Any questions? Ask us: support@enigmaprotector.com

Virus

Post here messages if you have any problems with working of Enigma Protector

Virus

Postby vfa98035 » Sat Jan 14, 2017 2:52 pm

Hi there, I found way to make Enigma protector undetectable but for some reason after I edit the "ENIGMA" string to something else, the program wont start.

there is anyway to fix that?

Some picture:

Protect my file with Enigma:

Image

Open the protected file with hexwork shop:

Image

Change the string of "ENIGMA" to something else like "DADADA" since the anti virus softwares detects by creating signatures
*"454E49474D41" - "ENIGMA" string on anti virus softwares signature databases.

Image

*The problem is that after I change the specific string of "ENIGMA" the file wont start.

Thanks.
vfa98035
 
Posts: 2
Joined: Sat Jan 14, 2017 2:41 pm

Re: Virus

Postby ilya01 » Sat Jan 14, 2017 3:20 pm

Hello!
You cannot modify protected files.
Problem of detection files by this string -> problem of antivirus owners. It is very stupid idea - detection files by string.
You can send false positive report or remove this antivirus.
Reputation of thease company's must be damaged.
ilya01
 
Posts: 87
Joined: Tue Oct 07, 2014 2:31 am

Re: Virus

Postby vfa98035 » Sat Jan 14, 2017 3:24 pm

ilya01 wrote:Hello!
You cannot modify protected files.
Problem of detection files by this string -> problem of antivirus owners. It is very stupid idea - detection files by string.
You can send false positive report or remove this antivirus.
Reputation of thease company's must be damaged.


Well, i already tested it with virus total, after you change this string, the file is 100% clean from viruses.
about to modify the protected file, you actually can do it, When I edited other lines/strings with hexworkshop I could start the program.
the program wont start only if i edit this specific string "ENIGMA". i have no idea why, i am sure the owners of the program did it.
so what i am searching for someone who have any idea how i can change this string and make the app start work.

here is some proof:
Not edited string results:
https://www.virustotal.com/he/file/9c40 ... 484407706/

Edited string results:
https://www.virustotal.com/he/file/5e40 ... 484407663/
Last edited by vfa98035 on Sat Jan 14, 2017 3:29 pm, edited 1 time in total.
vfa98035
 
Posts: 2
Joined: Sat Jan 14, 2017 2:41 pm

Re: Virus

Postby ilya01 » Sat Jan 14, 2017 3:28 pm

Seems, that are you don't enabled integrity check's.
Please try to enable this.
ilya01
 
Posts: 87
Joined: Tue Oct 07, 2014 2:31 am

Re: Virus

Postby Enigma » Mon Jan 16, 2017 9:51 am

Hi, first of all, I prefer my files to be clean from Kaspersky and detected by dozen of other minor AV, than being detected by Kaspersky and clean for dozen minors. When you edited the file it becomes detected by Kasperky, this is bad thing.

Then, you are using version 4.x (or even 3.x?) for protection. But since version 5 we added a taggant that allows to avoid false detections. So huge recommendation to switch to v5.

And also, if today you modify signature of protector and you have smaller number of detections, this does not mean that tomorrow you will not get 56/56 in virustotal. This game is quite "unrecommended".
Enigma
Site Admin
 
Posts: 2183
Joined: Wed Aug 20, 2008 2:24 pm


Return to Problems

Who is online

Users browsing this forum: Majestic-12 [Bot] and 13 guests

cron