What is a Rootkit?
(from http://www.sysintern...itrevealer.html the maker of "Rootkit Revealer")
A persistent rootkit is one associated with malware that activates each time the system boots. Because such malware contain code that must be executed automatically each system start or when a user logs in, they must store code in a persistent store, such as the Registry or file system, and configure a method by which the code executes without user intervention.
Memory-based rootkits are malware that has no persistent code and therefore does not survive a reboot.
There are many methods by which rootkits attempt to evade detection. For example, a user-mode rootkit might intercept all calls to the Windows FindFirstFile/FindNextFile APIs, which are used by file system exploration utilities, including Explorer and the command prompt, to enumerate the contents of file system directories. When an application performs a directory listing that would otherwise return results that contain entries identifying the files associated with the rootkit, the rootkit intercepts and modifies the output to remove the entries.
The Windows native API serves as the interface between user-mode clients and kernel-mode services and more sophisticated user-mode rootkits intercept file system, Registry, and process enumeration functions of the Native API. This prevents their detection by scanners that compare the results of a Windows API enumeration with that returned by a native API enumeration.
Kernel-mode rootkits can be even more powerful since, not only can they intercept the native API in kernel-mode, but they can also directly manipulate kernel-mode data structures. A common technique for hiding the presence of a malware process is to remove the process from the kernel's list of active processes. Since process management APIs rely on the contents of the list, the malware process will not display in process management tools like Task Manager or Process Explorer.
1. Run "dir /s /b /ah" and "dir /s /b /a-h" inside the potentially infected OS and save the results.
2. Boot into a clean CD, run "dir /s /b /ah" and "dir /s /b /a-h" on the same drive, and save the results.
3. Run a clean version of WinDiff from the CD on the two sets of results to detect file-hiding ghostware (i.e., invisible inside, but visible from outside). See Hacker Defender ghostware files revealed (highlighted) for an example.
4. Note: there will be some false positives. Also, this does not detect stealth software that hides in BIOS, Video card EEPROM, disk bad sectors, Alternate Data Streams, etc.
This is exactly what RootKitty does.
RootKitty only scan for files right now although I might add registry scanning sometime soon.
Feel free to download and try RootKitty but please don't link to it or add it to your production build yet. Notice that the version number is 1.0.0... In fact, it was still just a thought up until about 2 hours ago.
As stated in the above link:
The same goes for RootKitty so don't just delete anything that it finds!
Here's the link:
Here's how to use it:
1. Boot into windows and click on "Win-Scan". The mouse pointer will turn into an hourglass and a dos box will open. You have to wait until the dos box disappears and the mouse pointer goes back to normal before closing the program. This can take quite a while if you have alot of files.
2. Boot into ubcd4win and click on "PE-Scan" and wait for it to finish
3. Click on "Compare"
If a file was detected in PE/ubcd4win and was stealthed from windows then it'll show up in the listbox.