[Verizon Samsung Galaxy S7 Guides, News, & Discussi] psouza4:
My findings: clean (but really uninteresting)

So here are my findings:

(1) I was not able to detect any viruses or malicious code in the payload. It seems relatively clean and we're seeing false-positives.

(2) The batch file (in the file bypassfrp.exe) is nothing extraordinary at all and uses precisely the same technique that's been floating around YouTube and various guides. The way he does it may be slightly different, but it's still a matter of taking advantage of an activity to get access to a browser when you shouldn't and then using the browser sign-in to associate the device with your account to bypass FRP.

(3) here are the entire contents of his batch file:

@shift
@echo off
cls
echo Let me be perfectly clear, this works on PE1 with latest security patch.
echo I also want to mention that I take no responsibility for loss of data.
echo If you do not have PE1 please flash PE1 with ODIN prior to proceeding!
echo.
echo Be certain you have Samsung Driver software installed
echo If you are certin you already have them please exit the installer.
.\"Samsung USB Driver Pack\SAMSUNG_USB_Driver_for_Mobile_Phones.exe"
echo.
echo Plug your mobile device in and allow the drivers to load.
echo Once the drivers are loaded Flash Rooted kernel with ODIN
echo.
echo We are running the Odin Software
echo If you recieve a malware warning from any security software please ignore!
echo Exit the ODIN software to continue the process
Odin_PrinceComsy.exe
echo.
echo.
echo Enter Galaxy S7 Maintenance Boot Mode (Takes time)
echo 1. Power Down the Galaxy S7
echo 2. When Powered Down, Press and Hold the Power and Volume Down Buttons
echo at the Same Time
echo 3. Continue Holding These Two Buttons Until You See the Special Maintenance
echo Boot Mode Menu
echo 4. Then Let Go of Both the Power and Volume Down Buttons
echo.
echo Select Option 5 with the Volume Down button and press Home to select it.
echo.
echo Allow the reboot fully into Setup Wizard again.
echo.
pause
echo.
adb kill-server
adb wait-for-device
echo.
echo You should see the Settings Menu shortly
adb shell am start -S com.android.settings/.Settings$PowerUsageSummaryActivity >nul
echo.
echo Once you see the settings menu Connect to a Wireless network that has internet access
echo.
pause
adb shell am start -S com.google.android.gsf.login/com.google.android.gsf.login.LoginActivity >nul
echo.
echo You should now see a Re-type password screen
echo DO NOT USE THIS SCREEN TO RE-TYPE PASSWORD
echo Instead click the "Menu button" on the top right and select "Browser sign-in"
echo Click OK to accept Terms of Service
echo Sign in to your Google Account
echo.
pause
echo.
echo After successfully signing in the system should now bounce you back.
echo Press the back button numerous times to get back to the Setup Wizard.
echo Continue to press the back button until you get back to the "Welcome"
echo Proceed as if you were setting up the phone normally.
echo Do not worry the (Just a sec...) portion takes some time to pass.
echo.
echo Prior to continuing you must FULLY SETUP YOUR PHONE and be at the Home Screen
echo.
echo Now that FRP is bypassed lets Fully Root your system!
echo.
pause
echo.
echo Mounting System and RootFS RW
adb shell mount -o rw,remount /system
adb shell mount -o rw,remount rootfs /
echo Pushing SuperSU to Data
adb push SuperSU-v2.74-2.img /data/su.img
echo.
adb push launch_daemonsu.sh /system/etc/launch_daemonsu.sh
echo.
echo Revoving Security Log Agent Protections
adb shell mv /system/app/SecurityLogAgent/SecurityLogAgent.apk /system/app/SecurityLogAgent/SecurityLogAgent.old
echo.
echo Pushing zip files to Storage for later use
adb push xposed-v85.1-sdk23-arm64-custom-build-by-wanam-20160530.zip /storage/emulated/0/
echo.
echo Installing FlashFire (Check your device screen and hit Accept)
adb install flashfire.apk
echo.
echo Installing SuperSU Application
adb install -r SuperSU-v2.74-2.apk
echo.
echo Installing Xposed Framework Application
adb install XposedInstaller_3.0_alpha4.apk
echo.
echo Rooting System
adb shell < supersu.cmds
echo.
echo.
echo.
echo.
Echo Your device is now fully Rooted as well as FRP Removed
echo We are now Rebooting your Device, Enjoy!
echo.
echo.
echo.
echo.
start https://"www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=UNW5MU5J4RZEE"
pause

Save it as a batch file and run it instead of his executable. In the future, [MENTION=557282]xboxexpert[/MENTION] please release clean source code or at the very minimum, something people can scan to verify isn't malicious (or don't release anything at all).

EDIT/UPDATE: Here are some VirusTotal links:

Original self-extracting .exe from [MENTION=557282]xboxexpert[/MENTION]'s Google Drive:

https://www.virustotal.com/en/file/...e3015f3cad294b98e100a26a/analysis/1468341516/

Using 7-zip to extract all files, then using 7-zip to create a ZIP archive of all files:

https://www.virustotal.com/en/file/...e3015f3cad294b98e100a26a/analysis/1468341516/

Replacing the file 'bypassfrp.exe' in the ZIP archive with 'bypassfrp.bat' (contents are listed above):

https://www.virustotal.com/en/file/...e3015f3cad294b98e100a26a/analysis/1468341516/

There's one false-positive in 'Samsung Galaxy S7x FRP Bypass/XposedInstaller_3.0_alpha4.apk', which is 'Android-AppCare/Xposed.8aaf'. This is a false-positive because we know that it's Xposed and it's safe to install to our phones. It's also not binary code that can harm our PCs.

EDIT/UPDATE 2: Here's a download link to the batch file version, no other changes made:

Samsung_Galaxy_S7x_FRP_Bypass_batchversion.zip (MD5 hash 0D93A3084B6680284283A94AEAD99434 -- matches third VirusTotal link above)