Truncated class file - Possible Virus.

**Billt** · 10-22-2011, 09:45 PM

Google directed me to a malicious site and NOD32 went crazy telling me which files it blocked. Two caught my eye, GhostPacket.class and GhostProtocol.class. I've tried CavaJ, it says the file doesn't exist and JAD tells me it's a truncated class file. I've never really heard of a Java virus but how could I get inside of these files and examine them?

**Fubarable** · 10-22-2011, 09:53 PM

I'm no pro at this, not by any means, but I think your best bet is still to try to decompile them. If CavaJ and JAD don't work, then perhaps try another one. I've no experience with decompilers though but have heard that some of the better ones cost buck$$.

**Billt** · 10-22-2011, 09:59 PM

Give me a name of a high dollar one.

I'm about to try with DJ Java.

Scratch that. DJ is a fancy version of JAD.

**Fubarable** · 10-22-2011, 10:10 PM

Originally Posted by Billt

Give me a name of a high dollar one.

Again, I'm not your man for this since I've never used a decompiler, and in fact I can guarantee that you know more about decompiling than I do. Hopefully someone more knowledgeable will post something on this shortly.

Luck!

**DarrylBurke** · 10-24-2011, 10:07 PM

I would consider the possibility that the files are not in fact Java class files at all.

db

**Billt** · 10-25-2011, 04:16 AM

I opened the files in a hex editor and some of the imports show up. It's definitely a java file. The hex editor won't copy the text, only the hex values.