A few weeks ago Brian contacted me about his research on Symantec Quarantine files. He has already worked on some parts of DeXRAY and he suggested that he could improve the code handling the VBN files. And so he did – the result is lots of new code that enables DeXRAY to decrypt these files much better!
Brian wrote a post explaining the internals of Symantec VBN files and you should definitely go and read it!
Really great piece of work. Thank you Brian!
You can download the latest version of DeXRAY here.
The full list of supported or recognized file formats is listed below:
- AhnLab (V3B)
- ASquared (EQF)
- Avast (Magic@0=’-chest- ‘)
- Avira (QUA)
- Baidu (QV)
- BitDefender (BDQ)
- BullGuard (Q)
- CMC Antivirus (CMC)
- Comodo <GUID> (not really; Quarantined files are not encrypted 🙂
- ESafe (VIR)
- ESET (NQF)
- F-Prot (TMP) (Magic@0=’KSS’)
- Kaspersky (KLQ, System Watcher’s <md5>.bin)
- Lavasoft AdAware (BDQ) /BitDefender files really/
- Lumension LEMSS (lqf)
- MalwareBytes Data files (DATA) – 2 versions
- MalwareBytes Quarantine files (QUAR) – 2 versions
- McAfee Quarantine files (BUP) /full support for OLE format/
- Microsoft Forefront|Defender (Magic@0=0B AD|D3 45) – D3 45 C5 99 header handled
- Panda <GUID> Zip files
- Spybot – Search & Destroy 2 ‘recovery’
- SUPERAntiSpyware (SDB)
- Symantec ccSubSdk files: {GUID} files and submissions.idx
- Symantec Quarantine Data files (QBD)
- Symantec Quarantine files (VBN)
- Symantec Quarantine Index files (QBI)
- Symantec Quarantine files on MAC (quarantine.qtn)
- TrendMicro (Magic@0=A9 AC BD A7 which is a ‘VSBX’ string ^ 0xFF)
- QuickHeal <hash> files
- Vipre (<GUID>_ENC2)
- Zemana <hash> files+quarantine.db
- Any binary file (using X-RAY scanning)