rootkit.com

main menu

home

forums
Show me new threads!

bookmarks

post article

view blogs

vault

you must be level 2 to upload files to your vault

downloads

you must be logged to access downloads

Rootkit Collection

File	Contributer	Link
Hacker Def...	hf	n/a
HE4Hook	admin	n/a
BASIC CLAS...	hoglund	n/a
Vanquish	xshadow	n/a
NT Rootkit	hoglund	n/a
FU	fuzen_op	n/a
WinlogonHi...	JeFFOsZ	n/a
klister	joanna	n/a
Patchfinde...	joanna	n/a
MyNetwork	hoglund	n/a
MTDWin	hoglund	n/a
NTFSHider	hoglund	n/a
VideoCardK...	hoglund	n/a
VICE	fuzen_op	n/a
Klog	Clandestin...	n/a
NtIllusion	Kdm	n/a
AFX Rootki...	TheRealAph...	n/a
SInAR	vulndev	n/a
Shadow Wal...	Clandestin...	n/a
BootRootki...	dereksoede...	n/a
CHAZ - Nim...	neocrackr	n/a
Clandestin...	merlvingia...	n/a
FUTo	petersilbe...	n/a
Windows Me...	alcapone66...	n/a
RAIDE	petersilbe...	n/a
BOOT KIT	vipinkumar	n/a
BluePill	Joanna and...	n/a
DEFRAG	blume1975	n/a
Keyboard H...	chpie	n/a
CheatEngin...	DarkByte	n/a

backends
A news back-end to implement RootKit news into your website is here or more advanced version here.

An XML/RSS feed that includes both NEWS and BLOGS for RootKit is here: XML/RSS.

Beta feed for replied posts here. feedback to admins not forums, we know about times being off...

ROOTKIT
Will RE for Cash

Saturday July 31st

Featured Article: Nostalgia: n00bk1t, an advanced ring3 rootkit in C by jeffosz

(As Seen On TechTV) VICE - Catch the hookers!

By: fuzen_op

VICE is a new tool to detect user mode Win32 API hooks and kernel mode hooks. It comes complete with a nice user interface thanks to Greg Hoglund. The user mode detection can take some time, but be patient. It is worth it. Also, if you want to add more checks to the kernel, just extend driver.ini.

VICE You will need the Microsoft .NET Framework to run because of the GUI.
.NET Framework

Warning
This software is brand new and is known to throw some false postives, especially with the user-mode rootkit detection. If you scan your system and it informs you that you have a rootkit infection, you may not have a rootkit infection, but instead a false positive - so relax - it would be helpful if you post the results that you obtain so the authors can improve the detection algorithm. Most important is the address of the hook, and the name of the DLL that is performing the hook.

Known User API False Positives
shim.dll
setupapi.dll
comctl32.dll (Usually seen with Outlook running)
sfc_os.dll and sfc.dll (Used for Microsoft Windows File Protection)
adsldpc.dll

Known Kernel False Positives
1. IRP's hooked by a file in the sytem root directory named ntoskrnl.exe
2. Functions hooked by vsdataant.sys (Only if you have Zone Alarm)

Happy Hunting!
Jamie Butler

VICE has been tested on 2000/XP, but it should run on NT and 2003.

Greetz to: Greg; lonerancher, fin, and the eEye crew; and gcla at enterasys.

read comments (136) / write comment

recent comments:
another false positives kr0m 06.Jun:07:47
suggestion linuxbox 28.May:20:39
kernal mode rootkits mikemcc 12.May:02:17
Should I Panic Art-Nocturne 07.May:02:54
Me Three kaos_engr 04.May:15:01
. . .

printer-friendly version

ROOTKITS, Subverting the Windows Kernel
By: Greg Hoglund and Jamie Butler

Rootkits are powerful tools to compromise computer systems without detection. Get the original and best book on the subject here.

logged users

active for last 5 minutes

registered users:79912

There are currently 0 registered users and 20 guests browsing the website.

Welcome our latest registered user: Pris

recent board posts
subject author date
Hiding Tcp... _MAX_ Jul / 27
unload dri... dubteam2000 Jul / 26
APC Delive... aall87 Jul / 21
x64 SSDT h... lolwurst Jul / 21
password r... markedu9 Jul / 19
How to hid... Hack4freedom Jul / 15
UNC PATH A... pain_abator Jul / 15
CALL in na... _MAX_ Jul / 13
Conflict b... _MAX_ Jul / 08
Making dev... blackd0t Jul / 06
Hide proce... l0ngshot Jul / 01
Process Ha... krzys Jul / 01
Rooting VP... simplicityx Jun / 24
Rootkits: ... chimai Jun / 24
NDIS Inter... lclee_vx Jun / 17

recently replied posts
subject author date
x64 SSDT h... vrtulex Jul/27
unload dri... EreTIk Jul/27
Hiding Tcp... _MAX_ Jul/27
BIOS Rootk... rossettoecioccolato Jul/25
about this... DiabloNova Jul/22
APC Delive... aall87 Jul/21
password r... markedu9 Jul/19
UNC PATH A... pain_abator Jul/19
How to hid... vrtulex Jul/16
CALL in na... _MAX_ Jul/16
Hide proce... vrtulex Jul/10
Conflict b... _MAX_ Jul/08
Making dev... blackd0t Jul/07

recent blog entries
DiabloNova Jul 31, 12:06
ghost1369 May 09, 04:30
DiabloNova May 08, 15:33
_4epen May 04, 15:42
DiabloNova May 02, 03:59

Best Screenshots / Analog
May 14, 2010
dep.png /
click on the picture to enlarge and see description
!
read comments (0)
write comment
view archive(90) :
Analog(53) / Best Screenshots(37)
submit a picture to gallery

the most active news users
based on the number of news posts for last 30 days

user nr. of posted news

select skin

As a computer, I find your faith in technology amusing.