Results 1 to 8 of 8
  1. #1
    Billt is offline Member
    Join Date
    Oct 2011
    Posts
    8
    Rep Power
    0

    Default Truncated class file - Possible Virus.

    Google directed me to a malicious site and NOD32 went crazy telling me which files it blocked. Two caught my eye, GhostPacket.class and GhostProtocol.class. I've tried CavaJ, it says the file doesn't exist and JAD tells me it's a truncated class file. I've never really heard of a Java virus but how could I get inside of these files and examine them?

  2. #2
    Fubarable's Avatar
    Fubarable is offline Moderator
    Join Date
    Jun 2008
    Posts
    19,316
    Blog Entries
    1
    Rep Power
    25

    Default Re: Truncated class file - Possible Virus.

    I'm no pro at this, not by any means, but I think your best bet is still to try to decompile them. If CavaJ and JAD don't work, then perhaps try another one. I've no experience with decompilers though but have heard that some of the better ones cost buck$$.

  3. #3
    Billt is offline Member
    Join Date
    Oct 2011
    Posts
    8
    Rep Power
    0

    Default Re: Truncated class file - Possible Virus.

    Give me a name of a high dollar one.

    I'm about to try with DJ Java.

    Scratch that. DJ is a fancy version of JAD.
    Last edited by Billt; 10-22-2011 at 10:07 PM.

  4. #4
    Fubarable's Avatar
    Fubarable is offline Moderator
    Join Date
    Jun 2008
    Posts
    19,316
    Blog Entries
    1
    Rep Power
    25

    Default Re: Truncated class file - Possible Virus.

    Quote Originally Posted by Billt View Post
    Give me a name of a high dollar one.
    Again, I'm not your man for this since I've never used a decompiler, and in fact I can guarantee that you know more about decompiling than I do. Hopefully someone more knowledgeable will post something on this shortly.

    Luck!

  5. #5
    DarrylBurke's Avatar
    DarrylBurke is offline Member
    Join Date
    Sep 2008
    Location
    Madgaon, Goa, India
    Posts
    11,189
    Rep Power
    19

    Default Re: Truncated class file - Possible Virus.

    I would consider the possibility that the files are not in fact Java class files at all.

    db

  6. #6
    Billt is offline Member
    Join Date
    Oct 2011
    Posts
    8
    Rep Power
    0

    Default Re: Truncated class file - Possible Virus.

    I opened the files in a hex editor and some of the imports show up. It's definitely a java file. The hex editor won't copy the text, only the hex values.

  7. #7
    DarrylBurke's Avatar
    DarrylBurke is offline Member
    Join Date
    Sep 2008
    Location
    Madgaon, Goa, India
    Posts
    11,189
    Rep Power
    19

    Default Re: Truncated class file - Possible Virus.

    Do the files have the CAFEBABE header?

    db

  8. #8
    Billt is offline Member
    Join Date
    Oct 2011
    Posts
    8
    Rep Power
    0

    Default Re: Truncated class file - Possible Virus.

    Quote Originally Posted by DarrylBurke View Post
    Do the files have the CAFEBABE header?

    db
    Yep, I don't know how I've never noticed that before in a class file.

Similar Threads

  1. Truncated class file [HELP NEEDED]
    By Tylers Pur3 in forum New To Java
    Replies: 8
    Last Post: 08-03-2010, 06:48 PM
  2. Anti virus
    By gyan916 in forum Advanced Java
    Replies: 3
    Last Post: 08-03-2010, 10:22 AM
  3. Button is sometimes truncated
    By new2java2009 in forum New To Java
    Replies: 7
    Last Post: 06-07-2010, 05:36 PM
  4. Do you have Virus scan computer code for Java
    By star24h.com in forum New To Java
    Replies: 5
    Last Post: 11-08-2009, 03:07 AM
  5. Examples / virus software programming
    By Implode in forum New To Java
    Replies: 17
    Last Post: 09-02-2009, 08:10 AM

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •