At the request of Vodacom3G (did I mention he likes to bully me), here's a simple quick and dirty 1 pager on root-kits.
What is a Root-Kit?
The term root-kit is used to describe the mechanisms and techniques whereby malware, including viruses, spyware, and trojans, attempt to hide their presence from spyware blockers, anti-virus, security and system management utilities. When malware or spyware utilize a root-kit, it can make itself invisible to security systems, including anti-virus tools and system-diagnostic tools such as Task Manager. Usually, a root-kit will obscure its installation and attempt to prevent its removal through a subversion of standard system security, such as removing or disabling anti-virus and other security software. Root-kit commands replace original system command to run malicious commands chosen by the attacker and to hide the presence of the root-kit on the system by modifying the results returned, thereby suppressing all evidence of the presence of the root-kit. A root-kit is often used to hide other utilities, which are often used to abuse a compromised system. These may include so-called "backdoors" to help the attacker subsequently access and gain control of the system more easily, send out spam emails, launch attacks against other computers, pop up advertisements while using the internet, record internet usage, steal passwords or other personal information, or anything else of the attackers choosing.
How to detect
Root-kits are usually detected by UPDATED anti-virus or anti-spyware programs when the root-kit tries to infect a computer. Once a root-kit has infected a computer, detection becomes much more difficult and complex. The fundamental problem with root-kit detection is that the operating system currently running cannot be trusted. In other words, actions such as requesting a list of all running programs or a list of all files and folders cannot be trusted to behave as intended, since a root-kit can modify the output of such requests. There is no surefire way to detect a root-kit from within a running system, since a root-kit is capable of controlling any aspect of the system. It is possible to look for signs of a possible infection so that one may look deeper for the cause.
A spyware/root-kit infestation can create significantly higher CPU activity, disk usage, and network traffic, all of which slow the computer down. Stability issues, such as application or system-wide crashes, are also common. Spyware which interferes with networking software commonly causes difficulty connecting to or maintaining a connection to the Internet.
Many spyware programs display advertisements. Some programs simply display pop-up ads on a regular basis while others display ads in response to specific sites that the user visits. Pop-up ads commonly relate to pornography, pharmaceuticals, gambling or financial schemes. Links to these sites may be added to the browser window, history or search function.
Root-kits and spyware often attempt to disable and/or remove existing firewalls, anti-virus, anti-spyware and other security software, often causing them to crash. You may also get errors when using normal Windows network utilities such as PING, TRACERT, NETSTAT, etc which would make it appear that TCP/IP and Winsock are corrupt.
If a computer is exhibiting such symptoms, the following actions can be done to try confirm if there is malware present…
How to recover
Due to the nature of infections, recovery is often tricky and requires a lot of time and effort. Because a root-kit renders an operating system untrustworthy, the only way to return it to a trustworthy state is to reformat and reinstall the system. No removal can render a system trustworthy again. Often removal attempts can result in further system instabilities or total system crashes, even in safe mode. The recommended action is to contact your IT support to backup your information and reinstall the operating system and all applications and data.
What is a Root-Kit?
The term root-kit is used to describe the mechanisms and techniques whereby malware, including viruses, spyware, and trojans, attempt to hide their presence from spyware blockers, anti-virus, security and system management utilities. When malware or spyware utilize a root-kit, it can make itself invisible to security systems, including anti-virus tools and system-diagnostic tools such as Task Manager. Usually, a root-kit will obscure its installation and attempt to prevent its removal through a subversion of standard system security, such as removing or disabling anti-virus and other security software. Root-kit commands replace original system command to run malicious commands chosen by the attacker and to hide the presence of the root-kit on the system by modifying the results returned, thereby suppressing all evidence of the presence of the root-kit. A root-kit is often used to hide other utilities, which are often used to abuse a compromised system. These may include so-called "backdoors" to help the attacker subsequently access and gain control of the system more easily, send out spam emails, launch attacks against other computers, pop up advertisements while using the internet, record internet usage, steal passwords or other personal information, or anything else of the attackers choosing.
How to detect
Root-kits are usually detected by UPDATED anti-virus or anti-spyware programs when the root-kit tries to infect a computer. Once a root-kit has infected a computer, detection becomes much more difficult and complex. The fundamental problem with root-kit detection is that the operating system currently running cannot be trusted. In other words, actions such as requesting a list of all running programs or a list of all files and folders cannot be trusted to behave as intended, since a root-kit can modify the output of such requests. There is no surefire way to detect a root-kit from within a running system, since a root-kit is capable of controlling any aspect of the system. It is possible to look for signs of a possible infection so that one may look deeper for the cause.
A spyware/root-kit infestation can create significantly higher CPU activity, disk usage, and network traffic, all of which slow the computer down. Stability issues, such as application or system-wide crashes, are also common. Spyware which interferes with networking software commonly causes difficulty connecting to or maintaining a connection to the Internet.
Many spyware programs display advertisements. Some programs simply display pop-up ads on a regular basis while others display ads in response to specific sites that the user visits. Pop-up ads commonly relate to pornography, pharmaceuticals, gambling or financial schemes. Links to these sites may be added to the browser window, history or search function.
Root-kits and spyware often attempt to disable and/or remove existing firewalls, anti-virus, anti-spyware and other security software, often causing them to crash. You may also get errors when using normal Windows network utilities such as PING, TRACERT, NETSTAT, etc which would make it appear that TCP/IP and Winsock are corrupt.
If a computer is exhibiting such symptoms, the following actions can be done to try confirm if there is malware present…
- Scan the computer with an updated anti-virus program
- Scan the computer with an updated anti-spyware program (e.g. Spybot, Ad-Aware, AVG, etc)
- Connect to the internet but do nothing for at least 30 minutes. If your computer is uploading or downloading a lot of data during this time, it’s a good sign there is an infection.
- Get an IT support specialist to look and see what processes are running (e.g. SysInternals Process Explorer), what connections are being made on the Internet (e.g. SysInternals TCP View) and what programs start automatically (e.g. SysInternals AutoRuns). They can analyze the data from such exercises to determine if something is wrong.
- Get an IT specialist to use specialized tools such as SysInternals Root-kit Revealer, Trend Micro HijackThis, AVG Anti-Rootkit, WireShark, etc do analyze the system activity.
- Take the OS offline (via hard drive removal or Live CD) and perform malware scans.
How to recover
Due to the nature of infections, recovery is often tricky and requires a lot of time and effort. Because a root-kit renders an operating system untrustworthy, the only way to return it to a trustworthy state is to reformat and reinstall the system. No removal can render a system trustworthy again. Often removal attempts can result in further system instabilities or total system crashes, even in safe mode. The recommended action is to contact your IT support to backup your information and reinstall the operating system and all applications and data.
.