Desktop Adsense Cash Machine

Not sure if this was posted here already however i did a quick scan through the board and didnt find anything.

This software will create adsense pages with articles grabbed from other sources

hxxp://mark*flavi*n.com/than*ks-ACM.html

n3th4wk said:

Virus!!!!!!!!!!!!!!!!

Click to expand...

the link or the software?

n3th4wk said:

Virus!!!!!!!!!!!!!!!!

Click to expand...

Come on dude. Get you rep rolling by supplying more helpful info, eg what sort of virus, how did you detect it, etc?

I scanned it with Zonealarm and got nothing. I installed it and the only warning I got was that it wanted to access the internet at 127.0.0.1:2039. It seems to run whether I allow or disallow this access. The more tech fellas here might know what it does here, eg calls home and supplies your IP or something.

Seems alright to me though.

yeah i would love more info, so i can make a move on it.

I believe 127.0.0.1:2039 would just be a local loopback or like where a TOR like program looks for a link to your machine. TOR uses 127.0.0.1:8118 but without TOR the program should only go as far as your NIC card.

Not sure but my thoughts

Program goes out to internet but works fine.

[ DetectionInfo ]
* Sandbox name: NO_MALWARE
* Signature name: NO_VIRUS
* Compressed: NO
* TLS hooks: YES
* Executable type: Application
* Executable file structure: OK

[ General information ]
* Display message box (Setu) : Cannot open AVI..
* Display message box (Setu) : Access violation at address 00436868 in module 'sample.exe'. Write of address 00000180..
* File length: 1652267 bytes.
* MD5 hash: 4b6fc7101b11d732a85e2022d84ed02b.

[ Changes to filesystem ]
* Creates directory C:\WINDOWS\TEMP\1600103177.
* Creates file C:\WINDOWS\TEMP\1600103177\data.pak.
* Creates file C:\WINDOWS\TEMP\1600103177\license.rtf.
* Creates file C:\WINDOWS\TEMP\1600103177\setup.dat.

[ Process/window information ]
* Creates an event called .

[ Signature Scanning ]
* C:\WINDOWS\TEMP\1600103177\data.pak (915187 bytes) : no signature detection.
* C:\WINDOWS\TEMP\1600103177\license.rtf (7666 bytes) : no signature detection.
* C:\WINDOWS\TEMP\1600103177\setup.dat (14628 bytes) : no signature detection.

So is this working or is it still just virus?

yha is it good or a virus