suck-o.com

Mr_Vain · Post by **Mr_Vain** » 03 Jun 2006, 10:18

Does nyone know what`s going on with the CIA RAT ?I would like to have a new undetectable version since its the strongest trojan there is.

devilhunter · Post by **devilhunter** » 13 Jun 2006, 11:43

cant say its the best there was(and still is) another trojan which was created in '99 it was called trapdoor it gave u acces to anything on the users PC and deactivated antivirus software the bug was it slowed down ur pc

Post by **CommonStray** » 13 Jun 2006, 12:29

take the CIA RAT source and modify its signatures, that way antivirii progs wont pick it up

Post by **CommonStray** » 13 Jun 2006, 12:32

devilhunter wrote:cant say its the best there was(and still is) another trojan which was created in '99 it was called trapdoor it gave u acces to anything on the users PC and deactivated antivirus software the bug was it slowed down ur pc

almost all trojans give you full access to a system if its used correctly, filesystem, processes etc...some such as sub7 even allow you to do the matrix effect as seen in the movie, as well as screencaptures, print, cdrom open/close etc...

Mr_Vain · Post by **Mr_Vain** » 13 Jun 2006, 15:41

CircuitB0mB wrote:take the CIA RAT source and modify its signatures, that way antivirii progs wont pick it up

GREAT !!! erm...where can i find the src?

Nerdz · Post by **Nerdz** » 13 Jun 2006, 21:59

Can you simply use an unasm and change stuff like comments?

Post by **DNR** » 14 Jun 2006, 08:36

A quick surf on virus signatures only said that antiviri progs (which each use their own propriety way) scan for the signature of bytes that are in a certain order - adding bits to comments or padding the software may not hide the collection of bytes that it is looking for. Rewriting that tell-tale section could work - but then you'd be creating a new variant of said virii.

DNR

CIA

CIA

virii signatures