[theVK]

Hi.
I'm looking for an ideas - how to make an anti-botkill?
I don't want code, just explain me what tricks should I use.
Thx in advance.

[olaff00_]

What do u mean with anti-botkill? no av-detection, no termination, no deletion?

[.Zero]

Hi,

Anti-Botkill tends to mean preventing other 3rd party malware from destroying your malware. That being said, there are various ways to do this. I will give you few examples:

• Rootkit
  


• Custom Injection Activity
  


• Lower-Level hooks
  


• Signature Stealing
  


• Administrative Access
  


• Loading Before, malwares
  


• Persistence
  

These are basic, it does not take a genius to figure these things out. Its logical a botkiller encompasses by monitoring the following things:

• Internet Activity
  


• Injection Activity
  


• File Activity
  


• Checking File Signatures
  


• File Location (Shady Or Not)
  


• Registry Changes
  


• External Threads of process
  


• Debugging Blocks
  

These are the ways a botkiller functions, that being said it should be obvious how to hinder this detection and bypass these methods. Its not difficult.

Hope I helped

EDIT: Those who find signature stealing difficult I would strongly recommend they look through Kaspersky Anti-Virus blogs to see how to implement signature stealing as Kaspersky describes signature stealing technically. I recommend you guys search for it.

[theVK]

Big thanks .Zero, the best answer I got :)

[IRP_MJ_SCSI]

Anti-Botkill is just a combination of hook removal, low level rootkit and file / registry key checks.

[Feminist]

No bot killer (tested) has been able to kill my file infection routine- yet. It seems like the majority of them just check registry/file locations/signatures

[IRP_MJ_SCSI]

No bot killer (tested) has been able to kill my file infection routine- yet. It seems like the majority of them just check registry/file locations/signatures

Hahahhaha file infection, bro this isn't the 90s. I hope you're better at reversing than you are at coding malware.

[Feminist]

Hahahhaha file infection, bro this isn't the 90s. I hope you're better at reversing than you are at coding malware.

You'd be surprised how effective older techniques are.

[IRP_MJ_SCSI]

You'd be surprised how effective older techniques are.

And what happens when AV starts detecting your bots signature in random files and quarantines them.

[Feminist]

And what happens when AV starts detecting your bots signature in random files and quarantines them.

Two things can happen

Either the person assumes their AV is broken and deletes their AV or they delete all these files and reinstall their OS. Of course, I can't find a signature in my files. So unless the AV is storing hashes by dates there really shouldn't be a problem. By the way, that means polymorphism is being used- not that I am unable to select some byte string.

[IRP_MJ_SCSI]

Two things can happen

Either the person assumes their AV is broken and deletes their AV or they delete all these files and reinstall their OS. Of course, I can't find a signature in my files. So unless the AV is storing hashes by dates there really shouldn't be a problem. By the way, that means polymorphism is being used- not that I am unable to select some byte string.

lol, like you could write a decent polymorphic engine xD

[Feminist]

lol, like you could write a decent polymorphic engine xD

If you say so. You can keep deluding yourself with the whole "nobody is better than me" attitude if you wish.

[IRP_MJ_SCSI]

If you say so. You can keep deluding yourself with the whole "nobody is better than me" attitude if you wish.

I never said nobody is better than me, but you're certainly not. loool

[Feminist]

I never said nobody is better than me, but you're certainly not. loool

It sure sounds like you are saying that, based on how you interact with other people.