The MASM Forum Archive 2004 to 2012

Project Support Forums => MASM32 => Topic started by: Reozil on November 28, 2011, 01:24:43 PM

Title: Concerned
Post by: Reozil on November 28, 2011, 01:24:43 PM
Hi,
I downloaded and installed masm32 from following location. httpx://win32assembly.online.fr/files/win32asm.exe
Then i sent the file to https://threatcenter.crdf.fr/?More&ID=54297&D=CRDF.Malware-Generic.1590610550 and read the info i says there.
Is my computer safe? Specially i´m concerned that the installer patched C:WINDOWS\system32ctl3dv2.dll ? Why does it need to do so? Is this safe?
Title: Re: Concerned
Post by: BogdanOntanu on November 28, 2011, 02:27:42 PM
As a general rule: It is highly possible that you are NOT safe.
Never download MASM32 from sites not trusted. In fact never downlaod and execute anything from sites not trusted.

You have a list of trusted sites on Hutch's site here:
http://www.masm32.com/masmdl.htm

MASM32 on that site is located here: http://win32assembly.online.fr/files/masm32v7.zip  (very old version)
Notice that it is an zip and not an EXE.

Now how did you reached that link :D ?

That is an old mirror of Iczelion's site. Apparently it is not maintained from a long time.
I recommend that you only get the tutorials and the sources from there, inspect them and rebuild them yourself.

Never get p recompiled executables... unless you like to risk ;)

Title: Re: Concerned
Post by: Reozil on November 28, 2011, 02:38:52 PM
Quote from: BogdanOntanu on November 28, 2011, 02:27:42 PM
As a general rule: It is highly possible that you are NOT safe.
Never download MASM32 from sites not trusted.

You have a list of trusted sites on Hutch's site here:
http://www.masm32.com/masmdl.htm

MASM32 on that site is located here: http://win32assembly.online.fr/files/masm32v7.zip  (very old version)
Notice that it is an zip and not an EXE.

Now how did you reached that link :D ?

its in the first tutorial
http://win32assembly.online.fr/tut1.html




Title: Re: Concerned
Post by: BogdanOntanu on November 28, 2011, 02:42:59 PM
My version of Icz's tutorials did not have THAT :D :D :D

Get MASM32 from Hutch's site ....
Title: Re: Concerned
Post by: BogdanOntanu on November 28, 2011, 02:44:04 PM
Here you have the tutorials in an CHM ;)

http://website.masm32.com/iczelion/iczelion.zip

Other than installing MASM and an IDE (RadASM or WinASM or another) I suggest that you avoid links to executables if possible ;)


Title: Re: Concerned
Post by: dedndave on November 28, 2011, 03:54:35 PM
Quote from: Reozil on November 28, 2011, 01:24:43 PM
Hi,
I downloaded and installed masm32 from following location. httpx://win32assembly.online.fr/files/win32asm.exe
Then i sent the file to https://threatcenter.crdf.fr/?More&ID=54297&D=CRDF.Malware-Generic.1590610550 and read the info i says there.
Is my computer safe? Specially i´m concerned that the installer patched C:WINDOWS\system32ctl3dv2.dll ? Why does it need to do so? Is this safe?

that is not the masm32 package
it is the win32asm package   :P
and - a very old one, dated 1997
so, it's good to go...
...for win95   :bg

if you want masm32, start with this page
http://masm32.com/installation.htm

once you have read that, go to this page
http://masm32.com/masmdl.htm

it's good to know that the masm32 package has improved since the Iczelion tutorials were written
there are some things in the tutorials that are no longer required
for example, all the API PROTO's are done for you
some other time-saving improvements have also been made

here is the program for the second tutorial, updated
        INCLUDE \masm32\include\masm32rt.inc

        .DATA

MsgBoxCaption   db "Iczelion Tutorial No.2",0
MsgBoxText      db "Win32 Assembly is Great!",0

        .CODE

start:
        INVOKE  MessageBox, NULL, addr MsgBoxText, addr MsgBoxCaption, MB_OK
        INVOKE  ExitProcess, NULL

        END     start
Title: Re: Concerned
Post by: Vortex on November 28, 2011, 06:13:00 PM
Hi Reozil,

Jotti's page reports that the file is clean : nothing found

Jotti's report (http://virusscan.jotti.org/eng/scanresult/a5bfef2c0314670f3d168ba0358423e2302a5494)
Title: Re: Concerned
Post by: hutch-- on November 30, 2011, 07:16:14 AM
Reozil,

First make sure your computer is not infected with any viruses or trojans then get MASM32 from the www.masm32.com web site. It sounds like you have a hacked old version which is not safe to use and may damage your computer. The only authorised versions of MASM32 are in the download list at www.masm32.com, use anything else and you risk getting a virus or trojan on your computer for FREE.  :P