search

Neo23x0 / Raccine

A Simple Ransomware Vaccine
The Unlicense
942 stars 123 forks source link

Empty Event Message #44

Closed Neo23x0 closed 3 years ago

Neo23x0 commented 3 years ago

I can't figure out under which circumstances this "empty" message would be produced. Could someone of you find the location where this happens?

@JohnLaTwC @Eran-YT @Omodaka9375 ?

Screenshot 2020-10-21 164044

JohnLaTwC commented 3 years ago

It comes from the install script: eventcreate.exe /L Application /T Information /id 1 /so Raccine /d "Raccine event message"

JohnLaTwC commented 3 years ago

notice the eventId is 1. raccine.exe always logs with #define RACCINE_EVENTID_MALICIOUS_ACTIVITY 2. The only place 1 is used is in the eventcreate in the install. You could change the message in the installer to say something like "Raccine registration of event id %x"

Neo23x0 commented 3 years ago

Oh my ... yes! I'll change it to a more descriptive message. Thanks