Atapi.sys Rootkit is EVERYWHERE!

Man…every client I’ve seen for the past 2 weeks who was infected with malware also had this Atapi.sys rootkit.  I know I’ve written about this about 2 weeks ago, but I wanted to keep this fresh.  If you’re searches are getting redirected and you’ve scanned with just about every thing you can think of then there’s a pretty good chance your atapi.sys has been patched (Microsoft Security Essentials detects a spawned dll from this rootkit…I think it’s called AlureonCT).

One easy way to find out if you have a patched Atapi.sys is to run the latest copy of GMER Anti-RootKit.  Upon opening GMER it will run a very fast quick scan.  If you see any entries like \DEVICEHARDDISK\Atapi (something like that) or Atapi.sys “suspicious modification” (especially this one) then your probably dealing with a very nasty rootkit.

For clients that run Windows XP I’ve just been using Combofix (Combofix disinfects Atapi.sys).  For other operating systems (32-bit) I’ve just been using a bootable anti-malware disc (bartpe) and replacing atapi.sys with one from the Windows disc.

, , ,