DyKnow Stopper

[ethanarb]

My school uses Dyknow to monitor our laptop screens, but of course I dont want to be watched! I have written a small program in C# that detects the process's and ends them. I was wondering of anyone else has developed something similar, but will allow you to send any image you want. Thanks!

[centip3de]

My school uses Dyknow to monitor our laptop screens, but of course I dont want to be watched! I have written a small program in C# that detects the process's and ends them. I was wondering of anyone else has developed something similar, but will allow you to send any image you want. Thanks!

Possibly? This would require attaching to the process (kinda complex, not really), and telling it to look somewhere else (pretty damn complex). It would require extensive reverse engineering, or the source of the program. Either way, it's possible, but I doubt anyone on this forum has done that hack for that specific program.

[WallShadow]

My school also uses dyknow, so this could be very useful to me. Would you please post the source code for us?

[ethanarb]

My school also uses dyknow, so this could be very useful to me. Would you please post the source code for us?

All it does is scan for the ucpa and Monitor processes. And when they are detected, alerts you and lets you end them.
http://ethanarbuckle.com/basic.zip

[WallShadow]

Thanks a lot ethanarb! This will really come in handy!

[ethanarb]

No problem! We also have Web filtering software (FortiClient) that im going to include with that. Also adding a interface! Hopefully

[WallShadow]

Personally, the way I used to combat DyKnow in my school was a security exploit I found. The actual process that starts DyKnow on my school laptop is started by a small server side batch script which is executed at start-up. It had a simple {IF "%windir%"==""} using which i injected an EXIT command. But then the injection started screwing other stuff up so had to stop that. Though I must say, the injection made my laptop start-up about 2x faster, and cut down the list of active process three-fold (I actually compared it with a not compromised system).

So thanks, I look forward to using this.

WallShadow

[ethanarb]

Ahh. But DyKnow isnt started when the laptop boots up, but when the teacher triggers it... Or at least from what I can tell. Their are no other proccesses running that relate to dyknow when it isnt monitoring us.

[WallShadow]

I looked back at it and noticed that the DyKnow on my school laptop is very different. It is incorporated into another system called ScriptLogic which is responsible for starting it and running it. It has about 5 or 6 processes running as services under several svchost.exe, and I also don't have administrator privileges, so I can't even view a full description on the process, much less terminate it. Back to the drawing board for me.

[ethanarb]

Is it not possible to simply replace the process's in the program I made with the ones that run on your netbook? It could easily be switched.