Warnings about RootKits 3

[2ffat]

Microsoft has issued a new warning about RootKits. These programs spy on the system and may even change the kernel.

http://www.computerworld.com/printthis/2005/0,4814,99843,00.html

They may also be the cause of some Blue Screens o' Death.

http://support.microsoft.com/default.aspx?scid=kb;en-us;894278

James P. Cottingham
-----------------------------------------
^{To determine how long it will take to write and debug a program, take your best estimate, multiply that by two, add one, and convert to the next higher units.}

 

[bcastner]

The latter KB article is not a rootkit exploit.

 

[bcastner]

The Sysinternals wizards, Mark Russinovich and Bryce Coqswell, have released RootkitRevealer, freeware:

RootkitRevealer is an advanced root kit detection utility. It runs on Windows NT
4 and higher and its output lists Registry and file system API discrepancies that may indicate the presence of a user-mode or kernel-mode rootkit. RootkitRevealer successfully detects all persistent rootkits published at

http://www.rootkit.com,

including AFX, Vanquish and HackerDefender (note: RootkitRevealer is not intended to detect memory-based rootkits like Fu that don't survive reboots).

What is a Rootkit?
The term rootkit is used to describe the mechanisms and techniques whereby malware, including viruses, spyware, and trojans, attempt to hide their presence from spyware blockers, antivirus, and system management utilities. There are several rootkit classifications depending on whether the malware survives reboot and whether it executes in user mode or kernel mode.

Download and discussion of Rootk kit exploits:

http://www.sysinternals.com/ntw2k/freeware/rootkitreveal.shtml

 

[2ffat]

Cool!


James P. Cottingham
-----------------------------------------
^{To determine how long it will take to write and debug a program, take your best estimate, multiply that by two, add one, and convert to the next higher units.}

 

[bcastner]

Very cool.

Not an absolute solution, but sufficient at this state of the art.

 

[jlockley]

I downloaded and ran the program. It listed every single file I had in my folders (about 22,000) as not visible (a symptom of a bootkit). We are neither impressed nor amused.