Excellent site for beginners and review:

http://www.webs4u.co.nz/hints/hints.html

ROOTKITS

What are they

Software tools intended to conceal running processes, files or system

data, thereby helping an intruder to maintain access to a system whilst

avoiding detection.

Not malware but programs that cleverly and deeply hide the presence of

malware programs

Malwear program may report your PC to be clean

Files not seen with usual Windows programs, e.g. WE, Task Manager, Startup

folder

Received lots of publicity re 2005 Sony copy protection software on some CDs

installed a rootkit on Windows computers; Symantec also involved

Originated with Unix tools to hide intruder traces thus allowing rooting

How are they used

In the past by hackers to hide Trojans; now to hide spyware or mass circulation

viri/worms

May take over your PC in a surreptitious manner

May work with worms, sniffers, keyloggers, DoS (Denial of Service), email spam,

access user names and log-in information for sites that require them

What are the various types

1. Persistent Rootkits: A persistent rootkit is one associated with malware that

activates each time the system boots. Because such malware contain code that

must be executed automatically each system start or when a user logs in, they

must store code in a persistent store, such as the Registry or file system, and

configure a method by which the code executes without user intervention.

2. Memory-Based Rootkits: Memory-based rootkits are malware that has no

persistent code and therefore does not survive a reboot.

3. User-mode Rootkits: There are many methods by which rootkits attempt to

evade detection. For example, a user-mode rootkit might intercept all calls to the

Windows FindFirstFile/FindNextFile APIs, which are used by file system exploration

utilities, including Explorer and the command prompt, to enumerate the contents of

file system directories. When an application performs a directory listing that would

otherwise return results that contain entries identifying the files associated with the

rootkit, the rootkit intercepts and modifies the output to remove the entries.

The Windows native API serves as the interface between user-mode clients and kernel-

mode services and more sophisticated user-mode rootkits intercept file system,

Registry, and process enumeration functions of the Native API. This prevents their

detection by scanners that compare the results of a Windows API enumeration with that

returned by a native API enumeration.

4. Kernel-mode Rootkits: Kernel-mode rootkits can be even more powerful since,

not only can they intercept the native API in kernel-mode, but they can also directly

manipulate kernel-mode data structures. A common technique for hiding the presence

of a malware process is to remove the process from the kernel's list of active processes.

Since process management APIs rely on the contents of the list, the malware process will

not display in process management tools like Task Manager or Process Explorer.

How do we diagnose the presence of Rootkits

Not easy!

Most AV and anti-spyware scanners worthless although some now are adding this feature

Need a special detector

Many being developed and improved but still are difficult to use and are non-specific

Good idea to use several

This one looks promising: RootkitRevealer:

http://www.sysinternals.com/Utilities/RootkitRevealer.html

Other examples: BlackLight from F-Secure (free); RootkitRevealer (free); Rootkit Hook

Analyzer (Beta and free); IceSword (free, Chinese, experience users only)

Malicious Software Removal Tool from MS

Not dedicated to RKD

Distributed via MS and Windows Update services

What is the therapy

Two pronged i.e. removal of the RK then the malwear

Extremely difficult to remove even with positive diagnosis

Many feel better formatting & re-installing the OS would be best approach

Back up clone possible only if backup done prior to the infestation

What prophylaxis should I use

Same as avoiding malwear infections in general i.e. use several layers of protection

Running Windows from lesser than Administrator account (not always practical)

Use security tools that prevent global hooking e.g. Process Guard ($29.95), Anti Hook

(free); not practical for all users i.e. only P2P users, and crackers those that downlad and

install programs frequently

the best advice an ounce of protection .. !