ForestCat
August 14th, 2005, 10:57 AM
Hey, Friends,
I have a couple of questions & comments that I hope may ultimately lead to a useful thread. Bear with me as my knowledge of rootkits is a bit limited & I apologize if this is a bit naive, but at minimum it might be a nice resource for future well-intentioned Wilder's noobs such as myself...
My understanding is that broadly speaking, these beasts fall into two categories. The first hide the physical evidence of themselves by modifying/replacing core os components, redirecting api calls, etc. The second, and I may be wrong here, are virtual constructs, i.e. the malware is created dynamically on the fly, by whatever means, hiding in ADS, etc., and, I would assume only survive in memory. If they were able to survive a reboot, then I'm thinking that the mechanism involved would put them at least partially into the first category. My point in a minute... :)
I would ask some of the developers & pros here to critique the following:
Assuming that there _is_ a physical component to the malware(1st case)-
Let's mount the suspect hard drive in another physical system. Boot that system from a known clean PE cd or equivalent with current tools such as TDS, Kaspersky, etc. Even better if said PE has OS at same revision level as suspect drive OS. You see where I'm going. Do a binary compare on all the OS components. Scan the hell out of everything. Load the suspect hive, export & whack anything that moves at startup.
Now I do understand that this approach is somewhat signature-dependant. But I also think it depends to a high degree on the heuristic strength ( sorry, had to use the h-word...) of the tools involved (why I pine for TDS :'( , & believe it is still viable- folks _will_ continue to get infected with "old" bugs)
I've used this approach to clean up some fairly ugly stuff. However, my yardstick for success could be flawed.
My point: There seems to be a strong opinion that reformatting & reinstallation is the only way to effectively clean a rootkit infection. I'm looking for the experiences of the been-there, done-that's on both sides. Thanx for reading.
P.S. I do have a life. I know that reformating is faster & less trouble, but there are those cases ;)
--==Forestcat==--
I have a couple of questions & comments that I hope may ultimately lead to a useful thread. Bear with me as my knowledge of rootkits is a bit limited & I apologize if this is a bit naive, but at minimum it might be a nice resource for future well-intentioned Wilder's noobs such as myself...
My understanding is that broadly speaking, these beasts fall into two categories. The first hide the physical evidence of themselves by modifying/replacing core os components, redirecting api calls, etc. The second, and I may be wrong here, are virtual constructs, i.e. the malware is created dynamically on the fly, by whatever means, hiding in ADS, etc., and, I would assume only survive in memory. If they were able to survive a reboot, then I'm thinking that the mechanism involved would put them at least partially into the first category. My point in a minute... :)
I would ask some of the developers & pros here to critique the following:
Assuming that there _is_ a physical component to the malware(1st case)-
Let's mount the suspect hard drive in another physical system. Boot that system from a known clean PE cd or equivalent with current tools such as TDS, Kaspersky, etc. Even better if said PE has OS at same revision level as suspect drive OS. You see where I'm going. Do a binary compare on all the OS components. Scan the hell out of everything. Load the suspect hive, export & whack anything that moves at startup.
Now I do understand that this approach is somewhat signature-dependant. But I also think it depends to a high degree on the heuristic strength ( sorry, had to use the h-word...) of the tools involved (why I pine for TDS :'( , & believe it is still viable- folks _will_ continue to get infected with "old" bugs)
I've used this approach to clean up some fairly ugly stuff. However, my yardstick for success could be flawed.
My point: There seems to be a strong opinion that reformatting & reinstallation is the only way to effectively clean a rootkit infection. I'm looking for the experiences of the been-there, done-that's on both sides. Thanx for reading.
P.S. I do have a life. I know that reformating is faster & less trouble, but there are those cases ;)
--==Forestcat==--