Go Back   FileForums > Games > Game Trainers
Reload this Page Trainer containing srchasm.dll?
Register FAQ Community Calendar Today's Posts Search

Reply
 
Thread Tools Search this Thread Display Modes
  #1  
Old 07-08-2011, 08:50
d33znhutz d33znhutz is offline
Registered User
  
Join Date: Aug 2011
Location: UK
Posts: 3
Thanks: 0
Thanked 0 Times in 0 Posts
d33znhutz is on a distinguished road
Trainer containing srchasm.dll?
hi....

yes, i know there are many threads about trainers and them showing as false positives, and i know by how a trainer works that is usually the case but after having a search around i can't find any info on trainers using srchasm.dll so i was wondering if someone could give me some info on if this is a usual dll used for trainers? the only info i can find on the net about srchasm.dll is it being associated to a logger that steals bank info/passwords, but no mention of it being used commonly in trainers

trainer in point is Plants vs Zombies v1.2.0.1073 PLUS 10 TRAINER by BReWErS

anyone got any idea?

tia
Reply With Quote
Sponsored Links
  #2  
Old 07-08-2011, 09:18
TippeX's Avatar
TippeX TippeX is offline
zeroes and ones.....
  
Join Date: Jan 2003
Posts: 3,842
Thanks: 2
Thanked 33 Times in 23 Posts
TippeX is on a distinguished road
Could just be a name clash.. Srchasm could be a byte pattern search code in asm for example.. Upload the file to virustotal.com to see what it says, and post the results, if its suspicious i will take a look
__________________
bleh
DO NOT PM me with questions, leave that in the forums...ESPECIALLY if i dont know you...
Reply With Quote
  #3  
Old 07-08-2011, 09:40
d33znhutz d33znhutz is offline
Registered User
  
Join Date: Aug 2011
Location: UK
Posts: 3
Thanks: 0
Thanked 0 Times in 0 Posts
d33znhutz is on a distinguished road
i don't have the dll anymore, i just deleted it. didn't seem to put anythin in the registry, just copied the dll to c:\windows\srchasm\. still got the trainer but that comes back with a few generic titles, guessin cause of the way its packed from what i read. heres the results for the trainer anyhow....

Antivirus results
AhnLab-V3 - 2011.08.07.00 - 2011.08.07 - Packed/Upack
AntiVir - 7.11.12.233 - 2011.08.05 - -
Antiy-AVL - 2.0.3.7 - 2011.08.06 - Trojan/win32.agent.gen
Avast - 4.8.1351.0 - 2011.08.07 - -
Avast5 - 5.0.677.0 - 2011.08.07 - -
AVG - 10.0.0.1190 - 2011.08.07 - Suspicion: unknown virus
BitDefender - 7.2 - 2011.08.07 - -
CAT-QuickHeal - 11.00 - 2011.08.07 - TrojanPWS.Gampass
ClamAV - 0.97.0.0 - 2011.08.07 - PUA.Packed.UPack-2
Commtouch - 5.3.2.6 - 2011.08.06 - W32/Heuristic-210!Eldorado
Comodo - 9662 - 2011.08.07 - Packed.Win32.MUPACK.~KW
DrWeb - 5.0.2.03300 - 2011.08.07 - -
Emsisoft - 5.1.0.8 - 2011.08.07 - Backdoor.Win32.Popwin!IK
eSafe - 7.0.17.0 - 2011.08.07 - Suspicious File
eTrust-Vet - 36.1.8486 - 2011.08.05 - -
F-Prot - 4.6.2.117 - 2011.08.06 - W32/Heuristic-210!Eldorado
F-Secure - 9.0.16440.0 - 2011.08.07 - -
Fortinet - 4.2.257.0 - 2011.08.07 - -
GData - 22 - 2011.08.07 - -
Ikarus - T3.1.1.104.0 - 2011.08.07 - Backdoor.Win32.Popwin
Jiangmin - 13.0.900 - 2011.08.07 - Trojan/Generic.atcq
K7AntiVirus - 9.109.4973 - 2011.08.02 - -
Kaspersky - 9.0.0.837 - 2011.08.07 - HEUR:Trojan.Win32.Generic
McAfee - 5.400.0.1158 - 2011.08.07 - Suspect-BL!C37746B6FE49
McAfee-GW-Edition - 2010.1D - 2011.08.07 - Heuristic.LooksLike.Win32.Suspicious.C
Microsoft - 1.7104 - 2011.08.07 - -
NOD32 - 6358 - 2011.08.07 - a variant of Win32/GameHack.O
Norman - 6.07.10 - 2011.08.07 - W32/Packed_Upack.A
nProtect - 2011-08-07.01 - 2011.08.07 - Trojan/W32.Agent.236624
Panda - 10.0.3.5 - 2011.08.07 - Trj/Pupack.A
PCTools - 8.0.0.5 - 2011.08.07 - Trojan-PSW.Gampass
Prevx - 3.0 - 2011.08.07 - -
Rising - 23.69.03.03 - 2011.08.04 - Suspicious
Sophos - 4.67.0 - 2011.08.07 - Sus/ComPack-C
SUPERAntiSpyware - 4.40.0.1006 - 2011.08.07 - -
Symantec - 20111.2.0.82 - 2011.08.07 - Infostealer.Gampass
TheHacker - 6.7.0.1.272 - 2011.08.06 - W32/Behav-Heuristic-060
TrendMicro - 9.200.0.1012 - 2011.08.07 - -
TrendMicro-HouseCall - 9.200.0.1012 - 2011.08.07 - -
VBA32 - 3.12.16.4 - 2011.08.06 - -
VIPRE - 10094 - 2011.08.07 - Trojan.Win32.Packer.Upack0.3.9 (ep)
ViRobot - 2011.8.6.4609 - 2011.08.07 - -
VirusBuster - 14.0.156.1 - 2011.08.07 - Packed/Upack
File info:
MD5: c37746b6fe495b24e829f8af6d884e74
SHA1: 3fae205bf8a5db1d3aa577ed04a79585f13cd9f2
SHA256: 75160a71d7167fd324fe4cdef176f16ce42f6a8a6f6250ab90 0e5d2a6810fd87
File size: 236624 bytes
Scan date: 2011-08-07 16:27:50 (UTC)
Reply With Quote
  #4  
Old 07-08-2011, 10:18
d33znhutz d33znhutz is offline
Registered User
  
Join Date: Aug 2011
Location: UK
Posts: 3
Thanks: 0
Thanked 0 Times in 0 Posts
d33znhutz is on a distinguished road
ok, got bored/curious an plugged in my old tower runnin XP (just to be on the safe side) and let the trainer do it's thing. it installed the dll to C:\WINDOWS\srchasst and identifies as Microsoft Search-Assistant-Control which is a bit weird. uploaded the dll to virustotal.com and here are the results

Antivirus results
AhnLab-V3 - 2011.08.07.00 - 2011.08.07 - Packed/Win32.Vmpbad
AntiVir - 7.11.12.233 - 2011.08.05 - TR/Black.Gen2
Antiy-AVL - 2.0.3.7 - 2011.08.06 - -
Avast - 4.8.1351.0 - 2011.08.07 - -
Avast5 - 5.0.677.0 - 2011.08.07 - -
AVG - 10.0.0.1190 - 2011.08.07 - -
BitDefender - 7.2 - 2011.08.07 - Gen:Trojan.Heur.lO8@uGw8r7ni
CAT-QuickHeal - 11.00 - 2011.08.07 - -
ClamAV - 0.97.0.0 - 2011.08.07 - -
Commtouch - 5.3.2.6 - 2011.08.06 - W32/SuspPack.BB.gen!Eldorado
Comodo - 9664 - 2011.08.07 - UnclassifiedMalware
DrWeb - 5.0.2.03300 - 2011.08.07 - -
Emsisoft - 5.1.0.8 - 2011.08.07 - Gen.Trojan!IK
eSafe - 7.0.17.0 - 2011.08.07 - -
eTrust-Vet - 36.1.8486 - 2011.08.05 - -
F-Prot - 4.6.2.117 - 2011.08.06 - W32/SuspPack.BB.gen!Eldorado
F-Secure - 9.0.16440.0 - 2011.08.07 - Gen:Trojan.Heur.lO8@uGw8r7ni
Fortinet - 4.2.257.0 - 2011.08.07 - -
GData - 22 - 2011.08.07 - Gen:Trojan.Heur.lO8@uGw8r7ni
Ikarus - T3.1.1.104.0 - 2011.08.07 - Gen.Trojan
Jiangmin - 13.0.900 - 2011.08.07 - Trojan/Generic.bcfy
K7AntiVirus - 9.109.4973 - 2011.08.02 - Riskware
Kaspersky - 9.0.0.837 - 2011.08.07 - HEUR:Trojan.Win32.Generic
McAfee - 5.400.0.1158 - 2011.08.07 - Generic.dx!tij
McAfee-GW-Edition - 2010.1D - 2011.08.07 - Generic.dx!tij
Microsoft - 1.7104 - 2011.08.07 - VirTool:Win32/Obfuscator.XZ
NOD32 - 6358 - 2011.08.07 - a variant of Win32/Packed.VMProtect.AAA
Norman - 6.07.10 - 2011.08.07 - W32/Suspicious.C3!genr
nProtect - 2011-08-07.01 - 2011.08.07 - -
Panda - 10.0.3.5 - 2011.08.07 - Trj/CI.A
PCTools - 8.0.0.5 - 2011.08.07 - HeurEngine.Vmpbad
Prevx - 3.0 - 2011.08.07 - -
Rising - 23.69.03.03 - 2011.08.04 - -
Sophos - 4.67.0 - 2011.08.07 - Mal/Behav-363
SUPERAntiSpyware - 4.40.0.1006 - 2011.08.07 - -
Symantec - 20111.2.0.82 - 2011.08.07 - Packed.Vmpbad!gen1
TheHacker - 6.7.0.1.272 - 2011.08.06 - Trojan/Packed.VMProtect.aaa
TrendMicro - 9.200.0.1012 - 2011.08.07 - TROJ_GEN.R47E1HD
TrendMicro-HouseCall - 9.200.0.1012 - 2011.08.07 - TROJ_GEN.R47E1HD
VBA32 - 3.12.16.4 - 2011.08.06 - -
VIPRE - 10094 - 2011.08.07 - VirTool.Win32.Obfuscator.XZ (v)
ViRobot - 2011.8.6.4609 - 2011.08.07 - -
VirusBuster - 14.0.156.1 - 2011.08.07 - -
File info:
MD5: 2280af0ec5e9ca40818112d6f3f6e027
SHA1: 469f52995b2b5f2fbde322def4dabf1a4cf3a63a
SHA256: 496a61ab617b06548ee4d64d58ca952910519b2b4f1e5dc241 a91200f1b71942
File size: 183296 bytes
Scan date: 2011-08-07 17:08:17 (UTC)
Reply With Quote
  #5  
Old 07-08-2011, 18:47
Joe Forster/STA's Avatar
Joe Forster/STA Joe Forster/STA is offline
Senior forum member
  
Join Date: Nov 2000
Location: Hungary
Posts: 9,836
Thanks: 20
Thanked 342 Times in 224 Posts
Joe Forster/STA is on a distinguished road
Yeah, weird: Micro$oft executables are rarely encrypted, especially with serious stuff like VMProtect!
__________________
Joe Forster/STA
For more information, see the FileForums forum rules and the PC Games forum FAQ!
Don't contact me via E-mail or PM to ask for help with anything other than patches (or software in general) done by me, otherwise your request may be deleted without any reply!
Homepage: http://sta.c64.org, E-mail: [email protected]; for attachments, send compressed (ZIP or RAR) files only, otherwise your E-mail will bounce back!
Reply With Quote
  #6  
Old 14-08-2011, 09:33
STN STN is offline
Registered User
  
Join Date: Aug 2008
Location: a dark cave that has gone wet
Posts: 70
Thanks: 2
Thanked 6 Times in 5 Posts
STN is on a distinguished road
Its the dll the trainers uses for its hacks. I can recall BREWERS used dll injection in its trainer and named their dll srchasm.dll so no one would find it. As long as you got the trainer from GCW, you should be fine.

I find it weird brew decided to do that instead of just using brew.dll or something like that which most groups does.
__________________
DEViATED - We are seriously iNSANE!
Reply With Quote
  #7  
Old 16-08-2011, 18:14
darkedone02's Avatar
darkedone02 darkedone02 is offline
Registered User
  
Join Date: Jun 2011
Location: none of your business
Posts: 21
Thanks: 0
Thanked 0 Times in 0 Posts
darkedone02 is on a distinguished road
is it actually brewer's himself or a teammate of his under brewers name?
Reply With Quote
  #8  
Old 03-09-2011, 12:56
h4x0r #'s Avatar
h4x0r # h4x0r # is offline
Registered User
  
Join Date: Apr 2009
Location: Spain
Posts: 200
Thanks: 0
Thanked 5 Times in 2 Posts
h4x0r # is on a distinguished road
more information for delete this file HERE

lol?, Ikarus: Backdoor.Bifrost ( i can read this detection HERE ), this is true?, bifrost is a trojan...
__________________
IN NEW PROJECTS
Last edited by h4x0r #; 03-09-2011 at 13:00.
Reply With Quote
Reply

« Previous Thread | Next Thread »

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Forum Jump

Similar Threads
Thread Thread Starter Forum Replies Last Post
Announcement and final word on the CheatHappens vs. h4x0r trainer war Joe Forster/STA Game Trainers 7 12-07-2010 08:31
REQ: Stolen trainers to be removed from GCW BigBoi Game Trainers 87 09-04-2009 07:33



All times are GMT -7. The time now is 20:36.

FileForums - Archive - Privacy Statement - Top

Powered by vBulletin® Version 3.8.11
Copyright ©2000 - 2026, vBulletin Solutions Inc.
FileForums @ https://fileforums.com