Plans for New ChunkVNC

[silekonn]

supercoe,

This is a request for the upcoming ChunkVNC. A new strain of ransomware also encrypts your data. There is as yet no known solution to "Cryptolocker" and users without separate backups are forced to pay the $300. You are probably aware of this.

Someone created a program to install policies blocking executable launches in key folders. It is a very good idea as many infections now begin in those locations. "CryptoPrevent" (http://www.foolishit.com/vb6-projects/cryptoprevent/) is not a bad idea. It blocks ChunkVNC. When creating the next version, can you use employ an alternate directory?

Thank you,

Silekonn

[supercoe]

I understand the logic but think about it this way.

If everyone started using this program to block execution from those directories the virus writers would just change their execution directory as easily as I could.
Since this would just make a vicious cycle, I would prefer if anyone that decides to use this software simply works with it's whitelist.

It's interesting to see the developer state that certain software "poorly" uses %appdata%.
The reason I use the temp directory is so I have a place that InstantSupport can extract itself and run in user mode without having to ask for admin privileges.
Remote access software requires this ability in many circumstances as it's not always possible to ask for admin rights for installation.

On a side note, cryptolocker is a nasty virus! I've had a few customers learn the hard way why it's important to have a backup because of it.

[supercoe]

Oops, I forgot to give you a solution.

If you feel you still need to change the directory just open SRC\InstantSupport.au3 LINE:45

Code: Select all

Global $WorkingPath = @AppDataDir & "\InstantSupport_Temp_Files"

[heat_z0ne]

any one has any good ideal for working path ???

Global $WorkingPath = @AppDataDir & "\InstantSupport_Temp_Files"
to
Global $WorkingPath = @temp & "\InstantSupport_Temp_Files"?????????????????/

WORKS>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

Global $WorkingPath = "C:\Windows\temp\InstantSupport_Temp_Files"