** RootKit Detection + Prevention ! **

Most comprehensive and full list of antirootkits available for x86 Windows NT

List of Anti-Rootkits

Originally posted by SpannerITWks wlording Hi, You may get more help with this if you ask on some of the other forums such as - www.wilderssecurity.com - etc. Keep checking back here though as you never know who might reply. All the best, Spanner

Edited by wlording - 14 May 2009 at 5:45pm

Originally posted by raiderfan Hello,   Tried http://rku.nm.ru/ .  It seems like a dead link.   raiderfan

Did you omit "0" in these numbers?

AFAIK exactly 5000/10000 were transfered to authors of these programs. More to say, they are now working on TrendMicro, AFAIK cardmagic working on TrendMicro Rootkit Buster antirootkit (and their AV's solutions).

It's a pity, AR completely with the source code costs so cheap.

Well, this depends on how you presented your software. Even Unreal.B sector hiding rootkit source (130 Kb) was sold for the price more than Darkspy cost by TM opinion.

I can understand why some programmers start to write malware.

Yes, usually good kernel mode bot costs ~ DS price, at least in Russia. Support? Then more. Trivial trojan downloader bot with private cryptor and builder can cost  5000$ (this is just starting price). I can imagine how many costs Rustock.

EP can you share your opinion about who is behind malware industry?

Usual merchants, they want easy money, and this sphere gives them it. Just image - 40.000.000 of active bots of just ONE botnet each day sents billions of SPAM emails, as example. Payload is great, botnet masters - they are millionaires, usual trojan coders of course no.

TTL (Time To Live) of rootkits is not very long. This depends on the level of rootkit. Usual trojans must live ~3, 5 month, they getting payload not by stealth, by their count. Kernel mode spambots should stay alive more, but ~1 year it is almost the top. Rustock.C works well all 2007 year and died in the end of it, so antivirus companies just established fact of its existence, there are almost no C variants ITW. And now image how many payload was from C variant, and even still working B.

IMO the distorted picture how it presented by AV companies (good vs bad, white vs black) don't reflex the real situation.

Exactly.
Well you know, malware community honestly don't care about antivirus companies their neverdying stupid advertising, proactive defense, other stupid terms etc. They perfectly understand one thing -> they will get payload no matter what AV side will do to prevent them. It is huge business, capable by count of money with with AV business.

And you know, AV side is honestly don't care about their users. Do you think they really want to help somebody with trojan at his/her computer? Maybe this was in 199x, but now, all, absolutely all stays on $$$.

Take a look on Kaspersky Lab official position as a perfect illustration.

"We can't cure, detect this malware? Well, then IT IS NOT EXISTS, and we will tell this everybody, no matter have them this malware on their computers or no".

"Something bypassed our proactive defense? How this can be? You are idiot!"

"Bootkit? WTF is that? What it is undetected by our super-puper Antivirus 7.0? Hahaha, this trojan is not widely spread, so Okay guys, relax, no real threat here".

"BUGS????! In our AV???!! IT IS IMPOSSIBLE, you tested not final version"

"Well you know, I'm the best exUSSR virus analysts, - said Gostev privately".

"We will prevent what we can't cure", - E.K. on last CEBIT.

This is Collection of dangerous and simple stupid Delusions.

Originally posted by EASTER Or have they simply run the gambit and theres no more interest in Rootkit Detections for basic NT Systems as before?

Hmm. Strange I never noticed this post here before. The answer is simple, dream has come to an end. Nobody don't care, $$$ everywhere, time of the enthusiasts have nearly come to an end.

DarkSpy sold to TrendMicro for 10.000 $ and can't continue.
IceSword sold to TrendMicro for 5.000 $ and very likely will not be continued.
RkTrap fall to abyss with his author.
GMER sold to Avwil Software and very likely will be not as before (maybe Gmerek at last will fix his neverending bugs then?).

list continues.

Even Rustock series is over. There are no more future E, F etc.

Whats left? Not so many. Mostly crappy sh*t as this SRD bullsh*t VMX "detector" of nothing.

This is nearly end of the saga, are you ready for jump?
This topic is also dead.