unhooking ntdll.dll and kernel32.dll

[x42x4b]

Hello,

i've spent 10h on "search form" and i didn't find solution.

This is anti-rootkit thing, yeah, yeah... why create new one when we have IceSword :-)...

I'm making removing tool for malware (free for all, that's why I am AutoITing It :-) ). This damn malware hooked my ntdll.dll (OpenProcess, FindFile..., Reg...). I can't lock PID and handles for malware-process. I think there are two ways to unhook it...

1) http://www.stanford.edu/~stinson/misc/curr...ating_hooks.txt

- "repair" hooked func

- take down mal-process

- repair regs, del files

2) http://***.org/

- "break" hooked func (change protected filenames, regkeys, procnames)

- take down mal-process

- repair regs, del files

I know, there are people on this forum, who are able to help. I know about anti-public politic in such a funcs in AutoIT. Well, what can I say... If someone needs gov-aprovement = PM :-).

Once more time, please help me.

Regards.

Edit: Removed URL for hooks library :-)

Edited August 31, 2006 by x42x4b

[x42x4b]

Well i tricked rootkit process...

I'm deleting his file before it starts.

Thx for help :-).

Edited August 31, 2006 by x42x4b

[Confuzzled]

I'm sorry, I'm having a blonde moment. I read your two posts twice and still can't make any sense out of what you started out to achieve, what you wanted, and whether you finally got it.

[x42x4b]

  Confuzzled said:

I'm sorry, I'm having a blonde moment. I read your two posts twice and still can't make any sense out of what you started out to achieve, what you wanted, and whether you finally got it.

malware replaces (place hook) functions in ntdll.dll which are for getting process ID. For example:

malware process name is klopok.exe :-), when any process asks ntdll.dll for pid of klopok.exe receives nothing :-).

I'd like to replace hooked function by correct one, which shows me pid of klopok.exe. Just simple and maybe stupid example but I think you should get a point (if you know what hooking funcs in win is)

[taozhong]

  x42x4b said:

1) http://www.stanford.edu/~stinson/misc/curr...ating_hooks.txt

- "repair" hooked func

- take down mal-process

- repair regs, del files

2) http://***.org/

- "break" hooked func (change protected filenames, regkeys, procnames)

- take down mal-process

- repair regs, del files

If you want to unlock the dll file, maybe you could try this

- Unlocker

- Direct download

It can unlock the process which hooked the file, then you can delete the mal-process.

Sorry for my english, I'm Taiwanese.

And if I misunderstand your problem please forgive me.

[x42x4b]

  taozhong said:

If you want to unlock the dll file, maybe you could try this

- Unlocker

- Direct download

It can unlock the process which hooked the file, then you can delete the mal-process.

Sorry for my english, I'm Taiwanese.

And if I misunderstand your problem please forgive me.

Thanks for answer but I'm not looking for a tool for unlocking dlls or apps. When process is a rootkit (in ring3) you need to unhook APIs...

This topic is still active... :-).

Regards...