finding a removal tool whenever possible because some anti virus/anti malware programs don't remove it completely also remember to disable system restore as i recall this piece of malware like to store itself there as well good luck

Oh..I already have it removed..that parts easy...just wanted look at the code :)

cheyenne:

Wanna use *nix or windows? Ah hell just go here http://www.thefreecountry.com/progra...semblers.shtml
frhed is probably what you need, I haven't tried borg

Quote:

---

Originally Posted by cheyenne1212

Oh..I already have it removed..that parts easy...just wanted look at the code :)

---

lol sorry i didnt read your whole post , was 3 am ,and had worked on 2 pcs that day, the nonprofit organization i belong to i get all the hard repairs , so my brain was fried lol

Quote:

---

Originally Posted by cheyenne1212

Oh..I already have it removed..that parts easy...just wanted look at the code :)

---

Hey cheyenne, what did you use? Everything I try isn't getting rid.