[djpnuemo]

reinfected the machine after re-imaging it. this time ocmi.sys was the infected driver. dr. web cureit endlessly loops when detecting the infection.

previous test was with pciide.sys

detects infection
cures infection
detects infection
cures infection
detects infection
cures infection

infection not removed... *sigh*

[IndiGenus]

reinfected the machine after re-imaging it. this time ocmi.sys was the infected driver. dr. web cureit endlessly loops when detecting the infection.

detects infection
cures infection
detects infection
cures infection
detects infection
cures infection

infection not removed... *sigh*

Heee.....no big surprise. This is a tough one to fix without booting out of live system. You can simply replace with the recovery console, or one of the PE disks.

[obse]

reinfected the machine after re-imaging it. this time ocmi.sys was the infected driver. dr. web cureit endlessly loops when detecting the infection.

Which OS did you use for tests?

[djpnuemo]

xp sp3

[obse]

xp sp3

Could you provide a registry entry for ocmi.sys? for example imagepath (on infected or clean system)
Did you execute other cure/detection tools before cureit?
I know this bug can be reproduced when you trying to cure system twice in a session (by ignoring reboot suggestion message). Did you?

[EP_X0FF]

You can reproduce that bug by simple running Dr.Web CureIt! inside box with fresh TDL3. Infected driver is not meaningful. It gives this error loop with everything TDL3 infects.

Screenshots with up to date CureIt and TDL.







After intercepting this infinite loop of cure/detect Windows dmio.sys was killed. After reboot we have

00000000 0.00000000 Ah Lou, come on man, we really like this place

TDL3 successfully survives.

[djpnuemo]

that machine was re-imaged shortly after the test. i had the exact problem stated in EP_X0FF's post (http://www.kernelmode.info/forum/viewto ... p=853#p853).

if you must have that information, i can reinfected the machine and gather that information. it will take me some time, fyi.

[EzzO]

Hi guys, can you tell wich CureIT is this? Now in beta section we have new CureIT! with self-protection, new starter and more, that can be downloaded here. Can you try to cure TDL 3 with beta CureIT and show the results? Thanks :)

[obse]

You can reproduce that bug by simple running Dr.Web CureIt! inside box with fresh TDL3. Infected driver is not meaningful. It gives this error loop with everything TDL3 infects.

Thanks for info. It sounds strange, but all my previous tests never show such way of curing process. I will try to reproduce it.

[obse]

that machine was re-imaged shortly after the test. i had the exact problem stated in EP_X0FF's post (http://www.kernelmode.info/forum/viewto ... p=853#p853).

if you must have that information, i can reinfected the machine and gather that information. it will take me some time, fyi.

it will be very nice if you do.

btw, can you show value imagepath from hklm\system\currentcontrolset\services\ocmi on your clean test system?