Comments on: Skynet Rootkit – When Malware with Movie Names Attack! http://remove-malware.com/malware/rootkits/skynet-rootkit-%e2%80%93-when-malware-with-movie-names-attack/ Antivirus Reviews For 2011 / 2012, Tools and How To's Mon, 21 May 2012 21:20:00 +0000 hourly 1 http://wordpress.org/?v=3.3.2 By: Samhttp://remove-malware.com/malware/rootkits/skynet-rootkit-%e2%80%93-when-malware-with-movie-names-attack/#comment-5162 Sam Sat, 26 Dec 2009 03:28:11 +0000 http://remove-malware.com/uncategorized/skynet-rootkit-%e2%80%93-when-malware-with-movie-names-attack/#comment-5162 FYIThe session, titled "Vista: How Secure Are We?," was presented by David Tan, co-founder and chief technology officer at CHIPS Computer Consulting.By Moore's side were equally prestigious hackers Joanna Rutkowska—security researcher at COSEINC—and Jon "Johnny Cache" Ellch, author of "Hacking Exposed Wireless."Not all bugs are being detected by Vista," pointed out famed hacker H.D. Moore. "Look at how a hacker gets access to the driver: Right now I'm working on Microsoft's automated process to get Metasploit-certified. It [only] costs $500."Moore is the founder of the Metasploit Project and a core developer of the Metasploit Framework—the leading open-source exploit development platform—and is also director of security research at BreakingPoint Systems. The irony of his statement lies in the idea that Vista trusts Microsoft-certified programs—programs that can include a hacker exploit platform that walks through the front door for a mere $500 and a conveyor-belt approval process.For her part, Rutkowska granted that yes, one way to own a Vista system is by getting a rootkit certified, but if you want a compromised system, you don't even have to waste your time and money with certification—"It can be a graphics card with a stupid bug," she said. "You can't do anything about it. You can't sue the vendor for introducing a bug. You can't prove it was done intentionally."Until Microsoft or some security vendor concocts a black list for buggy drivers, Rutkowska said, Vista is potential toast. Of course, bugs can always be detected in memory, right? Except—oops!—Rutkowska FYI

The session, titled “Vista: How Secure Are We?,” was presented by David Tan, co-founder and chief technology officer at CHIPS Computer Consulting.

By Moore’s side were equally prestigious hackers Joanna Rutkowska—security researcher at COSEINC—and Jon “Johnny Cache” Ellch, author of “Hacking Exposed Wireless.”

Not all bugs are being detected by Vista,” pointed out famed hacker H.D. Moore. “Look at how a hacker gets access to the driver: Right now I’m working on Microsoft’s automated process to get Metasploit-certified. It [only] costs $500.”

Moore is the founder of the Metasploit Project and a core developer of the Metasploit Framework—the leading open-source exploit development platform—and is also director of security research at BreakingPoint Systems. The irony of his statement lies in the idea that Vista trusts Microsoft-certified programs—programs that can include a hacker exploit platform that walks through the front door for a mere $500 and a conveyor-belt approval process.

For her part, Rutkowska granted that yes, one way to own a Vista system is by getting a rootkit certified, but if you want a compromised system, you don’t even have to waste your time and money with certification—”It can be a graphics card with a stupid bug,” she said. “You can’t do anything about it. You can’t sue the vendor for introducing a bug. You can’t prove it was done intentionally.”

Until Microsoft or some security vendor concocts a black list for buggy drivers, Rutkowska said, Vista is potential toast. Of course, bugs can always be detected in memory, right? Except—oops!—Rutkowska

]]> By: Corey Bhttp://remove-malware.com/malware/rootkits/skynet-rootkit-%e2%80%93-when-malware-with-movie-names-attack/#comment-3743 Corey B Sun, 16 Aug 2009 06:11:48 +0000 http://remove-malware.com/uncategorized/skynet-rootkit-%e2%80%93-when-malware-with-movie-names-attack/#comment-3743 haha dude, iv'e had this piece of crap .dll forever and i havent though of running combofix xD thanks :) haha dude, iv’e had this piece of crap .dll forever
and i havent though of running combofix xD
thanks :)

]]> By: Dieselmanhttp://remove-malware.com/malware/rootkits/skynet-rootkit-%e2%80%93-when-malware-with-movie-names-attack/#comment-3738 Dieselman Fri, 14 Aug 2009 23:22:58 +0000 http://remove-malware.com/uncategorized/skynet-rootkit-%e2%80%93-when-malware-with-movie-names-attack/#comment-3738 Read this for why you do not need a Sandbox on 64 bit systems.http://www.sandboxie.com/index.php?WindowsVista64 Read this for why you do not need a Sandbox on 64 bit systems.

http://www.sandboxie.com/index.php?WindowsVista64

]]> By: Bohttp://remove-malware.com/malware/rootkits/skynet-rootkit-%e2%80%93-when-malware-with-movie-names-attack/#comment-3737 Bo Fri, 14 Aug 2009 22:48:47 +0000 http://remove-malware.com/uncategorized/skynet-rootkit-%e2%80%93-when-malware-with-movie-names-attack/#comment-3737 Why don't rootkits work on x64 systems? Any sources you could cite to help me understand? Why don’t rootkits work on x64 systems? Any sources you could cite to help me understand?

]]> By: roffehttp://remove-malware.com/malware/rootkits/skynet-rootkit-%e2%80%93-when-malware-with-movie-names-attack/#comment-3736 roffe Fri, 14 Aug 2009 21:25:08 +0000 http://remove-malware.com/uncategorized/skynet-rootkit-%e2%80%93-when-malware-with-movie-names-attack/#comment-3736 what do you think would have happenet if Tom would have had defenswall, would he have been infected then? Just want to know sinse im using Defenswall and Avira together. what do you think would have happenet if Tom would have had defenswall, would he have been infected then? Just want to know sinse im using Defenswall and Avira together.

]]> By: Victorhttp://remove-malware.com/malware/rootkits/skynet-rootkit-%e2%80%93-when-malware-with-movie-names-attack/#comment-3735 Victor Fri, 14 Aug 2009 18:07:47 +0000 http://remove-malware.com/uncategorized/skynet-rootkit-%e2%80%93-when-malware-with-movie-names-attack/#comment-3735 Matt,Is there any HIPS software that works well on a 64 bits OS?Thanks in advance. Matt,

Is there any HIPS software that works well on a 64 bits OS?

Thanks in advance.

]]> By: malwarekillahttp://remove-malware.com/malware/rootkits/skynet-rootkit-%e2%80%93-when-malware-with-movie-names-attack/#comment-3734 malwarekilla Fri, 14 Aug 2009 14:28:25 +0000 http://remove-malware.com/uncategorized/skynet-rootkit-%e2%80%93-when-malware-with-movie-names-attack/#comment-3734 @rescuenerds - just like the good'ole days of removing malware :) It still blows me away that malware coders haven't found a way to patch the OS to allow rootkits on x64. @rescuenerds – just like the good’ole days of removing malware :) It still blows me away that malware coders haven’t found a way to patch the OS to allow rootkits on x64.

]]> By: malwarekillahttp://remove-malware.com/malware/rootkits/skynet-rootkit-%e2%80%93-when-malware-with-movie-names-attack/#comment-3733 malwarekilla Fri, 14 Aug 2009 14:24:24 +0000 http://remove-malware.com/uncategorized/skynet-rootkit-%e2%80%93-when-malware-with-movie-names-attack/#comment-3733 @medeis - not enough to deal with douchebag's like you... @medeis – not enough to deal with douchebag’s like you…

]]> By: medeishttp://remove-malware.com/malware/rootkits/skynet-rootkit-%e2%80%93-when-malware-with-movie-names-attack/#comment-3732 medeis Fri, 14 Aug 2009 13:14:11 +0000 http://remove-malware.com/uncategorized/skynet-rootkit-%e2%80%93-when-malware-with-movie-names-attack/#comment-3732 :D. You are so funny malwarekilla. How much money kaspersky give you? :D . You are so funny malwarekilla. How much money kaspersky give you?

]]> By: rescuenerdshttp://remove-malware.com/malware/rootkits/skynet-rootkit-%e2%80%93-when-malware-with-movie-names-attack/#comment-3728 rescuenerds Fri, 14 Aug 2009 04:25:15 +0000 http://remove-malware.com/uncategorized/skynet-rootkit-%e2%80%93-when-malware-with-movie-names-attack/#comment-3728 The truth is - if you're using Vista x64 or Win 7 x64 you won't get rootkits. The architecture won't allow it. So it's pretty straightforward to remove infections. Whenever we see an infection on Vista x64, it's usually just a regular program that autostarts at boot. You can kill it's process, delete the startup entry, and delete the files/folders and - viola! - no more infection. A quick scan with an antimalware like malwarebytes or kaspersky to clean up behind you and you're done. The truth is – if you’re using Vista x64 or Win 7 x64 you won’t get rootkits. The architecture won’t allow it. So it’s pretty straightforward to remove infections. Whenever we see an infection on Vista x64, it’s usually just a regular program that autostarts at boot. You can kill it’s process, delete the startup entry, and delete the files/folders and – viola! – no more infection. A quick scan with an antimalware like malwarebytes or kaspersky to clean up behind you and you’re done.

]]>