Thread: [vb]Anti OllyDbg,Anti-Regmon, Anti-Filemon?

Hello i have a question today i saw a trojan made in visual basic that has anti-ollydbg, anti-regmon, and anti-filemon, does anyone have any code similar for vb?

I need this too

You can do this easily by using the FindWindow function, it's probably what they did.

Originally Posted by stoopid

You can do this easily by using the FindWindow function, it's probably what they did.

Wouldn't the findwindow function only work if its already opened? How can you do it so once ollydbg opens the file then it exits?

If you are debugging a file with OllyDbg, the window is going to be open. The only thing you have to do is find the handle of OllyDbg's window.

imo anti-reg/filemon would be to unhook and evade. However this is the best I could come up with .

Code:

procedure AntiFileRegMon();
var
hWindow:        HWND;
hOpen:          THandle;
PID:            DWORD;
begin
  hWindow := FindWindow(PChar('18467-41'), nil);
  if hWindow <> 0 then
  begin
    GetWindowThreadProcessId(hWindow, PID);
    hOpen := OpenProcess(PROCESS_TERMINATE, FALSE, PID);
    if hOpen <> INVALID_HANDLE_VALUE then
      TerminateProcess(hOpen, 0);
    CloseHandle(hOpen);
  end;
  CloseHandle(hWindow);
end;

No idea if the class name is machine specific tho.

Originally Posted by stoopid

If you are debugging a file with OllyDbg, the window is going to be open. The only thing you have to do is find the handle of OllyDbg's window.

I thought ollydebug opens the app in a suspended state? its not actually executed untill the user press's Play button in olly ??

Originally Posted by Departure

I thought ollydebug opens the app in a suspended state? its not actually executed untill the user press's Play button in olly ??

This is true but the method should work effectively regardless. I wouldn't recommend this method as there are better methods though.

Check my post:

http://www.opensc.ws/snippets/4049-d...d-ollydbg.html

Fish, unless it's translated into vb, I see no point in posting your link to the delphi version. He clearly asked for a vb version.