Results 1 to 5 of 5

Thread: how to avoid Smartcheck detection ???

  1. #1
    moZfet
    Guest

    how to avoid Smartcheck detection ???

    any Idea?
    I promise that I have read the FAQ and tried to use the Search to answer my question.

  2. #2
    CoDe_InSiDe
    Guest
    Hi moZfet,

    i don't use SmartCheck so much so i also don't know any protection against it, but i think i've read somewhere that it searches for it's WindowClassName (with API = FindWindowA)
    Hope this helps...

    Cya...

    CoDe_InSiDe
    I promise that I have read the FAQ and tried to use the Search to answer my question.

  3. #3
    KaKTuZ / TMG
    Guest
    let me elaborate a little. indeed, the only smartcheck detection i know of, finds if it is loaded by the WindowClassName of smartcheck.exe and then sends two WM_CLOSE messages to it (two, to surpass the closing confirmation). Your task is then either to patch the windowclassname in smartcheck, OR, alternatively, find the string in the offending program and patch there.

    HTH.
    I promise that I have read the FAQ and tried to use the Search to answer my question.

  4. #4
    4oh4
    Guest
    This got me thinking about an old crackme....released maybe a year or so ago.

    I never did crack that bast$*@, but if I remember right... Filemon logged the crackme as checking the SChck registry entries which store the last opened files.

    Oh.... I always wondered why any vb shareware programmers didn't check for app.path & "\" & app.name & ".sup"

    I think that's how that'd be done in vb anyways, but it'd be too easy to check for the presence of that SChck file in the app's directory.
    I promise that I have read the FAQ and tried to use the Search to answer my question.

  5. #5
    nchanta
    Guest
    there is also a known detection for SC by searching for the 'smrtchck.tsf' file in c:\%windir%, rename this file and it will destroy that detection...

    NchantA
    I promise that I have read the FAQ and tried to use the Search to answer my question.

Similar Threads

  1. How to avoid OutputDebugString() message box?
    By GuangZor in forum OllyDbg Support Forums
    Replies: 3
    Last Post: May 15th, 2010, 21:28
  2. How to avoid AVS-detection @ packer
    By forwarder in forum Malware Analysis and Unpacking Forum
    Replies: 2
    Last Post: October 2nd, 2003, 21:37
  3. Smartcheck and Windows Me
    By h8er in forum Tools of Our Trade (TOT) Messageboard
    Replies: 0
    Last Post: December 5th, 2001, 18:29
  4. Smartcheck help
    By hodgePod in forum Tools of Our Trade (TOT) Messageboard
    Replies: 0
    Last Post: March 28th, 2001, 22:49
  5. Smartcheck
    By golk75 in forum Tools of Our Trade (TOT) Messageboard
    Replies: 8
    Last Post: January 9th, 2001, 17:34

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •