[B-boy/StyLe/]

Hello all,

Does anyone have an information if this old rootkit is already detected or have a sample ?

I can't find any information about it since 2008...

http://helios.miel-labs.com/2008/10/metrarootkit.html

http://forum.sysinternals.com/topic9630 ... html#82941

http://www.onlysoft.it/Video/GDRootkit_2_0.wmv

All the best,
G.

[EP_X0FF]

Hi,

Since no information was provided (even privately) and regarding to muel-labs blog entry (PspCidTable, SwapContext bypassing) this rootkit can be easily detected.
But since we don't have sources or sample more likely it was just a non workable proof-of-concept or author (disappeared also) BS ;)

Regards.

[Alex]

Probably no-one have samples of these rootkits, but as my tests show, it is easy to bypass all public detectors. I believe thet private detectors use some additional detection method, so they probably could detect these rootkits and my testing samples. Author of these rootkits claimed that own thread scheduler is the best solution for process/thread hiding. He was right, but it is possible to hide processes/threads even without any advanced thread scheduler and this was done in Invisible Process 1.0.

Alex

[EP_X0FF]

Author of these rootkits claimed that own thread schedule

I believe it worked only on authors machines :mrgreen:

[B-boy/StyLe/]

Thank you all for yours replies. :)

Regards,
G.

[EP_X0FF]

Topic moved to General Discussion because it's malware unrelated