Page 1 of 3 123 LastLast
Results 1 to 15 of 32
  1. #1
    placido95's Avatar
    Join Date
    Apr 2009
    Gender
    male
    Location
    i dont have anything to write
    Posts
    2
    Reputation
    10
    Thanks
    15
    Hi! I made my second secure keylogger (be sure that it can inject ur DLL in the games) In this version; you can select what game do you want; War Rock or Ava; in the next version i will add more games and a Auto detection; but im still working on it!!!

    I will post soon the results of Virus Scan!
    edited by m_t_h:
    virusscans are above; 1/36 and 2/40.
    same screenshoot
    Last edited by /b/oss; 07-21-2010 at 10:42 PM.

  2. The Following 14 Users Say Thank You to placido95 For This Useful Post:

    *DJ* (09-29-2010),Alagaan (06-07-2012),anokiller (08-25-2012),cur (09-16-2012),DarkSt0rmX (05-06-2012),elguapo19 (10-03-2012),Fallenspartan (04-24-2012),Hotsausex (09-11-2012),lucrutten22 (09-09-2010),Mercy123r (09-18-2010),michinaga (09-04-2012),shikatta (07-28-2012),spli (09-18-2012),vietvu1 (09-16-2012)

  3. #2
    XAlterEgoX's Avatar
    Join Date
    Jul 2010
    Gender
    male
    Posts
    7
    Reputation
    10
    Thanks
    0
    My Mood
    Stressed

    Wink

    ]

    Uploaded with ImageShack.us


    VirusTotal:Virustotal. MD5: 598951ce62ae8b8a640ccf5e71e7985e Trojan-Downloader.Win32.Pher!IK Trojan-Downloader.Win32.Pher
    VirusScan: Multi Injector - Secure Version - Pla Softwre.exe MD5:598951ce62ae8b8a640ccf5e71e7985e - VirSCAN.org 3% Scanner(s) (1/36) found malware!


    HERES THE CODE FOR WHO THINK THAT THIS IS A TROJAN:
    Public Class Form1

    Private TargetProcessHandle As Integer
    Private pfnStartAddr As Integer
    Private pszLibFileRemote As String
    Private TargetBufferSize As Integer

    Public Const PROCESS_VM_READ = &H10
    Public Const TH32CS_SNAPPROCESS = &H2
    Public Const MEM_COMMIT = 4096
    Public Const PAGE_READWRITE = 4
    Public Const PROCESS_CREATE_THREAD = (&H2)
    Public Const PROCESS_VM_OPERATION = (&H8)
    Public Const PROCESS_VM_WRITE = (&H20)

    Public Declare Function ReadProcessMemory Lib "kernel32" ( _
    ByVal hProcess As Integer, _
    ByVal lpBaseAddress As Integer, _
    ByVal lpBuffer As String, _
    ByVal nSize As Integer, _
    ByRef lpNumberOfBytesWritten As Integer) As Integer

    Public Declare Function LoadLibrary Lib "kernel32" Alias "LoadLibraryA" ( _
    ByVal lpLibFileName As String) As Integer

    Public Declare Function VirtualAllocEx Lib "kernel32" ( _
    ByVal hProcess As Integer, _
    ByVal lpAddress As Integer, _
    ByVal dwSize As Integer, _
    ByVal flAllocationType As Integer, _
    ByVal flProtect As Integer) As Integer

    Public Declare Function WriteProcessMemory Lib "kernel32" ( _
    ByVal hProcess As Integer, _
    ByVal lpBaseAddress As Integer, _
    ByVal lpBuffer As String, _
    ByVal nSize As Integer, _
    ByRef lpNumberOfBytesWritten As Integer) As Integer

    Public Declare Function GetProcAddress Lib "kernel32" ( _
    ByVal hModule As Integer, ByVal lpProcName As String) As Integer

    Private Declare Function GetModuleHandle Lib "Kernel32" Alias "GetModuleHandleA" ( _
    ByVal lpModuleName As String) As Integer

    Public Declare Function CreateRemoteThread Lib "kernel32" ( _
    ByVal hProcess As Integer, _
    ByVal lpThreadAttributes As Integer, _
    ByVal dwStackSize As Integer, _
    ByVal lpStartAddress As Integer, _
    ByVal lpParameter As Integer, _
    ByVal dwCreationFlags As Integer, _
    ByRef lpThreadId As Integer) As Integer

    Public Declare Function OpenProcess Lib "kernel32" ( _
    ByVal dwDesiredAccess As Integer, _
    ByVal bInheritHandle As Integer, _
    ByVal dwProcessId As Integer) As Integer

    Private Declare Function FindWindow Lib "user32" Alias "FindWindowA" ( _
    ByVal lpClassName As String, _
    ByVal lpWindowName As String) As Integer

    Private Declare Function CloseHandle Lib "kernel32" Alias "CloseHandleA" ( _
    ByVal hObject As Integer) As Integer


    Dim ExeName As String = IO.Path.GetFileNameWithoutExtension(Application.Ex ecutablePath)

    Private Sub Inject()
    Dim app As String
    If RadioButton1.Checked = True Then app = "WarRock"
    If RadioButton2.Checked = True Then app = "AVA"
    On Error GoTo 1
    Timer1.Stop()
    Dim TargetProcess As Process() = Process.GetProcessesByName(app)
    TargetProcessHandle = OpenProcess(PROCESS_CREATE_THREAD Or PROCESS_VM_OPERATION Or PROCESS_VM_WRITE, False, TargetProcess(0).Id)
    pszLibFileRemote = Application.StartupPath & "\" + ExeName + ".dll"
    pfnStartAddr = GetProcAddress(GetModuleHandle("Kernel32"), "LoadLibraryA")
    TargetBufferSize = 1 + Len(pszLibFileRemote)
    Dim Rtn As Integer
    Dim LoadLibParamAdr As Integer
    LoadLibParamAdr = VirtualAllocEx(TargetProcessHandle, 0, TargetBufferSize, MEM_COMMIT, PAGE_READWRITE)
    Rtn = WriteProcessMemory(TargetProcessHandle, LoadLibParamAdr, pszLibFileRemote, TargetBufferSize, 0)
    CreateRemoteThread(TargetProcessHandle, 0, 0, pfnStartAddr, LoadLibParamAdr, 0, 0)
    CloseHandle(TargetProcessHandle)
    1: MsgBox("Unable to Inject")
    Me.Close()
    End Sub

    Private Sub Timer1_Tick(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles Timer1.Tick
    Dim app As String
    If RadioButton1.Checked = True Then app = "WarRock"
    If RadioButton2.Checked = True Then app = "AVA"
    If IO.File.Exists(Application.StartupPath & "\" + ExeName + ".dll") Then
    Dim TargetProcess As Process() = Process.GetProcessesByName("HSUpdate")
    If TargetProcess.Length = 0 Then
    Me.TextBox1.Text = ("Waiting for " & app & ".exe")
    Me.TextBox2.Text = ("Let´s Hack")
    Else
    Timer1.Stop()
    Me.TextBox1.Text = "Done..."
    Call Inject()
    End If
    Else
    Me.TextBox1.Text = ("" + ExeName + ".dll not found")
    Me.TextBox2.Text = ("Rename the .dll To " + "" + ExeName)
    End If
    End Sub

    Private Sub Form1_Load(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles MyBase.Load
    Timer1****terval = 50
    Timer1.Start()
    End Sub

    Private Sub Button1_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles Button1.Click
    MsgBox("Wait; the program will automatically inject; only select an option; AVA or WarRock.", MsgBoxStyle****formation, "Info")
    End Sub

    Private Sub GroupBox1_Enter(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles GroupBox1.Enter

    End Sub

    Private Sub Button2_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles Button2.Click
    Form2.show()
    End Sub
    End Class



    The status bar say that you have to change the program name to the dll's name!!!

    but i dont know why the same antivirus detect a trojan; i think that he detects it because the injection code!
    Last edited by XAlterEgoX; 07-21-2010 at 10:45 PM.

  4. #3
    Drake's Avatar
    Join Date
    Mar 2010
    Gender
    male
    Location
    Belgium,Oost-Vlaanderen
    Posts
    12,681
    Reputation
    1801
    Thanks
    4,855
    need screenshot,2 VirusScans .

  5. #4

  6. #5
    /b/oss's Avatar
    Join Date
    Feb 2010
    Gender
    male
    Posts
    13,652
    Reputation
    795
    Thanks
    3,543
    you need at least 1 ScreenShoot and at least 2 virusscans.

    hmm its wery simple and this isn't multi injector.
    Last edited by /b/oss; 07-21-2010 at 10:39 PM.

  7. #6
    XAlterEgoX's Avatar
    Join Date
    Jul 2010
    Gender
    male
    Posts
    7
    Reputation
    10
    Thanks
    0
    My Mood
    Stressed
    -.- see up!!!

    look uP!!

  8. #7
    /b/oss's Avatar
    Join Date
    Feb 2010
    Gender
    male
    Posts
    13,652
    Reputation
    795
    Thanks
    3,543
    Quote Originally Posted by XAlterEgoX View Post
    -.- see up!!!

    look uP!!
    i already downloaded it. AVIRA find 1 trojan, and look at your VS. accoually would you send me code or do i have to decompile it myself?

    edit: no. injection code ins't virus.

  9. #8
    XAlterEgoX's Avatar
    Join Date
    Jul 2010
    Gender
    male
    Posts
    7
    Reputation
    10
    Thanks
    0
    My Mood
    Stressed
    yeh no problem

    er; please; stop using big red word style please!!!
    Last edited by XAlterEgoX; 07-21-2010 at 10:46 PM.

  10. #9
    /b/oss's Avatar
    Join Date
    Feb 2010
    Gender
    male
    Posts
    13,652
    Reputation
    795
    Thanks
    3,543
    ok. /approved
    /post resoults

  11. #10
    XAlterEgoX's Avatar
    Join Date
    Jul 2010
    Gender
    male
    Posts
    7
    Reputation
    10
    Thanks
    0
    My Mood
    Stressed
    -.- T.T well.... can someone test it with some DLL and post the results? i need repair Bugs!!! Thanks

  12. #11
    justint5o4's Avatar
    Join Date
    Apr 2010
    Gender
    male
    Posts
    13
    Reputation
    10
    Thanks
    2
    Whats the password to inject?

  13. #12
    /b/oss's Avatar
    Join Date
    Feb 2010
    Gender
    male
    Posts
    13,652
    Reputation
    795
    Thanks
    3,543
    Quote Originally Posted by XAlterEgoX View Post
    -.- T.T well.... can someone test it with some DLL and post the results? i need repair Bugs!!! Thanks
    why do you have 2 accounts i mean... you posted with one and now you have another. i don't understand why you typed: i made second KEYLOGGER

  14. #13
    muumimamma's Avatar
    Join Date
    Jan 2010
    Gender
    female
    Posts
    2,491
    Reputation
    48
    Thanks
    409
    My Mood
    Daring
    Quote Originally Posted by justint5o4 View Post
    Whats the password to inject?
    Wtf ?
    U mean AVA.exe ?
    [ Useless space ]

  15. #14
    /b/oss's Avatar
    Join Date
    Feb 2010
    Gender
    male
    Posts
    13,652
    Reputation
    795
    Thanks
    3,543
    Quote Originally Posted by muumimamma View Post
    Wtf ?
    U mean AVA.exe ?
    no. he mean RAR pass.

    its in comment (when you open .rar there's comment) its his name

  16. #15
    muumimamma's Avatar
    Join Date
    Jan 2010
    Gender
    female
    Posts
    2,491
    Reputation
    48
    Thanks
    409
    My Mood
    Daring
    Quote Originally Posted by m_t_h View Post

    no. he mean RAR pass.

    its in comment (when you open .rar there's comment) its his name
    He typed inject . o_o
    Lol but ok .
    [ Useless space ]

Page 1 of 3 123 LastLast

Similar Threads

  1. [RELEASE] xsgmhx's multi injector
    By iRobot™ in forum WarRock - International Hacks
    Replies: 48
    Last Post: 08-01-2010, 03:47 AM
  2. [Release] Deathninjak0's Multi-Tool [First]
    By deathninjak0 in forum Visual Basic Programming
    Replies: 3
    Last Post: 12-07-2009, 08:59 AM
  3. Multi injectors
    By Thats the way it is in forum Visual Basic Programming
    Replies: 9
    Last Post: 11-25-2009, 04:32 PM
  4. [Release] Kizz's Hack Injector [Release]
    By That0n3Guy in forum Combat Arms Hacks & Cheats
    Replies: 26
    Last Post: 07-28-2009, 10:41 PM
  5. Replies: 40
    Last Post: 04-14-2009, 06:19 AM

Tags for this Thread