LMT AntiMalware (Formerly - LMT Anti Logger)

Hi!
LMT AntiMalware 5.4 released
Changelog:

• Rename the software from LMT Anti Logger to LMT AntiMalware.
• Realtime Protection: Introducing the CuteDuck engine - a in-house engine based on databases from ClamAV, which supports scanning of PE files, MS Office files, compressed files and script files.
• Basic Firewall: Will display Remote IP information when it detects an untrusted program tries to access the internet.
• Fixed: Some minor bugs.

Homepage: https://www.leminhthanh.me/antimalware/
https://www.leminhthanh.me/antimalware/assets/img/tabs-1.jpg

 

Just a suggestion, maybe u should hide the 22K downloads, people are not gonna be impressed with it, if anything they might think "that's so little".

U can also put some claims like "Obliterates virus, leaves them no chance" etc. Doesn't matter if it's true or not, all the big av makers do that anyway. Just make it sound more convincing. Casual people won't know all the tech lang, but they will sure be impressed if they read that

 

Thanks, I will update the website

 

leaves some stuff behind after uninstall I think, the main program directory was still there after reboot, used revo

 

Is this Open Source?

 

Nope. Found nothing here https://github.com/leminhthanh1998?tab=repositories

That said, you think other avs and anti-malware are open source? if they were open source anyone could fork and make their own versions. Thus the original authors wouldn't earn money from it. Kinda anyway. So yeah. None of the other anti malware or avs are really open source are they. So why would this be different.

Actually there is some open source security software - https://sourceforge.net/directory/s...ic:security-utilities/antimalware/os:windows/

But they suck lol.

If you are so desperate for one, try Windows Defender Configurator from that guy on Malware Tips. Except then u have to use Windows Defender...

 

Hi!
LMT AntiMalware 5.4.1 released
Changelog:

• CuteDuck engine: Added support for .RAR and .CHM formats.
• Fixed: Some minor bugs.

Homepage: https://www.leminhthanh.me/antimalware

 

A video about my app:
LMT AntiMalware 5.4.1: Tested vs Malware https://www.youtube.com/watch?v=nB1kl9yil60

 

Hi,
Watched the video, impressive work you've done. I have to test LMT AntiMalware one of my "testing laptops" soon.
One little suggestion, in "Fileless Malware Protection" tab, is it possible to sort those block rules alphabetically?
Are fileless malware block rules auto-blocked like in OSA/Syshardener etc similar sofwares?
Because OSA/Syshardener/HC does not work with LTSC, what method do you use to make those block rules?

Would be really nice to make your rules with arguments too in Fileless tab, for example:
[Notify, Block, Allow] Net.exe user /add
[Notify, Block, Allow] Net.exe localgroup administrators * /add
[Notify, Block, Allow] Net.exe user * \password \domain
etc...

Regards,
-sepik

 

Something like this, that i'm using now:
https://imgur.com/jK6RZoC

 

how's that, I have LSTC and OSA and syshardener and hardener

 

Hi,
Thanks for your suggestion on Fileless Protection, I will add it in some next versions.
About OSA/Syshardener, I dont know how they work. My software uses a kernel-mode driver that allows to control when a process starts, if the process with arguments matches the rules, my software will block that process from executing.
https://i.imgur.com/J0tLo2J.png

 

Is it signed kernel mode driver? I've tested a many AV's. F-secure is the worst, Dr Web self protection is the best i've tested and one other Zonealarm firewall driver.
Yes, we can think about the situation, like Dr Web and Zonealarm, how "deep" they can install a driver? Ring 0?
I tried to kill Dr Web processes, by using several ways. Process hacker cant kill it, it needs a admin installed .sys driver to do so.
Dr web won, years ago, a medal for its self protection. No pskill, no taskkill, no via powershell. The same goes for zonealarm.
Im kind sacred, how deep some AVs can made, and actually control your machine...

 

Stop being so paranoid lol. The harder it is to kill, the better from a defensive standpoint.

 

Hi!
LMT AntiMalware 5.4.2 released
Changelog:

• CuteDuck engine: Fixed a bug when LMT AntiMalware extract and scans Macro code in MS Office files.
• CuteDuck engine: Fixed a bug when scan .CHM file.
• Fileless Protection: Rules will load in alphabetical order.

Homepage: https://www.leminhthanh.me/antimalware/
https://i.imgur.com/ofJ1utx.png

 

My software can be killed by TaskManager or Process hacker
pskill, taskkill is not able to kill my software
https://i.imgur.com/qBNWXju.png

 

So why not make it so that it can't be killed?

 

Interesting, tried to kill Dr Web processes via an admin. Process hacker offered to install .sys file, and i allowed. Dr Web KATANA popped up, unknown driver attempt (.sys) to install.
Pretty good, i think.
-sepil

 

It's already on my research list and I think normal malware can't kill my software.

 

Perhaps you can test it against these two simulators:

https://www.snapfiles.com/get/antikeyloggertester.html
https://www.snapfiles.com/get/stt.html

Cool, but is the ransomware blocked by signature or by behavior blocking? And the new GUI really looks great!

 

The 1st app last updated 2009, the 2nd 2017. There may be lots of new methods for collecting data. U think u are safe until the malware hops on ur pc and extract ur mic and webcam and whatnot and ur program doesn't even beep because u used some old tests and u're convinced it's foolproof.

 

My software completely prevents those 2 tools from recording the keyboard
https://i.imgur.com/FGREjfo.png

 

Actually these methods are still being used by keyloggers, so it doesn't matter that these tools are a bit older.

Cool, but how did it block it, by blocking the keyboard hook? And what about the other tests, did it also block access to clipboard and webcam? And what about making screenshots?

 

Why dont u test urself lol

 

I don't use virtual machines anymore, and I'm not willing to install it on my real machines, that's why.