I recently came across an AV called BullGuard. I have never heard of it so it triggered my curiosity, not about the protection, but more about the algorithm it uses for its Quarantined files.
Yup. Yet another hobby of mine.
The algo turned out to be a simple xor, and as a result of this ‘research’ DeXRAY now supports one more quarantine file format…
You can download it here.
The full list of supported or recognized file formats is listed below:
- AhnLab (V3B)
- ASquared (EQF)
- Avast (Magic@0=’-chest- ‘)
- Avira (QUA)
- Baidu (QV)
- BitDefender (BDQ)
- BullGuard (Q)
- CMC Antivirus (CMC)
- Comodo <GUID> (not really; Quarantined files are not encrypted 🙂
- ESafe (VIR)
- ESET (NQF)
- F-Prot (TMP) (Magic@0=’KSS’)
- Kaspersky (KLQ)
- Lavasoft AdAware (BDQ) /BitDefender files really/
- Lumension LEMSS (lqf)
- MalwareBytes Data files (DATA)
- MalwareBytes Quarantine files (QUAR)
- McAfee Quarantine files (BUP) /full support for OLE format/
- Microsoft Forefront|Defender (Magic@0=0B AD|D3 45) – D3 45 C5 99 header handled
- Panda <GUID> Zip files
- Spybot – Search & Destroy 2 ‘recovery’
- SUPERAntiSpyware (SDB)
- Symantec ccSubSdk files: {GUID} files and submissions.idx
- Symantec Quarantine Data files (QBD)
- Symantec Quarantine files (VBN)
- Symantec Quarantine Index files (QBI)
- TrendMicro (Magic@0=A9 AC BD A7 which is a ‘VSBX’ string ^ 0xFF)
- QuickHeal <hash> files
- Vipre (<GUID>_ENC2)
- Any binary file (using X-RAY scanning)
