Search:  

 
theme to black backgroundlet page decide theme
HomeFind ServiceReviewsISP NewsFAQsForumsToolsDatabaseAbout 
 
   All ForumsHot TopicsGallery






how-to block ads


 
Forums » Up and Running » Security » Security » One in Five PC's Infected With Rootkits
Share Topic:
RSS topic:
toggle:
flat / full
normal / watch
Posting:
Post a:
Post a:
Links: ·Hijack This logs? ·Panda Free Tools ·Vundo Removal
AVG7.5 Free Update Manager problems »
« Avira AntiVir Personal Classic and Premium  

fatdcuk
Premium
join:2005-02-20
England

1 edit

Re: One in Five PC's Infected With Rootkits

Sorry for the delay folks but as promised yesterday here is are the screenshots/data returned from testing some of the tools mentioned in this thread versus samples from my Zoo collection.

All RK malwares used have been harvested from in the wild infections over the last 18months and there are no proof-of-concept RK's used.These are live malware rootkits

Testbed1(loaded malware RK's)
1)Rustock B (huy32.sys)
2)Nulprot (asc3550.sys+asc3550p.sys)*
3)Haxdoor (ntio256.sys+protector.exe)
4)Srizbi (Eyvw95.sys)
5)Cutwail/Bulknet (Runtime2.sys)**

*Imports a secondary infection from the WWW that is not hidden.
**Drops other files after installation that are not hidden.

Prev-X CSI= 4/5 Is blind to Nulprot.



AVG AntiRootKit= 4/5 Is blind to Nulprot.


RKU= 4/5 Is blind to Nulprot.


GMER 1.0.14 Beta= 5/5


Nulprot VT upload today>>>
»www.virustotal.com/resultado.htm···7b697495

Testbed2(loaded malware RK's)
1)Rustock A (lzx32.sys)
2)Wincom32 (Wincom32.sys)
3)TR.inject/allinone(VideoAti0.sys+dll+exe)
4)Haxdoor.sm(Pasksa.dll+p81eskse.sys)

Prev X CSI= 3/4 Blind to Allinone


AVG AntiRootKit= 4/4


RKU =4/4


GMER 1.0.14Beta= 4/4


TR.Inject/Allinone VT report today>>>
»www.virustotal.com/resultado.htm···f327bde6
permalink · 2007-12-16 13:07:32 · Print · Reply to this

Bubba17
Less is More
Premium
join:2006-09-21

Re: One in Five PC's Infected With Rootkits

Well, based on the test results you've shared (again, thanks), I obtained GMER 1.0.13 (wasn't able to obtain your beta version) and it's not finding anything.

Notice ... I didn't announce I was clean.
permalink · 2007-12-19 12:03:01 · Reply to this

fatdcuk
Premium
join:2005-02-20
England

2 edits

Re: One in Five PC's Infected With Rootkits

Here is the GMER 1.0.14 Beta link>>>
»www2.gmer.net/beta/

I've been using the Beta version for around 4 weeks now and can safely say it is more stable for my setup and has gained some more functionability over the previous version:)
permalink · 2007-12-19 12:27:39 · Reply to this

AB
Premium
join:2006-04-04
Leesburg, VA
said by Bubba17 See Profile :

Notice ... I didn't announce I was clean.
Yes, I notice that.
Well, allow me to announce-- my machine is clean!
Yeah, baby! Yee-haaa!

I think I owe a debt of gratitude to SipSizurp's and the others' clients though, that shouldered the burden and helped to keep me in that other 75 or 80% percentile.
Whew! Close one!

Thanks, gents!
permalink · 2007-12-20 16:57:09 · Print · Reply to this

Bubba17
Less is More
Premium
join:2006-09-21

Re: One in Five PC's Infected With Rootkits

said by AB See Profile :

I think I owe a debt of gratitude to SipSizurp's and the others' clients though, that shouldered the burden and helped to keep me in that other 75 or 80% percentile.
Whew! Close one!
You found something? And, successfully eradicated it?

You used RkU? Did you try GMER?
--
HN7000s | Horizons 1 (127W) | Gateway: 1110Mhz | Dish: .98m 2 Watt | Pro+

"Fast is fine, but accuracy is everything" --Wyatt Earp
permalink · 2007-12-20 22:11:53 · Print · Reply to this

AB
Premium
join:2006-04-04
Leesburg, VA

Re: One in Five PC's Infected With Rootkits

said by Bubba17 See Profile :

said by AB See Profile :

I think I owe a debt of gratitude to SipSizurp's and the others' clients though, that shouldered the burden and helped to keep me in that other 75 or 80% percentile.
Whew! Close one!
You found something?
Nope. Not a thing.

This is why I'm in that 'other percentile'.
permalink · 2007-12-20 22:20:02 · Print · Reply to this
Forums » Up and Running » Security » SecurityAVG7.5 Free Update Manager problems »
« Avira AntiVir Personal Classic and Premium  

Monday, 14-Dec 17:40:52 Terms of Use | Privacy Policy | Hosting by www.nac.net - DSL,Hosting & Co-lo | feedback | contact
over 10 years online! © 1999-2009 dslreports.com.republican-creole
page compression OFF
Most commented news this week
· [97] Google To Sell Phone Directly To Consumers
· [63] TiVO Tries To Figure Out Where It Fits
· [50] Faster Verizon DSL Service Will Burn Your House Down
· [48] Verizon Kindly Forgives Kid's $21,917 3G Bandwidth Bill
· [42] NY Times: AT&T 3G Network Is Secretly Awesome
· [20] Sweden First To Get LTE Service
· [19] Rural Broadband User? You're Screwed
· [1] Monday Morning Links
Most people now reading
· Official Mediacom Email Discussion Thread [Mediacom]
· Ashen Verdict Rep farming guide (ICC 10) [World of Warcraft]
· personal check etiquette [General Questions]
· DKs and their obsession with Agility [World of Warcraft]
· What VOIP changes did you make in 2009? [VOIP Tech Chat]
· IMG 1.7 (IMG Updates and Discussion) [Verizon FIOS TV]
· how to get money back when ripped off [General Questions]
· Windows 7 boot manager editing questions [Microsoft Help]
· [ Classes] Druid tanking: rotation and glyphs [World of Warcraft]
· So independants will be out of business in..........? [Canadian Broadband]