Тема: AntiSandBox
it supports much Sandboxes/Emus, like Anubis, Threat Expert, Sandbox, JoeBox, Norman, WireShark, Kaspersky, iDEFENSE sysAnalyzer, Sunbelt, Sandboxie, Virtual PC, Virtual Box and others.
#include <stdio.h>
#include <windows.h>
#include <tlhelp32.h>
char* sExes[] = { "joeboxserver.exe", "joeboxcontrol.exe", //joebox
"wireshark.exe", //wireshark
"avp.exe", //kaspersky
"sniff_hit.exe", "sysAnalyzer.exe" }; //sysanalyzer
char* sUsers[] = { "username", //threat expert
"user", //sandbox
"currentuser" }; //norman
char* sModules[] = { "api_log.dll", "dir_watch.dll", //sunbelt & sandboxie
"pstorec.dll", //sunbelt
"SbieDll.dll", }; //sandboxie
int ProcessCheck()
{
PROCESSENTRY32 pe32 = { sizeof( PROCESSENTRY32 ) };
HANDLE hSnapshot = CreateToolhelp32Snapshot( TH32CS_SNAPALL, 0 );
if( Process32First( hSnapshot, &pe32 ) )
{
do
{
for( int i = 0; i < ( sizeof( sExes ) / sizeof( char* ) ); i++ )
{
if( strstr( pe32.szExeFile, sExes[ i ] ) )
{
return( i + 1 );
}
}
}
while( Process32Next( hSnapshot, &pe32 ) );
}
return( 0 );
}
int ModuleCheck()
{
for( int i = 0; i < ( sizeof( sModules ) / sizeof( char* ) ); i++ )
{
if( GetModuleHandle( sModules[ i ] ) )
{
return( i + 1 );
}
}
return( 0 );
}
int UserCheck()
{
char szBuffer[30];
unsigned long lSize = sizeof( szBuffer );
if( GetUserName( szBuffer, &lSize ) == 0 )
return( 1 );
for( int i = 0; i < ( sizeof( sUsers ) / sizeof( char* ) ); i++ )
{
if( strstr( szBuffer, sUsers[ i ] ) )
{
return( i + 1 );
}
}
return( 0 );
}
int main()
{
if( ProcessCheck( ) == 0 )
printf( "process check < clean\n" );
if( ModuleCheck( ) == 0 )
printf( "module check < clean\n" );
if( UserCheck( ) == 0 )
printf( "user check < clean\n" );
getchar( );
return 0;
}Копипаст Откуда то....
Отредактировано spider-intruder (2009-05-16 17:53:54)