Adlice forum
Software feedback => RogueKiller => Topic started by: Tigzy on October 01, 2015, 01:38:03 PM
-
Hello,
RogueKiller 11 is right behind the door :)
We need you to test it before it replaces the official version (currently 10.X.X).
It's quite critical because the only major change is about the Kernel Driver. We have re-coded all the driver from scratch, following best practices to ensure it's compatible with all operating systems (from Windows XP to Windows 10, 32 and 64 bits) and with all environments.
Why is it critical? Because a bug in the Kernel Driver means Blue Screen Of Death, which is not particularly a good thing. Yeah, that's annoying.
So we need as much tests as possible to ensure no bug is left before it's moved in production.
You will find the binaries here:
- (32 bits) http://download.adlice.com/RogueKiller/RogueKiller_beta.exe
- (64 bits) http://download.adlice.com/RogueKiller/RogueKillerX64_beta.exe
What's new?
- Rewritten all kernel code. From scratch.
- Kernel Hooks detections are now made on userland side, in common with IAT hooks detection. Easier to maintain, more efficient.
- Minified amount of code on Kernel side for safier code.
- Driver is now aware of Windows 8/8.1/10.
No big change in the flow, nor in the UI.
The most important occurs while Antirootkit scan => SSDT, Shadow SSDT, IRPs, Filters. IAT scan isn't affected.
I have a BSOD, what do I do?
- Go in C:/Windows/minidumps, find the file that has been generated (blabla.dmp).
- Send it to us: http://upload.adlice.com, or attach in comments (it's a small file).
Thanks for your help 8)
-
Hi Boss. It doesn't the matter if my PC crashes. Nothing compared to more than ten BSODs after installing Win 10 Pro: that's why it's free! My best regards, greysmouth BO IT.
-
Thanks for the opportunity to test this beta out.
I have ran it on a Windows 10 64bit VM not much installed on it. Any who it did cause an issue where the computer rebooted. I have attached the minidump file for your review.
-
Thanks! :)
-
Thanks for the opportunity to test this beta out.
I have ran it on a Windows 10 64bit VM not much installed on it. Any who it did cause an issue where the computer rebooted. I have attached the minidump file for your review.
Hey, I'm loaded the minidump but it doesn't contain much information.
Do you have an idea where it BSoD during the scan?
-
Hi
Thanks for letting us testing RogueKiller 11 beta, but unfortunately my HP Laptop with Windows 10 installed crashed with.
Attached is the minidump as requested. Renamed from dmp to txt.
-
Hi Roger,
Thanks for the feedback. :)
Regards.
-
Thanks all,
Minidumps were all on same bug: Reading kernel memory in a bad way.
A beta 3 will come soon, I'll keep you informed.
-
Hello,
beta 3 is online (same link, replaces old version)
firefoxthebomb and Roger Schwarz may I ask you to tell me if it crashes again?
Thanks a lot!
-
Hi
This time with new version 3 it worked without crash, great! The results I have uploaded to your upload directory for review.
Thank you again.
Roger
-
Thanks :)
Received your email, IAT hooks are another problem (code is common with version 10) and are fixed on in a different way.
If you can reproduce the Chrome hooks, then it'd be great if you can send a full memory dump of Chrome process (with Process Explorer / Process Hacker)
-
Hi. here the last log file running beta 3. Actually, I never had any BSODs since running RK beta in Win 10 Pro enviroment. Regards, greysmouth BO IT.
-
Hi greysmouth,
Thanks.
Could you please attach the JSON version of the log in your next reply ?
Regards.
-
Hi greysmouth,
Thanks.
Could you please attach the JSON version of the log in your next reply ?
Regards.
I'm not allowed..greysmouth BO IT.
-
Hi greysmouth,
Coud you try to rename the .json file to .txt ?
EDIT : You will now normally be able to upload .json files as well.
Regards.
-
Hi greysmouth,
Coud you try to rename the .json file to .txt ?
EDIT : You will now normally be able to upload .json files as well.
Regards.
Hello!
Here we go!
greysmouth BO IT.
-
Hi greysmouth,
Many thanks. :)
Regards.
-
Hello! More reports running beta 3 on Win 10 Pro; enjoy! Best regards, greysmouth BO IT
-
Hi greysmouth,
Thanks. :)
Regards.
-
RogueKiller 11 beta 4 is out!
-
Hi. Here attached the beta 3s last two reports under the new fresh Win 10 Build 10565. Enjoy! best regards, greysmouth BO IT.
-
Hi. Here attached is the first new beta 4 report under Win 10 Pro Build 10565 OS. Regards, greysmouth BO IT.
-
RogueKiller 11 beta 5 is uploading, will be online in a couple minutes :)
Filesystem scan will be much much faster!
greysmouth could you uncheck "Display legit hooks" ? makes our life easier when reading reports :)
-
Sure I will. Regards, greysmouth BO IT.
-
RogueKiller 11 beta 5 is uploading, will be online in a couple minutes :)
Filesystem scan will be much much faster!
greysmouth could you uncheck "Display legit hooks" ? make our like easier when reading reports :)
Hi. Done! Here are new reports running Beta 5 trough Win 10 Pro Build 10565. Regards, greysmouth BO IT
-
Perfect :)
-
Hi. One more beta 5 report. Regards, greysmouth BO IT.
-
Beta 7 is online!
Soon we will publish a blog post regarding incoming changes.
-
Beta 8 is online!
-
I'm trying RogueKiller 11.0.0.0 beta 8 on a Windows 7 64-bit Professional, Dell Latitude E6400 laptop w/ 500GB SSD & 8GB RAM.
I'm using Comodo antivirus.
At first I got an error about an unsigned driver (specifically TrueSight.sys).
I used an app called Driver Signature Enforcement Overrider to force that file to sign...upon rebooting it puts Windows into Test Mode.
Now when starting RK I get "Antirootkit driver failed to load with error [3221226536]. Please contact us for more information."
So, here I am.
Thanks,
Steve Sybesma
-
Hi Steve,
Welcome to Adlice.com Forum.
RogueKiller driver, TrueSight.sys, is digitally signed.
When using Driver Signature Enforcement Overrider, you corrupt the signature and thus, make it impossible to load.
Regards.
-
Hello. Here attached is the last RK beta 8 report.Enjoy!Regards, greysmouth BO It
-
Sorry Tigzy I got busy and just now was able to test it.
I downloaded and ran version 11 beta 8 with no issues this time around.
-
Hi firefoxthebomb,
Thanks for your review. :)
RogueKiller version 11 will hopefully be released tomorrow as stable.
Regards.
-
Hello. Here attached is the last RK beta 8 report.Enjoy!Regards, greysmouth BO It
Hello guys! Please, have a look at my attached report. It seems RK has found something weird. Thanks and regards, greysmouth BO IT.
-
Hi greysmouth,
RogueKiller 11 is now released as stable.
Could you please download latest version, redo a scan and post the report in your next reply ?
Regards.
-
Yes, Sir!
Will you excuse me, where's the RK Premium stable version's download? Thanks and regards,greysmouth BO IT.
-
Hi greysmouth,
You just have to download and install the full version (http://download.adlice.com/RogueKiller/setup.exe) and register it with your licence key. :)
Regards.
-
Anyone get this and is it positive or false positive?
RogueKiller V11.0.0.0 beta 9 (x64) [Nov 18 2015] (Free) by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Website : http://www.adlice.com/software/roguekiller/
Blog : http://www.adlice.com
Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User : Michael [Administrator]
Started from : C:\Users\Michael\Desktop\RogueKillerX64_beta.exe
Mode : Scan -- Date : 12/03/2015 16:00:01
¤¤¤ Processes : 0 ¤¤¤
¤¤¤ Registry : 0 ¤¤¤
¤¤¤ Tasks : 0 ¤¤¤
¤¤¤ Files : 0 ¤¤¤
¤¤¤ Hosts File : 0 ¤¤¤
¤¤¤ Antirootkit : 30 (Driver: Loaded) ¤¤¤
[IAT:Inl(Hook.IEAT)] (explorer.exe) ntdll!NtSetSystemInformation : Unknown @ 0x76ef01e0 (jmp 0x161140|jmp 0xfffffffffffffe19|jmp 0x19b)
[IAT:Inl(Hook.IEAT)] (explorer.exe @ kernel32.dll) ntdll!NtWriteVirtualMemory : Unknown @ 0x76ef03a0 (jmp 0x162650|jmp 0xfffffffffffffc59|jmp 0x19b)
[IAT:Inl(Hook.IEAT)] (explorer.exe @ kernel32.dll) ntdll!NtDuplicateObject : Unknown @ 0x76ef0380 (jmp 0x162610|jmp 0xfffffffffffffc79|jmp 0x19b)
[IAT:Inl(Hook.IEAT)] (explorer.exe @ kernel32.dll) ntdll!NtCreateEvent : Unknown @ 0x76ef02c0 (jmp 0x162490|jmp 0xfffffffffffffd39|jmp 0x19b)
[IAT:Inl(Hook.IEAT)] (explorer.exe @ kernel32.dll) ntdll!NtNotifyChangeKey : Unknown @ 0x76ef0480 (jmp 0x161bf0|jmp 0xfffffffffffffb79|jmp 0x19b)
[IAT:Inl(Hook.IEAT)] (explorer.exe @ kernel32.dll) ntdll!NtTerminateProcess : Unknown @ 0x76ef03d0 (jmp 0x162760|jmp 0xfffffffffffffc29|jmp 0x19b)
[IAT:Inl(Hook.IEAT)] (explorer.exe @ kernel32.dll) ntdll!NtOpenEvent : Unknown @ 0x76ef02d0 (jmp 0x162520|jmp 0xfffffffffffffd29|jmp 0x19b)
[IAT:Inl(Hook.IEAT)] (explorer.exe @ kernel32.dll) ntdll!NtAssignProcessToJobObject : Unknown @ 0x76ef0390 (jmp 0x162160|jmp 0xfffffffffffffc69|jmp 0x19b)
[IAT:Inl(Hook.IEAT)] (explorer.exe @ kernel32.dll) ntdll!NtSetContextThread : Unknown @ 0x76ef03f0 (jmp 0x161510|jmp 0xfffffffffffffc09|jmp 0x19b)
[IAT:Inl(Hook.IEAT)] (explorer.exe @ kernel32.dll) ntdll!NtCreateSection : Unknown @ 0x76ef0300 (jmp 0x1624b0|jmp 0xfffffffffffffcf9|jmp 0x19b)
[IAT:Inl(Hook.IEAT)] (explorer.exe @ kernel32.dll) ntdll!NtOpenProcess : Unknown @ 0x76ef0360 (jmp 0x162750|jmp 0xfffffffffffffc99|jmp 0x19b)
[IAT:Inl(Hook.IEAT)] (explorer.exe @ kernel32.dll) ntdll!NtNotifyChangeMultipleKeys : Unknown @ 0x76ef0490 (jmp 0x161bf0|jmp 0xfffffffffffffb69|jmp 0x19b)
[IAT:Inl(Hook.IEAT)] (explorer.exe @ kernel32.dll) ntdll!NtQueryObject : Unknown @ 0x76ef0440 (jmp 0x162990|jmp 0xfffffffffffffbb9|jmp 0x19b)
[IAT:Inl(Hook.IEAT)] (explorer.exe @ KERNELBASE.dll) ntdll!NtCreateIoCompletion : Unknown @ 0x76ef0340 (jmp 0x162020|jmp 0xfffffffffffffcb9|jmp 0x19b)
[IAT:Inl(Hook.IEAT)] (explorer.exe @ KERNELBASE.dll) ntdll!NtOpenSection : Unknown @ 0x76ef0310 (jmp 0x1625f0|jmp 0xfffffffffffffce9|jmp 0x19b)
[IAT:Inl(Hook.IEAT)] (explorer.exe @ KERNELBASE.dll) ntdll!NtCreateSemaphore : Unknown @ 0x76ef02a0 (jmp 0x161e90|jmp 0xfffffffffffffd59|jmp 0x19b)
[IAT:Inl(Hook.IEAT)] (explorer.exe @ KERNELBASE.dll) ntdll!NtOpenSemaphore : Unknown @ 0x76ef02b0 (jmp 0x161920|jmp 0xfffffffffffffd49|jmp 0x19b)
[IAT:Inl(Hook.IEAT)] (explorer.exe @ KERNELBASE.dll) ntdll!NtCreateMutant : Unknown @ 0x76ef0280 (jmp 0x161f00|jmp 0xfffffffffffffd79|jmp 0x19b)
[IAT:Inl(Hook.IEAT)] (explorer.exe @ KERNELBASE.dll) ntdll!NtOpenMutant : Unknown @ 0x76ef0290 (jmp 0x161950|jmp 0xfffffffffffffd69|jmp 0x19b)
[IAT:Inl(Hook.IEAT)] (explorer.exe @ KERNELBASE.dll) ntdll!NtCreateTimer : Unknown @ 0x76ef0320 (jmp 0x161ee0|jmp 0xfffffffffffffcd9|jmp 0x19b)
[IAT:Inl(Hook.IEAT)] (explorer.exe @ KERNELBASE.dll) ntdll!NtOpenTimer : Unknown @ 0x76ef0330 (jmp 0x161960|jmp 0xfffffffffffffcc9|jmp 0x19b)
[IAT:Inl(Hook.IEAT)] (explorer.exe @ KERNELBASE.dll) ntdll!NtCreateThreadEx : Unknown @ 0x76ef03c0 (jmp 0x161f90|jmp 0xfffffffffffffc39|jmp 0x19b)
[IAT:Inl(Hook.IEAT)] (explorer.exe @ KERNELBASE.dll) ntdll!NtTerminateThread : Unknown @ 0x76ef03e0 (jmp 0x162500|jmp 0xfffffffffffffc19|jmp 0x19b)
[IAT:Inl(Hook.IEAT)] (explorer.exe @ KERNELBASE.dll) ntdll!NtOpenThread : Unknown @ 0x76ef0370 (jmp 0x1619b0|jmp 0xfffffffffffffc89|jmp 0x19b)
[IAT:Inl(Hook.IEAT)] (explorer.exe @ KERNELBASE.dll) ntdll!NtSuspendThread : Unknown @ 0x76ef0420 (jmp 0x161290|jmp 0xfffffffffffffbd9|jmp 0x19b)
[IAT:Inl(Hook.IEAT)] (explorer.exe @ rpcrt4.dll) ntdll!NtAlpcSendWaitReceivePort : Unknown @ 0x76ef0470 (jmp 0x162270|jmp 0xfffffffffffffb89|jmp 0x19b)
[IAT:Inl(Hook.IEAT)] (explorer.exe @ rpcrt4.dll) ntdll!NtQueueApcThreadEx : Unknown @ 0x76ef0430 (jmp 0x161770|jmp 0xfffffffffffffbc9|jmp 0x19b)
[IAT:Inl(Hook.IEAT)] (explorer.exe @ gdi32.dll) ntdll!NtVdmControl : Unknown @ 0x76ef0270 (jmp 0x160ff0|jmp 0xfffffffffffffd89|jmp 0x19b)
[IAT:Inl(Hook.IEAT)] (explorer.exe @ ntmarta.dll) ntdll!NtOpenEventPair : Unknown @ 0x76ef02f0 (jmp 0x161a20|jmp 0xfffffffffffffd09|jmp 0x19b)
[IAT:Inl(Hook.IEAT)] (explorer.exe @ ws2_32.dll) ntdll!NtLoadDriver : Unknown @ 0x76ef01d0 (jmp 0x161a30|jmp 0xfffffffffffffe29|jmp 0x19b)
¤¤¤ Web browsers : 0 ¤¤¤
¤¤¤ MBR Check : ¤¤¤
+++++ PhysicalDrive0: +++++
--- User ---
[MBR] 78f4806284ed6e73f3a83b663c08c754
[BSP] 3b232571214c544ddb843532265a46f2 : HP MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 100 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 206848 | Size: 465631 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
2 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 953819136 | Size: 11207 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
User = LL1 ... OK
Error reading LL2 MBR! ([1] Incorrect function. )
+++++ PhysicalDrive1: +++++
Error reading User MBR! ([15] The device is not ready. )
Error reading LL1 MBR! NOT VALID!
Error reading LL2 MBR! ([32] The request is not supported. )
-
Hi greysmouth,
RogueKiller 11 is now released as stable.
Could you please download latest version, redo a scan and post the report in your next reply ?
Regards.
Hi Curson. Here we go..RK 11 Final version and report. Best regards, greysmouth BO IT.
-
Hi ronster1269,
These entries are false positives.
This should be fixed in RogueKiller current version.
Regards.
-
Hi greysmouth,
Your report is perfectly clean.
Thanks for taking your time to help us through the beta. :)
Regards.
-
Hello. Glad to hear you. So, now running the RK stable version. It works good. Best regards, greysmouth BO IT.
-
Hi greysmouth,
Glad to hear this.
Regards.