[egomoo]

RkU Version: 3.8.388.590, Type LE (SR2)
==============================================
!-->[Hidden] C:\WINDOWS\system32\drivers\paqkkmhplelf.sys
!-->[Hidden] C:\WINDOWS\system32\drivers\str.sys

But you need to do quick reset. That's the key :)

edit:
Beaten by GamingMaster. Yes, here it is - magic :)

the random driver will recreated while deleted by other antirootkit tool.

in my test,Safe Returner could remove the new Black Energy 2.1+ rootkit. (Use "DATEA0B.tmp.exe" sample)

[GamingMasteR]

the random driver will recreated while deleted by other antirootkit tool.

KDetective v1.3.1 can still defeat it :
- delete all suspicious notify routines
- restore hooked threads service table
- suspend the two suspicious system threads
- restore other splice hooks
- get the driver name from Kd+ -> Unloaded Drivers and delete it from system32\drivers folder

[spaceman]

Black list found.

rootrepeal.sys gmer.sys greypill.sys Normandy.sys gmer.exe RootRepeal.exe RkUnhooker.exe ccSvcHst.exe MsMpEng.exe msseces.exe mcagent.exe mcshield.exe mfefire.exe mfevtps.exe McSvHost.exe avp.exe egui.exe ekrn.exe spideragent.exe spidergate.exe spiderml.exe dwengine.exe cfp.exe cmdagent.exe avwebgrd.exe avmailc.exe avshadow.exe avguard.exe avfwsvc.exe avgnt.exe avgui.exe avgnsx.exe avgam.exe avgemc.exe avgfws9.exe avgwdsvc.exe AVGIDSMonitor.exe avgtray.exe avgfrw.exe avgcsrvx.exe AVGIDSAgent.exe avgrsx.exe avgchsvx.exe

edit:

two payload dlls can be extracted easily from svchost.exe for example.

This probably belongs in the Newbie Questions forum, but how do you extract dlls from a process?

[EP_X0FF]

Locate memory regions marked as r/w + executable (which are not belongs to any visible in loader list dlls) and dump them to disk.

[EP_X0FF]

Here is some fresh BlackEnergy2 to play.
Same antirootkits blacklist still in place.

[dphrag]

Hi all

I am trying to identify a data structure to enum/check for the service/filename , is there any ?

thanks

[EP_X0FF]

Hi all

I am trying to identify a data structure to enum/check for the service/filename , is there any ?

thanks

Hello,

personally I don't understand what you asking. Can you be more specific?

[dphrag]

I am using Windbg to debug some samples. I can find the servicetable hooks and the threads . I am trying to find a way by using windbg to get the service name or the driver name

[EP_X0FF]

I am using Windbg to debug some samples. I can find the servicetable hooks and the threads . I am trying to find a way by using windbg to get the service name or the driver name

Did you tried lm command? AFAIR this rootkit real driver filename can be retrieved through unloaded modules list.

[dphrag]

Thats works great , thanks !