CastleCops® Rootkit Unhooker

Need help? Click here to register for free! Absolutely zero advertisements on this site!

	Donation/Premium

	Donations. Become Premium Today!

	Security Central

	· Home · PIRT/Fried Phish · MIRT · SIRT · Deutsch · Wiki · Newsletter · O16/ActiveX · CLSID List · Contest2007 · Downloads · Feedback (send) · Forums · HijackThis · Hijacktrend · LSPs · My Downloads · O18 · O20 · O21 · O22 · O23 · O9 · Premium · Private Messages · Proxomitron · Reviews · Search · StartupList · Stories Archive · Submit News · WsIRT · Your Account · Acceptable Use Policy

Forum FAQ

Usergroups

Profile

Select FavForums

Rootkit Unhooker
Goto page 1, 2 Next

This topic is locked you cannot edit posts or make replies

All -> FavForums -> Rootkit Revelations

[del.icio.us!] [digg it!] [reddit!]

View previous topic :: View next topic

Author

Message

Cudni

Special Response Team

Joined: Dec 10, 2002
Posts: 3718
Location: Et In Arcadia ego

Posted: Mon Aug 28, 2006 2:01 pm Post subject: Rootkit Unhooker

from [Address edited by Forum Mod] Cudni _________________ Hecho en Mexico

Prince_Serendip

Site Moderator

Joined: Sep 07, 2002
Posts: 17542

Posted: Mon Aug 28, 2006 3:29 pm Post subject:

Hi Cudni, We have already tested this application, and it does not meet with our approval. Too buggy and needs more work. All the best _________________ Microsoft MVP Consumer Security 2006, 2007 & 2008

Cudni

Special Response Team

Joined: Dec 10, 2002
Posts: 3718
Location: Et In Arcadia ego

Posted: Mon Aug 28, 2006 3:34 pm Post subject:

I thought you might have tested it already Can it be useful to help reveal what is running? Cudni _________________ Hecho en Mexico

Prince_Serendip

Site Moderator

Joined: Sep 07, 2002
Posts: 17542

Posted: Mon Aug 28, 2006 4:09 pm Post subject:

Not with a crashed system. Standard Win XP. And, hard to remove as well. We could not get the darn thing to work at all. Not safe, especially for newbies. _________________ Microsoft MVP Consumer Security 2006, 2007 & 2008

negster22

Security Expert
Premium Member

Joined: Mar 10, 2004
Posts: 5394

Posted: Mon Aug 28, 2006 6:46 pm Post subject:

There are many other more stable alternatives. _________________ Negster22 - MS MVP - Consumer Security 2006-2008

Cudni

Special Response Team

Joined: Dec 10, 2002
Posts: 3718
Location: Et In Arcadia ego

Posted: Mon Aug 28, 2006 8:00 pm Post subject:

so it works on a stable system but not on a owned one? i tried it on one of my systems and nothing broke but then i didn't try to stop anything Cudni _________________ Hecho en Mexico

negster22

Security Expert
Premium Member

Joined: Mar 10, 2004
Posts: 5394

Posted: Mon Aug 28, 2006 9:10 pm Post subject:

No - the program itself can cause system instability, so other alternative anti-rootkit programs are preferable. _________________ Negster22 - MS MVP - Consumer Security 2006-2008

Cudni

Special Response Team

Joined: Dec 10, 2002
Posts: 3718
Location: Et In Arcadia ego

Posted: Mon Aug 28, 2006 9:31 pm Post subject:

Thanks We wait until the authors improve on the prog Cudni _________________ Hecho en Mexico

IP: 69.243.*.*

Guest

Posted: Wed Sep 06, 2006 2:31 pm Post subject:

I personally have used this tool since its public release and have found it to be as stable as rootkitrevealer, blacklight beta, and IceSword. The bonus is this tool can unhook and restore some hooked ntapi calls and detects hidden processes and drivers that the previously mentioned AntiRootkit tools missed. Tested on live machines running 4 different WinXP SP2 (clean and heavily infected) 2 different WinXP Home SP2 (clean and infected) 1 Win2K3 SP1 (clean) I did notice that if other (unnamed here) antirootkit kernel drivers were loaded before or after RkU, there may be crashes. However, by itself, there were no problems.

Cudni

Special Response Team

Joined: Dec 10, 2002
Posts: 3718
Location: Et In Arcadia ego

Posted: Wed Sep 06, 2006 2:44 pm Post subject:

and in case you need to remove it, totally http://www.dslreports.com/forum/remark,16793501#16797932 Cudni _________________ Hecho en Mexico

negster22

Security Expert
Premium Member

Joined: Mar 10, 2004
Posts: 5394

Posted: Wed Sep 06, 2006 5:59 pm Post subject:

Quote:

I did notice that if other (unnamed here) antirootkit kernel drivers were loaded before or after RkU, there may be crashes. However, by itself, there were no problems.

Yes, that is precisely the problem. Some anti-rootkit drivers may not unload after closing the program and then the user may be unaware that they are running two antirootkit drivers simultaneously. Also, there should be a warning about not running multiple anti-rootkit programs at the same time and what the consequences can be. If the program conflicts with other programs and serious consequences can result then ideally those program conflicts should be noted.

Some rootkit tools can be run simultaneously with no problem, so it is not that obvious, though the ideal solution is to unload any lingering rootkit drivers manualy using sc or netstop and only run one anti-rootkti program at a time. If that rule is followed, there should be no or minimal problems.

BTW, does rootkit RKU unload its driver when the program is closed? If not, what is the name of the driver so it can be done manually via the cmd line, before any other rootkit apps are run.

Quote:

The bonus is this tool can unhook and restore some hooked ntapi calls and detects hidden processes and drivers that the previously mentioned AntiRootkit tools missed.

Have you tested its driver and process detection compared to DarkSpy? If so please elaborate or test. I would be very interested in a comparison. Also, is it able to detect BadRKDemo's driver and service registry key?

_________________
Negster22 - MS MVP - Consumer Security 2006-2008

IP: 148.208.*.*

Guest

Posted: Thu Sep 07, 2006 3:19 pm Post subject:

Hello from Mexico Well i has been tested RKU in so many version and DS in the last version 1.5 i mean and i found that DS is more unstable and gave me some BSOD in some computers.... remove RKU and DS is so easy just delete the .sys file in the drivers directory BTW the both tools work fine to find hiden process and drivers can you tellme where i cant find a BadRootkit sample ?? but i can thell you that RKU will not find the registry key cuz it is not make for that purpose.... Mixel Adm

negster22

Security Expert
Premium Member

Joined: Mar 10, 2004
Posts: 5394

Posted: Thu Sep 07, 2006 4:35 pm Post subject:

Hi there in Mexico. DarkSpy unloads its driver automatically upon closing, so there is no problem there, and I have never had any crashes using it. GMER doesn't but it only conflicts with itself (a newer version) and it can be easily unloaded by issuing this command: sc stop gmer As far as deleting driver files goes, a better solution is to use SC (as above) or net stop to remove the driver, so you can still use the program. That is easy if you know the driver name. Do know what it is for RKUnhooker? I don't believe badrkdemo is available for public download. Here is a test that you can look at. It has no process and ony has a hidden driver which it hides thru DKOM: http://security.over-blog.com/article-3086414.html _________________ Negster22 - MS MVP - Consumer Security 2006-2008

Mixel

Cadet
Cadet

Joined: Sep 08, 2006
Posts: 5
Location: Mexico

Posted: Sat Sep 09, 2006 1:25 am Post subject:

negster22 wrote:

DarkSpy unloads its driver automatically upon closing, so there is no problem there, and I have never had any crashes using it.

yes i see your point but i desagree with you because both leave the drivers loaded... even more if you stop DS driver manually ( well i did it by the Driver manager) it crash the system but RKU driver doenst ........

and i found something .. that i can run both programs w/o a problem...

yes RKU and DS can run at the same time....

negster22 wrote:

Do know what it is for RKUnhooker?

file name: rkhdrv10.sys

display name: RootKit Unhooker Driver
service name: rkhdrv10

negster22 wrote:

http://security.over-blog.com/article-3086414.html

mmm i dont now .. for example Autoruns never gona shuw a Driver as a service.. because they are not the same.... Cool

i goin to search for a BadRK demo just for test ...

BTW i nerver tested Gmer but i goin to just for fun Very Happy

Saludos desde Durrancho

jjajaj that is my city.... Very Happy

negster22

Security Expert
Premium Member

Joined: Mar 10, 2004
Posts: 5394

Posted: Sat Sep 09, 2006 3:55 am Post subject:

I was able to duplicate your BSOD by unloading darkspy but my system was fully recoverable on reboot, so no harm done. I thought it unloaded because I saw this in Autoruns but not so: DarkSpy File not found: C:\WINDOWS\system32\DarkSpyKernel.sys I think the order in which the drivers are loaded can influence whether there is a system crash, and the severity of it. To install a device driver it has to be registered as a system service by creating a service key in the registry: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\<driver name> where <driver name> = service DisplayName The "ImagePath" value in this key contains the driver path (ie. C:\WINDOWS\system32\DarkSpyKernel.sys) badRKdemo hides its service key from the service control manager using DKOM, and most rootkit detectors cannot see it, but DarkSpy can see it and delete it succesfully. GMER video w/ badRKdemo: http://www.gmer.net/badrkdemo.wmv When/if you get badRKdemo, please test with ssv, too. _________________ Negster22 - MS MVP - Consumer Security 2006-2008

	All -> FavForums -> Rootkit Revelations	All times are GMT Goto page 1, 2 Next
Page 1 of 2

You can post new topics in this forum
You can reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum


	2002-2008 � Computer Cops LLC dba CastleCops®. All rights reserved. Acceptable Use Policy. Use signifies your agreement. 187ppm 0.326s (0.057s) Making cybercriminals unhappy since 2002*