Urgent: File being detected! - Page 2

**trophaeum** · #11 (**permalink**) 04-09-2008, 11:04 AM

wr only interests me for countries luxe dont do currently... sad that even with how much they offer per install im not interested in them terribly much isnt it? oh well

**blackknyt** · #12 (**permalink**) 04-10-2008, 08:53 PM

yeah this sucks, I haven't even bothered applying to their program cause of this.

**creztor** · #13 (**permalink**) 04-12-2008, 04:03 PM

Yes, makes it less encouraging to promote, especially when you know that many of the people that download your files are going to pick it up with scanners and just delete it :| I stopped promoting WR because of this.

**trophaeum** · #14 (**permalink**) 04-13-2008, 03:24 PM

new exe as of right now, turns out the only common av apps that miss it are mcaffee and clamav...

**creztor** · #15 (**permalink**) 04-17-2008, 07:36 AM

They updated it again and NOD32 still picks it up

**trophaeum** · #16 (**permalink**) 04-17-2008, 05:37 PM

@#%#$ Useless!

**rivets** · #17 (**permalink**) 04-20-2008, 08:33 AM

Check out the results from a scan at VirusTotal:
Virustotal. MD5: 412aef6f61aa7e4009c61c38bd1a6714 Trojan-Downloader.Win32.Small.uny Win32/TrojanDownloader.Small.IAW Trojan.Retapu.I

The latest WR exe is detected by 18 out of 31 AV.

Like creztor, I'm still waiting for Luxecash too.

**creztor** · #18 (**permalink**) 04-20-2008, 02:50 PM

Yeah, such a high payout is pointless. I thought I 'fixed' the .exe and removed the signature or whatever but turns out I broke it and don't think any of my installs were registered

Keep waiting for WR to do the job.

**chapster** · #19 (**permalink**) 04-20-2008, 03:46 PM

I'm going to assume you tried to fix it by zeroing portions of the signature, right?

You can't "fix" an exe just by zeroing out stuff just to change the signature.
When you change a simple letter/character it's an instruction that you are changing, one that could be very important.

A more vivid example? let's say this is your program:

Quote:

IF: you get lost
{

DO: call me
DO: find the nearest officer
IF: your phone start losing signal
{
DO: ask "what's your problem bitch?"
DO: slap!

}
DO: ask officer what's the way to the nearest train station.

}

Let's say that while trying to remove the signature you cripple your program by changing some stuff to Zero (like some video explained):

Quote:

IF: you get lost
{

DO: call me
DO: find the nearest officer
00000000000000000000000000000000000
00
DO: ask "what's your problem bitch?"
DO: and slap!

00
DO: ask officer what's the way to the nearest train station.

}

It wont get you the same results right? I'm sure the officer won't be too fond of you

In other word, don't hex edit and change stuff that you don't know. All those weird characters that you see have a purpose.

**creztor** · #20 (**permalink**) 04-21-2008, 05:50 AM

Yes chapster, I understand why it didn't work, I am changing code which will change the way the program executes etc. It was worth a shot though. I was fairly sure anything I did wouldn't "fix" it, because if it truly was that simple, WR would have done it a long time ago.

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode