charlestek
October 22nd, 2005, 10:50 PM
Hi. I just tried the System Virginity Verifier cited from the Sunbelt Software Blog <URL: http://www.invisiblethings.org/tools.html >
http://www.rootkit.com/newsread.php?newsid=357
(Description below in asterisked section)
and it warns me that I have a massive difference between kernel32.dll on disk and in memory on my WinXp Pro Sp2 System. I also have ZoneAlarm Pro on my system and Pivx's Pre-Empt. The log shows the Zonealarm vsdatant.sys driver, and says I have a bad problem in kernel32.dll. Can anyone offer an opinion as to whether this could a false positive, or do I need to panic???
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
module ntoskrnl.exe [0x80800000 - 0x80a14100]:
0x8080403d [RtlPrefetchMemoryNonTemporal()+0] 1 byte(s): exclusion
filter: single byte modification
file :c3
memory :90
verdict = 1
0x80804aa2 18 byte(s): exclusion filter: KeFlushCurrentTb()
file :d8 0f 22 d8 c3 0f 20 e0 25 7f ff ff ff 0f 22 e0 0d 80
memory :e0 25 7f ff ff ff 0f 22 e0 0d 80 00 00 00 0f 22 e0 c3
verdict = 1
0x80804aba 1 byte(s): exclusion filter: single byte modification
file :c3
memory :00
verdict = 1
0x808078ea 1 byte(s): exclusion filter: single byte modification
file :05
memory :06
verdict = 1
0x8080b724 [KiServiceTable[31]] 4 byte(s): KiServiceTable HOOK:
address 0xb96d01c0 is inside vsdatant.sys module
[0xb96b5000-0xb970e000]
target module path: \??\C:\WINDOWS\system32\vsdatant.sys
file :ad 24 8b 80
memory :c0 01 6d b9
verdict = 2
0x8080b73c [KiServiceTable[37]] 4 byte(s): KiServiceTable HOOK:
address 0xb96cd2d0 is inside vsdatant.sys module
[0xb96b5000-0xb970e000]
target module path: \??\C:\WINDOWS\system32\vsdatant.sys
file :48 9d 89 80
memory :d0 d2 6c b9
verdict = 2
0x8080b74c [KiServiceTable[41]] 4 byte(s): KiServiceTable HOOK:
address 0xb96e5864 is inside vsdatant.sys module
[0xb96b5000-0xb970e000]
target module path: \??\C:\WINDOWS\system32\vsdatant.sys
file :61 77 89 80
memory :64 58 6e b9
verdict = 2
0x8080b764 [KiServiceTable[47]] 4 byte(s): KiServiceTable HOOK:
address 0xb96e4680 is inside vsdatant.sys module
[0xb96b5000-0xb970e000]
target module path: \??\C:\WINDOWS\system32\vsdatant.sys
file :14 63 8d 80
memory :80 46 6e b9
verdict = 2
0x8080b768 [KiServiceTable[48]] 4 byte(s): KiServiceTable HOOK:
address 0xb96e48a0 is inside vsdatant.sys module
[0xb96b5000-0xb970e000]
target module path: \??\C:\WINDOWS\system32\vsdatant.sys
file :1a 94 8a 80
memory :a0 48 6e b9
verdict = 2
0x8080b770 [KiServiceTable[50]] 4 byte(s): KiServiceTable HOOK:
address 0xb96e7280 is inside vsdatant.sys module
[0xb96b5000-0xb970e000]
target module path: \??\C:\WINDOWS\system32\vsdatant.sys
file :1b d4 88 80
memory :80 72 6e b9
verdict = 2
0x8080b7a0 [KiServiceTable[62]] 4 byte(s): KiServiceTable HOOK:
address 0xb96cd7b0 is inside vsdatant.sys module
[0xb96b5000-0xb970e000]
target module path: \??\C:\WINDOWS\system32\vsdatant.sys
file :07 cc 8f 80
memory :b0 d7 6c b9
verdict = 2
0x8080b7a4 [KiServiceTable[63]] 4 byte(s): KiServiceTable HOOK:
address 0xb96e5fb0 is inside vsdatant.sys module
[0xb96b5000-0xb970e000]
target module path: \??\C:\WINDOWS\system32\vsdatant.sys
file :78 9f 8b 80
memory :b0 5f 6e b9
verdict = 2
0x8080b7ac [KiServiceTable[65]] 4 byte(s): KiServiceTable HOOK:
address 0xb96e5d90 is inside vsdatant.sys module
[0xb96b5000-0xb970e000]
target module path: \??\C:\WINDOWS\system32\vsdatant.sys
file :fa 79 8b 80
memory :90 5d 6e b9
verdict = 2
0x8080b7b8 [KiServiceTable[68]] 4 byte(s): KiServiceTable HOOK:
address 0xb96e3fc0 is inside vsdatant.sys module
[0xb96b5000-0xb970e000]
target module path: \??\C:\WINDOWS\system32\vsdatant.sys
file :b6 ca 89 80
memory :c0 3f 6e b9
verdict = 2
0x8080b82c [KiServiceTable[97]] 4 byte(s): KiServiceTable HOOK:
address 0xb96cb380 is inside vsdatant.sys module
[0xb96b5000-0xb970e000]
target module path: \??\C:\WINDOWS\system32\vsdatant.sys
file :ec 98 8c 80
memory :80 b3 6c b9
verdict = 2
0x8080b830 [KiServiceTable[98]] 4 byte(s): KiServiceTable HOOK:
address 0xb96e6160 is inside vsdatant.sys module
[0xb96b5000-0xb970e000]
target module path: \??\C:\WINDOWS\system32\vsdatant.sys
file :f0 3c 8d 80
memory :60 61 6e b9
verdict = 2
0x8080b858 [KiServiceTable[108]] 4 byte(s): KiServiceTable HOOK:
address 0xb96e74e0 is inside vsdatant.sys module
[0xb96b5000-0xb970e000]
target module path: \??\C:\WINDOWS\system32\vsdatant.sys
file :fc c2 89 80
memory :e0 74 6e b9
verdict = 2
0x8080b878 [KiServiceTable[116]] 4 byte(s): KiServiceTable HOOK:
address 0xb96cd5e0 is inside vsdatant.sys module
[0xb96b5000-0xb970e000]
target module path: \??\C:\WINDOWS\system32\vsdatant.sys
file :e3 9c 89 80
memory :e0 d5 6c b9
verdict = 2
0x8080b890 [KiServiceTable[122]] 4 byte(s): KiServiceTable HOOK:
address 0xb96e3dc0 is inside vsdatant.sys module
[0xb96b5000-0xb970e000]
target module path: \??\C:\WINDOWS\system32\vsdatant.sys
file :96 cc 89 80
memory :c0 3d 6e b9
verdict = 2
0x8080b8a8 [KiServiceTable[128]] 4 byte(s): KiServiceTable HOOK:
address 0xb96e3b90 is inside vsdatant.sys module
[0xb96b5000-0xb970e000]
target module path: \??\C:\WINDOWS\system32\vsdatant.sys
file :74 19 8b 80
memory :90 3b 6e b9
verdict = 2
0x8080b9ac [KiServiceTable[193]] 4 byte(s): KiServiceTable HOOK:
address 0xb96e6420 is inside vsdatant.sys module
[0xb96b5000-0xb970e000]
target module path: \??\C:\WINDOWS\system32\vsdatant.sys
file :32 62 97 80
memory :20 64 6e b9
verdict = 2
0x8080b9c8 [KiServiceTable[200]] 4 byte(s): KiServiceTable HOOK:
address 0xb96cfe90 is inside vsdatant.sys module
[0xb96b5000-0xb970e000]
target module path: \??\C:\WINDOWS\system32\vsdatant.sys
file :ba fe 89 80
memory :90 fe 6c b9
verdict = 2
0x8080b9d8 [KiServiceTable[204]] 4 byte(s): KiServiceTable HOOK:
address 0xb96e66a0 is inside vsdatant.sys module
[0xb96b5000-0xb970e000]
target module path: \??\C:\WINDOWS\system32\vsdatant.sys
file :56 4d 97 80
memory :a0 66 6e b9
verdict = 2
0x8080b9f0 [KiServiceTable[210]] 4 byte(s): KiServiceTable HOOK:
address 0xb96d0370 is inside vsdatant.sys module
[0xb96b5000-0xb970e000]
target module path: \??\C:\WINDOWS\system32\vsdatant.sys
file :ca e9 8a 80
memory :70 03 6d b9
verdict = 2
0x8080ba28 [KiServiceTable[224]] 4 byte(s): KiServiceTable HOOK:
address 0xb96cd920 is inside vsdatant.sys module
[0xb96b5000-0xb970e000]
target module path: \??\C:\WINDOWS\system32\vsdatant.sys
file :2c 0e 8a 80
memory :20 d9 6c b9
verdict = 2
0x8080ba68 [KiServiceTable[240]] 4 byte(s): KiServiceTable HOOK:
address 0xb96cb1f0 is inside vsdatant.sys module
[0xb96b5000-0xb970e000]
target module path: \??\C:\WINDOWS\system32\vsdatant.sys
file :d6 7e 8c 80
memory :f0 b1 6c b9
verdict = 2
0x8080ba84 [KiServiceTable[247]] 4 byte(s): KiServiceTable HOOK:
address 0xb96e5b80 is inside vsdatant.sys module
[0xb96b5000-0xb970e000]
target module path: \??\C:\WINDOWS\system32\vsdatant.sys
file :1d dc 89 80
memory :80 5b 6e b9
verdict = 2
0x8080baac [KiServiceTable[257]] 4 byte(s): KiServiceTable HOOK:
address 0xb96e4ad0 is inside vsdatant.sys module
[0xb96b5000-0xb970e000]
target module path: \??\C:\WINDOWS\system32\vsdatant.sys
file :2b bc 8a 80
memory :d0 4a 6e b9
verdict = 2
0x8080bac0 [KiServiceTable[262]] 4 byte(s): KiServiceTable HOOK:
address 0xb96cb530 is inside vsdatant.sys module
[0xb96b5000-0xb970e000]
target module path: \??\C:\WINDOWS\system32\vsdatant.sys
file :54 14 94 80
memory :30 b5 6c b9
verdict = 2
0x8080bac4 [KiServiceTable[263]] 4 byte(s): KiServiceTable HOOK:
address 0xf7a1f63c is inside uphcleanhlp.sys module
[0xf7a1f000-0xf7a21000]
target module path: \??\C:\WINDOWS\system32\Drivers\uphcleanhlp.sys
module file is NOT PRESENT!!!
file :2b 50 97 80
memory :3c f6 a1 f7
verdict = 3
module ntoskrnl.exe: end of details
kernel32.dll (7c800000 - 7c8f4000)... suspected! (verdict = 5).
module kernel32.dll [0x7c800000 - 0x7c8f4000]:
0x7c801af1 [LoadLibraryExW()+0] 6 byte(s): JMPing code (jmp to:
0x5f05001e)
address 0x5f05001e DOES NOT belong to ANY MODULE!
file :6a 34 68 88 e2 80
memory :ff 25 1e 00 05 5f
verdict = 5
0x7c80aa7b [FreeLibrary()+15] 4 byte(s): SUSPECTED code
modification:
file :dc ff ff ff
memory :bd 55 7f e2
verdict = 5
module kernel32.dll: end of details
SYSTEM INFECTION LEVEL: 5
0 - BLUE
1 - GREEN
2 - YELLOW
3 - ORANGE
4 - RED
--> 5 - DEEPRED
SUSPECTED modifications detected. System is probably infected!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
The woman who wrote it describes it:
***************************************************************************************************************
The idea behind SVV is to check important Windows System components, which are usually altered by various
stealth malware, in order to ensure system integrity and to discovery potential system compromise.
SVV 1.0 implements only code virginity verification which is the first step in SVV implementation and its task
is to ensure the integrity of the code sections of in-memory mapped kernel and usermode modules (that is kernel
drivers and usermode DLLs).
Yes, there are dozens of ways to write a rootkit not detectable by SVV 1.0, because SVV 1.0 is not intended to
be an ultimate solution - it's just a first step in building integrity based compromise detector. Next steps
will involve IDT, SDT, IRP dispatch tables checking, etc...
How SVV is different form VICE? SVV doesn’t look for a known patterns of infection as VICE does (JMP hooks)
just ensures in-memory code integrity. VICE seems to generate lots of false positives, while SVV was designed to
minimize the number of false positives. On the other hand, SVV 1.0 checks only code sections, while VICE is
able to check also IAT/EAT, SDT and IRP dispatch tables.
More details about SVV can be found in my recent HITB presentation:
[url]http://invisiblethings.org/papers/hitb05_virginity_verifier.ppt[/url]
SVV 1.0 can be downloaded here:
[url]http://invisiblethings.org/tools/svv-1.0-public.zip[/url]
http://www.rootkit.com/newsread.php?newsid=357
(Description below in asterisked section)
and it warns me that I have a massive difference between kernel32.dll on disk and in memory on my WinXp Pro Sp2 System. I also have ZoneAlarm Pro on my system and Pivx's Pre-Empt. The log shows the Zonealarm vsdatant.sys driver, and says I have a bad problem in kernel32.dll. Can anyone offer an opinion as to whether this could a false positive, or do I need to panic???
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
module ntoskrnl.exe [0x80800000 - 0x80a14100]:
0x8080403d [RtlPrefetchMemoryNonTemporal()+0] 1 byte(s): exclusion
filter: single byte modification
file :c3
memory :90
verdict = 1
0x80804aa2 18 byte(s): exclusion filter: KeFlushCurrentTb()
file :d8 0f 22 d8 c3 0f 20 e0 25 7f ff ff ff 0f 22 e0 0d 80
memory :e0 25 7f ff ff ff 0f 22 e0 0d 80 00 00 00 0f 22 e0 c3
verdict = 1
0x80804aba 1 byte(s): exclusion filter: single byte modification
file :c3
memory :00
verdict = 1
0x808078ea 1 byte(s): exclusion filter: single byte modification
file :05
memory :06
verdict = 1
0x8080b724 [KiServiceTable[31]] 4 byte(s): KiServiceTable HOOK:
address 0xb96d01c0 is inside vsdatant.sys module
[0xb96b5000-0xb970e000]
target module path: \??\C:\WINDOWS\system32\vsdatant.sys
file :ad 24 8b 80
memory :c0 01 6d b9
verdict = 2
0x8080b73c [KiServiceTable[37]] 4 byte(s): KiServiceTable HOOK:
address 0xb96cd2d0 is inside vsdatant.sys module
[0xb96b5000-0xb970e000]
target module path: \??\C:\WINDOWS\system32\vsdatant.sys
file :48 9d 89 80
memory :d0 d2 6c b9
verdict = 2
0x8080b74c [KiServiceTable[41]] 4 byte(s): KiServiceTable HOOK:
address 0xb96e5864 is inside vsdatant.sys module
[0xb96b5000-0xb970e000]
target module path: \??\C:\WINDOWS\system32\vsdatant.sys
file :61 77 89 80
memory :64 58 6e b9
verdict = 2
0x8080b764 [KiServiceTable[47]] 4 byte(s): KiServiceTable HOOK:
address 0xb96e4680 is inside vsdatant.sys module
[0xb96b5000-0xb970e000]
target module path: \??\C:\WINDOWS\system32\vsdatant.sys
file :14 63 8d 80
memory :80 46 6e b9
verdict = 2
0x8080b768 [KiServiceTable[48]] 4 byte(s): KiServiceTable HOOK:
address 0xb96e48a0 is inside vsdatant.sys module
[0xb96b5000-0xb970e000]
target module path: \??\C:\WINDOWS\system32\vsdatant.sys
file :1a 94 8a 80
memory :a0 48 6e b9
verdict = 2
0x8080b770 [KiServiceTable[50]] 4 byte(s): KiServiceTable HOOK:
address 0xb96e7280 is inside vsdatant.sys module
[0xb96b5000-0xb970e000]
target module path: \??\C:\WINDOWS\system32\vsdatant.sys
file :1b d4 88 80
memory :80 72 6e b9
verdict = 2
0x8080b7a0 [KiServiceTable[62]] 4 byte(s): KiServiceTable HOOK:
address 0xb96cd7b0 is inside vsdatant.sys module
[0xb96b5000-0xb970e000]
target module path: \??\C:\WINDOWS\system32\vsdatant.sys
file :07 cc 8f 80
memory :b0 d7 6c b9
verdict = 2
0x8080b7a4 [KiServiceTable[63]] 4 byte(s): KiServiceTable HOOK:
address 0xb96e5fb0 is inside vsdatant.sys module
[0xb96b5000-0xb970e000]
target module path: \??\C:\WINDOWS\system32\vsdatant.sys
file :78 9f 8b 80
memory :b0 5f 6e b9
verdict = 2
0x8080b7ac [KiServiceTable[65]] 4 byte(s): KiServiceTable HOOK:
address 0xb96e5d90 is inside vsdatant.sys module
[0xb96b5000-0xb970e000]
target module path: \??\C:\WINDOWS\system32\vsdatant.sys
file :fa 79 8b 80
memory :90 5d 6e b9
verdict = 2
0x8080b7b8 [KiServiceTable[68]] 4 byte(s): KiServiceTable HOOK:
address 0xb96e3fc0 is inside vsdatant.sys module
[0xb96b5000-0xb970e000]
target module path: \??\C:\WINDOWS\system32\vsdatant.sys
file :b6 ca 89 80
memory :c0 3f 6e b9
verdict = 2
0x8080b82c [KiServiceTable[97]] 4 byte(s): KiServiceTable HOOK:
address 0xb96cb380 is inside vsdatant.sys module
[0xb96b5000-0xb970e000]
target module path: \??\C:\WINDOWS\system32\vsdatant.sys
file :ec 98 8c 80
memory :80 b3 6c b9
verdict = 2
0x8080b830 [KiServiceTable[98]] 4 byte(s): KiServiceTable HOOK:
address 0xb96e6160 is inside vsdatant.sys module
[0xb96b5000-0xb970e000]
target module path: \??\C:\WINDOWS\system32\vsdatant.sys
file :f0 3c 8d 80
memory :60 61 6e b9
verdict = 2
0x8080b858 [KiServiceTable[108]] 4 byte(s): KiServiceTable HOOK:
address 0xb96e74e0 is inside vsdatant.sys module
[0xb96b5000-0xb970e000]
target module path: \??\C:\WINDOWS\system32\vsdatant.sys
file :fc c2 89 80
memory :e0 74 6e b9
verdict = 2
0x8080b878 [KiServiceTable[116]] 4 byte(s): KiServiceTable HOOK:
address 0xb96cd5e0 is inside vsdatant.sys module
[0xb96b5000-0xb970e000]
target module path: \??\C:\WINDOWS\system32\vsdatant.sys
file :e3 9c 89 80
memory :e0 d5 6c b9
verdict = 2
0x8080b890 [KiServiceTable[122]] 4 byte(s): KiServiceTable HOOK:
address 0xb96e3dc0 is inside vsdatant.sys module
[0xb96b5000-0xb970e000]
target module path: \??\C:\WINDOWS\system32\vsdatant.sys
file :96 cc 89 80
memory :c0 3d 6e b9
verdict = 2
0x8080b8a8 [KiServiceTable[128]] 4 byte(s): KiServiceTable HOOK:
address 0xb96e3b90 is inside vsdatant.sys module
[0xb96b5000-0xb970e000]
target module path: \??\C:\WINDOWS\system32\vsdatant.sys
file :74 19 8b 80
memory :90 3b 6e b9
verdict = 2
0x8080b9ac [KiServiceTable[193]] 4 byte(s): KiServiceTable HOOK:
address 0xb96e6420 is inside vsdatant.sys module
[0xb96b5000-0xb970e000]
target module path: \??\C:\WINDOWS\system32\vsdatant.sys
file :32 62 97 80
memory :20 64 6e b9
verdict = 2
0x8080b9c8 [KiServiceTable[200]] 4 byte(s): KiServiceTable HOOK:
address 0xb96cfe90 is inside vsdatant.sys module
[0xb96b5000-0xb970e000]
target module path: \??\C:\WINDOWS\system32\vsdatant.sys
file :ba fe 89 80
memory :90 fe 6c b9
verdict = 2
0x8080b9d8 [KiServiceTable[204]] 4 byte(s): KiServiceTable HOOK:
address 0xb96e66a0 is inside vsdatant.sys module
[0xb96b5000-0xb970e000]
target module path: \??\C:\WINDOWS\system32\vsdatant.sys
file :56 4d 97 80
memory :a0 66 6e b9
verdict = 2
0x8080b9f0 [KiServiceTable[210]] 4 byte(s): KiServiceTable HOOK:
address 0xb96d0370 is inside vsdatant.sys module
[0xb96b5000-0xb970e000]
target module path: \??\C:\WINDOWS\system32\vsdatant.sys
file :ca e9 8a 80
memory :70 03 6d b9
verdict = 2
0x8080ba28 [KiServiceTable[224]] 4 byte(s): KiServiceTable HOOK:
address 0xb96cd920 is inside vsdatant.sys module
[0xb96b5000-0xb970e000]
target module path: \??\C:\WINDOWS\system32\vsdatant.sys
file :2c 0e 8a 80
memory :20 d9 6c b9
verdict = 2
0x8080ba68 [KiServiceTable[240]] 4 byte(s): KiServiceTable HOOK:
address 0xb96cb1f0 is inside vsdatant.sys module
[0xb96b5000-0xb970e000]
target module path: \??\C:\WINDOWS\system32\vsdatant.sys
file :d6 7e 8c 80
memory :f0 b1 6c b9
verdict = 2
0x8080ba84 [KiServiceTable[247]] 4 byte(s): KiServiceTable HOOK:
address 0xb96e5b80 is inside vsdatant.sys module
[0xb96b5000-0xb970e000]
target module path: \??\C:\WINDOWS\system32\vsdatant.sys
file :1d dc 89 80
memory :80 5b 6e b9
verdict = 2
0x8080baac [KiServiceTable[257]] 4 byte(s): KiServiceTable HOOK:
address 0xb96e4ad0 is inside vsdatant.sys module
[0xb96b5000-0xb970e000]
target module path: \??\C:\WINDOWS\system32\vsdatant.sys
file :2b bc 8a 80
memory :d0 4a 6e b9
verdict = 2
0x8080bac0 [KiServiceTable[262]] 4 byte(s): KiServiceTable HOOK:
address 0xb96cb530 is inside vsdatant.sys module
[0xb96b5000-0xb970e000]
target module path: \??\C:\WINDOWS\system32\vsdatant.sys
file :54 14 94 80
memory :30 b5 6c b9
verdict = 2
0x8080bac4 [KiServiceTable[263]] 4 byte(s): KiServiceTable HOOK:
address 0xf7a1f63c is inside uphcleanhlp.sys module
[0xf7a1f000-0xf7a21000]
target module path: \??\C:\WINDOWS\system32\Drivers\uphcleanhlp.sys
module file is NOT PRESENT!!!
file :2b 50 97 80
memory :3c f6 a1 f7
verdict = 3
module ntoskrnl.exe: end of details
kernel32.dll (7c800000 - 7c8f4000)... suspected! (verdict = 5).
module kernel32.dll [0x7c800000 - 0x7c8f4000]:
0x7c801af1 [LoadLibraryExW()+0] 6 byte(s): JMPing code (jmp to:
0x5f05001e)
address 0x5f05001e DOES NOT belong to ANY MODULE!
file :6a 34 68 88 e2 80
memory :ff 25 1e 00 05 5f
verdict = 5
0x7c80aa7b [FreeLibrary()+15] 4 byte(s): SUSPECTED code
modification:
file :dc ff ff ff
memory :bd 55 7f e2
verdict = 5
module kernel32.dll: end of details
SYSTEM INFECTION LEVEL: 5
0 - BLUE
1 - GREEN
2 - YELLOW
3 - ORANGE
4 - RED
--> 5 - DEEPRED
SUSPECTED modifications detected. System is probably infected!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
The woman who wrote it describes it:
***************************************************************************************************************
The idea behind SVV is to check important Windows System components, which are usually altered by various
stealth malware, in order to ensure system integrity and to discovery potential system compromise.
SVV 1.0 implements only code virginity verification which is the first step in SVV implementation and its task
is to ensure the integrity of the code sections of in-memory mapped kernel and usermode modules (that is kernel
drivers and usermode DLLs).
Yes, there are dozens of ways to write a rootkit not detectable by SVV 1.0, because SVV 1.0 is not intended to
be an ultimate solution - it's just a first step in building integrity based compromise detector. Next steps
will involve IDT, SDT, IRP dispatch tables checking, etc...
How SVV is different form VICE? SVV doesn’t look for a known patterns of infection as VICE does (JMP hooks)
just ensures in-memory code integrity. VICE seems to generate lots of false positives, while SVV was designed to
minimize the number of false positives. On the other hand, SVV 1.0 checks only code sections, while VICE is
able to check also IAT/EAT, SDT and IRP dispatch tables.
More details about SVV can be found in my recent HITB presentation:
[url]http://invisiblethings.org/papers/hitb05_virginity_verifier.ppt[/url]
SVV 1.0 can be downloaded here:
[url]http://invisiblethings.org/tools/svv-1.0-public.zip[/url]