Rootkit Unhooker

@fcukdat

What a surprise!

From our sources we discovered that wincom32.sys is the predecessor of Rustock.A series. Unfortunatelly we have removed it from the our zoo, because we have found nothing interesting at first look. Now everything is changing, can you help us again and give a copy of wincom32 dropper of driver itself?

Thank you very much.

 

fcukdat :

I couldn't agree more, RkU assists me in exposing what is hidden and is unrivalled in ARKs, thanks team RkU.

EP_X0FF :

Excellent, look forward to the release.

 

Mni41.sys is the PE386 rootkit, based on Rustock.B, we can said that because it contains tcp/ip stack machine unique to all rustocks and packer similar to Rustock.B but more weak. So we have another variant of rustock. But we can't call it C, because it is very weak in self-defense abilities. So we can guess that this is simple prototype of B variant. Also very interesting that it is trying to remove competitors - ntio256.sys and runtime2.sys

 

I just ran the latest version of RKUnhooker and noticed an entry in the SSDT table that I'm not sure what to make of. The entry indicates an unknown module, but it does not tell me what or where this module is. Anything to be worried about?

Thanks, Al

 

Many security software installed.

This is one of their hooks.

 

Nice Screens fcuk post more.

 

I have a problem with RootKitUnhooker

Every time I launch RKU, I get this message and after that it seems to load OK. I am just wondering why I get this message. Using version 3.7.300.506 build date 29.08.2007.

 

Hi aigle, maybe a previous version...did you uninstall and reboot.

 

yes before installing this version, I uninstalled older version and rebooted.

 

Just when I wanted to download the latest RkU for a tools CD, I found this:
RkU Home

LOL
Does anyone have a link to the latest RkU?

 

RkU3.7.300.501.zip can be downloadet here:
http://www.chip.de/downloads/c1_downloads_21701698.html

 

Delete all rkhdrv in driver directory and in services\ (registry).

LoL, the revenge of kaspersky, looooooooooooooooool,
So they seem to have humor.

Damn, I would really know which are these foes of evil fantasy aka EP and RkU Crew.
Probably this is really kaspersky or supporter of kaspersky, now the proclaimed war of EP was fought against him and his company.

 

The MD5 hash here:
MD5 1f4fde4b8003dccc7ca488d43de1f12b *RkU3.7.300.501.exe
http://www.antirootkit.com/software/RootKit-Unhooker.htm