Fortunately the stealth techniques used by rootkit creators are not flawless.
The presence of a rootkit in their system can always be detected.
How can you do this.
First by verifying signatures having a database of programs that are known to be root kits and checking
your system for their existence.
The solution may not be very effective but it's easy to run.
That's why it's become automated and now forms a part of the Microsoft Malicious Software Removal Tool.
You can also detect anomalies in the operation of your system.
A rootkit will modify the operation of a system by definition.
It will try to hide something in the system this principle is the basis for Checker's and detectors
like system virginity verifier provided by Joana read Kosko
the tool can be used to evaluate the state of a system.
If a system has been installed recently it has no anti-virus and no new drivers it will be evaluated
as a 0 or 1 on the infection scale which means that the probability that the system is infected with
a rootkit is very low.
When you install an antivirus the system will probably move up on the level of the risk evaluation as
you can see a system that had a rootkit installed was assessed as level 5 on the scale of 0 to 5.
A change in the operation of the system was very apparent.
The third method for detecting rockets was deployed by Mark Russinovich in the rootkit revealer this
tool is another component of the system internals.
We rootkit revealer works as shown in the picture the assumption behind it is that since a rootkit hide
something in a system or a user mode program like rootkit revealer won't be able to see the hidden files
processes accounts or services but a rootkit revealer sends the same query without consulting user mode
in kernel mode API is what refers directly to low level structures.
For example files on a disk it will be able to compare the results between the two calls and see a potential
discrepancy the exposed difference must be due to something is due to a root kit hiding something from
the first call.
Let's now find out how this works in practice.
Let's start by looking at the rootkit from the viewpoint of an attackers computer.
The computer has hacker defender downloaded from the internet and installed the program's basic version
is made up from only two files.
A binary file and the c file which is in fact the root kit and the file which has the kids configuration
file.
If you take a look at the configuration file it turns out that it only requires to specify what objects
are to be hidden in the target computer system that can include processes services registry entries
free disk space open ports or files and directories.
When hiding files in directories you need to remember that the use of wildcard characters can be dangerous.
By typing for example w star you can hide the entire Windows System Folder from a user
our version of hacker defender has additionally a client program this version is not only a rootkit
but also a backdoor.
What's more the back door is closed by the root kit.
Let's now try to connect to a computer that already runs a hacker defender rootkit and the backdoor
that it hides submit the IP address of a selected computer.
The part that is listed on by the hidden back door and the password
was successfully connected to the target computer.
You can access the victim's command line interface.
The last thing we'll do is taking a look at the contents of Cecils desktop
Sissel is a user who logged onto the attacked computer.
Note that the user's desktop resides folders like auto runs contains a zip archive and a folder named
Ajax def and A-check stuff 100 our folder and a zip archive of the same name.
A lot of suspicious elements you can plainly see that they can be found in the user's desktop.
Let's see now what the user sees will switch to Windows XP where we're logged in is Cecil some objects
are invisible in this view.
To give you a better picture of the situation let's create a new folder and create a file inside of
it.
Everything's in order.
We'll create a second file
as you remember the hacker defender rootkit was set to hide objects that have the name starting with
A-check def will change the file name so that it includes that string.
After the window is refreshed it seems like the file is gone.
Let's now change the file name of the second file to A-check stuff 11.
Or a similar name.
The name doesn't seem to change after you refresh the window.
The file disappears.
The rootkit hides all objects that have the same name that starts with A-check stuff just as it was
set to
the folder we created is visible in the desktop but seems to be empty.
We know though that the folder does contain some files.
What can be done in this case Barker's signal which is rootkit revealer comes to the rescue.
Clicking on the scan button will make the tool check if the system contains some objects that are hidden
from users and administrators run the scanner.
The scan shouldn't take too long the first result and the 0 byte registry keys the alarms are probably
false positives
rootkit revealer shows them since have a registry key has emptied the Windows Registry Editor Raggatt
it will not display it.
This serves as a reason for hiding data in zero byte registry keys which happens quite often.
But the next results should never be here.
The next rows reveal a discrepancy between what is visible for the user and what's really found in the
system
or user can't see registry keys that as you can gather from their names are related to hacker defender
the directory and zip archive.
We mentioned before is invisible to the user.
You can also see here the files that we hit a moment before we changed their names detecting a rootkit
is possible as you can see.
But removing it from a system is a much more demanding task.
Before we move on it's worth taking note of the race between hacker defender and rootkit revealer as
you've seen rootkit revealer is able to successfully expose a hacker defender rootkit
knowing about this discovery.
The hacker defender developer tried to get the better of the scanner and hide the root kit again.
How can you defeat rootkit revealer a hacker defender root kids configuration file contains a section
where you can specify processes that the rootkit will not hide from
the section names rootkit revealer as one of the such processes by default.
What is the purpose of this action.
Scanning a computer with rootkit revealer.
The program sees all the objects in the system there'd be no discrepancies.
And the programs would report that there's no difference Markson of who wasn't working for Microsoft
at the time was notified about this move by the tech support staff who detected this in their customers
machines
a counteraction is hiding rootkit revealer from the hacker defender.
The scanner creates services with pseudorandom names and so on.
This is in fact a no win situation.
You can create new defense mechanisms and bypasses for both sides.
Ad infinitum.
If you bought a Sony BMG CD several years back and played it on the computer your machine was infected
with a Sony rootkit.
The company has copy protection measures ended in a real nightmare
to protect their digital rights.
Sony included in their CDs a piece of software that operated exactly like a rootkit
the software would install and hide in the system to track and prevent copying the music.
After the scandal was made public by Mark Russinovich Sony admitted to making a mistake and withdrew
the rootkit infected CDs.
Coming back to the main issue what steps can you take if you detect a rootkit.
If you're able to find legitimate sounding guidelines for the rootkit removal on the Internet you can
well follow them.
Unfortunately it's far more probable that eliminating the rootkit will involve disk formatting and reinstalling
the system removing some files or changes made by the rootkit doesn't mean that all changes have been
founded and deleted.