Jump to content

CAN I FIND BACKDOORED FILES? ANSWER IS YES!


K4rmaArr0ws
 Share

Recommended Posts

Hello MxC! I decided to make a topic teaching you avoid to be infected from bad files on internet [shared , from downloads and much more]

 

What is it a backdoored file?

 

It's an infected file , binded 99%, which would damage your personal data and use your pc like a bot!

 

What means bind? or what the hell we call binder?

 

It's a programm that can incorporate your virus,rat,keylogger,trojan with clean programms & files and infect others easily! It means binder is a way for crypting your bad files and infect others !

 

FIRST METHOD

Right click it, if you got winrar installed and you see

"open with winrar" then this means it was binded with winrar

so definitely it's backdoored

 

SECOND METHOD

Open it with a resource editor such as resource hacker/restorator/pe explorer and check the rcdata section,if theres 1 & 2 entries in it

then its binded

 

THIRD METHOD

Open it with a hex editor , at the start of a PE header theres always this line "This program cannot be run in DOS mode" , search for it,if it

exists more then once then it might be binded

it depends on the specific app,for example its not unusual for

binders/crypters to have the stub file attached in the resources

also search for .exe and inspect the results,a binded file

drops the files to a temp folder before executing em , so if

you find somethin like this: %.t.e.m.p.%..x.x...e.x.e or file1.exe/file2.exe

then its def binded...

 

FOURTH METHOD

Run it in sandboxie ,when a file is ran'd in sandboxie its isolated (cant access your files/registry, first click the sandboxie tray icon to

open up its Window , then right click the file and click "run with sandboxie"

if you see another process name in the sandboxie Window then its probably backdoored (this doesnt include sandboxie rpcss/dcom launch processes,those are legit and needed for some programs) , thats not all , the file may drop another when one of the buttons in the program GUI is clicked or after you close it , so click all the buttons and close it

just to make sure , if you do see other processes then immdiatly click file>terminate all processes from the sandboxie menu , if a file refuses to run in sandboxie or its suppose to be a program and it runs

without GUI then it would probably be best to delete it!!

 

[move]Credits 2 GOOLE SEARCH[/move]

 

*I MADE THIS GUIDE, OTHER RETARDS LEECH IT, YOU CAN FIND THIS GUIDE EVERYWHERE, IN GOOGLE FORUMS ETC, LEECHING YOUR GUIDES ISNT THE BEST THING TO MAKE YOU ANGRY BUT STILL BELONG TO 'EM*

 

Link to comment
Share on other sites

Link to comment
Share on other sites

When I was new in hf forums, so stop judging me for nothing  :-\

so,at April 2010?

 

Nice one

 

http://forum.cheatengine.org/viewtopic.php?p=4800294&sid=4d05d24f13c699099e37217d0b22041c

Link to comment
Share on other sites

If you find the guide usefull stop crying for credits and so on, because in MxC are sharing a lot of programms and files I thought that it is necessary to post it, bye

 

 

Where is the proper credits? And how do you know that the guide belong to this guy rolf, go play with your toys but away from my topic

Link to comment
Share on other sites

If you find the guide usefull stop crying for credits and so on, because in MxC are sharing a lot of programms and files I thought that it is necessary to post it, bye

You claimed to be yours.

No problem if you had put credits,or not even putting credits

 

but this

No mate it's 100% mine  :)

I am the first who shared it in other forums like hf, someone leech it really

really gets me angry

 

People are not that stupid as you think

 

In 1 week,you have scammed,lied many times.

Hell,noone is gonna believe w/e you say

 

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

 Share



  • Posts

    • Topic locked.
    • Kelly Clarkson Keto Gummies [SCAM WARNING 2023] Is It Worth Buying? Thusly, industry aces profoundly encourage that you lead further concentrate on the item prior to spending any cash in it. One of these choices is to utilize the keto candy known as "Keto Gummies." When you investigate it, you'll observe that there are a wide range of sorts of Kelly Clarkson Keto Gummies; despite the fact that they could all profess to get exactly the same things done, they're not something similar. Along these lines, we'll give you all you really want to be familiar with Kelly Clarkson Keto Gummies at this moment. https://groups.google.com/g/kelly-clarkson-keto-gummies-official/c/1vV0b1zknw8 https://groups.google.com/g/kelly-clarkson-keto-gummies-official/c/i8lbQL7g9mU https://sites.google.com/view/kellyclarksonweightlossgummie/ https://sites.google.com/view/kellyclarkson-weightloss-gummy/ https://infogram.com/kelly-clarkson-weight-loss-gummies-reviews-scam-or-legit-shark-tank-exposed-1hd12yxqxzzox6k https://infogram.com/kelly-clarkson-weight-loss-gummies-review-scam-exposed-shark-tank-and-customer-feedback-1h7k23050ngyv2x https://www.agentpet.com/forum/discussion/general/kelly-clarkson-weight-loss-gummies-review-the-truth-before-buy https://www.toyorigin.com/community/index.php?threads/kelly-clarkson-weight-loss-gummies-scam-alert-review-a-weight-loss-pill-or-waste-of-money.34009/ https://www.agentpet.com/forum/discussion/general/kelly-clarkson-weight-loss-gummies-reviews-warning-scam https://www.sympla.com.br/produtor/kellyclarksonweightlossgummiesbuy https://www.toyorigin.com/community/index.php?threads/kelly-clarkson-weight-loss-gummies-reviews-warning-scam-read-before-buying.34011/ https://www.facebook.com/profile.php?id=100090213336854
    • Should work via game launcher with auto-updates.
    • updated 7/2/2023   AlisaCodeDragon has been returned as L2Client Developer.! PUFA HAS BEEN TRANSFERED FROM GOLD MEMBER to SUPPORT TEAM
  • Topics

×
×
  • Create New...

AdBlock Extension Detected!

Our website is made possible by displaying online advertisements to our members.

Please disable AdBlock browser extension first, to be able to use our community.

I've Disabled AdBlock