Viruses / Trojans and program Cracks / Keygens

[marine1]

Nod is not free though is it?

 

[ginggs]

think what those keygen do.

They produce a key, much in the same way as an original key is generated, or am I missing something here?

it is illegal as well.

Citation needed.

I can't remember this site I once visited - it said to type a specific set of weird characters into notepad and to save it...then to scan the textfile with antivirus software and to my amazement, the textfile was detected as a virus.

I can't understand your amazement, have you ever opened an executable file in notepad? You see lots and lots of those weird characters, now if you happen to entered a particular pattern of weird characters into notepad that matches the signature of a real virus, one would hope it would trigger one's anti-virus.

 

[Glordit]

AVG always had problems with Cracked .exe's & keygen's

 

[mercurial]

have you ever opened an executable file in notepad? You see lots and lots of those weird characters, now if you happen to entered a particular pattern of weird characters into notepad that matches the signature of a real virus, one would hope it would trigger one's anti-virus.

You are forgetting about the fake viruses. Yes I have opened an exe, but the point is that it is normal text with a few weird characters @#$$#@. That should not set off virus alerts at all. The characters are weird because notepad obviously can't decompile or disassemble the app. In reality, those "weird" characters are not weird at all. They represent actual code from the app. It's obvious that AVG has become pathetic at detecting actual viruses. A few weird characters are hardly grounds for antivirus alerts.

 

[ginggs]

You are forgetting about the fake viruses.

What's a fake virus?

 

[gregmcc]

Its called pattern matching. The funny characters in notepad are actually hex values. Notepad doesn't display them too well - you will need to open it up in a hex editor. Those hex values translate to assembly code.

Virus programs use amongst other things, pattern recognition to look for virus code. They also use heuristics which analyse the code to look for virus like properties - new variations of the virus is detected this way.

They produce a key, much in the same way as an original key is generated, or am I missing something here?

They do generate keys but most of the time they also embed new malware onto your machine without you knowing it.

 

[ginggs]

They do generate keys but most of the time they also embed new malware onto your machine without you knowing it.

What sites do you download from?

A keygen generates keys. A program that installs malware on your machine while pretending to be something else is a trojan.

 

[gregmcc]

I know that - but I mean most keygens you download are trojans as well - they generate keys but also install trojans. I've seen very few 'legit' keygens.

 

[mercurial]

What's a fake virus?

False positives.

 

[ginggs]

What's a fake virus?

False positives.

If you say so.

I was explaining how an anti-virus looks for a particular sequence of bytes (the "signature" of the virus) and if it finds that same sequence of bytes in another file it will mistakenly flag it as the virus. This is a side-effect of anti-virus packages using signatures to identify a virus.

Heuristics are a bit more advanced, they look for suspicious things a program tries to do, for example; intercept keystrokes, create outbound internet traffic on port 25, configure themselves to start automatically. Unfortunately there are legitimate programs that do these same things and get caught by the anti-virus.

Lastly some executables are compressed; sometimes as a form of copy protection, sometimes just to reduce the size of the executable and sometimes to obscure the contents of the executable.

The people who crack games and figure out the algorithms to create keygens often go to great lengths to obscure how their programs work to prevent other groups from releasing a similar crack or keygen. I suspect that the compression and encryption methods used by these types of programs trip up the anti-virus programs, that is, appear as false positives.

 

[ginggs]

I know that - but I mean most keygens you download are trojans as well - they generate keys but also install trojans. I've seen very few 'legit' keygens.

I still don't know how you reach this conclusion, maybe you are downloading from the wrong sites. I've seen one site that lists thousands of cracks and keygens and no matter which one you click on, they always send you the same piece of malware.

Most keygens are genuine apps and not virii, but you can never take this for granted, cos there will always be one or two that will be a virus.

I agree with mercurial here.

 

[controlc]

I can't remember this site I once visited - it said to type a specific set of weird characters into notepad and to save it...then to scan the textfile with antivirus software and to my amazement, the textfile was detected as a virus.

My guess is that you're refering to the EICAR test string?

Copy/Paste the following line to a text file. Your antivirus should detect it as a virus.

X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*

Note that it's just a test string and not an actual virus