nimm doch das nucleawinterr rootkit.. da brauchste kein tut für, erklärt sich von ganz allein.
Nuclear Rootkit 1.0
Introduction
This rootkit perfom a user level Hook on Certain APIs , allowing you to Hide or modify some items on the NT Based OS (NT/2000/Xp/2k3) .
Features
*Process Hiding
*Files / Dirs Hiding
*Registry keys Hiding
*Connection in Netstat hiding
*Modules (dll) Hiding
*Application Block
*Connection Block
*Persistence (Undeletable , Unrenamable , Unmovable)
Usage
* Add the Files Names / Reg keys / Ports ect ... to the list in the Section you want and Click the Create Button.
* To Check if The Rootkit is Already Running on you , Click Check Result .
*You Can Save / load your Settings any time using Load Script / Save Script in the Context menu , I included a sample script called
samplescript.nsf you can load it directly in the rootkit editor .
Benefits / Hints
Process
Hide Process(s) totally from the task manager.
Hint : Add Exact processes name for example (notepad.exe)
File/Dir
Hide Directory(s) or File(s) from windows explorer.
Hint : Add Exact File or Directory Name for example (notepad.exe – Ali)
Registry
Hide Registry Value(s) from the registry editor and MSConfig.
Hint : Add Exact Registry Strings for example (hello)
Ports
Hide connections on / though any port(s) in netstat.
Hint : Add Ports and Protocols , for example (80 – http – smtp – 25 ect…)
Modules
Hide Modules in specific processes from any module explorer.
Hint : Add the Process Name then the module name , please note that
Some firewalls might block network access to the process u
Have chosen to hide a module in it .
Application Block
Block explorer from executing a list of applications
Hint : Add Exact file name for example (file.exe)
Connection Block
Block applications from connecting to anything
Hint : Add Exact processes name for example (iexplore.exe)
Persistence
Protect Directory(s) or File(s) from being deleted / renamed / moved
Hint : Add Exact processes name for example (notepad.exe , Directory ,ect…)
Undetected
Nuclear Rootkit Undetected Copies are available for Sale , Contact me if you are Interested .
Credits
afxcodehook - aphex
peb - erazer
Contact Details
Email :
[email protected]Site : http://www.nuclearwinter.us
-=[Nuclear Winter Crew 2005]=-
Edit: wenn du es stealthen willst musst es erstmal wieder entpacken (upx). danach kannste mit crypter, packer, whatever drüber und das ding ud machen. und mach dir ein virtuelles sys, am besten gleich ein image davon, dann kannst testen soviel du willst.
