POORTRY is a kernel-mode malware deployed as a digitally signed Windows driver — a tactic that allows it to operate with system-level privileges while evading many traditional security controls. First documented by Mandiant researchers in connection with the UNC3944 threat group, this malware leverages a legitimate Microsoft Windows Hardware Compatibility Authenticode signature to bypass driver signature enforcement on modern Windows systems. Because it runs at the kernel level, POORTRY can manipulate core operating system functions, disable security software, and maintain persistent access with minimal visibility to endpoint protection tools.
The use of a valid Microsoft signature is particularly concerning: it means the malware can load on fully patched Windows 10 and Windows 11 systems without triggering the built-in driver signature warnings that normally block unsigned kernel code. This malware represents a sophisticated supply-chain or certificate-abuse scenario, where attackers have either compromised a legitimate hardware vendor's signing infrastructure or exploited a leaked certificate to sign malicious code that Windows trusts implicitly.
Threat Profile
| Malware Name | POORTRY |
|---|---|
| Type | Kernel-mode driver / Rootkit |
| Platform | Windows (x64) |
| File Type | Windows PE executable (driver .sys file) |
| Digital Signature | Microsoft Windows Hardware Compatibility Authenticode (abused/compromised) |
| Associated Threat Actor | UNC3944 (financially motivated intrusion group) |
| Primary Capabilities | Security product tampering, privilege escalation, defense evasion |
| First Documented | 2023 (Mandiant public reporting) |
| Privilege Level | Kernel / Ring 0 |
| Detection Difficulty | High (signed driver, kernel rootkit techniques) |
| Typical Distribution | Post-compromise deployment via social engineering or hands-on-keyboard intrusion |
| Risk to Home Users | Moderate (targeted attacks, not mass-distributed) |
How It Spreads
POORTRY is not distributed through traditional mass-malware campaigns like phishing emails or exploit kits. Instead, it's deployed after an attacker has already gained access to a target system — often through social engineering or credential theft. The UNC3944 group, which Mandiant associates with this malware, is known for using phone-based social engineering (vishing) to trick help desk staff into resetting credentials or installing remote support tools. Once the attackers have administrative access, they deploy POORTRY to disable endpoint detection and maintain long-term control.
Because POORTRY requires administrator privileges to install a kernel driver, it's typically pushed during the lateral-movement or privilege-escalation phase of an intrusion. The attackers may use legitimate remote management tools (like ScreenConnect or TeamViewer) to upload the driver file, then execute it with elevated rights. The malware's valid Microsoft signature means Windows doesn't block the installation — the operating system sees it as a trusted hardware driver.
Common infection chains include:
- Social engineering attacks targeting IT support staff to gain VPN or remote desktop credentials
- Compromised service accounts with admin rights, often obtained through password spraying or credential dumps
- Abuse of legitimate remote access tools installed under false pretenses (e.g., fake "Microsoft support" calls)
- Post-exploitation frameworks used by advanced threat actors to automate driver deployment after initial compromise
- Supply chain compromise in rare cases, where the malware might be bundled with seemingly legitimate software updates
What It Does On Your Machine
Once loaded, POORTRY operates in kernel mode — the most privileged execution layer in Windows. This gives it unfettered access to system memory, processes, and hardware resources. Its primary mission is to disable or blind security software so that other malware can run undetected. It can terminate antivirus processes, unload security drivers, and manipulate kernel structures to hide malicious activity from monitoring tools. Because it runs at the same privilege level as the operating system itself, most consumer antivirus products cannot stop it once it's active.
The malware typically installs as a Windows service or driver that loads at boot time, ensuring persistence across reboots. It may register itself under a benign-sounding service name to avoid suspicion in Task Manager or services.msc. From the kernel, POORTRY can intercept system calls, modify process lists, and even hide files or registry keys from forensic tools — classic rootkit behavior. This makes post-infection analysis extremely difficult without specialized memory forensics or offline scanning from a bootable environment.
UNC3944's documented tactics suggest POORTRY is used as an enabler for ransomware or data exfiltration. By neutering endpoint protection, the attackers can deploy file-encrypting payloads, steal credentials from memory, or siphon sensitive documents without triggering alerts. The malware itself doesn't typically perform the final-stage attack — it clears the path for other tools in the threat actor's kit.
Manual Removal — Step by Step
Disconnect and Document
Unplug the network cable or disable Wi-Fi immediately. Do not shut down yet — take photos of any error messages or unusual service names in Task Manager (especially under the "Services" tab). Write down anything suspicious before you lose visibility.
Boot into Safe Mode with Networking
Restart while holding Shift, then navigate to Troubleshoot > Advanced options > Startup Settings > Restart, and select "Safe Mode with Networking." Kernel rootkits often fail to load in Safe Mode because Windows loads a minimal driver set. This gives you a fighting chance to remove the malicious driver.
Run Autoruns from Sysinternals
Download Microsoft Autoruns (a free, portable tool) on another clean machine and transfer it via USB. In Safe Mode, run Autoruns.exe as Administrator. Go to the "Drivers" tab and look for recently added .sys files in System32\drivers with unusual names or no publisher information. Uncheck any suspicious driver — do not delete yet.
Check Digital Signatures
Right-click suspicious .sys files in C:\Windows\System32\drivers and select Properties > Digital Signatures. POORTRY may show a valid Microsoft signature, but the signer details or timestamp might look wrong (e.g., a certificate issued to an obscure hardware vendor, or a signing date that doesn't match the "Date created" in file properties). Cross-reference the filename with known-good driver lists online.
Disable the Driver Service
Open an elevated Command Prompt (search "cmd", right-click, "Run as administrator"). Type sc query to list all services, then sc config [ServiceName] start= disabled for any service tied to the suspicious driver. Use sc delete [ServiceName] to remove the service registration entirely. Reboot to confirm the driver doesn't reload.
Delete Driver Files from Safe Mode
Still in Safe Mode, navigate to C:\Windows\System32\drivers and delete the malicious .sys file(s). If you get an "access denied" error, boot from a Windows installation USB, open Command Prompt from the recovery environment, and delete the file using del C:\Windows\System32\drivers\[filename].sys /F. The offline environment bypasses kernel-level protections.
Restore Security Software
Reboot normally and immediately reinstall or repair your antivirus. Run a full system scan with a reputable tool (Windows Defender, Malwarebytes, or Kaspersky Rescue Disk). POORTRY may have disabled or corrupted your security software — you might need to download a fresh installer from the vendor's website on another device.
Scan with Multiple Tools
Because kernel rootkits can hide from single-engine scans, use a layered approach: run GMER or Kaspersky TDSSKiller (specialized rootkit detectors), followed by a bootable rescue disk like Bitdefender Rescue CD. Check memory with Volatility or a similar forensic tool if you have the expertise.
Review Recently Installed Programs
Open Settings > Apps > Installed apps and sort by install date. Look for unfamiliar remote access tools, system utilities, or anything installed around the time symptoms started. Uninstall aggressively — attackers often leave multiple backdoors.
Change All Credentials
Assume any password entered on the infected machine is compromised. From a known-clean device, change passwords for your email, banking, work VPN, and any admin accounts. Enable multi-factor authentication everywhere. If this is a business machine, notify your IT department immediately — UNC3944 typically targets corporate networks, and lateral movement may be ongoing.
Prevention
- Enable application whitelisting or attack surface reduction rules. Windows Defender Application Control (WDAC) or AppLocker can prevent unauthorized drivers from loading, even if they're signed. In enterprise environments, this is critical against signed-malware threats.
- Train staff to recognize social engineering. UNC3944's primary entry vector is phone-based deception. Verify caller identity through official channels before resetting passwords or granting remote access — never trust caller ID alone.
- Require multi-factor authentication for all administrative actions. Even if an attacker steals a password, MFA can block the lateral movement needed to deploy POORTRY. Use hardware tokens (not SMS) for high-privilege accounts.
- Monitor driver installations with EDR tools. Endpoint detection and response platforms can alert on unexpected .sys file creation in System32\drivers, especially when coupled with service creation or boot-time persistence.
- Keep a golden-image backup. Maintain a clean, verified system image on external media. If a kernel rootkit takes hold, wiping and restoring from a known-good backup is often faster and more reliable than manual remediation.
- Audit certificate usage and revoke compromised certs. If you're an IT admin, subscribe to Microsoft's driver block list and apply it via Group Policy. This can prevent known-bad signed drivers from loading, even with valid signatures.
- Segment your network. Limit administrative access to jump servers or privileged-access workstations that are heavily monitored and isolated. This contains the blast radius if a single machine is compromised.
- Review boot-time drivers quarterly. Use Autoruns or similar tools to audit what loads at startup. Investigate any new drivers you didn't explicitly install, especially from unfamiliar publishers or with generic service names.
Bring It In
Kernel-mode malware like POORTRY is not a DIY repair for most users. The steps above assume a level of technical comfort that many homeowners and small-business owners simply don't have — and that's fine. One wrong move in the registry or a missed persistence mechanism can leave your system reinfected or unstable. Worse, because this malware operates at the kernel level, incomplete removal might corrupt your Windows installation, forcing a costly reinstall and potential data loss.
Computer Repair Roswell specializes in advanced malware remediation, including signed rootkits and driver-based threats. We use bootable forensic environments, memory analysis tools, and multi-engine scanning to verify complete eradication. Bring your desktop or laptop to our shop at 1750 Woodstock Rd, Roswell, GA 30075 (we're in the Woodstock Crossing shopping center, near the UPS Store). We'll diagnose the infection, remove all traces, restore your security software, and harden your system against reinfection — all while keeping your personal files intact. Call us at (770) 856-1734 to check availability or ask questions. Same-day service is often available for urgent cases, and we'll walk you through what we find in plain English. Don't let a kernel rootkit linger — every day it's active is another day attackers can steal data or deploy ransomware.