Re: Removal and forensics of advanced rootkit employing Shadow Walker technology - help needed!!!


"Polanski24" <infodate@xxxxxxxx> wrote in message
news:1152977306.356950.33150@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

You're certain there's no chance the SVV could be incorrect? It doesn't
look like there are any guarantees made with that tool. You don't have a
similarly configured system you could run SVV against and compare the
results, do you?

OMG

If IDT (Interrupt Descriptor Table) entry No 14 is redirected to memory
area which has no module with executable code in there system should
crash with blue screen of death at first page fault (even without that
since it will happen immediately after memory manager starts running).

.... assuming the results from the tool are accurate, hence my question.

What was the name of that file you submitted?


.