REGISTER
desert eagle
main menu

home

forums
    Show me new threads!

bookmarks

view blogs

vault

you must be level 2 to upload files to your vault

downloads

you must be logged on, and level 1, to access downloads

Rootkit Collection

File Contributer Link
Hacker Def... hfn/a
HE4Hook adminn/a
BASIC CLAS... hoglundn/a
Vanquish xshadown/a
NT Rootkit hoglundn/a
FU fuzen_opn/a
WinlogonHi... JeFFOsZn/a
klister joannan/a
Patchfinde... joannan/a
MyNetwork hoglundn/a
MTDWin hoglundn/a
NTFSHider hoglundn/a
VideoCardK... hoglundn/a
VICE fuzen_opn/a
Klog Clandestin...n/a
NtIllusion Kdmn/a
AFX Rootki... TheRealAph...n/a
SInAR vulndevn/a
Shadow Wal... Clandestin...n/a
BootRootki... dereksoede...n/a
CHAZ - Nim... neocrackrn/a
Clandestin... merlvingia...n/a
FUTo petersilbe...n/a
Windows Me... alcapone66...n/a
RAIDE petersilbe...n/a
BOOT KIT vipinkumarn/a
BluePill Joanna and...n/a
DEFRAG blume1975n/a
Keyboard H... chpien/a
CheatEngin... DarkByten/a

search the site

backends
A news back-end to implement RootKit news into your website is here or more advanced version here.

An XML/RSS feed that includes both NEWS and BLOGS for RootKit is here: XML/RSS.

[Valid RSS]

Beta feed for replied posts here. feedback to admins not forums, we know about times being off...

ROOTKIT
First to set up camp.
Thursday September 02nd
Featured Article: Nostalgia: n00bk1t, an advanced ring3 rootkit in C    by jeffosz
TDL3 - Why so serious? Let's put a smile on that face ..
By: thug4lif3

Abstract:

TDL or TDSS family is a famous trojan variant for its effectiveness and active technical development. It contains couple compoments: a kernel-mode rootkit and user-mode DLLs which performs the trojan operation such as downloaders, blocking Avs, etc,. Since the rootkit acts as an “injector” and protector for the usermode bot binaries, almost all technical evolutions of this threat family focus on rootkit technology so as to evade AV scanners.

As in its name, TDL3 is 3rd generation of TDL rootkit which still takes its aims at convering stealthy existences of its malicious codes. Beside known features, this threats is exposed with a couple of impressive tricks which help it bypassing personal firewall and staying totally undetected by all AVs and ARKs at the moment. These aspects and techniques will be discussed in more detail in the sections that follow.


You can read the full detailed analysis of first TDL3 rootkit version which was pushed from several drive-by exploit websites in recent days in this PDF:

http://www.rootkit.com/vault/thug4lif3/tdl3_analysis_paper_ed.rar
password: tdl3_analysis

I hope this analysis would shed some light on darkest part of this brand new and truly effective & widespread rootkit/bot. I'm looking forward hearing feedback and discussion from you guys

Best Regards,

-Nguyen Pho Son aka thug4lif3

read comments (31) / write comment

recent comments:
TDL3 3.24 ITWDiabloNova02.Feb:13:44
more resourcegreenoaktree19.Jan:09:02
TDL3 3.23 ITWDiabloNova18.Jan:01:29
Sampleferumpost30.Dec:18:07
Sampleferumpost30.Dec:17:19
. . .

views: 20287   printer-friendly version

login:
password:

ROOTKITS, Subverting the Windows Kernel
By: Greg Hoglund and Jamie Butler

Rootkits are powerful tools to compromise computer systems without detection. Get the original and best book on the subject here.


logged users

active for last 5 minutes

registered users:80290

There are currently 0 registered users and 32 guests browsing the website.

Welcome our latest registered user: samel

recent board posts
subject author date
rootkit is systan Sep / 01
help! i ca... qxsl2000 Aug / 31
ndis simpl... b919134 Aug / 30
ZwXxx Rout... systan Aug / 25
Hiding "sc... brym Aug / 24
MSV1_0_LOG... eKKiM Aug / 22
Driver Com... tp012409 Aug / 22
network fi... b919134 Aug / 18
I can't st... al3xey Aug / 12
Windows Vi... 120decibels Aug / 11
Creating a... masterjippo Aug / 10
New to Roo... arapes Aug / 07
DPC lock. Spec0p Aug / 05
Whats up w... Ntsc Aug / 05
Hiding Tcp... _MAX_ Jul / 27

recently replied posts
subject author date
rootkit is systan Sep/01
Hiding "sc... systan Sep/01
ZwXxx Rout... systan Sep/01
ndis simpl... _MAX_ Aug/31
help! i ca... qxsl2000 Aug/31
header Vir... systan Aug/25
MSV1_0_LOG... eKKiM Aug/22
Driver Com... vrtulex Aug/22
I can't st... vrtulex Aug/22
network fi... b919134 Aug/19

recent blog entries
littlebu Aug 24, 04:27
DiabloNova Aug 16, 04:49
DiabloNova Aug 13, 16:44
DiabloNova Aug 09, 15:25
DiabloNova Aug 05, 15:52
Best Screenshots / Analog
May 14, 2010

dep.png /

click on the picture to enlarge and see description

!

read comments (0)
write comment

view archive(90) :

Analog(53) / Best Screenshots(37)

submit a picture to gallery

the most active news users
based on the number of news posts for last 30 days

user nr. of posted news

select skin



Shift to the left, shift to the right! Pop up, push down, byte, byte, byte!