26 replies to this topic

[pdf]

wtf "File_Binder.exe" is a w32.blaster.worm

it creates some files in system directory!

[vnet576]

This is open source, I included the C++ sources of everything that I did. However if u're more comfortable with ASM then go right ahead..this project was meant to be open sourced.

[vnet576]

wtf "File_Binder.exe" is a w32.blaster.worm

it creates some files in system directory!

Of course it does rofl. This is why you should read the tutorial before you run any file. Geez some people.

Oh and btw you have been infected with blaster and Sobig worms. Refer yourself to symantec.com for disinfection. Next time read the code and tutorial before running anything.

[Axl]

Heh nils, great guy gotta love rbot

[Deltax]

its infected with the blaster virus..

[apusnaias]

very nice post =)

in zip file my kav detect a TrojanDropper.Win32.Bender.

i didn't execute the exe

thx man

[vnet576]

Well what do you know...haha..those bastards classified my program as a virus now. Guess one of those people downloading this was from the AV companies. You could've at least named it better...TrojanDropper.Win32.Vnet.Ownz.You...

Time to learn those polymorphic functions..and self encrypted functions..see if you bastards can detect that.

One more thing...you guys at Kaspersky better find better ways of detecting trojans. The first one that I made..donno how you got your hands on it.all you did was detect it based on the registry key I used. Now the registry key is completely random..gotta do better than that next time.

[tianzhen]

wtf "File_Binder.exe" is a w32.blaster.worm

it creates some files in system directory!

Of course it does rofl. This is why you should read the tutorial before you run any file. Geez some people.

Oh and btw you have been infected with blaster and Sobig worms. Refer yourself to symantec.com for disinfection. Next time read the code and tutorial before running anything.

[dmg]

Very interesting tut mate!! Works like a charm.

Unbelievable some people have the nerve to reply "It's infected with blaster!!".... One guy even get's himself infected.... OMFG how stupid can you be

[squ]

I'v found this topic today (i'm new user) and after lecture of the first post i thought - man by posting your binder here your going to kill it - AV will get it recognized...
But as you have probably already noticed - few changes in your source will make your binder undetectable again - Av definitons are usually very lame.
Few words about binders... if you ppl cannot code yourself (i cant too :/) use NSIS - it wont be detectable and its so simple with HM NIS edit.

Regards

[Anarchiste]

Thx i will test this...i was looking for a binder

[han79]

thinks