Rootkits are Hard to Detect (Shocker)

Half of the rootkits tested against anti-virus suites and online scanners prove tough to catch. No real surprise there...

New Tests Show Rootkits Still Evade AV - Dark Reading

Quote:

---

The XP test used 30 active rootkits and 30 pieces of malware using rootkit technologies. Not surprisingly, anti-rootkit tools did the best, detecting about 80 percent of the rootkits overall, while the security suites found over 66 percent, and online scanners, only 53 percent. Some tools crashed or hung up after completing the rootkit scans, and those were counted as “not detected.”

Security suites did better detecting inactive rootkits than active ones -- most found all (or nearly all) 30. But detecting and cleaning up active rootkits -- which is the task that AV-Test.org considers the “real rootkit test” -- was another story.

---

via Slashdot

I wonder where AV-Test.org gets the rootkits to test?

Friends at an AV company? Or maybe they just bring their kids' computers
to work.

edit -- From the article, this caught my eye: "Some tools crashed or hung up after completing the rootkit scans, and those were counted as “not detected.”"

I use IceSword and often see it crash on badly infected machines. Might try another tool like RootkitRevealer on those. Neither removes rootkits as far as I know.

What's everybody using on rootkits here? Anybody?

A lot of them are open source or u can find them on the web pretty easy

Quote:

---

Originally Posted by brokencrow

edit -- From the article, this caught my eye: "Some tools crashed or hung up after completing the rootkit scans, and those were counted as “not detected.”"

---

This is the point large red flags of system instability would have me format and reinstall to ensure it is not a hardware issue.

So in a sense the malware or "rootkit" is detected as the system becomes unstable with the application crashes or errors.

AFAIK...the only way to clean a rooted system is to format and reinstall...as you could never be sure what has been done to the system.

This because anti malware is a reactive technology.....detecting known malware.....opposed to a proactive or preventative application such as the use of limited users, firewalls and safe surfing habits .

Not saying these measures will eliminate malware as a whole...but greatly reduces the infections.

My humble opinion as always.

MLF

Quote:

---

Originally Posted by morganlefay

This is the point large red flags of system instability would have me format and reinstall to ensure it is not a hardware issue.

So in a sense the malware or "rootkit" is detected as the system becomes unstable with the application crashes or errors.

AFAIK...the only way to clean a rooted system is to format and reinstall...as you could never be sure what has been done to the system.

---

It still begs the question, "What is a rooted system?" Ask ten admins and
you'll get a number of answers (ten, maybe?). If the guys at AV-Test are
half-right, we really don't know for sure when a system is rooted. We know
when it's unstable and can make an educated guess (aka judgement call),
which is what we most often do. I chuckle when users (and even admins)
think of IT as an exact science. I find it far from that.

It ultimately gets down to what you can live with. In an enterprise environment,
"not much"...don't even format and reinstall. Just ghost the d@mn thing
with the proverbial standard image. On a home or SOHO system, apps and
data aren't planted on a server. Formatting and reinstalling present a new
set of problems. I will sometimes throw in a "sfc /scannow" to replace any
corrupted system files after cleaning up a bad malware infection. They'll be
reinfected soon enough if they keep it up. Most users don't 'get' what we
do and just want it to work.

Quote:

---

Originally Posted by morganlefay

This because anti malware is a reactive technology.....detecting known malware.....opposed to a proactive or preventative application such as the use of limited users, firewalls and safe surfing habits .

Not saying these measures will eliminate malware as a whole...but greatly reduces the infections.

My humble opinion as always.

---

Technology humbles us all. Ben Franklin's advice that an ounce of prevention
is worth a pound of cure holds more true than ever, particularly IT. I have
some users I've dealt with going on 8 years, and they've certainly come along.
Clean it up and keep to their budget. And just as important, warn them off
of their behavior (sin sites). As for cleaning rootkits, they are 'married' to
malware, so cleaning malware and regedits seem to be the order of the day.

Still curious what else folks are using on rootkits in Windows.

BTW: Pandas product line is reactive as well as proactive. This is different from other vendors.

www.infectedornot.com
www.activescan.com

Let me know if you need anything Panda wise and I will hook you up.

I do not no if any of you have come across this :http://www.microsoft.com/emea/spotli...px?videoid=359

Well worth an hour of any ones time to watch.

MLF you bring up an issue covered in the video, Resticted user account. Basicaly that is not going to give you much protection in the future.

As for what tools to use, use them all, as many as you can find. here's a list of some that I have used.

Regnuls
Autoruns
Process Explorer
IceSword
Backlight
TCPView
Rootkit Reveler

unhackme works well.

Wow...that looks like a great tool KorpDeath

Thanks

MLF

Hey there

Hmm, decided to try this "unhackme". Anyway downloaded it.

Well scanned the system. All of them were flase positives. It detected all my AV+FW processes and things like Cdburner and DAP.

Not satisfied!

Hi Cider,

You know that I am a script kiddie who just loves playing with all these tools? :D

I have noticed the same phenomenon with quite a few of them, in that they throw up "false positives". Actually they don't............... they are giving you a "heads up". If you loaded that software in the location it was found then everything is fine.............. if you didn't.......? :eek:

I was messing with some anti-dialer stuff a while back............ complained about all my ISP connection software............ well, they are dialers aren't they?

Personally I prefer an aggressive application, as I will look at what it tells me it considers suspicious.

Problem is that a legitimate application might be loaded with malicious intent?

Shame is that you cannot really recommend these hypersensitive applications to people who don't understand them, and those are the people who are most vulnerable? :(

just my thoughts.............

Quote:

---

Originally Posted by Cider

Hey there

Hmm, decided to try this "unhackme". Anyway downloaded it.

Well scanned the system. All of them were flase positives. It detected all my AV+FW processes and things like Cdburner and DAP.

Not satisfied!

---

As stated there will always be false positives with this type of software....

Personally I would like to know if there is some app calling home are "acting" like a root kit......remember the Sony DRM scandal :)

http://en.wikipedia.org/wiki/2005_So...ection_scandal

Note the last sentence

Quote:

---

The Sony BMG CD copy prevention scandal concerns the copy prevention measures included by Sony BMG on compact discs in 2005. Sony BMG included the Extended Copy Protection (XCP) and MediaMax CD-3 software on music CDs. XCP was put on 52 titles[1] and MediaMax was put on 50 titles.[2] This software was automatically installed on Windows desktop computers when customers tried to play the CDs. The software interferes with the normal way in which the Microsoft Windows operating system plays CDs, opening security holes that allow viruses to break in, and causing other problems. It is widely described as spyware.

As a result, a number of parties have filed lawsuits against Sony BMG; the company ended up recalling all the affected CDs; and greater public attention was drawn to the issue of commercially-backed spyware.

---

:eek7:

MLF

If that is the same Article that I think it is, it came up with the decision that Vista detected and prevented every rootkit they tried to install.

PS, New here- Mostly old members in this thread. Buenos Dios old members :)

I see. Well atleast my system is okay then :)

I am being too lazy, I will go through the suspicious files / processes that pop up.

Ill give it another go.

Thanks.