Well, We are trying to build an application using NT Native Api.
This application is for to delete some files used by a trojan, with most
popular AV donīt detect here and also donīt delete the main files.
The problem is:
This trojan install a .sys(Image sys Driver) with protects, all files used
by trojan to be deleted in boot process.
In other way, we cannot change any information from the registry, about this
trojan, because in Windows Environment, this trojan have a dll hooking any
change into their registry values, blocking the changes and in some cases,
rolling back any changes, we try to do, and of course, we cannot delete
those files, because, this dll, protectīs all yours owns files, including
the .sys file.
We try to insert a function native from NT, such as NTUnload, but donīt
work, I think because the driver donīt have a section with instructions to
unload the driver.
We can delete this files using NTDeleteFIle from NT Native Api, in our
executable, because the driver from trojan load before US, blocking the
function and we see a message(STATUS_SHARING_VIOLATION). So, we donīt have
any ideas to delete this files, they donīt infect any otherīs files, they
only intall Yours own files to monitoring PC activity and to try get Bank
So we donīt have more any ideas how we can delete the files.
Can someone help us?
By the way, if is needed, we can send here, or in private e-mail our source code, witch we try to delete this files, who we build a smaller application
in NT Native Api.
And the trojan dll use winlogon.exe to still in memory, but when we try to
close winlogon, they use System to stay in activity. we try to stop the
service, but we allways receive a information we do not have rights to do
this action, and I beliave, they donīt have a function STOP in the main dll
from Services. All steps was testing in Windows Environment also in Safe
Mode environment donīt work.
Thanks for Your help.