[utsav.0202]

Hi

To clean the MBR I am doing

Code: Select all

pIrp = IoBuildSynchronousFsdRequest(IRP_MJ_WRITE, pDevObj, ...);
IoCallDriver(pDevObj, pIrp);

what if a rootkit hooks the DriverStartIo routine in device's DRIVER_OBJECT structure and prevents the write operations?

Thanks and Regards
Utsav

[EP_X0FF]

Very rootkit specific. Go deeper or fool rootkit any other way. All this games ends up with making infection inactive and fix mbr utilities.