Unpacking crossfire.exe
Before I could unpack crossfire.exe. But now it doesn't work any more.
I have now kernel detective, I hide KD from xtrap by using a rootkit. But kernel detective doesn't see crossfire any more.
Xtrap detects KD with out rootkit.
crossfire.exe is a hidden process. search on google fidding hidden process with kernal detective
I downloaded a tool that detects hidden proccess, but crosfire is visable.
With other tools;
Dumping process 3604 (crossfire.exe) to
c:\teste.exe...
The process (crossfire.exe) could not be dumped.
Access is denied.
C:\Documents and Settings\Owner>
Or:
Error: Unable to read process memory