Jump to content

Recommended Posts

Posted

It's a leak of the scripts you may have seen used by some people on DragonNetwork such as title animation.

 

Read the read me file inside the archive if you need help to set it up.

 

More will be leaked later on.

 

All credits go to TheMadPizza, this crazy italian.

 

New link:

 

Scripts only (place in Scripts directory of PHX):

http://www.multiupload.com/8H5QPOMA29

 

 

Full package:

http://www.multiupload.com/1KKSGCZZ33

Password is coderx.ru

 

Antivirus results

AhnLab-V3 - 2011.01.10.00 - 2011.01.09 - -

AntiVir - 7.11.1.58 - 2011.01.09 - -

Antiy-AVL - 2.0.3.7 - 2011.01.09 - -

Avast - 4.8.1351.0 - 2011.01.09 - -

Avast5 - 5.0.677.0 - 2011.01.09 - -

AVG - 9.0.0.851 - 2011.01.09 - -

BitDefender - 7.2 - 2011.01.09 - -

CAT-QuickHeal - 11.00 - 2011.01.09 - -

ClamAV - 0.96.4.0 - 2011.01.09 - -

Command - 5.2.11.5 - 2011.01.08 - -

Comodo - 7341 - 2011.01.09 - -

DrWeb - 5.0.2.03300 - 2011.01.09 - -

Emsisoft - 5.1.0.1 - 2011.01.09 - -

eTrust-Vet - 36.1.8087 - 2011.01.07 - -

F-Prot - 4.6.2.117 - 2011.01.08 - -

F-Secure - 9.0.16160.0 - 2011.01.09 - -

Fortinet - 4.2.254.0 - 2011.01.09 - W32/Hupigon.MYFU!tr.bdr

GData - 21 - 2011.01.09 - -

Ikarus - T3.1.1.90.0 - 2011.01.09 - -

Jiangmin - 13.0.900 - 2011.01.09 - -

K7AntiVirus - 9.75.3472 - 2011.01.07 - -

Kaspersky - 7.0.0.125 - 2011.01.09 - -

McAfee - 5.400.0.1158 - 2011.01.09 - -

McAfee-GW-Edition - 2010.1C - 2011.01.09 - -

Microsoft - 1.6402 - 2011.01.09 - -

NOD32 - 5772 - 2011.01.09 - -

Norman - 6.06.12 - 2011.01.09 - -

nProtect - 2011-01-09.01 - 2011.01.09 - -

Panda - 10.0.2.7 - 2011.01.09 - -

PCTools - 7.0.3.5 - 2011.01.09 - -

Prevx - 3.0 - 2011.01.09 - -

Rising - 22.81.05.00 - 2011.01.08 - -

Sophos - 4.61.0 - 2011.01.09 - -

SUPERAntiSpyware - 4.40.0.1006 - 2011.01.09 - -

Symantec - 20101.3.0.103 - 2011.01.09 - -

TheHacker - 6.7.0.1.112 - 2011.01.09 - -

TrendMicro - 9.120.0.1004 - 2011.01.09 - -

TrendMicro-HouseCall - 9.120.0.1004 - 2011.01.09 - -

VBA32 - 3.12.14.2 - 2011.01.06 - -

VIPRE - 8009 - 2011.01.09 - -

ViRobot - 2011.1.8.4244 - 2011.01.09 - -

VirusBuster - 13.6.136.0 - 2011.01.09 - -

File info:

MD5: 6b6fe6384deffd407556d4c6195056d9

SHA1: b6e31c19ccc204598638680f3db5622cccf5711a

SHA256: 943a7af3a4f286402b85c3fae0ea3be5f2a25368cf6848401d44525088b35845

File size: 2340176 bytes

Scan date: 2011-01-09 21:13:38 (UTC)

Posted

I found trojan horse,droper.

 

You can download the software from the original source:

http://forum.coderx.ru/downloads.php?do=file&id=39

 

and copy the text files from the archive, if you don't believe

 

Note that the original archive is password encrypted to pass antivirus checks, as all hooking programs are detected as trojans. The shared archive is not encrypted.

Posted

i download from http://forum.coderx.ru/downloads.php?do=file&id=39 and i did not find

a virus. on your i fnd.. maybe because is from diff. site or u infected it?

 

btw its a version of phx. i did noot find any scripts.

as i wrote the version from coderx is password encrypted, that's why.. recompress his version with no encryption and you will get a similar output

 

the scripts are located into "scripts"

 

ps: the password for coderx version is "coderx.ru" if you can't read russian

Posted

I repacked it like phx authors do so you get the same scan output.. same files really..

 

http://www.virustotal.com/file-scan/report.html?id=943a7af3a4f286402b85c3fae0ea3be5f2a25368cf6848401d44525088b35845-1294607618

 

Again, special scripts are in scripts directory

  • 2 weeks later...
  • 2 weeks later...
  • 4 weeks later...

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now


  • Posts

    • Fresh off my private server for inspiration.
    • Custom High Five server L2insolence will open 2026-06-17 21:00 GMT+2 ! ! ! Web: http://www.l2insolence.eu/ Discord: https://discord.gg/duMjnj3y9A We have custom: 10 diferent looking custom armor sets. 8 weapon sets, 2 weapons sets are upgradable. 6 jewel sets. ----------------------------------- All custom tatto, masks, cloaks, agathions, belts, bracelest, talismans and more. Everi single item have own custom stats like: +p.atk% , +m.atk% , +p/m.def% and mutch more. All items in game have own stats. With custom looks. Glowing etc. ----------------------------------- Rates XP, SP: 25x Spoil and Drop: 10x Server Hard Farm ----------------------------------- Enchantment Safe enchant: +20099 Max enchant: +20099 All scrolls: 100% ----------------------------------- You can use scrolls or item enchant NPC to make +++ abd life beter. NPC Buffer There's an NPC buffer in all of our main towns. We have custom self buffs learned with npc with custom stats. Global Gatekeeper. GM Shop with normal items and custom ones, Event NPC, item upgrader NPC. Raid Bosses, every zone have its own boss and drops for rare mats, respawn every 10 seconds.. Olympiad The olympiad is ongoing every two weeks.
    • I agree that kernel-level protection offers much deeper visibility and control, especially when it comes to advanced bots and bypass techniques. That said, I'm not trying to claim that a usermode solution is impossible to bypass. My goal is simply to increase the cost and complexity of bypassing the protection while keeping deployment simple, stable, and compatible for server owners. A lot of Interlude server operators don't want to install kernel drivers or deal with the risks and maintenance that come with them. That's why I'm currently focusing on a layered approach: secure launcher architecture, HWID licensing, session validation, anti-debugging, injection detection, integrity checks, replay protection, and heartbeat monitoring. I'm not ruling out kernel support in the future. Right now, my priority is gathering real-world feedback, improving the product, and learning how people attempt to bypass different protection layers. I appreciate the feedback and the discussion.
    • not true, you can change any bot program name so the ones that are injecting aint a problem any more, you can aswell bypass everything in a dll so his way of thinking isnt bad at all
  • Topics

×
×
  • Create New...

Important Information

This community uses essential cookies to function properly. Non-essential cookies and third-party services are used only with your consent. Read our Privacy Policy and We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue..