A forum for reverse engineering, OS internals and malware analysis 

Forum for announcements and questions about tools and software.
 #1738  by USForce
 Sun Aug 01, 2010 11:16 am
STRELiTZIA wrote: Neither one nor the other :)
The principle is quite simple, TDL3+ Cleaner copies infected driver(s) to Windows Temp folder and restore it to his
original path, this trick clear infected driver image.

But the rootkit reinfects the driver using Watchdog threads, so I used TDL3+ Cleaner Service to work at the moment when Windows shuts down.
If I'm not wrong, you are reading the "clean" copy of the driver that is showed by the rootkit itself. This won't work if the machine has been infected more times by TDL3 because of a bug in TDL3 rootkit. If the system has been infected more than a time by this rootkit, the clean image of the driver showed by the rootkit is not the real clean one, it's corrupted
 #1739  by EP_X0FF
 Sun Aug 01, 2010 12:52 pm
This is very rare behavior mostly seen in testlab. Of course restoring original files from Windows CD is always better. Curing is more complex task and it is not necessary with this type of rootkits.
 #1740  by USForce
 Sun Aug 01, 2010 1:26 pm
Actually I have been able to reproduce this really bizzarre behavior more times. This is why I'm not trusting this cleanup approach anymore. Well, I leave it as last attempt at least
 #2635  by EP_X0FF
 Sat Sep 04, 2010 1:33 am
Topic split.

posts regarding RkU moved to RkUnhooker Safe Mode.