Rooting Out Rootkits

One critical aspect of system building is staying on top of the latest security threats. Another is having the best detection tools available to keep those threats at bay. The last thing you need is to deliver an infected Windows system to a customer—or to become susceptible yourself to some new form of highly undetectable, "stealth," malware.

One of the newest threats in the wild—what security mavens mean by "loose on the net"—is called a "rootkit," or RK for short. While a rootkit by itself causes no damage, it attempts to hide the presence of other malware, such as key-logging Trojans, viruses, and worms.

A rootkit differs from a virus in that it doesn’t seek to reproduce itself. Still, some modern viruses incorporate rootkits into their code libraries, very often to take advantage of a rootkit’s ability to remain hidden and elude detection. Also, rootkits borrow a page from typical virus behavior, in that they may seek to avoid detection by taking over for one or more specific system component files—in essence, adding their own agenda to whatever purpose the original files they replace may have served.

Rootkits often include components to open back doors on systems. Often they do so by incorporating stealthy remote access software that opens a system to unwanted, uninvited outside operations, much as many pieces of spyware do. But here's another way that rootkits differ from most spyware and viruses: They hide everything that might reveal their presence and activity on a system, including logins, processes, files, and logs. So little or no evidence of a rootkit's presence is ever available.

Also, rootkits can insinuate themselves into an operating system’s core components, so they run as part of the kernel with the same unlimited rights and privileges typically granted to such code. Though many rootkits also often include user mode components (necessary for any kind of user interaction or information display), it’s their kernel capabilities combined with their profound stealth that makes them such a nasty species of malware.The Trouble With Rootkits

What make rootkits truly insidious is that typical anti-virus and anti-spyware packages have great difficulty identifying them. That's because a rootkit can establish itself as part of the Windows boot-up code, an area frequently unchecked by detection programs.

To make matters worse, there aren’t any automated cleanup tools available—at least for now—that can remove a rootkit once it takes up residence on a PC. In fact, security experts Mark Russinovich and Bryce Cogswell, principals at Sysinternals Freeware and Winternals Software (and the creators of the RootkitRevealer utility I feature in this Recipe), both agree that once a rootkit is contracted, the only way to get rid of it is to wipe the hard disk and reinstall everything. Woe betides those who come down with a rootkit infection and don’t have a recent backup to restore!

The only exception to this is the Sony rootkit that Russinovich discovered recently. It originates from Sony Music CDs as an undocumented part of their digital rights management (DRM) software. In response to widespread consumer outrage, Sony released this patch to permit users to remove this rootkit from their computers; it does so by uninstalling a driver named "MediaJam" that makes this stealth monitor work.

As this Recipe goes to press, none of the major security suites offer a rootkit detection tool. But at least one suite vendor does plan to include such a tool in its next planned release. F-Secure plans to include a rootkit-detection tool called BlackLight in its forthcoming Internet Security 2006 suite. A free beta version of this tool is available until January 1, 2006, at the BlackLight beta page.I didn’t cover the F-Secure tool for this TechBuilder Recipe because in my opinion, Sysinternals' RootkitRevealer makes a better choice for system builder security toolkits. That's not only because it’s free and because Windows kernel gurus Russinovich and Cogswell wrote and recommend it. It's also because the pair's Sysinternals RootkitRevealer page offers the download, up-to-date information, and a populated forum.

One caveat: When deploying RootkitRevealer, remember to research any anomalies the utility finds before concluding that a system has a rootkit running. As I explain later in this Recipe, false positives—or apparent anomalies that are benign rather than overt signs of rootkit presence—are fairly common when using the RootkitRevealer tool.

Ingredients

Here's all you'll need on hand before starting this Recipe:

While you can pick any 32-bit Windows-based system for this Recipe, I chose my standard test machine, and then used the tool on every system I own. Rootkits are potentially insidious. So even though finding one necessitates a “wipe and reinstall” maneuver, you’re better off knowing you’ve got one on a system, rather than proceeding along in not-so-blissful ignorance.

Five Steps to Installing RootkitRevealer

Let's get started. Once you have your components assembled, follow these easy steps:

That’s all there is to it. Because there’s no installer to run, the entire process should take less than a minute, or less than time than it took you to read my instructions! This concludes the download and installation process for RootkitRevealer. Let's now start using the tool to detect rootkits on your systems.

Five Steps to Running Rootkit Revealer

As soon as RootkitRevealer is unzipped, the program (rootkitrevealer.exe) is ready to use. Follow these steps:

Interpreting RootkitRevealer ResultsIn the vast majority of cases, the Description field for discrepancies in RootkitRevealer will report either "Visible in Windows API, but not in MFT or directory index" or "Hidden from Windows API," as shown in another set of results I provoked from my test machine by running the tool. Note that the result looks different from previous screenshots because I stretched the display to list most directories and all descriptions in full:

After carefully inspecting all of these entries, I found they’re mostly temp files, or links to temp files. The jpeg file was opened and closed while the scan was running, which apparently resulted in having it reported as "Hidden from Windows API." Talk about thorough!

The RootkitRevealer home page devotes most of its coverage to explaining how to interpret the output. It lists the following possible descriptions:

To further interpret RootkitRevealer's results, you'll need to determine the origin or cause of what’s been reported. Googling the name of the Registry key or the file for which a discrepancy is discovered is a good place to start. This will often help to illuminate whether the symptom is benign or malign. Happily, most cases will turn out to be benign, as explained earlier. But if not, the Sysinternals RootkitRevealer Forum is a great source of potential help. Also, the forums at Rootkit.com are a valuable information resource on this topic.If you do find reports from RootkitRevealer that suggest the possible presence of a rootkit, remember that no tools currently exist that can clean up a rootkit infestation. Thus, the only remedy is to format the drive, then reinstall Windows and all necessary applications. Of course, if you don’t have a current backup of that system, you’ll want to obtain one before proceeding with wipe and restore maneuvers. And I strongly urge you to boot from a repair CD to run the backup. Then back up only those data files outside the OS folder hierarchy, to make certain you’re not backing up the rootkit along with everything else.

Bottom line: System builders who build and maintain Windows systems should make RootkitRevealer a standard part of their security toolkit. I liked it so much, I've even created weekly Task Scheduler jobs on all my machines to run RootkitRevealer as part of my ongoing security maintenance routine.

Finally, for even more information on the latest developments on rootkits, visit anti-malware sites like Kaspersky Lab, Symantec's informative site Security Response, and the aforementioned Rookit.com.

ED TITTEL is a freelance writer who specializes in markup languages, PCs, and networking topics. He's contributed to more than 130 books, including titles on spyware and IT certification. His upcoming book is Build The Ultimate Home Theater PC (John Wiley, November 2005). Ed has no commercial interest in any of the products, companies, or sites mentioned in this TechBuilder Recipe.0