Civil Engineering Association

This is license keyfile generator for some of CSI products. It makes legit licenses, and with use of this no crack/patch is required.

Look:


Supported CSI products:


Usage:
1. Select product.
2. Enter yout localcode (fingerprint from echoid/wechoid).
Select license expire date (WARNING!!! 1 year max).
3. Generate your license file (it took few seconds - just wait confirmation for generator).
4. Rename generated file to "lservrc" and copy to corresponding program dir.

Download:

Enjoy ;)

Hope this is OK.

Tutorial CSI Multi Products License Generator

Tutorial CSI Multi Products License Generator

After analysing the license generator files i found out that the so-called generator "csimp.exe" has a virus like behavior. The real generator is lsc.exe. And since there is no option for SAP2000 V14 i wrote a simple batch file that could be used instead of "csimp.exe" for generating SAP2000 V14 licenses. So copy-paste the text marked with italics in an empty text file with ".bat" extension, place that file next to "lsc.exe" and run it. (lsc.exe is part of the license generator)
Text for batch file:

If you encounter errors just make sure there is no "lservrc" file in the same folder with lsc.exe.

Thanks alot to LiviuM, I wrote same bat file for CSI Bridge

The same for :

ETABS 9 and Safe 12.








RAR Password: FromCivilEA

Dear all,

My contribution:


with the same password

Mirror
Password

Someone else saw something like this or only my antivirus is so stupid to think is a virus in this contribution ?
Good luck !



A lot of pages in internet about (18660 results by google) but try to see one for example.


From other site:

Quote:Description:
Win32.JunkPoly.Cryp is a malicious backdoor Trojan that runs in the background and allows remote access to the compromised system. Win32.JunkPoly.Cryp contains a hacktool for attackers to break into the PC. Win32.JunkPoly.Cryp can change Windows Explorer settings to download other malicious files from external servers. Win32.JunkPoly.Cryp monitors user activities to obtain valuable personal information. Win32.JunkPoly.Cryp poses a dangerous threat to any computer or system and should be terminated immediately.

Other names:



And this is from Microsoft site:

Technical Information (Analysis)
Virus:Win32/Virut.BM is a polymorphic file infector that targets .EXE and .SCR files. This virus also opens a backdoor by connecting to an IRC server, allowing a remote attacker to download and execute arbitrary files on the infected computer. It uses advanced techniques to hide infection.
Spreads Via…
Executable File Infection
Win32/Virut.BM disables Windows System File Protection (SFP) by injecting code into WINLOGON.EXE. The injected code patches sfc_os.dll in memory which in turn allows the virus to infect files protected by SFP.

The virus infects .EXE and .SCR files on access, hence actions such as copying or viewing files with Explorer, including on shares (with write access) will result in files being infected, and the virus spreading from machine to machine.

The virus injects its own code into a system process such as explorer.exe or winlogon.exe, and hooks low-level (NTDLL layer) Windows API calls in order to stay in memory. It hooks the following functions in each running process (NTDLL.DLL):

NtCreateFile
NtOpenFile
NtCreateProcess
NtCreateProcessEx

Thus, every time an infected process calls one of these functions, execution control is passed to the virus.

HTML File Infection
It writes code to HTML files that adds a hidden IFrame pointing to the domain 'zief.pl'. When the HTML file is opened, the browser connects to this server without the user's knowledge. The HTML page hosted at this location attempts to exploit a number of different vulnerabilities (including those affecting the user's browser and other applications) in order to run a copy of the virus. These modified HTML files are detected as Virus:HTML/Virut.BH.

The virus also modifies the local machine's hosts file, redirecting the domain 'zief.pl' to localhost (127.0.0.1) so that already-infected machines will not run the remotely-hosted copy of the virus.
Payload
Backdoor Functionality
Virut.BM connects to Internet Relay Channel (IRC) server 'irc.zief.pl' via port 80 using a particular channel. Should this fail, it instead attempts to connect to 'proxim.ircgalaxy.pl' also using port 80.

It contains functionality to download and execute arbitrary files on the affected system. This may include additional malware. The backdoor can also be used to change the host that it connects to for control.
Additional Information
Virut.BM creates the event 'Vx_5' to prevent multiple copies of itself from running simultaneously on the affected system. A minor variant may create another mutex "l0r5".