[AaLl86]

Hi All!
I'm new in this community. I'll introduce myself: my name is Andrea and i'm an italian "unemployed" security researcher.
I would like to present my implementation of TDL3 Removal Tool. Is a personal quite big project, it runs on Windows Xp, Vista, 7, on all 32 bit platform (no 64 bit already). It's still in alpha but fully working. It doesn't support RAID software system like Windows Dynamic disk. This is the only limitation it has.

I'll appreciative if some of you can test it.... the link is:
http://www.aall86.altervista.org/files/AntiTdl_0.1.zip

Tell me what do you think, and sorry for my english but it's not my native language...

Have a nice day. :D
Andrea

[EP_X0FF]

Hello,

thank you for sharing your project.

Seems to be it working not at 100%. Infection still alive after removal procedure.
TDL is not functional, but it still here. If you take a look on EP of infected atapi.sys you will find that driver still infected.

Tested with TDL 3.273 (from March) under Windows XP SP3.

[AaLl86]

Thank you very much... Indeed i wrote this cleaner with the latest version of TDL3 that it infect random driver... Tomorrow i download the payload from here and i look what's wrong ok? Many thanks for the test....

Have a nice evening!
Andrea

[Alex]

Hi AaLl86,

It looks as if the tool doesn't work under VmWare (vmscsi.sys)? I didn't (couldn't) test it under real OS at the moment

Code: Select all

AntiTDL - Entry Point del driver richiamata!
AntiTdl!GetDriverInfo - Trovato Driver Nt "vmscsi.sys" ad indice 19.
AntiTdl!RepairForgedDriver - DriverStartIo function error!

[AaLl86]

Hi Alex! Thank you for your test... Yes you're right, i didn't test it with virtual vmscsi controller, with raid controller, and also with Daemon Tools (that i found it uses an orrible solution for working correctly). But these features are currently under development.... (the version is still Alpha 0.1). I tell you that i'm working on these problem and i will fix as soon as possible in the future releases.... i made this release for cleaning many of my friends simple pcs with a SATA or IDE controller... Just a week of time that i prepare a virtual machine with scsi controller and i post the fix here ok? Many thanks to you for your test....

Have a nice evening!
Andrea

Hi AaLl86,

It looks as if the tool doesn't work under VmWare (vmscsi.sys)? I didn't (couldn't) test it under real OS at the moment

Code: Select all

AntiTDL - Entry Point del driver richiamata!
AntiTdl!GetDriverInfo - Trovato Driver Nt "vmscsi.sys" ad indice 19.
AntiTdl!RepairForgedDriver - DriverStartIo function error!

[AaLl86]

To EX_XOFF:
Hi Ep_xoff!
I made some tests with your sample: the cleaner removes currectly the infection, the only problem is that the infected file, at the end of the cleaning process, remain corrupted in its resource section, but in my test TDL3 become ko. I'm currently working on the restoration on the original file (it requires a deviation of the original driver IRP functions handler because TDL3 threads continuously rewrite it).
Can you explain me what did you intend with "TDL is not functional, but it still here"?
Perhaps do you mean what i wrote, or something else?

Thank you in advice
Andrea

Hello,

thank you for sharing your project.

Seems to be it working not at 100%. Infection still alive after removal procedure.
TDL is not functional, but it still here. If you take a look on EP of infected atapi.sys you will find that driver still infected.

Tested with TDL 3.273 (from March) under Windows XP SP3.

[EP_X0FF]

I mean that port driver is still infected and TDL code gets control (since Windows boots normally).

Additionally you need to check your tool with older TDL3 versions:

3.0 - 3.23, 3.24.

[STRELiTZIA]

Hi,

I mean that port driver is still infected and TDL code gets control (since Windows boots normally).

Additionally you need to check your tool with older TDL3 versions:

3.0 - 3.23, 3.24.

Tested...
Not work with TDL 3.241 (Locker)

atapi.sys FAILED last error 0x0000001F
ntfs.sys FAILED last error 0x0000045D

Regards.

[AaLl86]

Hi!
Thank you for the test.... i'm currently working on these issues.... Thank you also for the payload you gave me....

Andrea

Hi,

I mean that port driver is still infected and TDL code gets control (since Windows boots normally).

Additionally you need to check your tool with older TDL3 versions:

3.0 - 3.23, 3.24.

Tested...
Not work with TDL 3.241 (Locker)

atapi.sys FAILED last error 0x0000001F
ntfs.sys FAILED last error 0x0000045D

Regards.