A forum for reverse engineering, OS internals and malware analysis
--regdiff
user\current_classes\*\shell\sandbox = deleted registry key
OpenProcess(c:\users\user\desktop\sandboxie 4.62+bsa 1.49\bsa\bsa.exe) [c:\windows\syswow64\rundll32.exe]
OpenProcess(c:\program files\sandboxie\sbiectrl.exe) [c:\windows\syswow64\rundll32.exe]
Mr.Bojangles wrote:You have the exclusion lists to avoid showing that kind of stuff.Code: Select allmaybe omit that and other engine notices? so it doesn't look like antis?--regdiff user\current_classes\*\shell\sandbox = deleted registry key OpenProcess(c:\users\user\desktop\sandboxie 4.62+bsa 1.49\bsa\bsa.exe) [c:\windows\syswow64\rundll32.exe] OpenProcess(c:\program files\sandboxie\sbiectrl.exe) [c:\windows\syswow64\rundll32.exe]
EDIT: The second two might actually be antis..
Mr.Bojangles wrote:When I finish my current contract I'll make another tool that checks for existence. I haven't looked at anything yet though. I also only use 64bit windows. The additions are nice.I would say I fixed Ldr->HashLinks detection some time ago. It will be nice if you can check if it´s really fixed.
