Philips-TESTBOX2 Unpacked

[Boshko_Alfa]

hah... it's very uncivilized this... whatever i hope you have more brain to use on another pojects not cracking sw from boxes...

[v4mpire]

Originally Posted by dudlajmiga

why isn't this topic deleted and user banned?
ppl already told you that this is trojan v. [a nasty one - sality]

its not a trojan ! this exe infected by small virus but not packed
if here a expert please post full results !

[v4mpire]

Originally Posted by elcapitel

Also known as: W32.HLLP.Sality (Symantec), BKDR_SALITY.AG (Trend), W32/Sality.dll (McAfee), Win32.Sality.L (EZ Antivirus), W32/Sality.O (F-Secure), W32/Sality.q (McAfee), Win32.Tro.Sality.E (CounterSpy), W32/Virus.Win32.Sality.m (Kaspersky)

Description
Win32/Sality is a polymorphic virus that infects Win32 PE executable files. It also contains trojan components. Win32/Sality has been known to be downloaded by variants of the Win32/Bagle family.


Method of Infection

When an infected file is executed the virus decrypts itself and drops a DLL file into the %System% directory. The DLL file is injected into other running processes. The virus then executes the host program code.

Some examples of the names used by the Sality DLL file as reported to CA from the wild include the following:

* %System%\syslib32.dll
* %System%\oledsp32.dll
* %System%\olemdb32.dll
* %System%\wcimgr32.dll
* %System%\wmimgr32.dll

Note: '%System%' is a variable location. The malware determines the location of the current System folder by querying the operating system. The default installation location for the System directory for Windows 2000 and NT is C:\Winnt\System32; for 95,98 and ME is C:\Windows\System; and for XP is C:\Windows\System32.

Many variants of Sality also attempt to infect executable files referenced by values in the following registry keys:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

if this a trojan what is remot port and info for remot host !!
if u sure he is a trojan post here ur results and tell admin for delet my thread & bane my id !
br v4mpire

[free1600]

''this exe infected by small virus'' ? it's not enough to ban ?

br,
free1600

[baguette]

disinfected
http://www.multiupload.com/TDTGXEFIT2

[darmiles]

try this dis infect


lol


http://uploadmb.com/dw.php?id=1267757327&/Backups.rar

br

WTF TEAM