Thursday, February 14, 2008

Bitdefender Labs Antivirus Defense Center

Antivirus software - BitDefender - The future of security now!
maybe they mean yesterday, because before yesterdays updates and some mistakes by the unpacking engine for Inno Setup this months which have been fixed quite fast, it was a top security product.

BitDefender False positive by using:
Packer Compressor XComp098, XComp097 (XComp & XPack)
XComp/XPack: A freeware PE32-imagefile packer/rebuilder
(c)2007 JoKo, Version 0.98 02/18/2007

XComp is in some cases better with compression ratio as upx.
You can compare by self:

XComp/XPack PE32-imagefile packer and/or rebuilder - Freeware

UPX: the Ultimate Packer for eXecutables (Freeware) - Homepage

BitSum PeCompact (Commercial, for students limited free) - Homepage

using LZMA compression and pack some exe, dll files, upload the files to:
VirusTotal - Free Online Virus and Malware Scan

Try upx.exe with parameters --lzma , --best , --ultra-brute
PeCompact highest compression
XComp LZMA method
about NsPack By Nort Star (Commercial), I thing is nothing to say. Just look the result in a hexeditor and see the chaos in the headers, no option to clean/optimize this mess up.

Do they have a research team or do they just drop the signatures of whole packers to them virus database if enough users submit a infected file
because someone maybe have used this packer/compressor to pack some viiri into some program applications...
It is the most ridiculous Security System I ever seen.

eMule 0.48a Sins 0.5 packed with XComp 0.98 Analysis

File size: 1701652 bytes
MD5: 2a3fe800941bd32c7495734ed83dc4e1
SHA1: cf8c09fe40369cf921deb1b4e8128914e04ff9bf


Where is the Virus in this sample???

OllyDbg v1.10

Check the files with:
ExEinfo PE by A.S.L.
follow the unpacking hints

BitDefenders unpacking engine mistakes. Scanning a Inno Setup file - Instyler Module 9 !
Problem resolved within 2 hours by 3 following signature updates:

G DATA InternetSecurity 2008 v12 3er - and all Problems are gone?!

G DATA InternetSecurity 2008TotalCare2008_ESP_COV.exe

Trial 30 days:

All-round protection against all dangers from the internet!
Info Englisch:
Info Deutsch:
3 PC Licenses: € 53,95

Armadillo BitTorrent Mods infection with G Data - Dual engine scan !!!
"I've seen that with BitDefender already that this Armadillo BitTorrent Mods tries from alone to phone out even if they are not started, free run if a access rule have been created in firewall"


Anonymous said...

IKARUS Security Software GmbH Austria
copy virus database from Bit defender ?

Anonymous said...

Seh mal jetzt gibts gar keine Signatur mehr

Jedoch packt es nicht so gut.

Anonymous said...

XPack ?

Anonymous said...

Das sind ja so ne Experten. Warum haun die nicht die alten UPX Versionen vor UPXv1.9 wieder rein als Virus

Post a Comment