[EP_X0FF]

Looks strange :?
Cr4sh can you provide sample you used please? In my test RootRepeal2 detects TDL3.

[Cr4sh]

STEALTH CODE
-------------------
System 0x816f78b4 - Hidden Code
System 0x816f7ac8 - Hidden Code [Driver: , IRP: IRP_MJ_CLEANUP
...
System 0x816f7ac8 - Hidden Code [Driver: , IRP: IRP_MJ_WRITE]
System 0xf9af4657 - Modified Entry Point [Driver: TermDD, Other Val: 0xf9af5214]

Looks to me like it detects tdl3 - TermDD.sys

Yes, but I mean detection of infected driver (which contents are replacing by miniport hooks), during files scan.

Looks strange :?
Cr4sh can you provide sample you used please? In my test RootRepeal2 detects TDL3.

Shure (only Dr.Web and remover from Norman detects this build).

[ConanTheLibrarian]

I can confirm and back up cr4sh on this.

RR sees plenty of hidden code but nothing points to a driver or modified entry point.

%temp%\2.tmp is mentioned as a hidden module as well as a mysterious empty "hidden code". All others are IRP hidden codes.

[EP_X0FF]

Yes, I can confirm. Infected driver is atapi.sys, no proper detection.

[InsaneKaos]

RR will show the infected one. But only after a reboot.

[nullptr]

RR will show the infected one. But only after a reboot.

I can confirm this, prior to reboot:

STEALTH CODE
-------------------
System 0x82ee28b4 - Hidden Code
System 0x82ee2ac8 - Hidden Code [Driver: , IRP: IRP_MJ_CLEANUP]
etc

Also with occasional reference to *.tmp

After reboot:

STEALTH CODE
-------------------
System 0x833028b4 - Hidden Code
System 0x83302ac8 - Hidden Code [Driver: , IRP: IRP_MJ_CLEANUP]
etc
System 0x83302ac8 - Hidden Code [Driver: , IRP: IRP_MJ_WRITE]
System 0xf762b8ad - Modified Entry Point [Driver: Disk, Other Val: 0xf762c514]

CALLBACKS
-------------------
LoadImage 0x8330496e <unknown>

In this case infected driver is Disk.sys, but no mention of miniport port disk driver being associated with irp redirection.

[EP_X0FF]

In case of detection after reboot - this is not RootRepeal2 bug. I think if you still interested you all should PM a_d_13.

[nullptr]

I'm certainly not suggesting that it's a bug. :) No need to waste a_d_13's time.

[Maniac]

Crash report:

ROOTREPEAL CRASH REPORT
-------------------------
Windows Version: Windows 7 SP0
Exception Code: 0xc0000005
Exception Address: 0x012c0c9e
Attempt to write to address: 0x034e3000

ROOTREPEAL CRASH REPORT
-------------------------
Windows Version: Windows XP SP2
Exception Code: 0xc0000005
Exception Address: 0x7c9108f3
Attempt to write to address: 0x02029470

Another one here:
http://forums.malwarebytes.org/index.ph ... t&p=249041

RootRepeal crashes, with a message that says:
"Windows Version: Windows
Exception code 0xc0000005"

Ant this one:
http://forums.malwarebytes.org/index.ph ... t&p=255401

ROOTREPEAL CRASH REPORT
-------------------------
Windows Version: Windows XP SP3
Exception Code: 0xc0000005
Exception Address: 0x00417e70
Attempt to read from address: 0x00000000

What you need?

[coconut]

xp sp3 32bit, ms forefront 1.5.1981.0, kerio firewall 2.1.5

crashed when scanning SSDT entries

**

ROOTREPEAL CRASH REPORT
-------------------------
Windows Version: Windows XP SP3
Exception Code: 0xc0000005
Exception Address: 0x00417e70
Attempt to read from address: 0x00000000