Netch@nger(@==a ,don't ask why )

I tried QUnpack

16:26:31 - Opened NetCh@nger.exe
Quick self analyze.... unknown
PESniffer EP Scan: Unknown
PEiD scanning... Nothing found *

Then I tried diffrent OEPs-again nothing

This program is really hard to crack.Nothing found on the net(no cracks,patches,keygens or older v.'s)

If you manage to redirect the "Reminder" to the main window it would be a progress...(2 confs are also good).
I repeat-it's hard even loading it with OllyDbg...

| Сообщение посчитали полезным:

where link?

-----
Nulla aetas ad discendum sera

| Сообщение посчитали полезным:

I think here. Don't know really! http://www.newfreedownloads.com/transfer-NetChanger.html http://www.newfreedownloads.com/transfer-NetChanger.html
if so, target is simply packed with nspack.

| Сообщение посчитали полезным:

There are several packer layers not only NSPack. Original EXE is VB crap, so unpacking takes just a few seconds anyway (bpx on ThunRTMain).

Real protection is in VB code. Unpacked EXE tries restarting Windows, etc. And dont waste your time on mcdib.ocx. It is not EXE - its INI file, see the very end of it.

| Сообщение посчитали полезным:

Damn, i thought the ocx is an exe file lol

PS. LOL the developer of this prog is crazy!

NsPack 1st level
ASPack 2nd level
PeCompact 3rd level

At last: Microsoft Visual Basic 5.0 / 6.0.
And it reboots the OS now lol. Dman!


PS. Be carefull when you begin reversing the unpacked prog!
After you escape first try to reboot ... and you get the Reminder window... after you continue it reboots again
and i think it fucks up boot.ini file ... so you wont boot again :P

Here is the unpacked target with no rebooting and no changing to the boot.ini (renamed to zoom.ini so you can see what the program writes into the file)
http://rapidshare.com/files/66625427/unpacked.rar.html http://rapidshare.com/files/66625427/unpacked.rar.html

| Сообщение посчитали полезным:

It reboots my system too
What is the functions that does this?

ps:don't try this command during the program tries to reboot:
shutdown -a

It really f*cks boot.ini

| Сообщение посчитали полезным: