NoDelete for 32 and 64-bit platforms

Utilities designed for use with Sandboxie
Post Reply
MiRo
Posts: 2
Joined: Sun Oct 06, 2013 6:44 pm

NoDelete for 32 and 64-bit platforms

Post by MiRo » Sun Oct 06, 2013 7:53 pm

As there was no 64-bit version of Buster's Anti Delete DLL available, I've created a similar plugin called NoDelete, which is available for both 32 and 64-bit platforms. I've hooked API functions, which have the delete functionality that I know of:

- DeleteFile
- CreateFile
- NtDeleteFile
- NtSetInformationFile
- SHFileOperation

Usage is the same as for other plugins (see readme.txt). Full source of the plugin is included (released under MIT license).

Download from here: https://app.box.com/NoDelete-104-zip

Domochevsky
Posts: 125
Joined: Wed Jun 05, 2013 7:04 pm

Post by Domochevsky » Mon Oct 07, 2013 10:12 am

What exactly does this do?

MiRo
Posts: 2
Joined: Sun Oct 06, 2013 6:44 pm

Post by MiRo » Mon Oct 07, 2013 10:56 am

It prevents programs running under Sandboxie to delete files - useful for example during installation of a program or when some malware creates temporary files, do something with them and then deletes them to hide it's activity. With this plugin the programs think they were successful when deleting files although in reality the files are left in the sandbox.

Of course this could cause a different response from the program if it checks if the file is really deleted, but that's a trade-off.

Buster
Posts: 2576
Joined: Mon Aug 06, 2007 2:38 pm
Contact:

Post by Buster » Mon Oct 07, 2013 11:05 am

Thanks for the utility, MiRo!

baselsayeh
Posts: 2
Joined: Tue Aug 20, 2013 11:51 am

Post by baselsayeh » Tue Oct 15, 2013 5:09 am

Thanks you MiRo

Post Reply

Who is online

Users browsing this forum: No registered users and 1 guest