i sent the exe file to comodo for analysis.
D+ alerts informed me about some malware analysis heuristic.
the exe file tries to reload itself into memory.
it tries to load some dll named bassmod.dll but the prob is that this dll is created by the exe file and not detected by D+.
what do u think about this file?
password is comodo
it’s trying to execute clbcatq.dll and comres.dll, isnt it strange for a ■■■■■ file software? virustotal.com replied that 12 scanners on 36 detected some suspicious file, the packer used is one used to bypass AV scanning.
i sent it to kaspersky too.
i don’t really know if it’s a malware or not (maybe some adware) but what i want to know is if people got an alert about the fact that the file is creating a dll in their windows temp folder.
tested on windows xp pro sp3.
i added temporary files in my protected files and in image execution control settings.
in fact i added all file groups from the comodo menu in both protected files and image exec control
image control is set to agressive.
running paranoid mode.
got no alert when the dll is created.
the dll is created when i allow the exe file to execute msctfime.ime
