[dobbelina]

As RootKitty still isn't working properly, I decided to make my own plugin called "Rootbabe".
My plugin has an added advantage, you can now scan both with md5 or without.
Scanning without md5 is extremely fast, and will tell you directly, if a file is hiding itself
from Windows.
Scanning with md5 is slow, but it will also tell you if any files has been changed, in addition
to hidden.

There are 5 scanning options:

1. Winscan-No-md5 (This is the scan you make in Windows, very fast)
2. PE-scan-No-md5 (This is the scan you make from PE, very fast)
3. Winscanmd5 (This is the scan you make in Windows, slow)
4. Pe-scanmd5 (This is the scan you make from PE, slow)
5. WinDiff Compare (This is the Microsoft utility you use to compare the scan files)

Once the scan 1 and 2, or 3 and 4 has been completed, compare with WinDiff.
Compare the "md5" scans separately from the "No-md5", don't mix.

All scan result files will end up in the root of C:.

The fsum.exe freeware utility is owned by © Copyright 1999-2004 SlavaSoft Inc.
http://www.slavasoft.com/fsum/
I am not the author of this software.
All credits goes to the maker and copyright owner.

To install this plugin, simply extract the folder "Rootbabe" to the Malware folder inside your plugins,
and build the CD.

Download 143 kb: http://linkkings.bv2.net/Rootbabe.zip

[KCarney]

There is one slight mistake in your plugin, nothing major though.

In your rootbabe_nu2menu.xml file you have the plugin classified as AntiVirus, but in the rootbabe.inf it is classified under Malware.

Ex.

; rootbabe.inf
; PE Builder v3 plug-in INF file for Rootbabe 
; Plugin created by Linkking
; [url=http://www.ubcd4win.com]http://www.ubcd4win.com[/url]

[Version]
Signature= "$Windows NT$"

[PEBuilder]
Name="Malware: Rootbabe"
Enable=1


<!-- Nu2Menu entry for Rootbabe-->
<NU2MENU>
        <MENU ID="Programs">
                <MITEM TYPE="POPUP" MENUID="AntiVirus Tools">AntiVirus Tools</MITEM>
        </MENU>
<MENU ID="AntiVirus Tools">
                <MITEM TYPE="POPUP" MENUID="Rootbabe">Rootbabe</MITEM>
        </MENU>

This post has been edited by KCarney: 08 February 2007 - 04:16 PM

[rdsok]

Technically speaking a rootkit is neither a virus or a spyware... so just as we let pcuser choose which catagory was used for Rootkitty ( which I never have had a problem with and works just fine for me ) dobbelina is welcome to chose whichever catagory that they wish also... if another user wants they are welcome to change it on their copy.

[KCarney]

Understood, but it just seems confusing to have it classified as 2 different things and was probably a typo on dobbelina's part.

[dobbelina]

Ya, typo.
Easy to change.
Either re-classify the inf to Antivirus, or change the menus to the malware category,
whatever suits your mood:

<!-- Nu2Menu entry for Rootbabe-->
<NU2MENU>
        <MENU ID="Programs">
                <MITEM TYPE="POPUP" MENUID="Malware Tools">Malware Tools</MITEM>
        </MENU>
<MENU ID="Malware Tools">
                <MITEM TYPE="POPUP" MENUID="Rootbabe">Rootbabe</MITEM>
        </MENU>
        <MENU ID="Rootbabe">
                <MITEM TYPE="ITEM" DISABLED="@Not(@FileExists(@GetProgramDrive()\Programs\rootbabe\Winscanmd5.cmd))" CMD="RUN" FUNC="@GetProgramDrive()\Programs\rootbabe\Winscanmd5.cmd">Winscanmd5</MITEM>
        </MENU>
<MENU ID="Rootbabe">
                <MITEM TYPE="ITEM" DISABLED="@Not(@FileExists(@GetProgramDrive()\Programs\rootbabe\Pe-scanmd5.cmd))" CMD="RUN" FUNC="@GetProgramDrive()\Programs\rootbabe\Pe-scanmd5.cmd">Pe-scanmd5</MITEM>
</MENU>
<MENU ID="Rootbabe">
                <MITEM TYPE="ITEM" DISABLED="@Not(@FileExists(@GetProgramDrive()\Programs\rootbabe\Winscan-No-md5.cmd))" CMD="RUN" FUNC="@GetProgramDrive()\Programs\rootbabe\Winscan-No-md5.cmd">Winscan-No-md5</MITEM>
</MENU>
<MENU ID="Rootbabe">
                <MITEM TYPE="ITEM" DISABLED="@Not(@FileExists(@GetProgramDrive()\Programs\rootbabe\PE-scan-No-md5.cmd))" CMD="RUN" FUNC="@GetProgramDrive()\Programs\rootbabe\PE-scan-No-md5.cmd">PE-scan-No-md5</MITEM>
</MENU>
<MENU ID="Rootbabe">
                <MITEM TYPE="ITEM" DISABLED="@Not(@FileExists(@GetProgramDrive()\Programs\rootbabe\WinDiff.Exe))" CMD="RUN" FUNC="@GetProgramDrive()\Programs\rootbabe\WinDiff.Exe">WinDiff Compare</MITEM>
</MENU>
</NU2MENU>

Either way, it works in both cases

[rdsok]

Correction to the corrected corrections...


With UBCD4Win v3.04 ... we've re-did the menus again ( and I see another possible on in the future for a different type of programs )...

Antivirus is changed to Anti-Virus
Malware is changed to Anti-Spyware

[sarcasm] We felt the users were getting to complacent and needed something to wake them up... [/sarcasm] or actually we felt these were more in line with the industry and while the hyphens were not required, they made them easier to distinguish between them when reading them.



The definitions used for classifying malware now is becoming very complex. The lines between the different types are blurring more and more. The definition for viral infections is fairly stable.. it represents trojans, virus's and worms. Then comes in spyware which can also contain trojans and now even worms... ( some spyware is even beneficial like parental controls and keyloggers used in business's which is why you don't want to classify them as viral ).. then comes in rootkits which by themselves are none of the above but are used to help cloak all of the above.

So considering that info... perhaps in some future build we will simply need to place all of the above in one category... Anti-Malware. Hopefully ( we pray ) not for some time. At this time, since most of the rootkits seem to also be in conjunction with spyware... that is what we've classified this type of utility as but if anyone has a different opinion.. its not wrong either so you can classify it which ever way you think it fits your definition.

[robdharana]

As far as I checked Rootbabe/Rootkitty don't use SeBackupPrivilege so it looks that they don't hash all files (eg. System Volume Information) because they lack permissions. So one solution is to run them as SYSTEM account or use pview from Reskit and enable this privilege before scanning. Anyone can check if for example the output file includes hashes for System Volume Information files?