SysInternals Releases RootkitRevealer

Brian writes "In the wake of news that Microsoft is developing prototype software to detect rootkits, SysInternals has released a free rootkit detection tool named RootkitRevealer for all Windows systems NT4+. RootkitRevealer works by "comparing the results of a system scan at the highest level with that at the lowest level," and detects every known rootkit at rootkit.com. They also report that it is impossible to know for sure that a given system is clean from within it, but that defeating their tool would require a level of sophistication not yet seen. You can download RootkitRevealer."

Sysinternals is great

[Dr.Opveter]

I love their stuff [sysinternals.com]

No really, they have class utilities for free, thanks Sysinternals

If you run linux

[Apreche]

If you run linux you can use chkrootkit [chkrootkit.org]

Re:A level of sophistication?

[johndiii]

As the sysinternals article suggests, boot from a known clean CD and do an "off-line" system scan. They make the point that it will never be possible to determine with absolute certainty that a system is clean from inside the system.

Re:So this is...

[interiot]

No... Rootkits CHANGE the results of system API calls for everything running on the system, to try to hide the fact that there are suspicious processes and files on your system.

RootKitRevealer doesn't change any results of API calls at all.

RootKits are a fairly precisely-defined thing, I don't think there's as much grey area here as you think there is.

Re:If you run linux

[slavemowgli]

You don't need to run Linux for chkrootkit. More or less any Un*x or Un*x-like OS will do fine:

"chkrootkit has been tested on: Linux 2.0.x, 2.2.x, 2.4.x and 2.6.x, FreeBSD 2.2.x, 3.x, 4.x and 5.x, OpenBSD 2.x and 3.x., NetBSD 1.6.x, Solaris 2.5.1, 2.6, 8.0 and 9.0, HP-UX 11, Tru64 and BSDI."

Re:Call to arms

[Taladar]

Viruses don't disable rootkits, they install them. Rootkits are replacement system programs/libraries to hide the intruder presence/activity on your computer

Re:Strange...

[SpinJaunt]

If you are using Windows XP SP2 or Windows 2003 SP1, you'll need to turn off DEP (Data Execution Prevention) by editing your BOOT.INI and have change from

/noexecute=optin

to

/noexecute=AlwaysOff

http://msdn.microsoft.com/library/default.asp?url= /library/en-us/ddtools/hh/ddtools/BootIni_aff45176 -bd02-43cf-9895-c212fa392de2.xml.asp [microsoft.com] I had this problem with Daemon tools and Acohol 120%

Re:If you run linux

[Taladar]

Don't forget to run it from a known-good live-cd, otherwise it won't do you much good since it is just a script that uses several system programs.

Microsoft BSA

[TheFlyingGoat]

While you're at it, download the Microsoft Baseline Security Tool [microsoft.com]. It's not quite the same, but it's an excellent tool for anyone looking to make their Windows box more secure. It can also scan computers on your network (that you have rights on), so you can easily find all the Windows boxes on your network that aren't up to date on their patches, have Guest accounts enabled, or other bad things.

Re:Um

[Anonymous Coward]

Not even close. rootkits change system innards in such a way that processes magically don't show up in /proc, or 'ps' output, that md5 of 'somefile' returns a false signature, and other bits of magic.

The point of a rootkit is to subvert the system at such a deep level that tools like tripwire are fooled.

Re:About the software

[Anonymous Coward]

I don't know anything about rootkits, or this software, is it safe to delete everything it detects or is this for people that know exactly what they are looking for and you only delete a couple of things it finds??

Short answer - no. It will flag stuff that is hidden from the Native Windows API but not everything that's hidden is bad.

It's kind of a moot point anyway. If you find that you've been rootkitted you shouldn't try and clean it. You should reach for your original install media and start over.

Alternatively, take off and nuke the site from orbit. Apparently it's the only way to be sure.

Simple, really

[sczimme]

Why are they called rootkits in windows, when the superuser is called "administrator" and not "root"?

The entity/app/device known as a rootkit was first popularized (so to speak) as a way for the intruder to hide his tracks and maintain root access on a Unix machine. If rootkits had first become popular (again, so to speak) on Win32 machines they likely would have been called adminkit or similar.

In a general techspeak sense, though, (root == full access); most techies have at least a nodding acquaintance with Unix so the idea of root makes sense regardless of the OS in question.

The cynical part of me would like to mention that in years past there really wasn't much need for rootkits on Win32 machines: if the intruder wanted to keep privileged access it would be relatively simple matter to acquire it again.

Re:Sysinternals is great

[gowen]

A screen saver that fakes Windows system crashes? xscreensaver has had one of those [brown.edu] for years. (It also simulates Linux and Solaris kernel dumps, Macintosh Bombs, Amiga Guru Meditations and others)

Sysinternals.com is a Good site

[tristanj]

Sysinternals has been around a while. These guys really know their stuff when it comes to Windows operating systems.

Here are some good tools of their that I use frequently

Autoruns

http://www.sysinternals.com/ntw2k/freeware/autorun s.shtml [sysinternals.com] shows a complete list of programs that start up automatically when windows starts. Filemon

http://www.sysinternals.com/ntw2k/source/filemon.s html [sysinternals.com] Filemon shows all filesystem access, so you can see which files programs are accessing. I have found it very useful in diagnosing software problems and fighting spyware. Regmon

http://www.sysinternals.com/ntw2k/source/regmon.sh tml [sysinternals.com] Like filemon, but for registry access. Shows keys being read and created. Pagedefrag

http://www.sysinternals.com/ntw2k/freeware/pagedef rag.shtml [sysinternals.com] Defrags the registry hive (most of the registry is stored on disk but is not typically defragmented by many tools) and paging file. Also many others here

http://www.sysinternals.com/ntw2k/utilities.shtml [sysinternals.com]

IMHO any windows admin should have this stuff installed. Many of the utils come with source code.

Re:A level of sophistication?

[Hal_Porter]

Hmm, it's interesting idea, and you could do it back in the Dos days - load above Dos, hook some vectors that allow you wake after it loads and the system is yours.

The problem is that Windows takes over completely - it switched into protected mode, overwrites all memory and generates its own interrupt vector table. Hiding from Windows wouldn't be too hard - you'd just hook the Bios to tell it not to use bits of memory when NTDETECT runs. The problem would be getting your code to run after Windows loads.

Actually, you could imagine a virus that virtualises the CPU (maybe with the Vanderpool stuff). That way you'd get called whenever Windows did some trappable operation like changing the page table. You'd wait until system structures has stabilised and then install your Api hooks.

It's non trivial though.

Re:How do you REMOVE a rootkit?

[denis-The-menace]

Just use MS SOP to fix 99% of problems: Re-install

This irony here is that it's what you have to do to be 100% sure that no rootkits exists in ANY OS.

Re:Strange...

[wo1verin3]

Or you could right click on My Computer, click 'advanced', click on 'settings' in the performance box, and then on the 'Data Execution Prevention' tab.

Re:Better solution.

[cypherz]

The hardware that the hosted OS sees is generic virtualized hardware. I've used the vm containing my Windows dev environment on 4 machines over the two years I've been using it. I haven't had to reconfigure W2K once. As long as the DVD (or other hardware) is seen by linux, then vmware will virtualize it and present it to the hosted OS as a generic dvd (or whatever is appropriate). For example, the dvd on my current notebook is a hitachi. It is presented to Windows as an NEC/Vmware CD.

Re:my office pc is infected = howto remove?

[erlenic]

The only way to remove a root kit is to format the drive and reinstall the OS. Have fun!

Seriously though, at least two of those are listed in the article as being fine. Looking over the list, I don't see anything suspicious, and I have many of the same things listed for my system. Although if I'm reading that third line right, you have 9 GBs of bad clusters. You might want to scandisk.

Re:Strange...

[PurpleXanathar]

You can reenable it after installing Deamon Tools and Alcohol (at least it worked for me).

Re:An argument in favor of NTFS

[Hal_Porter]

You'd need a boot CD that looked at all the boot records and maybe even compared LILO and Grub MD5s^H^H^HSHA1s^H^H^H^HSHA256s against known good values.

Most people who run XP don't use a bootmanager, so the mere presence of one should be enough to ask the user why it's there, with the default action to disable it by installing the standard MBR / bootsector.

Oh, and microsoft kernel mode binaries are public key signed since windows 2000, so you don't need MD5/SHA - you can see if they are haxored or not by checking the signature.

Interestingly enough, you can do Start->Run sigverif.exe on a live system. The problem with sigverif is that it dumbly scans the windows directory for all files, not just the critical ones - I get warnings on a bunch of dlls, because they came with ancient 3rd party software.

Signature verification is the way to check the files on a bootdisk like BartPE or WinPE, though it would be need to be a bit smarter than sigverif.

Your system is fine...

[Leadhyena]

There is nothing wrong with your system. In the .chm file provided with the RootkitRevealer it explains:

Hidden from Windows API discrepancies are the ones exhibited by most rootkits, however you should expect to see a number of such entries on any NTFS volume since NTFS hides its metada files, such as $MFT and $Secure, from the Windows API. In addition, there are a number of Registry keys that are inaccessible from the Windows API and will report as access-denied discrepancies.

This explains all of the listed entries except for the last one(the $BADCLUS entry is due to missing clusters, like the previous poster said, and you need to do a scandisk). Your last entry is there because you had Firefox open when you ran the scan. Again from the help file:

Files or Registry data created after a scan starts will also show up as discrepancies, so run RootkitRevealer on an idle system.

You're fine, although your reaction will be similar to many other users who will see the same thing and freak out similarly, because they don't understand NT internals... I think this is not a good tool to release to the masses, and should only be used by sysadmins, just like how HijackThis is really good for detecting spyware, but only to someone who knows something about Windows systems.

Not to mention that if you have a rootkit installed, you better be prepared to wipe your system clean and reinstall the OS, because otherwise there's no way of knowing if you have the whole thing removed.

Re:handy

[hepwori]

Can you explain how it doesn't qualify? I think you may be confused: you mentioned non-compliance with the HIG, but the HIG isn't referenced at all from the "Designed for Windows XP" specification.

Take a look at the Designed for Windows XP Application Specification [microsoft.com] and let us know which bit you think Office doesn't comply with.

Re:I wonder how well this would work.

[Xenna]

Polymorphic: Useless because the scanner would check for the original binaries. If the checksum doesn't match a know good list -> alert. Viruses don't bother with polymorphism anymore since scanner manufacturers defeat these schemes easily these days.

Stealth: ALL rootkits are stealth (hide their presence). That's the whole point of a rootkit.

Dead space: Rubbish, data in dead space is never executed. It would have to be bootstrapped by normally visible code which is detected in the usual ways.

Bad sector: See dead space

Virtual system: See stealth

All in all I'd say your post is somewhat overrated ;)

Re:halting problem

[johndiii]

Your point is good (particularly the virus/scanner "arms race"), but not because of the halting problem. What you meant to say was the undecidability of the halting problem. Even so, to write off all automated analysis of software on that basis is a gross mis-generalization of the halting problem [wikipedia.org]. The undecidability of the halting problem is a very narrow statement, and depends completely on the use of an algorithm to analyze a representation of itself. It is a theoretical statement of the power of an slgorithm, and has never been applied in a practical circumstance (to my knowledge, anyway; any such example would be eagerly anticipated). In fact, per the Wikipedia article, there is a generalized algorithm to solve the halting problem for any finite machine (though it is so inefficient as to be useless).

Re:If you run linux

[OneArmedMan]

RKHunter is another good RootKit checker for your Favourite Unix flavour.

http://www.rootkit.nl/projects/rootkit_hunter.html [rootkit.nl]