Page 1 of 1

NoDelete for 32 and 64-bit platforms

Posted: Sun Oct 06, 2013 7:53 pm
by MiRo
As there was no 64-bit version of Buster's Anti Delete DLL available, I've created a similar plugin called NoDelete, which is available for both 32 and 64-bit platforms. I've hooked API functions, which have the delete functionality that I know of:

- DeleteFile
- CreateFile
- NtDeleteFile
- NtSetInformationFile
- SHFileOperation

Usage is the same as for other plugins (see readme.txt). Full source of the plugin is included (released under MIT license).

Download from here: https://app.box.com/NoDelete-104-zip

Posted: Mon Oct 07, 2013 10:12 am
by Domochevsky
What exactly does this do?

Posted: Mon Oct 07, 2013 10:56 am
by MiRo
It prevents programs running under Sandboxie to delete files - useful for example during installation of a program or when some malware creates temporary files, do something with them and then deletes them to hide it's activity. With this plugin the programs think they were successful when deleting files although in reality the files are left in the sandbox.

Of course this could cause a different response from the program if it checks if the file is really deleted, but that's a trade-off.

Posted: Mon Oct 07, 2013 11:05 am
by Buster
Thanks for the utility, MiRo!

Posted: Tue Oct 15, 2013 5:09 am
by baselsayeh
Thanks you MiRo