Sandboxie Support

Anti Keylogger and Clipboard monitor

2013-08-03T02:27:07-04:00

CODE:

http://att.kafan.cn/forum.php?mod=attachment&aid=MTAwMTQ4OXw4YmNhMTIzZXwxMzc1NTEwOTk3fDB8ODI2MjMy+http://www.microsoft.com/en-us/download/details.aspx?id=5582

CODE:

http://att.kafan.cn/forum.php?mod=attachment&aid=OTk5MjU1fGIwNzNjYTZmfDEzNzU1MTA5OTd8MHw4MjYyMzI%3D

Statistics: Posted by offchu — Sat Aug 03, 2013 2:27 am

Anti Keylogger and Clipboard monitor

2013-04-04T18:42:02-04:00

CrusherW9 wrote:Can anyone re-upload this please?

bump.

Statistics: Posted by Guest — Thu Apr 04, 2013 6:42 pm

Anti Keylogger and Clipboard monitor

2013-03-08T13:39:54-04:00

Can anyone re-upload this please?

Statistics: Posted by CrusherW9 — Fri Mar 08, 2013 12:39 pm

Anti Keylogger and Clipboard monitor

2011-10-02T17:36:53-04:00

kataki wrote:can any one upload to another site am not able to download the file
its giving me damaged file
thanks alot

https://anonfiles.com/cdn/1317591390732.7z
Have fun

Statistics: Posted by Guest — Sun Oct 02, 2011 5:36 pm

Anti Keylogger and Clipboard monitor

2011-09-28T13:57:24-04:00

can any one upload to another site am not able to download the file
its giving me damaged file
thanks alot

Statistics: Posted by kataki — Wed Sep 28, 2011 1:57 pm

Anti Keylogger and Clipboard monitor

2010-11-10T04:18:57-04:00

Hi, just a note about AKLT - your DLL doesn't do anything unless you run AKLT sandboxed. In the case of a keylogger already installed on your system (therefore it's not sandboxed), your DLL won't protect the user from this keylogger even if he/she is using a sandboxed web-browser.

Statistics: Posted by ssj100 — Wed Nov 10, 2010 3:18 am

Anti Keylogger and Clipboard monitor

2010-11-08T14:53:44-04:00

Does anyone have any further info regarding the method to capture data the Spyshelters test-tool uses? I am very curious but i suffer from a great lack of time to analyze it in depth at the moment. I have a small sense of feeling that the purpose of the tool is rather to market their product under abit of false or misleading info, but i could be wrong. This tool has been around for quite awhile and if i am not misstaken it has not gone through any greater changes since atleast 18+ months back.

The current FUD keyloggers around at current date uses rather sophisticated methods to remain so. All "logical" and oldschool documented methods are useless today. A wealthy host of security products have focused alot on defeating keylogging since the wildspree of (specifically Russian, Ukraine, Chinese, Vietnamese and Brazilian) RAT´s with logging capabilities that swept the globe like wildfire 2 years ago. Many of these products are now so touchy that they will generate false positives to such an extent that users may find them a pain in the ar*e to have installed.

Yet the spyshelter tool bypasses an ridiculous amount of these security products with ease, including some of the ones prone to generate an FP on keylogger detection as soon as u fire up notepad and type anything. Not even the behavioural based scanners or application control monitors found anything irregular about the test tool. Cant help but find this abit odd. The new breed of java based malware is extremely difficult to detect but i doubt theres any obfuscated java code being executed with their tool. It would be very interesting to test S-Shelters real effectiveness against any in the wild malware with logging. If i had time i would but im already hooked on too many similar projects. If anyone could pass me a shortcut i would be most thankful.

Zemana on the other hand im already familiar with, its a pretty good product too. Their test tool is also more believable and also easier to detect since it uses mostly known methods.

Sorry if i unintentionally hijacked the topic abit. This is a great tool for people like me who daily analyze unknown and/or suspicious activity and runtimes. Thanks for your effort and contribution. Much appreciated!

Statistics: Posted by mikkie — Mon Nov 08, 2010 1:53 pm

Re: Anti Keylogger and Clipboard monitor

2010-11-04T21:52:15-04:00

check this topic for a very nice explanation how to remove the visual studio runtime: http://www.uc-forum.com/forum/c-and-c/6 ... ntime.html

thanks, I have updated it

Statistics: Posted by rcbblgy — Thu Nov 04, 2010 9:52 pm

Re: Anti Keylogger and Clipboard monitor

2010-11-04T07:33:42-04:00

rcbblgy wrote:The dll needs vc++ 2008 sp1 to work, and the version of sandboxie it requires is v3.46 or higher (both of 32bit and 64bit)

check this topic for a very nice explanation how to remove the visual studio runtime: http://www.uc-forum.com/forum/c-and-c/6 ... ntime.html

Statistics: Posted by Mark_ — Thu Nov 04, 2010 7:33 am

Anti Keylogger and Clipboard monitor

2010-11-04T05:57:55-04:00

Yes, all my internet facing sandboxes only allow certain programs to start/run and access the internet. In fact, I have execution of everything unknown blocked by default system-wide with SRP too. If I want to play with a program or malware, I run it in a sandboxed VirtualBox.

I know , the dll is useless for most of people

but for me, I use sbie only, so it would be a little useful when I test an unknown program

And most of trusted programs will use these API which I hook in the dll, so it is also inconvenient

Statistics: Posted by rcbblgy — Thu Nov 04, 2010 5:57 am

Anti Keylogger and Clipboard monitor

2010-11-04T05:40:38-04:00

rcbblgy wrote:
EDIT: but come to think of it, simply denying execution of the program with Sandboxie's start/run restrictions is probably more effective?
so would you deny all unknown programs

Yes, all my internet facing sandboxes only allow certain programs to start/run and access the internet. In fact, I have execution of everything unknown blocked by default system-wide with SRP too. If I want to play with a program or malware, I run it in a sandboxed VirtualBox.

But regardless, it looks like you have done some good work here. I'm sure if you kept developing it, it could prove to be a very valuable addition for many people.

Statistics: Posted by ssj100 — Thu Nov 04, 2010 5:40 am

Anti Keylogger and Clipboard monitor

2010-11-04T05:34:15-04:00

ssj100 wrote:Never mind, I think I worked it out - I think you meant this:
CODE:
InjectDll=C:\SbieAKL\SbieAKL.dll
Simply putting:
CODE:
C:\SbieAKL\SbieAKL.dll

This is my mistake

EDIT: but come to think of it, simply denying execution of the program with Sandboxie's start/run restrictions is probably more effective?

so would you deny all unknown programs

Statistics: Posted by rcbblgy — Thu Nov 04, 2010 5:34 am

Anti Keylogger and Clipboard monitor

2010-11-04T05:28:25-04:00

ssj100 wrote:
rcbblgy wrote:It can't block screen-shot logger.

About the Zemana's test tool, if you use sbie v3.5 and win7 64bit, the dll could block it, otherwise, can't
Right, any reason why it can't block it on other Windows platforms? Or is that still in development?

I don't know how it gets the key stroke

I use Defensewall to test it, and Defensewall shows me that the tool uses RegisterRawInputDevices to get the key stroke, but I have hooked this function in my dll, I don't know why it can't be blocked

Statistics: Posted by rcbblgy — Thu Nov 04, 2010 5:28 am

Anti Keylogger and Clipboard monitor

2010-11-04T05:29:02-04:00

Never mind, I think I worked it out - I think you meant this:

CODE:

InjectDll=C:\SbieAKL\SbieAKL.dll

Simply putting:

CODE:

C:\SbieAKL\SbieAKL.dll

won't do anything. In your instructions above, you make it sound like that's all you need to input for 32-bit.

By the way, just tested it with the Spyshelter tool and it works against keylogging and clipboard monitoring. Nice work.

EDIT: but come to think of it, simply denying execution of the program with Sandboxie's start/run restrictions is probably more effective?

Statistics: Posted by ssj100 — Thu Nov 04, 2010 5:26 am

Anti Keylogger and Clipboard monitor

2010-11-04T05:23:54-04:00

ssj100 wrote:When I try to put
CODE:
C:\SbieAKL\SbieAKL.dll
in the "Sandboxie.ini" file (for 32-bit), I get an error.

Error ? Could you give me some more information ?

Statistics: Posted by rcbblgy — Thu Nov 04, 2010 5:23 am