A forum for reverse engineering, OS internals and malware analysis 

Search found 216 matches

 Go to advanced search

Re: DrvMon

 by Brock ¦  Sun May 22, 2011 6:32 pm ¦  Forum: Tools/Software ¦  Topic: DrvMon ¦  Replies: 51 ¦  Views: 62723

@EP_X0FF: To reproduce the Windows component blocking issue a simple test such as this works. Try this under Windows XP x86. Open DrvMon and deny all driver loading, then right click the desktop choosing "properties" and then the "settings" tab which will show your display settings. Hopefully, vga.d...

Re: DrvMon

 by Brock ¦  Sun May 22, 2011 5:26 am ¦  Forum: Tools/Software ¦  Topic: DrvMon ¦  Replies: 51 ¦  Views: 62723

@EP_X0FF [1] I've compiled a quick PoC using a small c-written driver, it simply supports a standard DriverEntry and DriverUnload routines and prints debug messages proving it bypassed DrvMon and was loaded successfully even with DrvMon's "deny drivers loading" checked. The messages can be seen with...

Re: DrvMon

 by Brock ¦  Sat May 21, 2011 9:28 pm ¦  Forum: Tools/Software ¦  Topic: DrvMon ¦  Replies: 51 ¦  Views: 62723

@EP_X0FF & Fyyre: I wrote something identical to this months back for the same purpose which is the collection of malware drivers so I decided to leave you some constructive criticism. This DrvMon tool's "concept" is great but the actual tool itself needs to address some major issues... ;) [1] DrvMo...

Re: Another ARK

 by Brock ¦  Sat Nov 06, 2010 1:16 am ¦  Forum: Tools/Software ¦  Topic: Another ARK ¦  Replies: 14 ¦  Views: 17177

xqrzd - SoftWorkz Innovation is the activation partner, take it up with them and inquire as to why it would report disk full falsely. Check the dna.dll file, it's not copyrighted to NoVirusThanks Company.

Re: Another ARK

 by Brock ¦  Fri Nov 05, 2010 1:17 am ¦  Forum: Tools/Software ¦  Topic: Another ARK ¦  Replies: 14 ¦  Views: 17177

Revisit http://novirusthanks.org, a fully unrestricted evaluation / 24 hour trial of NoVirusThanks Anti-Rootkit is now available. After you're done downloading the trial setup and you are prompted with a product activation screen click "Request Eval Code" and enter a valid email address. After you o...

Re: Another ARK

 by Brock ¦  Thu Nov 04, 2010 12:28 pm ¦  Forum: Tools/Software ¦  Topic: Another ARK ¦  Replies: 14 ¦  Views: 17177

Amusement... How so? ;)

  • 1
  • 18
  • 19
  • 20
  • 21
  • 22