[MindfreaK]

This is an ring3 rootkit sample made by me for testing only that injects an thread into explorer which hooks NtQueryDirectoryFile.
It will hide every file with $sys$ in the beginning of the name.
Succesfully tested with Windows 7 x64.
This is only a bin.

http://r.virscan.org/report/0b0c3036092 ... fee5b.html

~Mind

[ArkKup]

nice but its crashing explorer when go to My Computer

[MindfreaK]

What OS are you running and is it x64 ?
~Mind

[ArkKup]

What OS are you running and is it x64 ?
~Mind

and can you run 64-bit files on 32 bit system ? of course it was 64-bit
Win 7 Pro sp1

[MindfreaK]

Mhhh.
Sure i can't run x64 bins on x86 , i just talked shit ...
however , that is really interesting :/ but not good.

[secObs]

To build your rootkit did you used the mhook library ?