Shoutbox

I'll try it tonight, will make up some new e-mail addresses and some disposable VMs.

I reckon it'll be bullhonky but I'm bored enough to try

In case people were still doubting if it is really fake:

* The contact names which he shows in his "demo" on http://www.youtube.com/watch?v=cwYtGjIkcQ4 are hardcoded in the .exe

* The comments on that Youtube video need to be pre-approved. So it's easy to keep bad comments out.

quote:

---

Originally posted by Menthix

quote:

---

Originally posted by Spazy
i am really tempted to try this. but i already burned myself a couple of weeks ago, trying the leak WLM 2010...
I know this is bullshit, and will do some crap to the pc or msn. but ahh i want to know if it really works.. i really hope it doesnt though...

---

Those who did try is so far go no result, only messages like:
"Error loading contact list"
"Online contacts: 0"
"Webcams available: 0"

---

hmm ok.. then if it doesn't work... what does it then do?
installing Trojans ?

quote:

---

Originally posted by Spazy
what does it then do?
installing Trojans ?

---

Possibly, or stealing your login details and the email addresses of your contactlist. Although is could just be it does nothing at all. After all, the idea is you need to buy the app. By the time you run it whoever created it already got his money.

quote:

---

Originally posted by Menthix
After all, the idea is you need to buy the app. By the time you run it whoever created it already got his money.

---

ah yeah ofc, i forgot the money factor. i have scanned the file with 3 different programs, it cant find anything, though yeah i probably need to install it before a scanner works.
but you make a good point, it is most likely the no money back feature that this program is all about for the author.

quote:

---

Originally posted by Spazy

quote:

---

Originally posted by Menthix
After all, the idea is you need to buy the app. By the time you run it whoever created it already got his money.

---

ah yeah ofc, i forgot the money factor. i have scanned the file with 3 different programs, it cant find anything, though yeah i probably need to install it before a scanner works.
but you make a good point, it is most likely the no money back feature that this program is all about for the author.

---

There's no install, you just extract it

I wonder why the app is calling GetAsyncKeyState... keylogger maybe?

quote:

---

Originally posted by Chrissy
Yes, I've tried it, and yes it works

---

rofl

quote:

---

Originally posted by Chrissy
Yes, I've tried it, and yes it works

---

Why the amount of bs doesn't surprise me... just stop seeking attention, thanks.

quote:

---

Originally posted by Spazy
i have scanned the file with 3 different programs, it cant find anything, though yeah i probably need to install it before a scanner works.

---

Virusscanners will rarely detect such stuff as a threat!

It is a major misconception that many people have about virusscanners (unfortunatly, yet another example of this here). Virusscanners can only detect 'real' virusses created by real hackers if you know what I mean.

They very very rarely detect malware created by script kiddies like this because such stuff is created using simple common instructions and logic which so many legit programs use.

A scanner would only detect it if it was, for example, made by some known trojan/virus SDK using some known programming patterns or variations on it. Or if the malware was submitted to one of the major anti-virus companies and deemed a threat.

As such, imho, malware like this is even more dangerous because scanners will most likely not pick up on it. This is exactly the same for extremely many Messenger malware which is floating around and the cause of so much hacked accounts.

A virusscanner is just a simple first defense against malware. It is not at all an absolute protection. For stuff like this there is one golden rule: if it sounds too good to be true, it really is...

quote:

---

Originally posted by matty
I wonder why the app is calling GetAsyncKeyState... keylogger maybe?

---

After looking a bit at the VB project source (see below) I actually doubt he is capable of programming something like that. I think the GetAsyncKeyState API is rather called from VB's own functions. eg: to detect the hotkey from a button. IRC, that API is also called nativly by VB in the MouseMove event (to get the state of the mouse buttons), ...


--------------------------------------------------------------------------------

Anyways, I had some time to spare and attempted to decompile the program myself.
And looking at the results, it seems that we overestimated this guy's capabilities to code.

As such, I strongly doubt there is a keylogger build-in or a client/server method. I think Menthix is correct by suggesting this might simply be a money making scam.

The decompiled Visual Basic project is attached to this post. You can clearly see how the thing is created (shitload of timers and everything is hardcoded). I wouldn't even be surprised if this is also the exact same program which is used to create that fake YouTube video because it think the program first tries to find some files (the premade videos?) and if it can't find them it will show the "Error loading contactlist", or something like that.

PS: the program is signed with the company name 'Wiesehahn Media'. Looking a bit around for that name and you'll find some dodgy Messenger related sites which are full of crap tools like this (I strongly suggest not to use any of their stuff - many stuff is fake/malware). Looking a bit around on those sites and you'll come across many tools made, or at least designed by a 'M. Wiesehahn'.

btw, it's funny how the contact 'Barry' from that YouTube video (around 2:25), looks extremely similar to the Facebook user Wiesehahn.