How to unhook SSDT

I have a few logs that show that SSDT's are hooked, How can i clear it. They are actually hooked funtions and hooked by ""

Can you post the relevant portions of the logs please.

Yes thanku. SSDT ——————- #: 041 Function Name: NtCreateKey Status: Hooked by "" at address 0xfa6070ce #: 053 Function Name: NtCreateThread Status: Hooked by "" at address 0xfa6070c4 #: 063 Function Name: NtDeleteKey Status: Hooked by "" at address 0xfa6070d3 #: 065 Function Name: NtDeleteValueKey Status: Hooked by "" at address 0xfa6070dd #: 098 Function Name: NtLoadKey Status: Hooked by "" at address 0xfa6070e2 #: 122 Function Name: NtOpenProcess Status: Hooked by "" at address 0xfa6070b0 #: 128 Function Name: NtOpenThread Status: Hooked by "" at address 0xfa6070b5 #: 193 Function Name: NtReplaceKey Status: Hooked by "" at address 0xfa6070ec #: 204 Function Name: NtRestoreKey Status: Hooked by "" at address 0xfa6070e7 #: 247 Function Name: NtSetValueKey Status: Hooked by "" at address 0xfa6070d8

I have a few logs that show that SSDT's are hooked, How can i clear it.
They are actually hooked funtions and hooked by ""

Venus_n

Please state what scanning utility is producing this report. (for instance, it "appears" to be SSDT Table of "ROOTREPEAL")

And state whether you are experiencing any symptoms that you believe to be related to this reported information?

Also please state what you may have already tried to do to resolve the situation, if anything.

Thanks, Rootrepeal is producing this SSDT table.

I am experiencing lots of bugs like the ones i started my topic ( http://forums.spybot.info/showthread.php?t=59764 on safer-netwrking forum) which still are there. The topic had closed with the conclusion that i only have bugs on my computer and not infections. So the hooked items maybe causing the bugs.

To resolve this, i had thought that it was virus or malware infection and tried scans with Avira, Malwarebytes, and spybot S&D. All are coming clean. Also, I raised a topic in the malware forum on safer-netwrking. That is http://forums.spybot.info/showthread.php?t=59764 but logs showed clean of infection. Besides, i didn't know what to do, i haven't done anything else on this.

Venus_n, You have already been given credible information from your Security Expert at Safer-Networking Forums, as well as the additional scanning that you have yourself performed, to the effect that your machine is clean of malware infection. We do not perform additional malware diagnostic nor removal procedures here in this Microsoft Windows Software Forum. _______________________________– Please keep in mind that in order for a computer to operate at all, certain functions are performed by the CPU and certain amounts of memory space are addressed in both RAM and virtual memory spaces in order to accomplish those functions in behalf of the various applications that we are familiar with as our browser or email or other application programs that we enjoy using. It is not a trivial matter to recognize and sort the thousands of lines of machine language, operating system language, and application codes that must be active at any one time, in order for the computer to light up the monitor screen and perform the activities that we wish to accomplish. Some of the entries in both Registry and Operating System, "appear" somewhat intimidating to the average user who may be more familiar with the graphical interface world of icons, pull-down menus, right-click menus, and application menu tabs and buttons. If we as users, had to give our attention to each of the thousands of lines of scripts and references in the Registry and operating system, every time we wished to send an email to a friend, we would not get very many messages sent. Thankfully, we have highly skilled and knowledgeable specialists who can sort through the complex amounts of information that is processed behind the scenes. When we are assured by these specialists that our machine is processing information accurately, and no malicious/infection exist in the system, then we can move ahead with the computer activities that we enjoy accomplishing. ______________________________ I urge you to avoid getting caught up in attempting to interpret reports from advanced tools that you may have applied to your machine under the instruction and guidance of a security specialist. Most often the reported information appears confusing, and sometimes even appears scary because the way words and references may be used in technical matters is often different from how we would use them in common language discussion. ______________________________ Using a computer and learning how to accomplish tasks of browsing, emailing, image display, sound display, and document writing….. should be fun. Please allow yourself to focus on what you wish to do with your computer, and rely upon the expertise of your security expert to determine that all the details are being performed correctly. Most often, when an application function doesn't perform they way we wish it would, it is because we have made some silly mistake ourselves, or tried to perform a function that our software isn't designed to accomplish. As you learn more about how to use your computer and your application programs, you'll be able to accomplish more of what you enjoy. Leave the tech-stuff to the specialists and experts. They've already told you that no infection presently exists in your machine. Time to move on with what you'd like to do. Best Regards

Thanks, i did not say this time that this is infection. These are hooked entries, and i said they maynot be infections since logs have come clean. But i wanted to know how to unhook them, since hooked fuctions or items i think are not the correct thing, even if they are'nt infections. That is why this topic is in the microsoft windows section.

Venus_n,

The following comment is not "authoritative", and is instead based on my own common sense understanding of how applications and functions gain access to CPU and RAM memory.

***Any mistakes or mistaken presumptions in the following are the sole fault and responsibility of me.
This is not posted for the purpose of technical understanding, but rather for higher level language (conversational English) understanding of what may be occurring at lower level languages (C++, Delphi, VB, VB.NET, C# .NET & Python) which may be used for purpose of actual control, direction, and execution of machine function.
__________________________

There are hundreds, and maybe thousands of reasons why we would want our computer to alert us to an action BEFORE THE ACTION IS EXECUTED.

• When we are about to permanently delete a saved document or image.
• When we are about to download a particular file, document, image, executable program or decide where the file should be placed.
• When we are about to install an application
• When we are using an application that may not be capable of opening the kind of document/image file we wish to handle.
• When we are about to stumble into a known-bad website address
• When we are about to click on (execute) a file that may be infected
• When we wish to diagnose problems with our internet connection
• When we wish to diagnose problems with our video graphic display
• When we wish to change font, size or color
• When we wish to place something on the clip board.
• When we make a change in a document or image and then wish to reverse that change because we don't like the effect.
• When we have instructed the computer to do something that is not immediately possible or which could cause damage/crash.
• When we would prefer to receive a BSOD warning to gather more information, rather than have the computer automatically restart to clear a problem.
• When we wish to run a CHKDSK on a drive that is presently already in service.
• When we wish to close a function, but still have open sub-panels from the same function that need to be closed first.

and on, and on…

Admittedly some of the above are handled at the application program level and not the kernel level.
But eventually we expect the CPU to address RAM memory and crunch the numbers for us, so that our desired application produces our desired product result.
The examples are given only to illustrate English language examples of when we may wish to be alerted PRIOR to being allowed to execute an action.
Again, I will admit my ignorance. An advanced reader may easily notice when my examples do not apply, are overly generalized, or not relevant.

Windows has a variety of native tools that it makes available to itself for such advanced warning, such as
Debugging,
networkdiagnostic,
Dx Diagnostic, etc.,
autoruns,
process manager,
Third-party applications also have tools available that "anticipate" what is about to take place and may permit the action, block the action, or ask the user to confirm the action.
For instance:
Spybot Search & Destroy - Tea-timer
Hosts File
BillP's WinPatrol
third-party antivirus
Third party antispyware
Spam filters
________________________

In general these tools are designed to notice what instruction is about to be executed, and then reference their own or Windows native libraries to determine a best course of action.
The action may be:
Yep. That will work
Nope. That can't be done
Alert. Are you sure you want to do that
Permission. You need Administrator permission to proceed
Permission. You do not have permission to proceed.
_______________________

At my limited level of familiarity, I am aware that commercial and free Antivirus programs (except Microsoft Security Essentials) use Kernel Hooks to place themselves in a position where they can anticipate what is about to take place.

If Antivirus programs didn't use such Hooks (or some other mechanism) to anticipate actions, they would not be able to "prevent" malicious/infectious actions, and instead would only be able to report to us after the fact…. "Yep, you got infected. Now what do you want to do?"

Therefore, not all Hooks are necessarily bad.

In your example of ROOTREPEAL log, the report indicates the existence of various SSDT hooks.
I have suggested to you that we average users will be best served by consulting Specialists to determine the benefit/risk of various objects that exist in our machines.
Otherwise, we might attempt to "unhook" something that is actually an important and beneficial process.

You have already consulted a Security Expert, who has declared after careful scanning and analysis that the objects existing on your machine are OK.
Removing any of those OK objects may compromise the security of your machine, or otherwise interfere with expected functioning.

Best Regards

in other words, the hooks are there for a reason, and the reason, even tho unknown to us, is not a malicious one, proven by scans already done and read by experts in the matter, so leave them alone. at a guess i'd say they were part of your anti-virus software.

in other words, the hooks are there for a reason, and the reason, even tho unknown to us, is not a malicious one, proven by scans already done and read by experts in the matter, so leave them alone.

at a guess i'd say they were part of your anti-virus software.

Pecisely!

Thankyou