Detecting and Removing Rootkits in a Nutshell

** FOR HJT HELPERS

Categorizing the rootkit detection and removal method is solely based on my personal opinion. I will appreciate any feedback or reports of inaccuracies, fallacies, found in this article:

abuibrahim0 AT gmail DOT com

Important Guidelines Before Removing a Rootkit if a rootkit is found on a machine:

1. Backup all important data, emails, documents, etc.

Þ this is just for safety measures. Removing a rootkit can cause system instability and a antirootkit software may sometimes remove a system file along with the rootkit. This step is particular important when using automatic tools for rooktit detections and removal.

2. Disconnect from the internet

3. Close down All Scheduling/Updating + Running Background tasks etc.

4. Disable real-time monitoring programs

5. When scanning for a rootkit, do not use the computer at all

6. Use 2 or more rootkit scanners

Þ Never rely on the results of one anti-rootkit software. Rootkits uses different technologies for hiding and no single anti-rootkit can find all rookit techniques.

Methods of Detecting and Removing Rootkits:

1. Automatic Detection and Removal

2. Semi-automatic Detection and Removal

3. Manual Detection and Removal

4. Advanced Detection and Removal

1) Automatic Detection and Removal:

Tools that automates the process of detecting a rootkit and removes them. Minimal skills are required to uses these tools.

Examples:

1. F-secure online scan: http://support.f-secure.com/enu/home/ols.shtml

2. AVG antirootkit

3. Trend-micro Rootkit Buster

4. Panda Antirootkit

5. Avira Antirootkit

6. Mcafee Rootkit Detective

7. Sophos Antirootkit

Disadvantage of using these Automated tools:

1. Highly unstable software. Have used it once at the rootkit revelations forum and it destroyed windows beyond repair

2. Highly unpredicatable -> they sometimes report that they remove a rootkit and they actually did nothing

3. Highly unreliable -> cannot find rootkits that use newer techniques.

The automatic tools are good though if you are removing the most popular or classic rootkits such as pe386.

2) Semi-automatic Detection and Removal:

- For more experienced users

- You will need to distinguish rootkits from false positives

- Such tools will highlight entries that are predicted to be rootkits. For example Icesword and GMER will highlight services and processes that are rootkits. RKunhooker will tag what are hidden.

Examples:

1. GMER

2. Icesword

3. Rootkit Unhooker

4. Darkspy

5. SVV

6. VICE

7. RootRepeal

Detection and Removal are split into two ways:

1. Rookits that use drivers (more common):

- Two important indicators are: hidden service, and rootkit files.

Rootkit files can be found at processes list (ex. Icesword), SSDT list (ex Icesword), rootkit file scan (ex. GMER), rootkit file browsing (ex. Darkspy) or from the service image path in the registry.

- Rootkit Removal steps:

Step1: Stop or Disable Service

Step2: End executable process(s)

Step3: Delete service and related files

2. Rootkits that use inline hooking or DLL hooking such as Vanquish (less common):

- One important indicator: presence of a dll file

The dll file can be found by two ways: "Code Hook" scan using RKunhooker (recommended), the other way is doing a full file scan using GMER or any other anti-rootkit tool

Note: GMER and Icesword do not automatically find these kind of rookits. Only when a full file scan is performed or rootkit file browsing, some hidden files may appear.

Also

- Removal steps:

Step1: perform "Code Hook" scan using RKunhooker

Step2: highlight all entries related to culprit dll file and click 'unhook selected'

Step3: End executable related process(s) if applicable (ex. vanquish.exe)

Step4: Delete dll and related files

3) Manual Detection and Removal:

¨ Manual Detection Tools:

1. RootkitRevealer

2. Rootkit Hook Analyzer

3. Sysprot

For how to know if there is a rootkit present in the rootkitrevealer results:

http://abuibrahim12.blogspot.com/2009/07/does-my-rootkitrevealer-log-show.html

To know how to intepret rootkitrevealer logs:

http://forum.sysinternals.com/forum_posts.asp?TID=2408&PN=1

¨ Manual Removal Methods:

1. Manually deleting files in safe mode

» given that the rootkit does not use SafeBoot keys to be hidden in safe mode as well

2. DOS commands

» may or may not work. HackerDefender can be completely deactivated and cleaned up using this method

such as:

Sc stop RKservice

Sc delete RKservice

Net stop RKservice

REG DELETE RKregpath

3. Manual Removal Tools

Example:

- Delete on reboot using killbox

- Avenger

- Combofix

In combofix the rootkit:: directive is not always needed. I found that file::, driver:: and killall:: are enough with most rootkits I have encountered.

4) Advanced Detection and Removal:

1. Slaving hard-drive to another computer and perform a normal anti-virus scan

2. Using a Bootable CD-ROM such as BartPE and UBCD4Win

3. Offline file comparisons: http://abuibrahim12.blogspot.com/2009/07/detecting-rootkits-in-windows.html

MBR Rootkits:

- Detection: see http://www2.gmer.net/mbr/

as you can observe the presence of the phrase: "\Device\Harddisk0\DR0" any where in a GMER log is an indication of an MBR rootkit regardless of its variant. However, you may need to verify first that changes done to MBR is not perfomed by a legitimate application such as acronis.

- Removal:

1. Windows Recovery Console:

Windows XP/2k: fixmbr

Windows Vista: bootrec.exe /fixmbr

2. Stealth MBR rootkit detector 0.2.2 by Gmer:

http://www2.gmer.net/mbr/mbr.exe

3. ESET Mebroot Remover:

http://www.eset.cz/download/emebremover

Recommended readings:

http://www.securityfocus.com/infocus/1850

http://safecomputing.umn.edu/guides/scan_unhackme.html

http://www.5starsupport.com/tutorial/rootkits.htm

http://www.microsoft.com/technet/sysinternals/utilities/rootkitrevealer.html

A. Elshafei

Detecting Rootkits in Windows Millennium/98/95

Detecting rootkits in windows 98 and ME is very difficult. There are no tools existing today that can detect or remove active rootkits for windows 98 and ME. If you contracted a rootkit in windows 98 or ME then the only guaranteed solution is to format/reinstall. For those who avoid formats at all cost, I have created a procedure that can be used as a guideline for detection. However these guidelines should be used only for those who have a high level of expertise with computers.

Background: Basically, the procedure is to compare a list of files/folders in the root drive (c:) drive that are visible in windows with a list of files of root drive in dos. Any files that show up in the dos list that were not visible in windows could be potential rootkits. The reason for disabling any active processes in windows before generating the list is to minimize the number of temporary files to ease up comparison and false positives. Active processes use temp files that my appear in dos and not in windows.

First, do you have a windows 98 boot disk? If not please do the following:
1. get a clean floppy disk and place it in your floppy drive.
2. Click Start -> Point to Settings and click Control Panel -> Click Add/Remove Programs -> Click the Startup Disk tab -> Click the Create Disk button
-> When finished, click OK
3. do not remove the floppy disk, keep it in there.

Second, please shut-down all running applications including the browser you are reading this from.
Try to turn off or disable as many applications as you can.

Third, clean up the clutter in the computer using ccleaner:
http://wiki.battlespam.info/index.php?title=Malware_Removal:_Clean_out_the_Clutter

Do not open or run anything once you are done with ccleaner.

Fourth, click start -> run -> type: command and press enter
Please type the following commands each followed by an enter key:
cd \
dir /s /b /a-d > files1.txt

Fifth, when the commands are done, please shutdown the computer with the floppy drive inside

Sixth, turn on the computer and make sure that your computer is booting from the floppy drive. Otherwise, you may have to enter the bios and set the boot sequence.

If booting from the floppy is successfully, at the first screen, select the second option that says something like: 'start the computer with out cd-rom support'

Once the command line appears, try to determine the drive letter of your hard-disk that was assigned by the boot disk. If the drive letter is not C and you are not sure which drive was assigned to the hard-disk, then please do the following through trial and error:
step1: type the following command:
C:
press enter
step2: then type dir and enter. You should be able to see the windows folder along with other directories somewhere at the end of the list. If no directories appear, then repeat step1 with a different letter such as D: or E:

Seventh, once you are in the correct hard-drive letter, please type the following command and press enter:
dir /s /b /a-d > files2.txt

Once done, remove the boot disk and restart your computer normally into windows.

Eighth, now we need to compare the files files1.txt with files2.txt .

The best way to compare the files is to use an automatic diff program. Two good programs are:
- Compare-It: http://www.grigsoft.com/wc3setup.zip

- Examdiff: http://www.prestosoft.com/edp_examdiff.asp

Compare-It has an advantage is that it will color in red the exact difference within common line in the two files. This is an advantage because it will make it easy to recognize and skip the lines with file names that were shortened in DOS. You can also generate an htlml report of the results.
ExamDiff has the advantage that you can only display the line differences from the two files. Compare-It also has that feature, but isnt as effective since it will also display common lines between two files that were ordered differently.

If you decide to use Compare-It, download, unzip and install the program.
Start the program-> browse the text file you generated from dos and click open:
files2.txt
> browse the other text file you generated from windows and click open: files1.txt
Now In the left pane, the lines that are colored in green are the files that appeared in DOS but not in windows.
The lines that are colored in blue are files that exist in both files but with some changes such as shortening the file names. Within the blue lines you will notice the difference colored in red.
You can simply skim quickly through the blue lines.
The lines colored in red in the right pane, are files that appeared in windows but not in dos. You can ignore these files.
The lines colored in black are common lines between the two files and these should be ignored.

Rootkits will likely be any files that show up in files2.txt that does not exist in files1.txt. If any of these lines are found, then double-check by actually trying to browse to these files while in windows and see if you are unable to locate them. Also make sure these files are not legitimate.

Ninth, if a rootkit file is suspected. You can rename the file while in dos. Boot the computer from the floppy disk as performed earlier. Perform the following command:
ren path/filename.xxx path/emanelif.bak

Reboot into windows and make sure everything is running fine.