7

I'm trying to use a deugger (namely OllyDbg) to analyze some exe files.

However, all the versions I downloaded from the Internet are considered as Trojans by some anti-virus software. (I use www.virustotal.com to scan the binary I downloaded)

Are OllyDbg's main behaviors belong to a kind of Trojan?

Currently, I want to download OllyDbg v1.10 defixed (version from [potentialy harmful link] http://4server.info/download/4shared.com/rar/RFNpFbiP/ollydbg_v110_defixed.html)

Here is the scan result of "ollydbg v1.10 defixed.rar" by virustotal:

VirusTotal results

Does "ollydbg v1.10 defixed.rar" really contain Trojans?

  • 9
    Why don't you download it from the official site? – S.L. Barth - Reinstate Monica Mar 3 '15 at 14:55
  • 26
    Sure looks like it if VirusTotal says so! Don't download software from shady websites kids, espcially if you can download it from the official site for free ;) – Mints97 Mar 3 '15 at 14:56
  • 1
    The .rar format by itself is pretty unusual for legitimate software, and the 4shared link (generic file upload site) is the icing on the cake. – user42178 Mar 3 '15 at 16:03
  • I did have a problem with an NT/Nokia development kit, on Vista. The built-in MS virus detection (or was it Kaspersky?) was constantly removing pieces of the debugger. Finally figured out which knobs to turn. Can't tell you more since it's been about 4 years. – Hot Licks Mar 3 '15 at 18:05
19

The link provided in the question seems really fishy. If it's a "patched" version supposed to get rid of limitation, it's more than probable the fixer added some kind of additional surprises (like a virus) in it. The official site already proposes a free version of the software, so I would start here to avoid getting a virus from a random stranger.

This being said, it's not impossible that anti-viruses detect innocuous programs as malwares. This happens cause AV checks for some known signatures of exploits and/or detects unusual behaviour, like access to some memory ranges for example.

Debuggers have these kinds of odd behaviours, as the need to bind to existing processes, de-route function calls, check and modify memory, etc.

  • 5
    Most antivirus consider legitimate cracks, not containing any undesired software, as "generic trojans". This is presumably to discourage their use and/or simply because it's, generally speaking, a risky category of software. Still, I think it's very wrong to intentionally erroneously classify software we don't like as a trojan. I obviously can't speak for this specific case. – Thomas Bonini Mar 3 '15 at 19:44
  • 2
    @AndreasBonini, a few years ago, when I used windows a lot more, it seemed to be the corporate security packages that flagged all cracked versions as malware while AVG free (which is what I used then) didn't. – Chris H Mar 3 '15 at 19:49
  • 1
    @ChrisH Makes sense from a policy perspective: if you have a cracked executable on a work image, something has gone very wrong. – sapi Mar 3 '15 at 22:13
  • I say the opposite of @AndreasBonini. While most cracks do what they claim to do, they also inject some kind of malware to the original software. I won't name them, but I have found a few of my own by sniffing the packets. Piracy is not 100% free. – Ayesh K Mar 4 '15 at 3:49
  • 1
    "legitimate cracks" - lol – piet.t Mar 4 '15 at 7:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.