LMT AntiMalware (Formerly - LMT Anti Logger)

I don't think my sandbox is comparable to Sandboxie. I developed it only took 3 hours, so it needs to be improved more.

 

Norwegian Bokmål: A-Z + ÆØÅ
KLID: 00000414 (nb)
Localename: nb-NO
Uppercase: Æ Ø Å
Lowercase: æ ø å

Æ: U+00c6 Latin Capital Letter Ae (Ash) * - Alt-code 0198
Ø: U+00d8 Latin Capital Letter O With Stroke - Alt-code 0216
Å: U+00c5 Latin Capital Letter A With Ring Above - Alt-code 0197

æ: U+00e6 Latin Small Letter Ae (Ash) * - Alt-code 0230
ø: U+00f8 Latin Small Letter O With Stroke - Alt-code 0248
å: U+00e5 Latin Small Letter A With Ring Above - Alt-code 0229

The software crashes the moment it's launched. No windows shown. Let me know if you need more information and I'll provide it.
Thank you!

 

It's rather based on restrictions than isolation...something like like GeSWall feature...right?
https://www.wilderssecurity.com/threads/geswall-vs-sandboxie.260472/#post-1589960

 

Yes

 

Hi!
LMT Anti Logger 4.6.1 released
Changelog:

• Fixed a bug in the Anti Keylogger feature that caused an application crash.

Homepage: https://leminhthanh.me/antilogger/
-----------------
@FibonacciMozart, can you try this version?

 

It works! Anti-screenlogger function works perfectly as well. Good looking out

I'm not sure if it's a bug or if it's supposed to be this way but these characters do not work: . , / ! (dot, comma, slash, exclamation mark).
It does say that some special keys may not work but dot and comma is much needed. Tested with ENG keyboard layout and same result.

Nonetheless, it works. Good developer - thanks LeMinhThanh

 

Those keys worked fine on my test, but I think I figured out why they didn't work in your case. I will release version 4.6.2 to fix that.

 

Hi!
LMT Anti Logger 4.6.2 released
Changelog:

• Fixed a bug in the Anti Keylogger feature.
• Temporarily disable the Registry Guard feature because it is not effective.

Home page: https://leminhthanh.me/antilogger/
-----------
@FibonacciMozart can you try this version?

 

Hi!
LMT Anti Logger 4.6.3 released
Changelog:

• Added YARA Rules Editor. Now you can edit YARA rules from the GUI.
• The app now will show details about the YARA rule when a matching process is detected.
• Now you can run a suspicious application in Sandbox when detected by Heuristic or YARA rule.

Homepage: https://leminhthanh.me/antilogger

 

It seems features keep on getting added without the high memory usage being addressed... last time I looked process explorer reported +/- 270 private bytes being used. Maybe break it up into smaller applications, or is that feasible?

 

OK I see, but I wondered if it would also run processes with for example low or untrusted rights.

I remember GeWall, it offered good protection but I hated it. Somehow I feel more secure if virtualization is used.

 

That is the cost of obfuscation and I think +200MB RAM usage shouldn't be a problem in 2020.

 

The "cost of obfuscation" is not known to me... explain?

 

Also... not everyone has money to update hardware

 

What hardware are you using ? I am sure you could still find some newer modern AMD CPU based PC-s, with more cores and enough RAM..

 

I protect the source code of the software by confusing it, this can cause the software use more than 200MB RAM.

 

Hi!
LMT Anti Logger 4.7 released
Changelog:

• Added Anti Exploit for Browsers. This feature automatically blocks all child processes of web app parent processes.

Homepage: https://leminhthanh.me/antilogger/

 

Hi!
LMT Anti Logger 4.7.1 released
Changelog:

• Added Malware Scanner. Helps find and detect malware on your computer. The database is still under development, so the scan result will not good.

Homepage: https://leminhthanh.me/antilogger/
-----------------------
I added this feature just because I wanted to test if my server can handle a database with over 1 million rows.
At the time of writing these lines, I have imported 1377411 hashes from ClamAV's database into my database.
And in my test, it only detected 11/92 ransomware samples
https://i.imgur.com/cO5Hp44.png

 

Cool, but do you simply block ALL child processes? What if they need to launch a legitimate tool? Now that I think of it, nowadays browsers are multi-process, so did you make a whitelist, so that for example chrome.exe can launch chrome.exe?

 

i like ur software but..
adw cleaner finds some suspected files when i install ur software....
and is the antiscreenlogger now working ?

 

If chrome.exe launches chrome.exe, my app will not block it.

 

Can you post the sreenshot when adw cleaner finds some suspected files?
And the anti screenlogger still not work on Win 10 2004

 

each time i install LMT and then i check with ADW cleaner i get this and i delete it and after deleting LMT runs perfectly.

***** [ Registry ] *****

Deleted HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe
Deleted HKLM\Software\Wow6432Node\\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe

 

Antiscreenlogger works on W10 Win 64 1909. It works with multiple monitors also.

Thanks, you fixed the issue with dot, comma etc but '/' (forward slash) does not work. Backslash works.
Also, with the antikeylogger: if you type fast the delay gets pretty annoying. It can't keep up. It's like typing on Win98 with slow HW. Maybe this can be improved in the future?
Other than that it works great. No performance issues.

 

But did you exclude them? Because you said that it will block ALL child processes.

That's weird! Why would LMT modify this registry key?