Flag: Tornado! Hurricane!

 Forums >>  Target Specific - General  >>  find hooked process

Topic created on: February 20, 2012 08:14 CST by charlie .

hi all,
I've a malware which hooks into the Windows shutdown procedure by deleting its own copy, is there a way to find the process which had hooked to this procedure ?

I know its hooked because its resident in memory my antivirus scan doesn't get rid of it. It deletes the on disk files and is resident in memory.

related to this http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor:Win32/Caphaw.A.

I want to find the culprit process and kill it manually.

thanks in advance.

charlie

  tresp4sser   February 24, 2012 17:55.18 CST
Have you read the technical analysis on the link you provided? Everything is written there: The backdoor injects itself to firefox/iexplore/explorer/reader_sl and also writes itself to the registry (HKCU\Software\Microsoft\Windows\CurrentVersion\Run).

If you tried to disable the techniques described in the link you provided and you haven't been able to get rid of the malware, I would suggest you to run Sysinternal's procmon and configure it to write its output into a file. Also make it run on startup automatically. Then, with Procmon running, shutdown your computer. After reviewing the procmon's output, you should be able to quickly determine which process injected the malware again.

Good luck.

  charlie     February 26, 2012 14:58.59 CST
Thanks for the tip Tresp4sser. The link just only explains part of the behaviour, the stealthiness of this malware is it creates a hidden run key and injects into explorer, deletes itself using a batch file and stays active in memory. I was able to find the hook using rootkit tools like kernel detective and able to clean it.

  raxen     March 27, 2012 20:47.16 CDT
Null modem + Windows Kernel Debugger + Another PC + a few dozen breakpoints = Answer but the procmon route is the more time conservative approach!

  zaltekk     July 27, 2012 13:47.13 CDT
Check out a tool called HookShark that DeepBlueSea over at GameDeception made.

Note: Registration is required to post to the forums.

There are 31,310 total registered users.


Recently Created Topics
[help] Unpacking VMP...
Mar/12
Reverse Engineering ...
Jul/06
hi!
Jul/01
let 'IDAPython' impo...
Sep/24
set 'IDAPython' as t...
Sep/24
GuessType return une...
Sep/20
About retrieving the...
Sep/07
How to find specific...
Aug/15
How to get data depe...
Jul/07
Identify RVA data in...
May/06


Recent Forum Posts
Finding the procedur...
rolEYder
Question about debbu...
rolEYder
Identify RVA data in...
sohlow
let 'IDAPython' impo...
sohlow
How to find specific...
hackgreti
Problem with ollydbg
sh3dow
How can I write olly...
sh3dow
New LoadMAP plugin v...
mefisto...
Intel pin in loaded ...
djnemo
OOP_RE tool available?
Bl4ckm4n


Recent Blog Entries
halsten
Mar/14
Breaking IonCUBE VM

oleavr
Oct/24
Anatomy of a code tracer

hasherezade
Sep/24
IAT Patcher - new tool for ...

oleavr
Aug/27
CryptoShark: code tracer ba...

oleavr
Jun/25
Build a debugger in 5 minutes

More ...


Recent Blog Comments
nieo on:
Mar/22
IAT Patcher - new tool for ...

djnemo on:
Nov/17
Kernel debugger vs user mod...

acel on:
Nov/14
Kernel debugger vs user mod...

pedram on:
Dec/21
frida.github.io: scriptable...

capadleman on:
Jun/19
Using NtCreateThreadEx for ...

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit