Can VB code cause fake postive?

Theodore

Power Member

Oct 13, 2009

683

196

• Dec 23, 2010

• #1

I've just hired a person from GAF to create a simple clicker program and the file he sent me has 4 trojans in it. He swears his computer is clean and he checked it again and hese not getting any warnings. So i was just wondering before i tell him that i dont accept his work, might these actually be fake positives?

And i know you get what you pay for when you go on websites like GAF

Link:

HTML:

http://www.virustotal.com/file-scan/report.html?id=73b525460e7c0e87d0ae788b27eb37aa2cc22dd2789c9373720a13e7367aa246-1293080549

Edit: sorry i know i have spelt positives wrong in the title lol

 

Last edited: Dec 23, 2010

E

ExobiT

Regular Member

Apr 21, 2008

382

242

• Dec 23, 2010

• #2

Scan the file with Anubis

Code:

http://anubis.iseclab.org/

and post the link for the results here.

 

raidel21

Regular Member

May 17, 2009

400

227

• Dec 23, 2010

• #3

Code:

http://www.computing.net/answers/security/virus-problem/29531.html

I don't expect 4 Trojans on ANY application..
I wouldn't trust this...

it has a redirector...

 

Theodore

Power Member

Oct 13, 2009

683

196

• Dec 23, 2010
• Thread Starter Thread Starter

• #4

raidel21 said:

Code:

http://www.computing.net/answers/security/virus-problem/29531.html

I don't expect 4 Trojans on ANY application..
I wouldn't trust this...

it has a redirector...

Click to expand...

Thank you, thats what i was thinking 4 is a bit suspicous =\

 

Theodore

Power Member

Oct 13, 2009

683

196

• Dec 23, 2010
• Thread Starter Thread Starter

• #5

ExobiT said:

Scan the file with Anubis

Code:

http://anubis.iseclab.org/

and post the link for the results here.

Click to expand...

Thank you but i got this everytime i tried to upload it =\

Error - No Executable File

Unfortunately your file could not be executed.
Either your file is not a valid Windows executable or some of its startup-dependencies have not been met.
According to the Unix file command your file is of the following type:
Zip archive data, at least v2.0 to extract

 

SleepieGirl

Regular Member

Mar 7, 2009

439

265

• Dec 23, 2010

• #6

im not sure what gaf is but yes you can get false positives...

i would run it in a vmware sandbox and watch what it does
also you should always make sure you get the source code

 

Theodore

Power Member

Oct 13, 2009

683

196

• Dec 23, 2010
• Thread Starter Thread Starter

• #7

ive just uploaded it to threatexpert and it says it will email the results to me within a few minutes.

Also regarding the zip file, if i unzip it that would leave my laptop under threat if you get me? Atleast the file is zipped up.

 

E

ExobiT

Regular Member

Apr 21, 2008

382

242

• Dec 23, 2010

• #8

unzip it without running the exe, and then upload it.

 

Theodore

Power Member

Oct 13, 2009

683

196

• Dec 23, 2010
• Thread Starter Thread Starter

• #9

right so aslong as i dont load the program im fine? Thank you

 

silver

Junior Member

Sep 16, 2008

158

74

• Dec 23, 2010

• #10

Is it programmed in visual basic or is it a VBScript?

 

Theodore

Power Member

Oct 13, 2009

683

196

• Dec 23, 2010
• Thread Starter Thread Starter

• #11

the threat expert one is:
http://www.threatexpert.com/report.aspx?md5=a9ca7c9b36b0da5383dfc2ac58f73c70

Means nothing to me sorry =\ just waiting for the anubis one now. Thank you guys for your time

 

Theodore

Power Member

Oct 13, 2009

683

196

• Dec 23, 2010
• Thread Starter Thread Starter

• #12

silver said:

Is it programmed in visual basic or is it a VBScript?

Click to expand...

as i know of visual basic. But the guy that did it pretty much just did it for me he made it so simple lol.

 

silver

Junior Member

Sep 16, 2008

158

74

• Dec 23, 2010

• #13

analysis says that is opens facebook, and thats most of it.
if that's what you wanted then I'd say it's ok.

$$Money$$ said:

looks false positive. althought not sure why its making a udp connection to 1053.

Click to expand...

although that's weird.
maybe you should ask the programmer about that.

 

Last edited: Dec 23, 2010

Theodore

Power Member

Oct 13, 2009

683

196

• Dec 23, 2010
• Thread Starter Thread Starter

• #14

and the anubis one:
http://anubis.iseclab.org/?action=result&task_id=16ce6a396f09945b411b2955ac1f09e93

http://anubis.iseclab.org/?action=result&task_id=16ce6a396f09945b411b2955ac1f09e93&format=html

Thanks guys!

 

Theodore

Power Member

Oct 13, 2009

683

196

• Dec 23, 2010
• Thread Starter Thread Starter

• #15

silver said:

analysis says that is opens facebook, and thats most of it.
if that's what you wanted then I'd say it's ok.

Click to expand...

yea its meant to do that thank you silver and money! Glad its a false positive. Just was a bit suspicous 4 trojans like if you get me

 

Theodore

Power Member

Oct 13, 2009

683

196

• Dec 23, 2010
• Thread Starter Thread Starter

• #16

Thanks again guys i will ask him that, and get back to use rep and thanks to you both.

 

Cyber_Demon12

Junior Member

Apr 16, 2009

181

32

• Dec 23, 2010

• #17

Its probably false positives. If you are worried about it, have him send you the code and check it and compile it yourself.

If you don't know VB well enough, have a friend or someone look at it?

 

C

cicciovalenti

Newbie

Jul 4, 2011

2

0

• Jul 4, 2011

• #18

when I use HTTP librery also for me some antivirus give a false positive virus

 

bulldawg88

Junior Member

Jan 13, 2012

166

106

• Jan 19, 2012

• #19

I use VBScript to do auto-clicking. I could look it over or write you a quick script if you want.

 

jammie

Power Member

Feb 24, 2008

773

379

• Jan 19, 2012

• #20

Since you own the rights to the code, why not look through it?

VB is very simple to understand and then you can compile and run it yourself and know nothing weird is going on.

If he won't send you the code, which you paid for, then something weird is going on.