[EP_X0FF]

No stealth modification was detected with this bootkit. You can take a look on it's driver, it is very simple (PsCreateSystemThread).

[PX5]

One was hardly detected just 40 hours ago, should do trick, sometimes good xp sp2 cd is nice to have laying around. :)

I watch IE launch in process exploder and user cry because he use FF and thinks its all IEs fault, which isnt so far off I dont reckon.

Code: Select all

Unicode Strings:
---------------------------------------------------------------------------
VS_VERSION_INFO
StringFileInfo
040904b0
CompanyName
Black Internet
FileDescription
File Loader
FileVersion
1.0.0.1
InternalName
Loader
Bible
41:38 And Pharaoh said unto his servants, Can we find such a one asthis is, a man in whom the Spirit of God is?  41:39 And Pharaoh saidunto Joseph, Forasmuch as God hath shewed thee all this, there is noneso discreet and wise as thou art: 41:40 Thou shalt be over my house,and according unto thy word shall all my people be ruled: only in thethrone will I be greater than thou.
LegalCopyright
Copyright (C) 2008 Black Internet, Inc.
OriginalFilename
Loader.exe
ProductName
Loader
ProductVersion
1.0.0.1
Bible
24:34 And he said, I am Abraham's servant.
VarFileInfo
Translation

[Gabethebabe]

Black Internet is a big hit, it is all over the malware forums.

Looks like mbrcheck is more successful in removing this infection than mbr.exe or eSage bootkit remover.

[PX5]

Link to mbrcheck?

[a_d_13]

It is a beta tool that I'm developing, using a whitelist of valid MBRs so it doesn't "detect" OEM MBRs, and also allows the user to dump the MBR to a file. If you come across an unknown MBR, please send it to me.

http://ad13.geekstogo.com/MBRCheck.exe (note: down at July 20th, use one below)
http://download.bleepingcomputer.com/ro ... RCheck.exe
http://www.kernelmode.info/MBRCheck.exe

Thanks,
--AD

[Quads]

It is a beta tool that I'm developing, using a whitelist of valid MBRs so it doesn't "detect" OEM MBRs, and also allows the user to dump the MBR to a file. If you come across an unknown MBR, please send it to me.

http://ad13.geekstogo.com/MBRCheck.exe (note: down at July 20th, use one below)
http://download.bleepingcomputer.com/ro ... RCheck.exe
http://www.kernelmode.info/MBRCheck.exe

Thanks,
--AD

Just a thought, what about boot loaders like GRUB and OS Selector in detection with MBRcheck.

Quads

[EP_X0FF]

Does it matter if system is inside vm or not?

Because the unknown mbrs seem to be more likely inside vms.

Your question is delirium. Please avoid posting "Revealing of nothing coz I bored (ala Sysinternals)" content here.

Special note for SystemPro:

Another violation and your posts will be deleted without any further notice.

[PX5]

I 2nd that motion!!!! :?

[Quads]

The downloaded files on the Bootkits install are updated, see attached

MBAM, SAS and Norton don't detect them during scans

Quads

[gjf]

The downloaded files on the Bootkits install are updated, see attached

MBAM, SAS and Norton don't detect them during scans

loader.exe - Trojan-Clicker.Win32.Cycler.akmy
smss.exe - Trojan.Win32.Vilsel.akef