ROOTKITS: BEGINNER’S GUIDE
SOME COMMON QUESTIONS (AND ANSWERS) ABOUT MALWARE KNOWING THE TYPES OF MALWARE VIRUSES WORMS TROJANS DIALERS BACKDOORS SPYWARE (AND MALICIOUS ADWARE) THE MANY AIMS OF MALWARE ROOTKITS: UNDERSTANDING THE ENEMY A BIT OF ROOTKIT LORE NEW TECHNOLOGIES, NEW DANGERS WHY DO ROOTKITS EXIST? FORMULATING RESISTANCE HACKERS MAY NOT BE SMARTER THAN YOU STEPS TO A BETTER SECURITY POSTURE PRACTICING RECOGNITION SPOTTING SIGNS OF MALWARE RECOGNIZING WHEN THE PROBLEM ISN’T MALWARE SUSPECTING THAT YOU’VE BEEN COMPROMISED PLANNING FOR RECOVERY PART II: RESISTANCE IS NOT FUTILE BEFORE DOING ANYTHING USING SYSTEM RESTORE BACKING UP YOUR REGISTRY BACKING UP YOUR STUFF WITH WINDOWS BACKUP CLEANING YOUR WINDOWS TO IMPROVE SECURITY EVERYTHING AND THE KITCHEN SINK: LOADING ONLY WHAT YOU NEED AT STARTUP REMOVING UNUSED PROGRAMS USING THE WINDOWS DISK CLEANUP UTILITY DEFRAGMENTING YOUR HARD DRIVE USING REGISTRY CLEANERS CONTROLLING REMOVABLE DEVICES DISABLING AUTORUN TURNING OFF AUTOPLAY ON ALL EXTERNAL DRIVES AND DEVICES SCANNING BOOT SECTORS BEFORE USING EXTERNAL MEDIA GOOD PRACTICES ARE A GOOD START CHOOSING YOUR CONTACTS CAREFULLY SURFING SAFELY DEVELOPING STRONG PASSWORDS ESTABLISHING LIMITED-ACCESS USER ACCOUNTS USING A HOSTS FILE BASHING YOUR BROWSER INTO SUBMISSION SAYING NO TO JAVA, JAVASCRIPT, AND ACTIVEX ADDING SITES TO YOUR TRUSTED ZONE DISABLE AUTOCOMPLETE IN INTERNET EXPLORER USING THE NEW INTERNET EXPLORER 7 SURFING WITH FIREFOX INSTEAD STAYING AHEAD OF THE GAME WITH SITEADVISOR MUST-HAVE PROTECTIONS ONLINE FIREWALL FIRST SCANNERS NEXT PREVENTING ROOTKITS BY PATCHING YOUR CLOTHES UPDATING YOUR OPERATING SYSTEM PATCHING, UPDATING, AND SERVICE PACKING LOOKING AT WHY YOU NEED UPDATES KNOWING WHERE YOU CAN GET THEM TAKING ADVANTAGE OF AUTOMATIC UPDATES GUIDE TO WINDOWS UPDATE AND MICROSOFT UPDATE PATCHING AND UPDATING YOUR SOFTWARE WAYS TO PATCH OR UPDATE YOUR APPLICATIONS WATCHING INTERNET SOURCES FOR KNOWN PROBLEMS WITH YOUR APPLICATIONS PATCHING AND UPDATING SHARED COMPUTERS IN HEAVY USE KNOWING WHEN YOU NEED A NEW COMPUTER A CHECKLIST FOR IMPROVING SECURITY LEARNING TO LOVE AUDITING ENABLING SECURITY AUDITING USING WINDOWS ACCESS CONTROL EDITING POLICIES AND CONFIGURING SECURITY MAKING YOUR OWN SECURITY-ANALYSIS UTILITY TESTING YOUR SYSTEM AGAINST A SECURITY TEMPLATE CUSTOMIZING A SECURITY TEMPLATE FOR A NETWORK PREVENTING ATTACKS BY LIMITING ACCESS LIMITING AND CONTROLLING PHYSICAL ACCESS USING LIMITED-ACCESS USER ACCOUNTS LIMITING ACCESS ON NETWORKS MAKING A BUSINESS SECURITY PLAN FOOLING ROOTKITS WITH VIRTUAL OPERATING SYSTEMS PLANNING YOUR DEFENSE AGAINST ROOTKITS ESTABLISHING A BASELINE PREPARING RECOVERY DISCS PART III: GIVING ROOTKITS THE RECOGNITION THEY DESERVE DISCOVERING HOW ROOTKITS HIDE AND SURVIVE KEYS TO THE KINGDOM: PRIVILEGES KNOWING THE TYPES OF ROOTKITS USER-MODE VERSUS KERNEL-MODE ROOTKITS PERSISTENT VERSUS NON-PERSISTENT ROOTKITS HOOKING TO HIDE HOW HOOKING WORKS KNOWING THE TYPES OF HOOKS DLLS AND THE ROOTKITS THAT LOVE THEM PRIVILEGED HOOKS USING EVEN MORE INSIDIOUS TECHNIQUES TO HIDE ROOTKITS DIRECT KERNEL-OBJECT MANIPULATION TROJANIZED UTILITIES LOOKING INTO THE SHADY FUTURE OF ROOTKITS HIDING PROCESSES BY DOCTORING THE PSPCIDTABLE HOOKING THE VIRTUAL MEMORY MANAGER VIRTUAL-MACHINE-BASED ROOTKITS WATCHING YOUR NETWORK FOR SIGNS OF ROOTKITS WATCHING LOGS FOR CLUES DEFENDING YOUR PORTS CATCHING ROOTKITS PHONING HOME EXAMINING THE FIREWALL TRUSTING SNIFFERS AND FIREWALLS TO SEE WHAT WINDOWS CAN’T HOW HACKERS USE SNIFFERS USING SNIFFERS TO CATCH HACKERS AT THEIR OWN GAME TESTING TO SEE WHETHER YOUR NIC IS IN PROMISCUOUS MODE SNIFFERS YOU CAN USE INVESTIGATING LOCKUPS AND OTHER ODD BEHAVIOR ACCESSING EVENT VIEWER MAKING SOME NECESSARY TWEAKS TO STREAMLINE LOGGING INSPECTING EVENT LOGS WITH WINDOWS EVENT VIEWER UPGRADING TO EVENT LOG EXPLORER TRYING MONITORWARE CHECKING YOUR SYSTEM RESOURCES MATCHING ACTIVITY AND BANDWIDTH EXAMINING ACTIVE PROCESSES MONITORING CPU CYCLES ROOTING OUT ROOTKITS CLEANING A NETWORK BEFORE DOING ANYTHING THE BEST OVERALL STRATEGY SCANNING YOUR OS FROM AN EXTERNAL MEDIUM MICROSOFT WINPE NON-MICROSOFT BOOTABLE CDS FILE-SYSTEM COMPARISON FROM FULL BOOT TO SAFE MODE CHECKPOINTING UTILITIES WITH OFFLINE HASH DATABASES VERIFYING FILES WITH FILEALYZER VERIFYING FILE INTEGRITY WITH OTHER UTILITIES ROOTKIT-DETECTION TOOLS AUTORUNS: AIDING AND ABETTING ROOTKIT DETECTION ROOTKIT REVEALER F-SECURE BLACKLIGHT BETA ICESWORD UNHACKME MALICIOUS SOFTWARE REMOVAL TOOL ANTIHOOKEXEC VICE SYSTEM VIRGINITY VERIFIER (SVV) STRIDER GHOSTBUSTER ROOTKITTY RAIDE DARKSPY GMER DETECTING KEYLOGGERS TYPES OF KEYLOGGERS DETECTING KEYLOGGERS WITH ICESWORD DETECTING KEYLOGGERS WITH PROCESS EXPLORER TRACKING A RAT: USING PORT EXPLORER TO TRACE NETBUS 1 60 PART IV: READYING FOR RECOVERY DECIDING WHAT TO DO IF YOU’RE INFECTED KNOWING WHEN TO GIVE UP AND START FROM SCRATCH WHAT HAPPENS WHEN THE PATIENT CAN’T BE SAVED DO YOU WANT TO TRACK DOWN THE ROOTKIT-ER, OR JUST RECOVER? TAKING MEASURED ACTION “MY COMPUTER DID WHAT?!” SAVING EVIDENCE TO REDUCE YOUR LIABILITY PREPARING FOR RECOVERY CUTTING OFF NETWORK CONNECTION BEFORE CLEANING OUT THE ROOTKIT PLANNING YOUR FIRST REBOOT AFTER COMPROMISE DON’T TRUST SYSTEM RESTORE AFTER ROOTKIT COMPROMISE WHEN A SIMPLE FORMAT AND REINSTALL WON’T WORK ERASING YOUR HARD DRIVE AND INSTALLING THE OPERATING SYSTEM WHAT YOU NEED BEFORE YOU BEGIN THIS PROCEDURE ERASING, PARTITIONING, AND FORMATTING INSTALLING WINDOWS XP AFTER YOU INSTALL AND BEYOND PART V: THE PART OF TENS HACKERDEFENDER NTFSHIDER ELITE TOOLBAR APROPOS ROOTKIT FU — THE MALWARE THAT’S ALSO AN INSULT FUTO MYFIP EEYE BOOTROOT FANBOT PE386 SHADOW WALKER AUMHA BLEEPING COMPUTER CASTLECOPS SECURITY PROFESSIONALS GEEKS TO GO GLADIATOR SECURITY FORUM MALWARE REMOVAL MICROSOFT NEWSGROUPS SYSINTERNALS FORUM (SPONSOR OF ROOTKIT REVEALER FORUM) SPYWAREINFO SPYWAREWARRIOR TECH SUPPORT GUY FORUM TOM COYOTE SECURITY FORUM