[xVipX]

hello today i have coding simple class to bypass process hacker by found window visible & child & setwindowtext & enable butoun and use timer very easy !
image : )
[img]http://up.dev-point.com/uploads1/cda83ae148cf1.gif[/img]
class
http://pastebin.com/wnZC5T2G
use :

Code

Dim x As New prote
        x.pass()

good luck

[EagleEye]

nice share good code btw , its good way ... i may use it in my future projects

[Only3]

what normal person do when he see that his process hacker doesnt work

[LethalNET]

this could be done to task manager too, winapi is very useful.
good work op although the code could be improved its a unique release :)

[xVipX]

what normal person do when he see that his process hacker doesnt work

yes i will put class to bypass taskmng + bsod
this gifte to y bro y the best in this : )

[Ninja]

this could be done to task manager too, winapi is very useful.
good work op although the code could be improved its a unique release :)

Unique? I saw at least 5 other threads this month about anti process killers.

[LethalNET]

Unique? I saw at least 5 other threads this month about anti process killers.

The method its using is what I'm saying is a unique release, instead of setting the process as critical or admin only its uses a completely different approach.
I'm not so active in these subforums so I may have overlooked but I haven't seen this posted anywhere here.
I'm not saying the concept of process protection is unique only the method he is using.

[Cecilia]

The method its using is what I'm saying is a unique release, instead of setting the process as critical or admin only its uses a completely different approach.
I'm not so active in these subforums so I may have overlooked but I haven't seen this posted anywhere here.
I'm not saying the concept of process protection is unique only the method he is using.

Anyone remember that .net 'rootkit' that removed the process from taskmanager using winapi stuff?

Its not unique at all, its been done before with plenty of things.

[nuk]

Anyone remember that .net 'rootkit' that removed the process from taskmanager using winapi stuff?

Its not unique at all, its been done before with plenty of things.

Is there really such a thing as a TRUE .net ring-0 Rootkit? ...I'm just wondering because I didn't think that was possible? Would be interesting to take a look at the source to something like that.

[Vigor]

Anyone remember that .net 'rootkit' that removed the process from taskmanager using winapi stuff?

Its not unique at all, its been done before with plenty of things.

Yaaa I remember that. I was the one that originally posted, coded, and released that. The very first one. :)

[Moon Rock]

Hmm, code seems pretty long but if it does the job then I don't see a problem.

[Ninja]

Who calls their PC "COBRAxXx-PC", lol.

[GhostCode]

Is there really such a thing as a TRUE .net ring-0 Rootkit? ...I'm just wondering because I didn't think that was possible? Would be interesting to take a look at the source to something like that.

A ring0 rootkit is not possible in C#/VB.Net.
A ring3 rootkit is theoretically possible in .net, tho its tricky to code, but it is possible.
It requires knowledge about remote process hooking, code injection etc.
Many people called 'Darkfire' a rootkit in .net.
Its not a rootkit at all.. ;]

[Cecilia]

A ring0 rootkit is not possible in C#/VB.Net.
A ring3 rootkit is theoretically possible in .net, tho its tricky to code, but it is possible.
It requires knowledge about remote process hooking, code injection etc.
Many people called 'Darkfire' a rootkit in .net.
Its not a rootkit at all.. ;]

Thats the one I thought of when I saw this thread.
Exactly, its not a rootkit at all, just a trick or two.

---

A ring0 rootkit is not possible in C#/VB.Net.
A ring3 rootkit is theoretically possible in .net, tho its tricky to code, but it is possible.
It requires knowledge about remote process hooking, code injection etc.
Many people called 'Darkfire' a rootkit in .net.
Its not a rootkit at all.. ;]

Thats the one I thought of when I saw this thread.
Exactly, its not a rootkit at all, just a trick or two.

[He B TeMy]

This has nothing to do with a rootkit, it's just "tampering" with processhacker.