I am kind of curious on how submitting it to virus total is condusive to make it detectable ?
(Apr 29, 2009 07:01 AM)Jambo Wrote: I am kind of curious on how submitting it to virus total is condusive to make it detectable ?
because they pass on scan detials to anti virus companys which then makes it detectble! use novirusthanks and click dont distribute (i think thats what it say or something along them lines )
I would like one when you finish it. I doesn't matter to me where it uploads to a ftp or mail..
can i have a copy of this
Hi,
would you make one for me plzzzzzzzzzzzzzz
(Apr 29, 2009 07:06 AM)Evolution Wrote: because they pass on scan detials to anti virus companys which then makes it detectble! use novirusthanks and click dont distribute (i think thats what it say or something along them lines )
How exactly can anti virus companies know what a file is up to through it's scan details ?
I'm considering to who I will distribute it to, here are some possible criteria I might use to know if you can be trusted:
-3+ or 5+ Reputations
-100+ Posts (these will be checked to make sure they are real posts and not just a new account)
-Hackforums.net account older than 3 months
-I have worked with you in the past and know you can be trusted.
Not sure which criteria I will use to know who I can trust with it but we will see.
The program has only recently been in the coding stage for the past week or so and therefore uses Windows Hooks to capture keys, I'm considering switching it over to GetAsyncKeyState which is a little less detectable or even to a keyboard driver keylogger which is virtually undetectable by all AVs if I have that much time (highly doubt it). It is being coded in C# so the end user must have the .Net Framework installed. Also it will copy and send over Firefox saved passwords, firefox saved form entries, Aim password hash codes (to be added soon - if AIM is installed), MSN passwords (to be added soon - if MSN is installed), so even if the keylogger is detected and deleted before that happens it will still send over a lot of vital information :).
@nem41: It already has an autocopy to the system32 folder and an autorun registry key, it makes no sense to infest all the drives or a bunch of folders because it is not a virus but a keylogger and infesting mutliple drives will only increase the chance an AV might find it or it might be marked as suspicious.
@Jambo: The exe file gets uploaded to the server to be checked, inside the file there are markers such as file size, name, API functions being called, etc that can be then sent to Antivirus companies to add on their blacklist and therefore will cause detections.
Have it run on startup? I noticed when people turn off their computers my keylogger stops -.- lol
Already included, it will start when windows loads via a registry key in the Run location, I'm considering switching over to the registry key in RunOnce instead and when the program loads to write a new registry key there after windows deletes it. This will make it less detectable but also may make it stop loading if it is unable to write the key after it was deleted.
Let me know what you guys prefer here, more hidden or a greater chance to load.
(Apr 29, 2009 06:49 PM)Yoshistr Wrote: Already included, it will start when windows loads via a registry key in the Run location, I'm considering switching over to the registry key in RunOnce instead and when the program loads to write a new registry key there after windows deletes it. This will make it less detectable but also may make it stop loading if it is unable to write the key after it was deleted.
Let me know what you guys prefer here, more hidden or a greater chance to load.
Hmmm, I would say maybe a better chance to load. Cause if you think about it. You can always hide it with a crypter
Can i please have one? I know im only +1rep but i've been here since december! Also im quickly nearing 100+ posts. Im loyal!
DO NOT DEAL WITH THIS MEMBER
Requests Haven't worked with you though, how would that be done?
@paloalto01: Yes you can hide it with a crypter but it will still show up in msconfig tool because it is in the startup registry key, I'm thinking use runonce instead because it will almost always be able to just rewrite the key and msconfig doesn't detect this key but I'm not sure if it will run in safemode and then not write the key. Basically it needs to run which will automatically delete the key since it is in runonce and once it starts it should write to the runonce key again that way when windows is rebooted it will run once more, etc.
I still haven't decided yet who I want to distribute it to, but I'm still coding so I'll keep you guys updated.
@Zammyslave: You can try to help write the program with me if you use C# or make great suggestions on how to capture keys using C# and if I use your code or great suggestion you will definitely get a copy. Also you seem like a trusted member so I'm sure either way you can request a copy.
DO NOT DEAL WITH THIS MEMBER
(Apr 29, 2009 07:30 PM)Yoshistr Wrote: @Zammyslave: You can try to help write the program with me if you use C# or make great suggestions on how to capture keys using C# and if I use your code or great suggestion you will definitely get a copy. Also you seem like a trusted member so I'm sure either way you can request a copy. Programming noob here lol. I'll try to think of something great though 😁
can i have any cool programs u got ready thanks
|
