View Single Post
  #2  
Old 03-29-2010, 18:13
metr0 metr0 is offline
Friend
 
Join Date: Apr 2009
Posts: 65
Rept. Given: 19
Rept. Rcvd 11 Times in 5 Posts
Thanks Given: 2
Thanks Rcvd at 2 Times in 2 Posts
metr0 Reputation: 11
These settings (for VMWare VMs) will disable some useful guest integration features but you can remove them at any time if it's not necessary to evade detection anymore.

Taken from some PDF, don't remember the author though. :/

Quote:
isolation.tools.getPtrLocation.disable ="TRUE"
isolation.tools.setPtrLocation.disable ="TRUE"
isolation.tools.setVersion.disable ="TRUE"
isolation.tools.getVersion.disable ="TRUE"
monitor_control.disable_directexec ="TRUE"
monitor_control.disable_chksimd ="TRUE"
monitor_control.disable_ntreloc ="TRUE"
monitor_control.disable_selfmod ="TRUE"
monitor_control.disable_reloc ="TRUE"
monitor_control.disable_btinout ="TRUE"
monitor_control.disable_btmemspace ="TRUE"
monitor_control.disable_btpriv ="TRUE"
monitor_control.disable_btseg ="TRUE"
Reply With Quote
The Following User Gave Reputation+1 to metr0 For This Useful Post: