New strange Virus ,Please help !

Hey friends

In Past two weeks my team identifies a strange Computer malware in one of our client’s computer.

As an anti malware Developer, we reported this computer malware to “Microsoft Malware Protection Center”
And they said they were so interested to our identification,

We contacted with Microsoft MMPC and CERT team and The person who contacted with us was “Tareq Saade” which is died in 19 Feb 2012 after
he sent us his final email in 19 Feb 2012,

http://www.redmond-reporter.com/news/140631323.html

http://blogs.technet.com/b/mmpc/archive/2012/02/28/in-memoriam-tareq-saade.aspx

We wanna doing this research to proud of him ,

This is the malware features :

1.The worm will blocked any kernel driver installation
( you cannot install any antivirus or anti malware with kernel capability )

2.when you execute any program ,the worm will execute WMP.exe
( we checked the registry key like
“HKEY_CLASSES_ROOT\exefile\shell\Cmd\command” This is not manipulated ! )

The worm worked with the other mechanism.

3. there is 2 “Explorer.exe” on the system ( one lunched by SVChost.exe and the other is normal )

4.there is no installed kernel driver on it ( the system and windows are X64 platform )

All kernel drivers belong to Microsoft and the other vendors are signed.

We ran the system with “Safemode” but the worm work in Safemode too.
(The only way to bypass worm activity is “Safe mode with command prompt)

5.the worm installed a Debugger on the system.
"IsDebuggerPresent" Function Result is true.

6. we try to enumerate processes with “EnumProcessModules” and “OpenProcess“
but the result is nothing. ( seems the worm hooked those functions too)

7. we try to install more than 20 antivirus product and kernel land tools but all these tools had failed to install own driver on the infected system.

It seems virus ran another “Explorer.exe” and attached a module on it and try to block access to module list via a kernel driver technique.
we try to use “NtQuerySystemInformation” and “NtQueryObject” to enum Kernel Drivers, but Virus driver hooked these function on the kernel land.

we did not find out anything special and it seems all kernel Drivers are signed.

And the final thing is we cannot install some Monitors Program like “API Monitor” or “Process Monitor”
Both had failed to ran.

if you guys see something like this please let us know ,

Thank you all ,

How about Venak and Avenak bro?

this is not Flame Virus ,

Take the disk out and examine it in another system.

Hi,