#Programs like windirstat archive#
#Programs like windirstat pro#
#Programs like windirstat code#

Now I donвЂ™t have the time to investigate into what exactly this thing is doing, but it bears all the hallmarks of malware and therefore from my perspective that file isnвЂ™t a false positive. Holy moly, Batman! Someone actually trojanized WinDirStat and it looks like EPO 4 just from a brief look.ДЄgain, this file is named windirstat.exe and to the naked eye it looks like the Unicode build from the 1.1.2 installer, but in actuality this is a trojanized version of the genuine file. text:004471B4 hPrevInstance = dword ptr 8ДЄnd when I did the same on the trojanized file it looked like this.

#Programs like windirstat pro#

So I loaded the genuine file into IDA Pro and the entry point looked like this.

#Programs like windirstat code#

The size matched, the timestamp in the PE header matched, just some things like the sections and a whole lot of code or data had been changed in the middle of the file. And what struck me was that all external traits shown by this file matched closely the Unicode build from the 1.1.2 installer.

#Programs like windirstat archive#

Now I didnвЂ™t have that file in my release archive so I asked for the file 3 and was then able to look at the actual trojanized file. It turned out that the file aforementioned Swedish user had inquired about wasnвЂ™t under detection, but another file with the MD5 hash a84aad50293bf5c49fc465797b5afdad. So I got a contact for the malware research at MalwareBytes and was able to inquire about the file. WeвЂ™ve had this before, but this time it was a slightly different case. That is the installer with the following two cryptographic hashes 2: I assumed false positive and it turned out that it was at least for the particular file that the Swedish user had (SHA1: 26e14a532e1e050eb20755a0b7a5fea99dd80588) 1 вЂ“ which was the genuine file from the genuine version 1.1.2 installer. Now, the report I got from a WinDirStat user from Sweden (thanks again!) was that MalwareBytes had detected WDS once again. In addition, WinDirStat can display data about files of unknown types and disk space.Well, actually it isnвЂ™t the genuine WinDirStat but a trojanized version posing as WinDirStat and itвЂ™s masquerading under the disguise of the good Unicode version of windirstat.exe which is contained in the installer. At the same time, you can quickly allocate all files of a certain type in the 'mosaic' structure of the hard disk. Click on any file in the mosaic and you will be able to see its extension and the path to it. Working in WinDirStat is very easy: select a folder in the window where the tree structure of the disk is shown - and a piece of mosaic corresponding to this folder and the files included in it will be highlighted with a white frame. The program interface is divided into several windows - one window shows the tree structure of files, the other window shows the graphic 'mosaic', and the third window shows the color designations for different types of files.

In doing so, each folder can be expanded and looked at the structure of the files it contains (both folders and files are sorted by size). In addition to the graphical representation, folders on the disk can be displayed as a tree. The program scans the contents of the hard drive and displays its structure in the form of a mosaic in which - the larger the size of the file or folder - the larger the mosaic they are represented. WinDirStat is a very useful utility that can graphically show the structure of files and folders on the hard disk.