[Buster_BSA]

Hi.

Here it´s SafeSys. This one is able to bypass Deep Freeze protection.

[EP_X0FF]

Unpacked sample and extracted driver are attached.

{4D36E967-E325-11CE-BFC1-08002BE10318} ntsd -d Debugger SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ :\ -SSDT " ",MyDLLEntry -SSDT Spooler DogKiller \\.\PciFtDisk DisableTaskMgr Software\Microsoft\Windows\CurrentVersion\Policies\System DisableWindowsUpdateAccess CheckedValue SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL VIP- VIP-1.0 Mac= &Os= &Ver= &Key= Send OK! Start Page SoftWare\Microsoft\Internet Explorer\Main -Service SYSTEM\CurrentControlSet\Services\Spooler ImagePath SOFTWARE\Microsoft\Windows\CurrentVersion\Run

d:\winddk\3790~1.183\pass\Driver\i386\Killer.pdb
ZwReadFile failed:%08x...
ObReXXX failed:%08x...
gNtosBase is: %08x..%08x..%08x..
IoGetBase failed:%08x...
pDevObj is: %08x...
gNtosBase is: %08x..%08x..%08x..
gNtosBase is: %08x..%08x..%08x..
MyIofCallDriver failed:%08x...
xxx Res is: %08x...
ExtentCount failed:%08x...
StartingVcn failed:%08x...
StartingVcn failed:%08x...
gDiskPos is: %08x..Cluster:%d...part offset: %08x..