[pipedev]

Hello,
I am looking for the source code in this thread:
http://forum.sysinternals.com/killing-i ... page1.html

I am doing a college project and killing IceSword from user mode is quite difficult so I am hoping that the Icie src code can help me out. Couldn't find the
source on sysinternals so I am hoping that someone here has it.

Thanks,
Ant

[EP_X0FF]

Attached.
See this too -> http://www.kernelmode.info/forum/viewto ... ?f=15&t=24, http://www.kernelmode.info/forum/viewto ... =15&t=1485
Wrong forum, moved.

[pipedev]

EP_X0FF, thanks very much.

I have been looking for code like that for a while -- very impressive code and works quite well, will keep me busy for a while.

Don't know if I should here I ask here or make another question but do you know of an available process and/or file hiding Ring 0 rootkit that can defeat IceSword.

[EP_X0FF]

Don't know if I should here I ask here or make another question but do you know of an available process and/or file hiding Ring 0 rootkit that can defeat IceSword.

IceSword was out-dated even in 2007. Take every ZeroAccess or TDL they will completely bypass this Chinese BSOD-generator.

[pipedev]

Thanks will check them out