[PX5]

Find the protector dll, mine was dropped in a subfolder inside WinSxS, made to appear as a backup file or something since subfolder is named like all backup folders for Vista/7

[ConanTheLibrarian]

vbma*** is not ZeroAcces - it is KillAV.D.

[B-boy/StyLe/]

vbma*** is not ZeroAcces - it is KillAV.D.

vbma*.sys is a variant of Win32/Rootkit.Agent.NTT trojan or Rootkit.Win32.Agent.bjqb 1 ;)

Here it is one new Trojan.KillAV.D




Regards,
G. ;)

[EP_X0FF]

Here is some new ZeroAccess build, thanks goes to PX5.
Still infects drivers, still stores data on hidden volume, sample enough reverse-friendly.

[digitalranger]

Here is some new ZeroAccess build, thanks goes to PX5.
Still infects drivers, still stores data on hidden volume, sample enough reverse-friendly.

It can infect only XP kernel or Win 7 kernel too?

[EP_X0FF]

It does not infect kernel it infect drivers. Start vm and try yourself.

[Flopik]

That's a nice malware , hidden from the PsLoadedModuleList & Object directory

lkd> dt _DRIVER_OBJECT 812203B0
ntdll!_DRIVER_OBJECT
+0x000 Type : 4
+0x002 Size : 168
+0x004 DeviceObject : (null)
+0x008 Flags : 4
+0x00c DriverStart : (null)
+0x010 DriverSize : 0
+0x014 DriverSection : 0x82261b70
+0x018 DriverExtension : 0x81220458 _DRIVER_EXTENSION
+0x01c DriverName : _UNICODE_STRING "\driver\2989018276"
+0x024 HardwareDatabase : (null)
+0x028 FastIoDispatch : 0xf89f6550 _FAST_IO_DISPATCH
+0x02c DriverInit : 0xb2106764 long <Unloaded_dFlr1nhs.SYS>+5764
+0x030 DriverStartIo : (null)
+0x034 DriverUnload : 0xf89f3e52 void +fffffffff89f3e52
+0x038 MajorFunction : [28] 0xf89f3dd9 long +fffffffff89f3dd9


lkd> dt _LDR_DATA_TABLE_ENTRY 0x82261b70
ntdll!_LDR_DATA_TABLE_ENTRY
+0x000 InLoadOrderLinks : _LIST_ENTRY [ 0x82261b70 - 0x82261b70 ]
+0x008 InMemoryOrderLinks : _LIST_ENTRY [ 0x0 - 0x0 ]
+0x010 InInitializationOrderLinks : _LIST_ENTRY [ 0x0 - 0x0 ]
+0x018 DllBase : 0xf89f2000
+0x01c EntryPoint : 0xf89f3ed8
+0x020 SizeOfImage : 0x7000
+0x024 FullDllName : _UNICODE_STRING ""
+0x02c BaseDllName : _UNICODE_STRING "80000002.sys"
+0x034 Flags : 0x1004000
+0x038 LoadCount : 1
+0x03a TlsIndex : 0
+0x03c HashLinks : _LIST_ENTRY [ 0xffffffff - 0x7aff ]
+0x03c SectionPointer : 0xffffffff
+0x040 CheckSum : 0x7aff
+0x044 TimeDateStamp : 0xfffffffe
+0x044 LoadedImports : 0xfffffffe
+0x048 EntryPointActivationContext : (null)
+0x04c PatchInformation : 0x00300038

vbma*** is not ZeroAcces - it is KillAV.D.

vbma*.sys is a variant of Win32/Rootkit.Agent.NTT trojan or Rootkit.Win32.Agent.bjqb 1 ;)

Here it is one new Trojan.KillAV.D




Regards,
G. ;)

[PX5]

http://www.virustotal.com/file-scan/rep ... 1300606086

[PX5]

http://www.virustotal.com/file-scan/rep ... 1300716595

[shaheen]

Just want to know few things:

1- Which anti-rootkit applications can detect this currently?

2- Can it bypass VM?

Thanks