sousasamir

Well, We are trying to build an application using NT Native Api.
This application is for to delete some files used by a trojan, with most
popular AV don´t detect here and also don´t delete the main files.
The problem is:
This trojan install a .sys(Image sys Driver) with protects, all files used
by trojan to be deleted in boot process.
In other way, we cannot change any information from the registry, about this
trojan, because in Windows Environment, this trojan have a dll hooking any
change into their registry values, blocking the changes and in some cases,
rolling back any changes, we try to do, and of course, we cannot delete
those files, because, this dll, protect´s all yours owns files, including
the .sys file.
We try to insert a function native from NT, such as NTUnload, but don´t
work, I think because the driver don´t have a section with instructions to
unload the driver.
We can delete this files using NTDeleteFIle from NT Native Api, in our
executable, because the driver from trojan load before US, blocking the
function and we see a message(STATUS_SHARING_VIOLATION). So, we don´t have
any ideas to delete this files, they don´t infect any other´s files, they
only intall Yours own files to monitoring PC activity and to try get Bank
Information.
So we don´t have more any ideas how we can delete the files.

Can someone help us?

By the way, if is needed, we can send here, or in private e-mail our source code, witch we try to delete this files, who we build a smaller application
in NT Native Api.


And the trojan dll use winlogon.exe to still in memory, but when we try to
close winlogon, they use System to stay in activity. we try to stop the
service, but we allways receive a information we do not have rights to do
this action, and I beliave, they don´t have a function STOP in the main dll
from Services. All steps was testing in Windows Environment also in Safe
Mode environment don´t work.

Thanks for Your help.

maxorator

Download Rootkit Unhooker, go to the "Drivers" tab, find the evil driver, right click on it and select "Wipe File".

__________________
The duck is irrelevant to my point.

Elysia

If you know the name, try forbidding execution permission on the file.
The reboot & delete.

__________________
Using: Microsoft Windows™ 7 Professional (x64), Microsoft Visual Studio™ 2008 Team System
I dedicated my life to helping others. This is only a small sample of what they said:
"Thanks Elysia. You're a programming master! How the hell do you know every thing?"
Quoted... at least once.

sousasamir

We like to build a solution, not using 3rd party.
We cannot block execution, because they have a dll and this dll still hooking the system, blocking any attemps to delete, block, rename, averything we can do it was tested, so we begin to build a Application usingo Nt Native Api.
But, anyway, thanks for Your replies, but we need a help in NT Native Api.

Elysia

Fire against fire, huh...
Still, I don't see a reason for not using a 3rd party solution, but if that is your desire...
I wish you luck, then. Kernel programming is not my area.

__________________
Using: Microsoft Windows™ 7 Professional (x64), Microsoft Visual Studio™ 2008 Team System
I dedicated my life to helping others. This is only a small sample of what they said:
"Thanks Elysia. You're a programming master! How the hell do you know every thing?"
Quoted... at least once.

matsp

Unfortunately, unless you can find a way to "unhook" this driver [which I doubt there is an API to do that - as hooking is generally done by simply putting new values in the relevant dispatch tables], you are not going to be able to "attack" it by driver code, NT API or otherwise, since it will [as I understand it from what you've written] use various hooks to prevent itself from being removed.

The native API is still just the internal representation of, mainly, the external API function calls - it is not some sort of silver bullet that allows you to do things you can't use with the external API.

--
Mats

__________________
Compilers can produce warnings - make the compiler programmers happy: Use them!
Please don't PM me for help - and no, I don't do help over instant messengers.

sousasamir

Anyone can please, contribute with an example to use ZwWriteFile/NtWriteFile
procedure? I think maybe I can in boot proccess change the trojan file content
to another one to stop himself to work.
The file accesses should be "\\??\\C:\\PROGRA~1\\UNT\\UNT.DLL".

Thanks for all.

sousasamir

Anyone can contribute with a example to use ZwWriteFile/NtWriteFile with the file "\\??\\C:\\PROGRA~1\\UNT\\UNT.DLL" to change the file contents?

Regards.

maxorator

If you have no rights to open that file with write access, there's no difference whether you use NtWriteFile or WriteFile.

Like matsp said, NT api does not help you to bypass OS security or limitations. It may help you to implement a few things differently than WinAPI does it, but not much - it certainly doesn't help with denied access.

__________________
The duck is irrelevant to my point.

sousasamir

Do you have a example with this function using this file?

Regards.

matsp

The first hit I got in Google describes how the function works fairly well - if you do not understand how to use that information, you are most certainly not ready to write driver-level code - that is NOT beginner stuff.

--
Mats

__________________
Compilers can produce warnings - make the compiler programmers happy: Use them!
Please don't PM me for help - and no, I don't do help over instant messengers.

Salem

Are you suggesting that this file is still used when you reboot in safe mode?

Perhaps boot off a live-CD, mount the NTFS volume from there and delete the bad file. No way is it going to be in use from there.

__________________
If you dance barefoot on the broken glass of undefined behaviour, you've got to expect the occasional cut.

sousasamir

Here is the source code which I try to compile and also build my solution.
Please see at: http://sousasamir.blogspot.com/
Thanks for help.

Regards.

matsp

Have you not listened to what we are saying: Whether you use the NT Native API or otherwise, you can not bypass the security system in windows.

--
Mats

__________________
Compilers can produce warnings - make the compiler programmers happy: Use them!
Please don't PM me for help - and no, I don't do help over instant messengers.

Salem

Wow, and I thought unformatted code posted here was ugly.
That just raises the bar way out of sight. It's awful (*pukes*)

__________________
If you dance barefoot on the broken glass of undefined behaviour, you've got to expect the occasional cut.