An Inconsequential Rootkit Test

Discussion in 'other anti-malware software' started by cruelsister, Apr 28, 2013.

Thread Status:
Not open for further replies.
  1. cruelsister

    cruelsister Registered Member

    Joined:
    Nov 6, 2007
    Posts:
    973
    Location:
    Paris
    Having a little time and a flash drive with 3 relatively new (found last week) zeroaccess rootkits, I decided it was time to infect a computer and try out some of the 3rd party rootkit removers, specifically the newest version of Oshi Unhooker (to my knowledge the first antimalware app from the Seychelles). Along with Oshi, I decided to test 8 others. Please note that only 3 samples were used and they all were a specific type of Rootkit so please don’t draw too much in the way of a conclusion. But if you do need an antirootkit scanner, I hope the results will assist on which to try first.

    Anyway, the test system was a Win XP 32bit thingy (lowest common denominator). Each of the 3 samples were confirmed as malicious (ZA) and run (one right after the other). As HitmanPro detected the rootkit after infection testing proceeded as follows:
    1), Samples run
    2). Confirmation of infection by HMP
    3). One of the AntiRookit scanners was run, and no matter the result the computer was rebooted and,
    4). HMP was again run to determine if System was cleansed of infection.

    Results:
    GMER- crashed
    avast! aswMBR Rootkit Scanner- crashed
    (Please note that both successfully completed a scan on the test system when it was completely clean)
    Bitdefender Rootkit Remover- fail (didn’t detect any infection)
    Trend Micro RootkitBuster- fail (detected infection but noted “Unable to Fix”)
    McAfee Rootkit Remover- fail (really fast but really useless)
    Sophos Rootkit Removal Tool- fail (Detected infection but failed to clean, even though it said it had. Typical Sophos! Also note that this is a combo Anti-malware\antivirus\antirootkit product and must be installed)
    Kaspersky TDSSKiller- fail (also uselessly fast)
    Oshi Unhooker- fail (WAHHH! I wanted it to work. But the interface is pretty)
    Malwarebtytes Anti-Rootkit- Pass (surprise, surprise)

    Conclusion and Comments- As shouldn’t be a shock to any, Malwarebytes makes good products. As for the GMER and Avast crashes, I can’t determine if the malware had a specific coding to cause these to crash, or if just the nature of the infection made them loop- whatever, they failed. I also have to add before I close that the Sophos product actually has a use- I came across a Trojan earlier this month that when run would hide the directory it was run from, as well as spawning a number of daughter programs into that same (now hidden) directory. Although Hitman could not see this directory to detect the files, Sophos was able to detect the parent and the daughters. And once again after stating that the infections were cleaned, it lied. Typical Sophos!
     
    Last edited: Apr 28, 2013
  2. Umbra

    Umbra Registered Member

    Joined:
    Feb 10, 2011
    Posts:
    2,143
    Location:
    in a remote land :)
    no Emsisoft Emergency Kit? Combofix?
     
  3. cruelsister

    cruelsister Registered Member

    Joined:
    Nov 6, 2007
    Posts:
    973
    Location:
    Paris
    Test Addendum: 3 others scanners were added:

    1). ComboFix- Pass (thanks, Umbra. I totally forgot to use this one)

    2). Emsisoft Emergency Scanner- fail (it did actually detect one (missed the rest) of the infected points, the hidden C:\windows\assembly\gac\desktop.ini file, and indicated it would delete it on reboot. Of course it failed to do so. I really don't like this product).

    3). CCE- Pass (found all and cleaned on reboot- actually performed better than I expected)
     
    Last edited: Apr 29, 2013
  4. BoerenkoolMetWorst

    BoerenkoolMetWorst Registered Member

    Joined:
    Dec 22, 2009
    Posts:
    3,764
    Location:
    Outer space
    Nice, how about Norton Power Eraser and NoVirusThanks ARK?
     
  5. siketa

    siketa Registered Member

    Joined:
    Oct 25, 2012
    Posts:
    2,695
    Location:
    Zagreb, Croatia
    Thanks, sista!
    :thumb:
     
  6. JoeBlack40

    JoeBlack40 Registered Member

    Joined:
    Apr 1, 2009
    Posts:
    1,572
    Location:
    Romania
    Thank you for the info cruelsister.Kaspersky TDSSKiller,hmmm...an unpleasant surprise i suppose..
     
  7. cruelsister

    cruelsister Registered Member

    Joined:
    Nov 6, 2007
    Posts:
    973
    Location:
    Paris
    I guess to wrap things up I reinfected the poor computer and ran MSERT, NNoVirusThanks rootkit tool, as well as Norton PowerEraser (which always puts me in a good mood).

    Results:

    Msert- fail (crashed whenever the system was infected with the ZA's- actually froze the system. Worked fine on a clean computer, however)

    NoVirusThanks Rootkit Tool- fail (found nothing. At least it was fast)

    Power Eraser- FAIL (It did find 3 things which it marked as malicious: Combofix, my beloved Seamonkey browser, and something it listed as "[]". I did select the latter and rebooted the computer. Upon restart I received a message that (sadly) Norton couldn't delete the file, but was presented with a link where I could buy NIS to proactively protect my computer. I clicked the link and was unfortunately redirected to some Russian Porn site- that pesky ZA trojan again).
     
  8. flatfly

    flatfly Registered Member

    Joined:
    Aug 25, 2010
    Posts:
    66
    Great thread! Thanks for taking the time to do this.
    And what about HMP, did you actually test it?
     
  9. Syobon

    Syobon Registered Member

    Joined:
    Dec 27, 2009
    Posts:
    469
  10. Esse

    Esse Registered Member

    Joined:
    May 26, 2011
    Posts:
    383
    Thanks for testing!
    Do you have the time to test Dr.Web CureIt?
    In my experience they normally pass were others fail.

    /E
     
  11. siketa

    siketa Registered Member

    Joined:
    Oct 25, 2012
    Posts:
    2,695
    Location:
    Zagreb, Croatia
    Just to make a note that NoVirusThanks AntiRootkit has not been upgraded for over two years...;)
     
  12. ronjor

    ronjor Global Moderator

    Joined:
    Jul 21, 2003
    Posts:
    57,721
    Location:
    Texas
    https://www.wilderssecurity.com/showthread.php?t=180128
     
Loading...
Thread Status:
Not open for further replies.