52 replies to this topic

[x01]

Thanks for posting these, but are any of them still working? Been struggeling with Kaspersky and Avira in C++ for several days now

[Hess]

Recently , KAV 8 sources was around , in torrent , they were about 1.25 GB archive (packed) , so , KAV 8 = AVP 8 , and AVP 9 (KIS 2012) didn't fixed it , until now. BTW , Poison Ivy (PI) was caught by only one API ExitProcess () , so , this made a nightmare for many free users. So , that was it , despite server settings crypting.

[Hess]

And fresh bad and stinky news: Kaspersky has launched beta of 2014 already ! :S Didn't tried it , but , they are making jokes with users ! :S

[Jochen]

Loading a fake DLL and checking the return value also works great with Runtime Detection a very simple example can be =>

Please Login or Register to see this Hidden Content

[Hess]

Also , real dll with headers stripped works fine , code is too ransom , and has no nothing with other files , but , it does job. Small *kit technique.

[Indy]

VMBE, most simple for updates.

[ComeBack]

i read some Emu´s have trouble with this address area,

also is good to get random values.

 

Not testet vs KAV...

Please Login or Register to see this Hidden Content

[Indy]

Please Login or Register to see this Hidden Content

[ComeBack]

Ah its the memory address area from timer.

[noh4t]

Could somebody make some ports too vb6? im having problems with kas atm..

[delphifocus]

Could somebody make some ports too vb6? im having problems with kas atm..

 

I think Sony Kuccio and Karcrack are both capable expert to port this code to VB6, if he both don't mind to do it.

[noh4t]

I think Sony Kuccio and Karcrack are both capable expert to port this code to VB6, if he both don't mind to do it.

Would be nice too see SEH Example in or timelock puzzle in vb

[hero420]

i remember bunnn using the same emulators in his fly crypter. He just used to do some maths before the emulator gives up !
Can someone port these snippets into vb6 ?