[Fabian Wosar]

Looks like EP_X0FF and I had the same idea :). I updated my initial posting with string dumps of the 32bit and 64bit unpacked DLL, the content of the cfg.ini and a dump of all files from the encrypted file system. All string dumps were obtained from an infected Windows 7 x64 machine which is why the dumps may differ with EP_X0FF's ones.

[EP_X0FF]

Thanks for update :)

Looks like rootkit needs some tweaks, infected test machine is now cannot boot :)

[Fabian Wosar]

Looks like rootkit needs some tweaks, infected test machine is now cannot boot :)

That's actually anti-debugging code. If you have kernel mode debugging set up for the machine it will no longer boot after infection. Deactivate kernel mode debugging and use LiveKD for example to debug it. I tripped over the same thing.

[EP_X0FF]

Yes, it was configured to debug boot. Thanks, will "fix" that :)

[USForce]

Not sure, I tried it on both WIndows XP SP2 and Windows 7 Ultimate x86 and they both couldn't start at system bootup after first restart. And they are not running with kernel debugging

[PX5]

http://www.kernelmode.info/forum/viewto ... f=16&t=287

This is one source of dropper, I believe i posted some links, first site was 19 days ago and Im waiting on the ones who pay me to release permission to share.

First encounter was over 30 days ago which left me with a machine that couldnt boot afterwards.

File that is missing from that particular dropper is n.exn and for sure its the version everyone is after, trival to me as Im just a garbage collector. ;)

[bytejammer]

From the Archive posted by EP_X0FF it seems that the rootkit is started from the MBR ? Does that mean that simple FixMbr from the Recovery CD will work to remove it?

[USForce]

Yes, looks like the MBR is patched on both x86/x64. Looks like someone has been inspired by Whistler bootkit

[EP_X0FF]

Please somebody try to kill it with fixmbr, I'm little busy updating detector for that stuff :D

btw, IO filtering seems to be the same.

[USForce]

Please somebody try to kill it with fixmbr, I'm little busy updating detector for that stuff :D

btw, IO filtering seems to be the same.

yes, it's the same. They have been just inspired by Whistler bootkit so that they are able to load on both x86/x64 by patching MBR.