1 Reply by crim

(6 replies, posted in Thoughts)

d_p wrote:

Yep, he's looking for a solution to just inject the code inside another process to intercept/hook the creation of another process.

Speaking about hiding from rk unhookers, hiding the hooks from kernel-mode from ring3 is 100% impossible due to the fact there's no way to neither forging memory nor forge false file content for a ring3 application. The only way to prevent kernel mode based antirootkit from usermode based app is to prohibit them to load their drivers ( via hooking, monitoring creating file/writing file and some other hardcore methods but it will take too long to mention them there ).

crim, do you have ICQ?

93 - 88 - 73 - 00, but i rarely have time to get online though

Go to forum: Thoughts

2 Reply by crim

(3 replies, posted in Virus eXchange)

doesnt look like cidox to me atleast not the samples i have from it

Go to forum: Virus eXchange

3 Reply by crim

(6 replies, posted in Thoughts)

inline hooking without dll is more stealth than dll injection, rootkit unhookers wont be able to know where the hooks are coming from while they will easily see where the hooks are coming from when you inject a dll and can easily delete the dll, making the ring3 hooks undetected from kernel mode rk unhookers will be hard though

Go to forum: Thoughts

4 Reply by crim

(1 replies, posted in News and announcements)

good to hear

Go to forum: News and announcements

5 Reply by crim

(7 replies, posted in Tech topics)

nonhuman wrote:

Yeah, that will for example pick USB and lock handle before some other tool (erm you dont plan on coding USB worms do you ? -.-) like infamous BFB/BFF (they had same algo, pool a-z and 8 char len random word used for filename and window name if I'm correct) or ngrbot and such crapware.

Here I used official release names not AV names so others can google etc.

Basicly idea is to pick low HEX value  ('1' == 31)

no i'm not planning to create usb worms, but usb spreading is a standard feature in all trojans i code, it still propogates good when you reach good volume in your net

Go to forum: Tech topics

6 Reply by crim

(8 replies, posted in vxheavens.com (aka vx.netlux.org))

staropramen?

Go to forum: vxheavens.com (aka vx.netlux.org)

7 Reply by crim

(4 replies, posted in Virus eXchange)

Smokey760 wrote:
crim wrote:

i think everybody has it, especially since pk released it publicly

your posts seems like a lame attempt at getting some karma and i don't flame you for that but atleast post something worth giving you karma for and not stuff thats been posted before

[Register or log in to view the URL]


quite frankly sir i realy dont care about karma points. i dont browse these forums enough to know what all is posted here
every single day of the week. nor do i care. i simply believe in "sharing". rather it be information or a program... so you stalking my posts seems like a lame attempt to flame someone who just doesnt care. so i hope it has been fun for you.
have a great night sir. smile

stalking? i clicked the topic and replied

Go to forum: Virus eXchange

8 Reply by crim

(7 replies, posted in Tech topics)

nonhuman wrote:

If you want to control when will your app receive notification ( if you decide to use WM_DEVICECHANGE approach) you have to set 3rd argument to something different then NULL and it will be alphabeticly ordered in windows list. (so if you pick right "name" for window you will be the first one to pick-up new device change)

hWnd = CreateWindowEx(NULL,"=)","abc",NULL,NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL);

so if window with named "bca" exists you will receive notification before it according to my tests.

this i didn't know, thanks

so i suppose if i choose window name "1" it will recieve even before?

Go to forum: Tech topics

9 Reply by crim

(4 replies, posted in Open space)

yeah, and lets screw everyone, make public innocent peoples passwords, what a propoganda.

lets fire up havij and LOIC everyone!!!
TARGET: PAYPAL AND LOS ZETAS

Go to forum: Open space

10 Reply by crim

(3 replies, posted in Newbie)

what about setting LD_PRELOAD? that would require a restart of the process though and would probably be the equalent of dll injection on windows so it's maybe not what you are looking for

Go to forum: Newbie

11 Reply by crim

(4 replies, posted in Virus eXchange)

i think everybody has it, especially since pk released it publicly

your posts seems like a lame attempt at getting some karma and i don't flame you for that but atleast post something worth giving you karma for and not stuff thats been posted before

[Register or log in to view the URL]

Go to forum: Virus eXchange

12 Reply by crim

(7 replies, posted in Thoughts)

that sounds like quite a 1999 method, better create a formgrabber and leave the victim unsuspecting

Go to forum: Thoughts

13 Reply by crim

(57 replies, posted in vxheavens.com (aka vx.netlux.org))

example123 wrote:

How to get Karma point for downloading attachment files?

you don't ask how to get it, contribute to the board and if someone appreacheates your shares = voila.

Go to forum: vxheavens.com (aka vx.netlux.org)

14 Reply by crim

(5 replies, posted in Virus talks)

samus wrote:

i remember also armadillo as software protection [Register or log in to view the URL]

armadillo is a packer, not source code obfuscator

Go to forum: Virus talks

15 Reply by crim

(16 replies, posted in Tech topics)

slek wrote:

Why are we always the one's "running away" hiding from the evil AV software that's trying to kill our creation? Real life viruses don't run and hide, they fight to survive and attack the good cells.. I think it's time viruses started fighting for their place and attack AV just as they attack our viruses... also known as Retro but I see very little of that being used..

maybe because trojans generally run in usermode while AV run in kernel, will have a hard time to fight back, it's like pistol vs knife, kernel trojans on the other hand dont have problems with it, that is why we see an increase in VBR/MBR rootkits

Go to forum: Tech topics

16 Reply by crim

(84 replies, posted in vxheavens.com (aka vx.netlux.org))

Orfentor wrote:

It's november now. And collection is not published yet

good job getting 5 posts in 10 minutes...

Go to forum: vxheavens.com (aka vx.netlux.org)

17 Reply by crim

(7 replies, posted in Virus talks)

Del_Armg0 wrote:

around 10 or 12 years ago i found the "pif" tech. ...

the principle was easy, a .pif is handled as an executable, my idea was to include more things in the .pif.
structure was :
______________
pif commands ( & icon)
--
bat script
--
irc script
______________

When run as a .pif, the file copied itself as a .bat, adding an autostart, and copied itself as a .ini in irc client directory
When run as a .bat, the file could made many things
When load as a .ini (in irc client), the file was an irc backdoor

As you see, such "shortcut file" can include many different things or codes inside, playing with extensions only the linked code will be executed.
You can probably find some of thoses "pif worms" on vxnetlux. I've lost almost all the things i did.


Sadly my ".pif" idea was badly copied, all the worms or trojans using it were just .exe renamed, without editing the ".pif".

while the subject is interesting it's not really relevant to the topic as the vulnerability lies in how windows handles the icon loading in .lnk files

Go to forum: Virus talks

18 Reply by crim

(1 replies, posted in Newbie)

if you know something about advertising you can always hook InternetReadFile (IE) and respective API's in other browsers and inject code to show ads when they visits popular sites like facebook, google, but it requires research on how to make your visits look legit (no affiliates for fall for having google.com/ and facebook.com/ as a referer, for example

Go to forum: Newbie

19 Reply by crim

(8 replies, posted in News and announcements)

anonymous4332 wrote:

Wow. I didn't expect people on a hacker forum to be so judgemental. Giving people negative karma for stating an opinion. Absolutely ridiculous. I now think lower of some of the people on this forum.

This is a place where people should be encouraged to discuss openly. Instead, cowards give negative karma without even posting a response because they are afraid that the negative karma will be reciprocated to them. What a joke.

Please grow up. Learn to discuss your differing opinions like adults.

herm1t: if you read this, it may be a good idea to make visible the people who give karma - whether it be negative or positive. Or, at the very least, it should be revealed to the person who is receiving the karma.

yeah ain't that a bitch, going from +2 to -4 karma for giving my view of the kiddie group known as anonymous...

Go to forum: News and announcements

20 Reply by crim

(7 replies, posted in Virus talks)

i'm not sure about this but as the bug is in explorer, my tests using a relative path like .\bla.dll always resulted in bla.dll being executed from the same drive as the system dir (as it's being executed from explorer, it does make sense) so from that it does not seem possible so i ended up making copies for each drive letter that would be relevant

Go to forum: Virus talks

21 Reply by crim

(22 replies, posted in News and announcements)

DoC32x wrote:
crim wrote:
DoC32x wrote:

lulz
sorry i attacked your girlfriend i apologize.
First of all who said i was one of them, and "Butt buddies" do you want to join in?? i know you like ass, your mom told me. lulz
we do have something in common, i am a leecher.

even if they do  do it like that, it works..

your Butt buddie is right "crim you rule".... lulz

i'm glad that you acknowledge that i rule, i apprechiate that but i don't leech - i contribute, come back when you grow some pubes, son.

"i contribute" you do, with what? not that n00b shit you post are you fucking serious.  lulz
i have pubes, your mom can confirm that.

look at my posts and you will see that i contribute, while your posts mainly (only) contains 'thx 2 uploader' anonymous nuthugging and alike.

and yeah i asked her and she does confirm it, but she also thought your penis was a womens clitoris.

now go play with dolls or visit 4chan and let real vxers be on the forum.

Go to forum: News and announcements

22 Reply by crim

(22 replies, posted in News and announcements)

DoC32x wrote:
crim wrote:
DoC32x wrote:

you are so much better lulz and what is it you do again ................................ Nothing.  lulz

what he does is not being an attention whore like you and your butt buddies

on a side note though, what do you do? all i see is a little leecher?

let me guess, expert in havij and google dorking?

lets face it, this is how it all went down:

1. some random anonymous kid googled for sql dorks, invoking inurl:.gov in google
2. found an injection in some police station or whatever
3. finds some documents about zetas
4. penis erected, makes an announcement
5. googles a bit about zetas, notices that they don't play games with little teens that talk shit online so he decides to cancel the 'mission'

this is how they do, not targeted attacks but rather mass scanning/dorking for injections and then acts like they are good at what they do, when the fact is that even a 12 year old could have done the same

skills? no. attention whores? yes.

lulz
sorry i attacked your girlfriend i apologize.
First of all who said i was one of them, and "Butt buddies" do you want to join in?? i know you like ass, your mom told me. lulz
we do have something in common, i am a leecher.

even if they do  do it like that, it works..

your Butt buddie is right "crim you rule".... lulz

i'm glad that you acknowledge that i rule, i apprechiate that but i don't leech - i contribute, come back when you grow some pubes, son.

Go to forum: News and announcements

23 Reply by crim

(22 replies, posted in News and announcements)

DoC32x wrote:
Del_Armg0 wrote:

Anonyclown sucks

you are so much better lulz and what is it you do again ................................ Nothing.  lulz

what he does is not being an attention whore like you and your butt buddies

on a side note though, what do you do? all i see is a little leecher?

let me guess, expert in havij and google dorking?

lets face it, this is how it all went down:

1. some random anonymous kid googled for sql dorks, invoking inurl:.gov in google
2. found an injection in some police station or whatever
3. finds some documents about zetas
4. penis erected, makes an announcement
5. googles a bit about zetas, notices that they don't play games with little teens that talk shit online so he decides to cancel the 'mission'

this is how they do, not targeted attacks but rather mass scanning/dorking for injections and then acts like they are good at what they do, when the fact is that even a 12 year old could have done the same

skills? no. attention whores? yes.

Go to forum: News and announcements

24 Reply by crim

(22 replies, posted in News and announcements)

lol someone is mad, no need to -karma for telling the truth but i guess this board has been infested with prepubertal anonymous clowns lately...

and the the above speaker, it's not that i support los zetas but they deserve publicly more than a bunch of attention seeking 15 year old whores (aka anonymous)

Go to forum: News and announcements

25 Reply by crim

(22 replies, posted in News and announcements)

bullshit, they got scared to death when they realized zetas don't play kiddie games like themselves

Go to forum: News and announcements