Rootkit May Be Behind Windows Blue Screen

L3sPau1 writes "A rootkit infection may be the cause of a Windows Blue Screen of Death issue experienced by Windows XP users who applied the latest round of Microsoft patches. It appears that the affected Windows PCs had the rootkit infection prior to deploying the Microsoft patches. Researcher Patrick W. Barnes, investigating the issue, has isolated the infection to the Windows atapi.sys file, a driver used by Windows to connect hard drives and other components. Barnes identified the infection as the Tdss-rootkit, which surfaced last November and has been spreading quickly, creating zombie machines for botnet activity."

Comments

Sounds like a good thing

[Anonymous Coward]

That's one way of forcing users to take care of an infection.

Re:Sounds like a good thing

[Anonymous Coward]

That's one way of forcing users to take care of an infection.

Let me try to respin it into an anti-Microsoft jab:

Windows API is such a jumbled mess of spaghetti code that not even low-level processes related to accessing the hard drive are safe from updates!

 

Re:Sounds like a good thing

[Anonymous Coward]

wireless has to be configured by the user, the HDD controller does not

Re:Sounds like a good thing

[Opportunist]

So I'd call that latest update a critical security fix. Install immediately!

Re:Sounds like a good thing

[SCPaPaJoe]

I sure am glad I have Vista!!!

Re:Sounds like a good thing

[Opportunist]

Uh... maybe they were fixing the loophole the spyware used to dig itself into the system? The fix plugged the hole, the (declared as system critical) spyware driver could not load, poof, BSOD.

Re:Sounds like a good thing

[FatdogHaiku]

I sure am glad I have Vista!!!

I understand each of the words.
I can pronounce all the syllables.
Yet this string will not register in my brain...
It's as if this arrangement of characters should not be.
Like some great sacrilege has sprung into being.

Re:Sounds like a good thing

[Sleepy]

That's a strawman argument.
It's natural for security minded folks to "jab" at Microsoft (in a manner similar to how safety advocates "jab" at lead-painted Chinese toys).

On a SANE OS, rootkits can't be installed by regular users who are viewing a banner ad, or plugging in a storage device like a memory stick or USB picture frame.

Re:Sounds like a good thing

[toadlife]

You say this in jest, but before reading TFA I was going to hold back on deploying this at work. Now I want to deploy it immediately.

Re:Sounds like a good thing

[Opportunist]

I'm not kidding. This is a security update. And what a big one! It does not only add to the security of a single machine, it adds to the security of the internet as a whole!

Re:Sounds like a good thing

[cbhacking]

... unless you run with maximum permissions (root/Administrator). Vulnerabilities in Flashplayer are typically cross-platform; an exploit that works in Windows will work (after modification, but it will work) on Linux too. The difference usually just comes down to the degree of harm possible. Besides, while I don't know how this particular infection spreads, the odds are very good that it's a trojan... such things work quite nicely on *any* system where the user can get full permissions (almost everything except locked-down business machines) and doesn't know much about computer safety (the vast majority of non-Linux PC users, and some of the Linux users too).

In any case, stardard user accounts can't make changes like that. While EoP exploits may well exist, there are none I know of being used in the wild right now, and Microsoft takes patching them quite seriously. In any case, the specific OS version you're referring to is so old that it was designed for computers that listed their clock speeds in MHz and their hard disks in tens of GB. If it were *anybody* other than Microsoft, they wouldn't still be getting security updates at all!

Re:Sounds like a good thing

[Anonymous Coward]

That's not strictly true. There are user-mode rootkits, though these are much less nefarious than their kernel-mode brethren. Still, they have the ability to gain total control over pretty much everything you do in the context of your user account. Granted it doesn't totally hose your machine, but it can still cause damage.

Re:Sounds like a good thing

[crawling_chaos]

This sane OS of yours, does it come with rainbow pooping unicorns too?

I hear it's scheduled for the next service pack. At least I heard the word "poop" used in reference to it.

Re:Sounds like a good thing

[Spy der Mann]

Yes, because Linux has no local privilege escalation vulnerabilities, right? This sane OS of yours, does it come with rainbow pooping unicorns too?

In a SANE OS, hackers NEED to escalate privileges to gain administrator privileges for their rogue processes.
In Windows, you ALREADY have administrator privileges! Right from the start!

Re:Sounds like a good thing

[rubi]

Not really if you have ALL your machines taken out by said measure.

Re:Sounds like a good thing

[rubi]

That's a strawman argument. It's natural for security minded folks to "jab" at Microsoft (in a manner similar to how safety advocates "jab" at lead-painted Chinese toys).

On a SANE OS, rootkits can't be installed by regular users who are viewing a banner ad, or plugging in a storage device like a memory stick or USB picture frame.

So, I think the answer to that is: there aren't any "sane" OSs available for the general public. Only highly controlled and restricted machines are configured like that for everyday use. In all other, eventually at least one full-privilege user or operation has to be present.

Re:Sounds like a good thing

[rubi]

And remember also the "privilege-escalation" exploits available.

Re:Sounds like a good thing

[TrancePhreak]

This is incorrect for versions of Windows starting with XP (if run as non super) and for Vista/7 (run as any user).

Re:Sounds like a good thing

[ozmanjusri]

Vulnerabilities in Flashplayer are typically cross-platform; an exploit that works in Windows will work (after modification, but it will work) on Linux too.

Can you link to any actual exploits, not just those imagined by Microsoft's marketing department?

Ah, well, that lets Microsoft off the hook then

[Rogerborg]

After all, there's no way that their malware tool could have spotted it, or the update could have checksummed the files before patching them.

If they put half as much effort into their anti-malware activities as they do into their DRM regime, the world would be a better place. We'd all have unicorns, and a pot of gold.

Re:Ah, well, that lets Microsoft off the hook then

[Com2Kid]

After all, there's no way that their malware tool could have spotted it

If a system has been rooted, nothing short of booting to another OS from a known clean media, mounting the disk read only, and scanning, is guaranteed to detect a root kit.

That'd make updates a real pain in the arse to install...

Re:Ah, well, that lets Microsoft off the hook then

[girlintraining]

After all, there's no way that their malware tool could have spotted it, or the update could have checksummed the files before patching them.

Well, actually no. Most rootkits either modify the permissions or patch critical system files that cannot be easily replaced, as this one does. It's designed to be stealthy -- so if you scan it, it will return a byte-for-byte copy of the original, which is kept elsewhere, while the operating system loads the infected one at boot.

Saying Microsoft is responsible for ensuring compatability with 3rd party software is ludicrious. This is like potholes -- while the government has a responsibility to patch the roads up so they remain drivable, cars are nonetheless designed with shocks and drivers are expected to watch for road hazards and avoid them as much as possible as well. It is a joint responsibility. Microsoft is not the sole responsible party here: The user shares the responsibility of ensuring the system has not been compromised.

Re:Ah, well, that lets Microsoft off the hook then

[_xeno_]

Isn't one of the things a rootkit does is attempt to prevent detection?

How do you know that they don't try and match checksums, only the rootkit was returning the "correct" data in order to hide its presence? I mean, it is in the system file that handles reading data from hard drives, which sounds like the perfect place to put in code designed to stealth out the rootkit.

Not that I can get to the article ("Error establishing a database connection"), so I have no idea if that's the case, but it seems quite possible to me that if it's a rootkit, it's actively hiding from detection, which would seem to let Microsoft off the hook. Except for however the rootkit infected the machine in the first place.

Re:Ah, well, that lets Microsoft off the hook then

[Loopy]

Clueless comment. Microsoft was NOT patching atapi.sys in this set of updates. Unless you're asking MSFT to checksum every single file that has one of their patch binaries as a dependency? (Think about that one for a second before your knee jerks.)

Re:Ah, well, that lets Microsoft off the hook then

[Heed00]

I'd call mine Gary:

God/Flanders: *Gasp* My unicorn! Oh, what have they done to you, Gary?"

Re:Ah, well, that lets Microsoft off the hook then

[PIBM]

Scanning it does not even guarantee the detection of the root kit. I can see tons of useless scans a user could run ;)

Re:Ah, well, that lets Microsoft off the hook then

[ozmanjusri]

Im going to go with the user.

Of course.

They're the ones who paid for an OS that's about as secure as a colander, after all.

Re:Ah, well, that lets Microsoft off the hook then

[PIBM]

The rootkit was hiding there, but there's nothing that prevent it from using other files which could have been modified (thus breaking hte rootkit compatibility ??)

Re:Ah, well, that lets Microsoft off the hook then

[Rockoon]

You seem to be suggesting that atapi.sys was updated. Got any proof of that?

You seem to be using the same failed logic as other people, that a file modification exists after it has been over-written. No, it actually doesn't. There are no ghostly modified bits that linger around. Clearly this file is doing something it shouldn't, which by definition means that it didnt get replaced in the update.

If you arent a programmer or some shit, dont offer your opinion, because right now its terribly stupid.

Re:Ah, well, that lets Microsoft off the hook then

[timeOday]

If they put half as much effort into their anti-malware activities as they do into their DRM regime, the world would be a better place.

They're more or less the same thing - the spread of malware is unauthorized file copying. The only way to fully prevent malware is to stop users from installing software, since they sometimes install malware.

The idea of not letting people install whatever they want on their own computers may sound ludicrous, but locked-down consoles have largely displaced PC's for gaming, and the iPhone is the #1 smartphone, so it's far from just a joke or a paranoid fantasy. It's here, and a lot of people like it.

Re:Ah, well, that lets Microsoft off the hook then

[The MAZZTer]

Windows File Protection is supposed to checksum and restore modified files. But if malware gets on your machine, all bets are off and it will likely be bypassed or tricked. In addition, it's a rootkit, so normal checksum scans are supposed to detect nothing, it's supposed to be good at hiding. Wouldn't be a very good rootkit if it was found by a feature not designed to find rootkits specifically.

Re:Ah, well, that lets Microsoft off the hook then

[Sockatume]

I'm not sure it'd be such a pain. Windows already demands to restart after critical updates anyway. Couldn't it throw a flag to boot from a secondary, encrypted, trusted "update partition" that only the Windows root can edit, and only during shutdown, then use that to mount the disk as read-only and install updates? You could call it Microsoft SafeUpdate, part of the Trusted Computing Initiative. Heck, make the secondary partition an SSD, give the hardware manufacturers a reason to get behind it.

Re:Ah, well, that lets Microsoft off the hook then

[BluenoseJake]

I'm pretty sure most other malware scanners are in use in the world, and they don't seem to be detecting either, but feel free to ignore the facts

Re:Ah, well, that lets Microsoft off the hook then

[jhoegl]

That is BS and you know it.
The user installed the virus into their system by doing something stupid.
Its like blaming the US Government for letting businesses go over sea when you still shop at Walmart.

Your response is a cop out.

Re:Ah, well, that lets Microsoft off the hook then

[BluenoseJake]

The iphone is the number 3 smartphone, in the world. I think it has %14. Please google.

Re:Ah, well, that lets Microsoft off the hook then

[davidwr]

"We'd all have unicorns, and a pot of gold."

Unicorns? UNICORNS? Who wants pesky unicorns? Mine keeps knocking over my pot of gold.

Re:Ah, well, that lets Microsoft off the hook then

[spun]

That is BS and you know it.

The user installed the virus into their system by doing something stupid.

Its like blaming the US Government for letting businesses go over sea when you still shop at Walmart.

Your response is a cop out.

Your response is what is commonly known as 'blaming the victim.' Seriously, you can't imagine any other way for malware to get onto a system except user stupidity? I'd call that a failure on your part. You know, Windows fanbois remind me of battered women, explaining to others how they walked into a door or fell down some stairs. No you didn't, you let somebody beat the shit out of you and then covered it up.

Re:Ah, well, that lets Microsoft off the hook then

[RoFLKOPTr]

I'm not sure it'd be such a pain. Windows already demands to restart after critical updates anyway. Couldn't it throw a flag to boot from a secondary, encrypted, trusted "update partition" that only the Windows root can edit, and only during shutdown, then use that to mount the disk as read-only and install updates? You could call it Microsoft SafeUpdate, part of the Trusted Computing Initiative. Heck, make the secondary partition an SSD, give the hardware manufacturers a reason to get behind it.

RootKit() {
if ( RecoveryPartitionPresent() == 1 ) {
WriteRandomShit(RecoveryPartition);
}
}

Re:Ah, well, that lets Microsoft off the hook then

[gbjbaanb]

You could call it Microsoft SafeUpdate

or even Windows File Protection and only allow drivers that have been digitally signed.

Nice idea I suppose, but as they didn't work there's only one solution - DRM on everything in your C drive!!

Re:Ah, well, that lets Microsoft off the hook then

[TheLink]

> Saying Microsoft is responsible for ensuring compatability with 3rd party software is ludicrious.

And saying Microsoft is responsible for ensuring compatibility with _malicious_ 3rd party software is even sillier.

If your system is screwed up by a rootkit, there is no way to 100% predict what could happen if you try to continue using it (including trying to install patches).

If the BSODs are only happening to rootkitted XP boxes then it's clearly not Microsoft's fault.

Re:Ah, well, that lets Microsoft off the hook then

[Tuidjy]

You know, it is far from easy to implement a "secondary, encrypted, trusted "update partition" that only the Windows root can edit, and only during shutdown" on a PC that has been rooted, unless you support this in hardware. And I can already hear the screaming and gnashing of teeth if some people, present company very much included, learned that PCs come with something like that.

I would certainly not be happy running hardware that I knew had something that I and no one I know could get into. And I can get into it, it's not that "trusted", is it?

Re:Ah, well, that lets Microsoft off the hook then

[psetzer]

This is pretty ironic considering the circumstances. Their DRM code is pretty much the standard process and kernel isolation plus hardware support for looking to see if anyone's messed around with critical system files to bypass that.

Re:Ah, well, that lets Microsoft off the hook then

[flitty]

People who get viruses are now "victims"? Or are you saying Windows users are "victims"?

Nevermind, this is /. --- don't answer that.

Re:Ah, well, that lets Microsoft off the hook then

[zippthorne]

How long would it take to checksum every executable and library on a windows machine, anyway? What makes this something that can't take place on a regular or manually initiated basis?

Re:Ah, well, that lets Microsoft off the hook then

[Mister Whirly]

And Linux fanbois remind me of a battered woman who cannot get her damn wireless card working for the life of her.

Re:Ah, well, that lets Microsoft off the hook then

[mrclisdue]

You know, Windows fanbois remind me of battered women, explaining to others how they walked into a door or fell down some stairs. No you didn't, you let somebody beat the shit out of you and then covered it up.

That's beautiful. I may borrow it someday.

cheers,

Re:Ah, well, that lets Microsoft off the hook then

[StormyWeather]

My colander is very secure thank you. I keep it underneath the stove, and it's not connected to the internet in any fashion. In fact, I don't even plug it in.

Re:Ah, well, that lets Microsoft off the hook then

[zippthorne]

Seems it matters how you tally the numbers. Apparently iPhone is the most used smartphone while Blackberry is the most bought smartphone.

That right there says something that is not particularly flattering to RIM.

Re:Ah, well, that lets Microsoft off the hook then

[spun]

I've installed Linux on half a dozen laptops in the last year. In every case, the installation auto detected the wireless card and I had absolutely no problem getting connected.

The year before that, I had to work on my mom's Windows laptop. She'd had several wireless cards in it over the years, and all the damn special software each of them had installed left her system a barely functioning wreck. It took me hours to get it sorted.

Anecdotal data, sure, but so is every single case of "Waaa! Linux doesn't have wireless, waaaaaaa!"

Re:Ah, well, that lets Microsoft off the hook then

[Sir_Lewk]

What exactly would be the point of that? Infections senselessly trashing systems is pretty 1990. If the recovery partition is ever actually needed, that would mean the rootkit is effectively dead already, so why should it care what happens next?

Re:Ah, well, that lets Microsoft off the hook then

[ascari]

It would be a lot easier if everybody just went with the plan and upgraded to Windows 7. Surely the improved security features I read about will prevent something like this to happen! Right?

Re:Ah, well, that lets Microsoft off the hook then

[svtdragon]

Or you don't pay for the OS, and you don't have to pay for antivirus.

Isn't free software great?

Re:Ah, well, that lets Microsoft off the hook then

[Mister Whirly]

Yeah, I know, but when has reality ever stopped anyone from beating a dead horse on Slashdot? I mean what is really the point of this whole site if you take away the saying half-truths to annoy people part??

Re:Ah, well, that lets Microsoft off the hook then

[cgenman]

On the one hand, I'd agree with the other posters that detecting rootkits once they're installed is incredibly difficult.

On the other hand, that windows is so rootable is a problem. Yay for adding malware tools to window. But the standard operating procedure of adding layer after layer of new code for new functionality is getting pretty creaky. It opens more avenues for rootkits and other problems to break through.

Re:Ah, well, that lets Microsoft off the hook then

[Z34107]

You're assuming your tool can detect the rootkit in any case.

If it can detect it during an offline scan, it can probably detect it during an online scan too. (Of course, the rootkit will have the opportunity to hide itself or destroy your tool.) ComboFix and MalwareBytes are especially good at removing TDSS.

Re:Ah, well, that lets Microsoft off the hook then

[Cl1mh4224rd]

Couldn't it throw a flag to boot from a secondary, encrypted, trusted "update partition" that only the Windows root can edit, and only during shutdown, then use that to mount the disk as read-only and install updates?

I'm pretty sure that if your system's been rooted, that's no protection at all. Besides, rootkits would quickly evolve to account for this process.

Re:Ah, well, that lets Microsoft off the hook then

[jedidiah]

So we have these two "extremes" to choose from:

      Either some hardware is not supported,

            or

      your system will get infested with malware and then eat itself the next time it's updated.

Take your pick.

Re:Ah, well, that lets Microsoft off the hook then

[jedidiah]

> Saying Microsoft is responsible for ensuring compatability with 3rd party software is ludicrious.

Not at all. This is their main selling point.

Re:Ah, well, that lets Microsoft off the hook then

[Opportunist]

As much as I hate defending MS, I can't help but doing it here.

A rootkit (and that is one) in a system means that you, being software running on that system, have no chance of detecting it, at least if it has done its homework. For the patcher, those checksums might even have been correct.

It also needn't be manipulated files. Windows, as any OS that has to allow low level drivers, allows you to load non-MS ring0 drivers. Like, say, Linux. It's either that or writing a device driver for every single pesky little controller out there. Do you think MS would do that? Or even do it well?

Now, you don't need drivers for hard drives themselves, but for their controllers. And spyware is quite keen on snuggling up to those controller and "filtering" the calls between them and the OS. Now, those spyware drivers are deemed part of the I/O system (for obvious reasons, they are part of the HD controller drivers as far the OS is concerned). If that driver cannot be loaded because that patch fixes a loophole the spyware used, the OS identifies that as a critical error in the HD controller driver and cannot access the hard drive anymore. BSOD.

The very same would probably happen in Linux, in BSD, in ... whatever Apple's OS is called, I forgot. You have a driver that is deemed critical by the system that fails to load.

If you want to blame anything on MS here, it's probably that this rootkit drivers could be installed in the first place. And I honestly don't know if it's MS to blame or the user. What should MS do if the user clicks "allow" on anything he gets asked? Take away control from the user? I doubt you'd like that.

Re:Ah, well, that lets Microsoft off the hook then

[chris mazuc]

They're more or less the same thing - the spread of malware is unauthorized file copying. The only way to fully prevent malware is to stop users from installing software, since they sometimes install malware.

So your solution is to set up a walled garden where only the Powers That Be decide what I can put on my machine?

The idea of not letting people install whatever they want on their own computers may sound ludicrous

Because it is. I would not buy a computer that I can't write my own software for, which is why something like an iPhone or an iPad just isn't very useful to me. And no, jailbreaking isn't a fix for that, just a band-aid. Now not everyone has this kind of requirement, so let me give another example: Apple rejecting the Google Voice app.

iPhone is the #1 smartphone, so it's far from just a joke or a paranoid fantasy.

[citation needed]

It's here, and a lot of people like it.

And they are the same people who don't understand the technology they use on a daily basis.

Re:Ah, well, that lets Microsoft off the hook then

[Opportunist]

Of course you'd have to scan with a tool that is able to identify the rootkit. It's quite worthless to inoculate someone for Malaria if you want to protect him from SARS.

Re:Ah, well, that lets Microsoft off the hook then

[spun]

Sure, trolling is fun. But so is whining about trolls. Ah, the fun games we can play, here, on Slashdot.

Slashdot: there's no better way to waste a day.

Re:Ah, well, that lets Microsoft off the hook then

[jedidiah]

This is the KERNEL and the IDE DRIVER.

NOTHING should be screwing around with that.

The idea that you can't keep the end user away from this is just DOS style nonsense. Most applications should not need to go anywhere near system files. If there needs to be some sort of "application" superuser then perhaps it's time to institute that sort of thing.

At this point, even package managers should probably not run as root unless the core OS is being updated.

Re:Ah, well, that lets Microsoft off the hook then

[Mister Whirly]

Fortunately, I live in a world where it is possible to exist between the two extremes in the middle ground. I have already chosen. I have 2 locked down Windows boxes, a Mac, and a Linux box at home, all of which are malware free with 100% of the hardware being functional. Life is great when you don't live all the way out to the extreme edges. It also helps that I look at operating systems as a means to an end, and not like a religion. An OS is just a tool in the toolbox. Arguing which is superior is akin to arguing whether a hammer or screwdriver is the better tool.

Re:Ah, well, that lets Microsoft off the hook then

[Opportunist]

Pretty worthless if anything is run with Admin rights anyway. Until WinXP (and this is a WinXP problem), it was quite normal for the ordinary user to be constantly logged in with an account that has administrator privileges. Consider now that the standard setup in XP (IIRC) sets user password and "Administrator" password identical and you can easily see what this would be worth.

Re:Ah, well, that lets Microsoft off the hook then

[dave562]

If they put half as much effort into their anti-malware activities as they do into their DRM regime, the world would be a better place.

Like developing a FREE anti-virus / anti-malware tool and giving it away?

Re:Ah, well, that lets Microsoft off the hook then

[Opportunist]

You can do it, but it's basically worthless if your system has been infected with a rootkit. The rootkit can (and usually does) show you a perfectly healthy system instead of the reality on the drive. As has been said before, the rootkit probably keeps a copy of the original file somewhere and only "shows" it to you in its original place (where now that rootkit file is located). It doesn't usually affect its operation, since it has already been loaded and unless it needs more data from its file (unlikely), nothing bad happens from the fact that the file that is loaded differs from the file that is shown on the disc.

If you now try to calculate a MD5 from the file on the disc, you will be supplied the original copy (that was replaced by the rootkit) and calculate your MD5 from the healthy file, making it appear a_ok and fine.

Once a system has been rooted you have lost. I hate to use the same words I always get to hear from consultants, but here they fit: You cannot identify some problems from within the system.

Re:Ah, well, that lets Microsoft off the hook then

[SpaceLifeForm]

You would think Windows Defender could do that.

Re:Ah, well, that lets Microsoft off the hook then

[Opportunist]

It's not the same, it's the exact opposite. With copyright infringment, you want the file on your PC, its creator does not. With malware, you don't but he does.

And as I've said above, the fact that people like it that way is a dangerous slippery slope. And hence I am all for things like mandatory "computer drivers licenses", maybe even mandatory annual checkups like we have here for our cars (yeah, yeah, car analogies... go call someone who cares). If people are able to take care of their machines, if they can ensure their machines are in good repair and healthy, they are less likely to accept this invasion in their ability to use their machines as they want.

Re:Ah, well, that lets Microsoft off the hook then

[EvanED]

If it can detect it during an offline scan, it can probably detect it during an online scan too.

Not if it's a good rootkit. If the rootkit gets loaded before your scanner, the rootkit can hide itself from your scanner. And if it's ever loaded before your scanner, it can make sure it will always be loaded before it.

Rootkits have been replacing read calls to files that it modified by returning the original, correct data for a long time now. So it wouldn't matter if your scanner hits the right file and has the signature, if the rootkit was there first it can hook the call and return the expected data. Bam... false negative.

The only way to ensure that the rootkit doesn't load is to boot from an uninfected OS.

Re:Ah, well, that lets Microsoft off the hook then

[Sleepy]

Wrong - you are ignorant on this topic. Otherwise, please explain EXACTLY how an unprivileged user goes about installing malware.
They don't have rights to do anything "stupid"...

Re:Ah, well, that lets Microsoft off the hook then

[Opportunist]

Over 90% of current infections are due to social engineering (aka "user stupidity"). The rest is usually due to certain third party software from a company with a big A, usually a certain reader for a Pretty Dumb Format or a tool to make webpages flashy.

If it's blaming the victim to say that it's effing stupid to open attachments that are sent by "Lawyer" and titled "last reminder" or run "security patches" their bank sends them because else their account is closed immediately, then yes, I blame the victim. Stupidity is no excuse. And this behaviour is, bluntly, EFFING stupid!

Re:Ah, well, that lets Microsoft off the hook then

[V!NCENT]

Do you?

Re:Ah, well, that lets Microsoft off the hook then

[nschubach]

If you never plug it in, how do you get it to work!?

Re:Ah, well, that lets Microsoft off the hook then

[V!NCENT]

In most cases the 'user' is the techniocal definition of an account. In other words: some program, like IE, that runs with admin rights (root) (no longer the case with Vista and beyond, but there are other apps) did it.

Re:Ah, well, that lets Microsoft off the hook then

[elephant_hunter]

You're acting as if Microsoft created the malware.

Re:Ah, well, that lets Microsoft off the hook then

[rarel]

I have a scanner, it's an Epson something. Doesn't do a damn thing, always gives me just a picture. These things are such a ripoff... :/

Re:Ah, well, that lets Microsoft off the hook then

[StiffPeter]

Hey, I don't wanna sound like a queer or nothin', but I think unicorns are kick ass! - Pete

If they put half as much effort into their anti-malware activities as they do into their DRM regime, the world would be a better place. We'd all have unicorns, and a pot of gold.

Re:Ah, well, that lets Microsoft off the hook then

[spun]

Bullshit. First, you have no data showing that 90% of infections are anything. You pulled that number out of your ass.

Second, 90% isn't 100%. Meaning, even if that number is correct, I am right and both you and the original poster there are wrong.

Third, being conned doesn't mean a person is stupid. Plenty of smart folks get conned.

Finally, this is just an opportunity for you to wave your dick around acting superior. You are too smart to ever have malware on your system, you go girl! Yay, you're so superior. I don't have malware on my system either, but I'm not so insecure that I need to put down people who do.

Re:Ah, well, that lets Microsoft off the hook then

[plague3106]

You pay with your time having to support the damned thing. Yup, I left linux because it was too much trouble keeping it going and I wasn't able to get done what I actually wanted to get done. I now happily pay for Windows, and have never had a virus.

Re:Ah, well, that lets Microsoft off the hook then

[zippthorne]

Ok, but there are still a number of problems that you *could* identify with regular checksumming, though aren't there?

Re:Ah, well, that lets Microsoft off the hook then

[Opportunist]

The only data I have on this matter is still under an NDA, so I can as well have none. But you are invited to draw your own sample. Take every infector you can get your hands on and check what way they use to get onto the machine.

And yes, 90% is not 100%. Still it means that the chance to be infected provided you know what you're doing is 1/10th of that if you don't. While this does not immediately translate to 9 out of 10 infected machines being infected because the user sitting in front of it is unable to defend against social engineering infection routes, it still means that you are about ten times as likely to catch something if you are not able to use your computer in a safe way.

There's a story in the firehose currently about an interesting incident that showcases the problem quite well. A blogging page had a huge problem: They appeared as the first Google search result for "facebook login". The result was stunning! Their comment section was swamped by angry people complaining that they cannot log into their facebook account. They did not check the URL, the did not even bother realizing that the webpage looks completely different.

Could you see how a malicious attacker could try to get the first spot for search terms containing paypal or amazon, and set up a fake page there to lure people into logging in?

Yet again, I would call it user stupidity if this happens. Or rather, the inability to use the tools sensibly. Getting conned even if you're smart and cautious because someone is smarter is one thing. Getting conned because you're using something and have not the foggiest idea what you're doing is something completely different.

Re:Ah, well, that lets Microsoft off the hook then

[Z34107]

My sentence immediately following your quote:

(Of course, the rootkit will have the opportunity to hide itself or destroy your tool.)

In my experience at my campus' help desk, the TDSS rootkit hasn't been sophisticated enough to hide from RootkitRevealer, ComboFix, or MalwareBytes.

We generally find it with one of the "XP Antivirus 2010" variants, and when they come together TDSS seems to reinstall the scareware payload. In those cases, it's especially obvious when it's been removed - the "you've been infected" pop-ups go away.

I don't disagree with you, but 90% of the time a 10 minute ComboFix scan removes it. The only way to be sure is diskpart clean all (or dd /dev/zero /dev/hda) from a WinPE or Linux boot disc.

Re:Ah, well, that lets Microsoft off the hook then

[Opportunist]

Certainly, but old fashion file infectors are rare these days. Why infect a system file (which comes with a can of worms all by itself, if for nothing else than for the threat that the next update could wipe your malware)? It is most efficient only when you also plan to plant a rootkit, else any AV tool will find you anyway.

Re:Ah, well, that lets Microsoft off the hook then

[adonoman]

For any home user that's running Win XP or earlier and not already running as admin, they'll log off, log back in as admin, and rerun the malware. For OSX/Linux/Vista/Win7 users, they'll happily enter their password when prompted.

Re:Ah, well, that lets Microsoft off the hook then

[Machtyn]

I don't think I follow you. Their DRM regime can be just as atrocious (from some reports I've read), as it is just as riddled with problems as anything else.

On another note, I had to deal with that atapi.sys rootkit. It was extremely nasti and I had to do a system format to rid the computer of it.

I suppose I'll have to go run combofix against the machine I had to "fix" last night.

Re:Ah, well, that lets Microsoft off the hook then

[spun]

So in your analogy, who is the wife-beater? Microsoft? Or the malware author?

The malware author. In case it wasn't clear, I am not blaming Microsoft. I'm old enough to remember when Windows really did crash all the time, and was not secure. But it hasn't been like that since XP SP 2.

Re:Ah, well, that lets Microsoft off the hook then

[jmnugent]

That's been my experience (relying on Combofix as my favorite/first scanner)... up until about a month ago, we started seeing rootkits and malware infections that were significantly more complex and sophisticated than anything I've ever seen. I've got 2 systems on my bench right now that are infected with some sort of MBR (Master Boot Record) rootkit. I've thrown every utility I can possibly find at them and not made much forward progress at all. Avira AntiVir Rescue CD seems to have gotten me a foothold (allowing me to identify hidden files).. although I had to use another custom BartsPE bootable CD to delete those files. .... GMER is also a very valuable rootkit detector, and their MBR.exe utility is a lifesaver.

Re:Ah, well, that lets Microsoft off the hook then

[spun]

Are you talking about all zealots, or just a subset? Because I'd venture a guess that a certain class of zealots distorts reality for pay, if you know what I mean.

Re:Ah, well, that lets Microsoft off the hook then

[Z34107]

A Windows PE disc (meaning any Server 2008/Vista or newer Windows disc) is very nice for this. Shift+F10 will bring a command prompt; bootsect will let you restore an XP or Vista boot sector.

Chkdsk breaks a lot of rootkits - they break the file system and chkdsk removes them.

Another fun trick: Make an image of the disk with ImageX from the Windows AIK. Then immediately restore the image onto your disk. ImageX is file based, and the rootkits do their best to hide, so they're missed when the image is gathered.

But by that point, it's faster/safter to do a clean install Q.Q

Re:Ah, well, that lets Microsoft off the hook then

[Capt.DrumkenBum]

Better version:

RootKit() {
if ( RecoveryPartitionPresent() == 1 ) {
WriteSelfInto(RecoveryPartition);
}
}

Re:Ah, well, that lets Microsoft off the hook then

[svtdragon]

I have never had this problem. In fact it's reduced the amount of support time I've had to put in, since the people whose PCs I've put it on now no longer have viruses. And for when they have issues, I have conveniently set up port forwarding on their routers and SSH servers so I can remote in and fix them without having to tell them "click x, now y, click apply, OK, and reboot."

I say this as I run an up-to-date Ubuntu server install that runs KVM that supports a Windows 7 VM using PCI passthrough to Windows Media Center for my TV tuner, which streams media to my 360 (since I don't want to get blacklisted for hacking it). All of that took a while to set up, but I went through the extra effort (over just using windows) because of the extra functionality Linux provides me--SVN servers, Trac VMs for my software projects, and a nifty little app that will actually send me an email and a text when my UPS kicks on due to a black/brownout, and keep me updated with its percentage of battery life. And those are just the first customizations I've made.

In short, Linux makes my life easier.

Re:Ah, well, that lets Microsoft off the hook then

[Dishevel]

Hammer!

Re:Ah, well, that lets Microsoft off the hook then

[spun]

No. No I'm not acting that way at all, sorry you misread that.

Re:Ah, well, that lets Microsoft off the hook then

[Dishevel]

Only 2 types of people get conned. The greedy and the stupid.

Re:Ah, well, that lets Microsoft off the hook then

[omnichad]

No, no. A good sturdy screwdriver can bang stuff into a wall. Try turning a screw with a hammer.

Re:Ah, well, that lets Microsoft off the hook then

[KingMotley]

Sorry, your rootkit is currently incompatible with this version of windows. Please contact the manufacturer of your rootkit for an updated version.

Re:Ah, well, that lets Microsoft off the hook then

[Anne Thwacks]

Do you have any idea how many UNIX drones are out there

Surely the answer must be "none" - drones obviously run "Windows for Drones"?

Re:Ah, well, that lets Microsoft off the hook then

[PsychoSlashDot]

After all, there's no way that their malware tool could have spotted it, or the update could have checksummed the files before patching them.

If they put half as much effort into their anti-malware activities as they do into their DRM regime, the world would be a better place. We'd all have unicorns, and a pot of gold.

Again... the patch did not patch the infected file. It patched the kernel. So how bad is it really that a properly patched kernel won't initialize an infected driver?

You're asking MS to check the MD5 of every file they provide, every time anything anywhere is patched. Further, the MD5 table has to hold every variant of every MS file, any of which could be valid. Further, files could be deliberately replaced by the user for any of a number of completely valid reasons. Not reasonable.

Re:Ah, well, that lets Microsoft off the hook then

[Fred Foobar]

No, no. A good sturdy screwdriver can bang stuff into a wall. Try turning a screw with a hammer.

That's easy! Use the "claw" end of a claw hammer. (Granted, this works ok for flat-head screws, but not so well for Philips screws)

Re:Ah, well, that lets Microsoft off the hook then

[dissy]

After all, there's no way that their malware tool could have spotted it, or the update could have checksummed the files before patching them.

Sadly, yes. But I still place a teeny bit of blame on Microsoft regarding this.

While you are totally correct in that their malware tool nor checksums would have been able to detect a rootkit, so this specific problem would still have happened at no fault of theirs.. Still, they could have Tried to verify a checksum.

I mean, you are fully correct that it wouldn't work anywhere close to 100% of the time.
But isn't 3 or 5% of the time better than zero?

Meh, I guess it doesn't matter. The rootkit method can't be detected unless the rootkit itself has a bug to see and take advantage of. So as long as there is nothing that can be done within the OS about it, attackers will continue using it as a vector (successfully), and Microsoft will pass the no-verifying-checksum buck off as pointless due to this very reason, while ignoring the many other ways a file could get changed and have a similar problem.

Imagine some major program like an Antivirus or a poor (read: hooks in the kernel deep) backup app, or even just a utility that has to change a major function in windows.. they release their update on the same day or a day before Microsoft finishes patch testing and pushes it out, thinking they tested that program already (Which they did, just not the newest version heh)

If they put half as much effort into their anti-malware activities as they do into their DRM regime, the world would be a better place. We'd all have unicorns, and a pot of gold.

Amen!

Re:Ah, well, that lets Microsoft off the hook then

[dissy]

And Linux fanbois remind me of a battered woman who cannot get her damn wireless card working for the life of her.

Well if she didn't use windows, she wouldn't have to fight for her life to get the wireless to work, it just would.
She also probably wouldn't be hitting her head on the desk causing her to be battered, if she didn't have to fight with Windows.

Re:Ah, well, that lets Microsoft off the hook then

[StillNeedMoreCoffee]

Sorry, getting caught through social engineering is not stupidity, its a con with evil people preying on innocent people. If you are saying it is criminal to be innocent, or shall we say, trust no one, don't believe anything anyone says, think ill of everything and everybody, then I say Sorry no. That is not a world anyone should live in, and people who prey on others are no good selfish greedy basdards and bitched and deserve jail time.

You can see it with viruses. There is always someone trying to find another path to cheap riches at someone elses expense. Find one way to stop it and they look for another way. So to blame the victim for someone finding a way to use their good nature to screw them, I say not their fault, ever.

Re:Ah, well, that lets Microsoft off the hook then

[westlake]

Your response is what is commonly known as 'blaming the victim.' Seriously, you can't imagine any other way for malware to get onto a system except user stupidity?

Why does malware remain resident on a system?

Win32/Alureon was added to MSRT and MSE last October. The Virus Tools scans suggest about 70% of mainstream AV programs should have detected it.

Re:Ah, well, that lets Microsoft off the hook then

[BikeHelmet]

I'd estimate it a lot lower than that. There's a lot of compromised ad networks... advertisements are a very common way to get infected - especially since many have flash content.

Maybe 10% are from user stupidity. Another 85% are from programmer stupidity. Don't you remember the earlier versions of Outlook/Outlook Express, where there was no way to delete a message without opening it plus the attachments? :P That's programmer stupidity at its finest. All these flash exploits and PDF exploits are also programmer stupidity. Ad network compromised? Programmer stupidity.

User stupidity is believing a telemarketer, or running an update received via email - and such stupidity is surprisingly rare. If it wasn't rare, OSX would be overrun with malware - but it isn't.

More fine examples of programmer stupidity are Windows XP getting infected within 3 seconds of plugging in the ethernet cable, unless you have a hardware router between you and the internet. Is it so hard to keep those ports closed, or at the very least ensure stuff like Help and Support can't be hacked to let viruses in? OSX manages it. Programmer stupidity.

Is the user running as an Admin? That's the default in XP. Programmer stupidity.

The only user stupidity I see is when someone is recommended spyware by a friend, and installs it. I've seen that with shitty System Cleaning software, and also old programs like Weatherbug. There's probably quite a bit of that going on on Facebook, but I'd still wager on programmer stupidity being a way huger factor.

Re:Ah, well, that lets Microsoft off the hook then

[BikeHelmet]

If the BSODs are only happening to rootkitted XP boxes then it's clearly not Microsoft's fault.

It really depends on how they got rootkitted. :P

But I will agree that the reason for blaming them is incorrect.

Re:Ah, well, that lets Microsoft off the hook then

[gsiliceo]

You can, you sure can within the system, you got to think outside the box. Lets say you are suspcious of your system You open a program that monitors the net connections, you have everything closed but activity is going on. And then either You load another program that tells you what files are loaded, you compare this list with a list you made when your system was healthy. And then you google the odd files, bingo! you got your malware identified. Or you load all the rootkit detectors in your arsenal. There are always indicators of irregular activity you just use the right tools to spot them.

Re:Ah, well, that lets Microsoft off the hook then

[machine321]

I find your lack of variable initialization disturbing.

Re:Ah, well, that lets Microsoft off the hook then

[ajlisows]

Really, this is a pretty Golden Opportunity for Microsoft to really push its "Windows Security Essentials" or whatever it is called. "You are about to install some new security updates. It is highly recommended that you scan your system with Microsoft Security Essentials before receiving these updates. Click "Yes" to automatically download, install, and scan your computer for any potential problems during the update process.

Yes, we all know Windows has some security holes. We can argue until we are blue in the face as to who is at fault for these holes. I do have a hard time blaming Microsoft if a "3rd party" piece of software is causing an update to blow up computers. You can't really expect them to find a machine, infect it with every malware/virus/rootkit variant (not to mention legitimate software) and run the updates to ensure that they will not crash the system.

Re:Ah, well, that lets Microsoft off the hook then

[ozmanjusri]

You pay with your time having to support the damned thing.

Now THAT is the biggest load of FUD I've seen in print for decades.

Do you know how much time I have to spend supporting family and friends Windows installs? They break CONSTANTLY!

Every friends' or family computer I've switched over to Linux has meant LESS time I've wasted fixing broken registries, troubleshooting failed installs, non-functioning networks or cleaning malware.

Linux is an order of magnitude less trouble-prone than Windows!

Re:Ah, well, that lets Microsoft off the hook then

[yuhong]

Indeed, MS already pushes a Malicious Software Removal Tool every Patch Tuesday along with the updates. I'd add detection and removal of the rootkit to it.

Re:Ah, well, that lets Microsoft off the hook then

[ajlisows]

You know....I guess I never really thought about it but what the hell is that Malicious Software Removal Tool anyway? Does it actually....you know...remove malicious software?

Re:Ah, well, that lets Microsoft off the hook then

[westyvw]

I don't get that one at all. It's windows that always needs my attention, hardly ever the linux boxes. Ubuntu can be a bit more annoying then I like, so while I will install it for some people because it is easy to use, it does require more attention and breaks more often then other Linux distros I use, but over all it just works and requires much less explanation to the end user.

Re:Ah, well, that lets Microsoft off the hook then

[Ciggy]

Still it means that the chance to be infected provided you know what you're doing is 1/10th of that if you don't.

No it doesn't. It means that for every 100 machine infected, 1/10 were belonging to those who knew what they were doing. In fact, it is actually possible (and likely given that it appears that most people do not know what they're doing [with Windows]) that you're chance of being infected if you know what you're doing is GREATER than if you don't know what you're doing!

Only if the NUMBER of machines owned by people who know what they're doing EQUALS the NUMBER of machines owned by people who don't know what they're doing will it mean you've got a 1/10 of the chance of being infected if you know what you are doing vs no knowing which means that the chance you've got of being infected if you know what you're doing is 1/9 that if you don't., since 1/9 of 9/10 is 1/10. Here's why:

<nerd mode>
The chance of being infected is

Pr(infected) = Pr(I) = <number of machines infected> / <total number of machines>
Pf(knowing) = Pr(K) = <number of machines of those knowing> / <total number of machines>
Pf(not knowing) = Pr(nK) = <number of machines of those not knowing> / <total number of machines>

also

Pr(infected | not knowing) = Pr(I | nK) = <number of infected of not knowing> / <total number of not knowing>

and

Pr(infected | knowing) = Pr(I | K) = <number of infected knowing> / <total number of knowing>

However, all we know is

Pr(knowing | infected) = Pr(K | I) = <number of infected knowing> / <total number of infected> = 1/10
Pr(not knowing | infected) = Pr(nK | I) = <number of infected not knowing> / <total number of infected> = 9/10

but we can use

Pr(I | K) = Pr(K | I) * P(I) / Pr(K)

similarly for

pr(I | nK) = Pr(nK | I) * P(I) / Pr(nK)

Then the chance to be infected provided you know what you're doing against that if you don't. is...what? I'll assume that it means how much more likely you are to be infected given you know what you're doing vs if you don't, ie

ch(K vs nk) = Pr(I | K) / Pr(I / nK)
ch(K vs nK) = Pr = Pr(K | I) * P(I) / Pr(K) / (Pr(nK | I) * P(I) / Pr(nK))
ch(K vs nK) = Pr(K | I) * P(I) * Pr(nK) / (Pr(nK | I) * Pr(I) *Pr(K))
ch(K vs nK) = Pr(K | I) * Pr(nK) / (Pr(nK | I) * Pr(K))
ch(K vs nK) = 1/10 * Pr(nK) / (9/10 * Pr(K))
ch(K vs nK) = 1/9 * (Pr(nK) / Pr(K))

I suspect that the majority of Windows users do not know what they're doing, thus: Pr(nK) > Pr(K) meaning that Pr(nK) / Pr(K) > 1 and ch(K vs nK) = (1/9 * [> 1]) > 1/9.

In particular, if the number of those who don't know what they're are doing (as I guess most people would suspect) is such that there are more than 9 times those who do know what they're doing, then

Pr(K) = #(K) / (#(K) + #(nK)) = #(K) / (#(K) + (9+d)#(K)) = #(K) / (#(K)(9+d)) = 1/(10+d) < 1/10
Pr(nK) = 1 - Pr(K) > 9/10

then the chance of being infected knowing vs not knowing is

ch(K vs nK) = 1/9 * ((9+d)/(10+d)) / (1/(10+d)) = 1/9 * (9+d) / 1 = 1/9 * (9+d) = 1 + d/9 > 1

meaning that you're MORE likely to be infected if you KNOW what you're doing then if you DON'T!
</nerd mode>

Re:Ah, well, that lets Microsoft off the hook then

[The End Of Days]

I've been wondering for years; do people really believe that anyone who expresses even a slightly positive opinion about anything Microsoft related is being paid? Is that an actual belief instead of convenient and lazy argument?

Re:Ah, well, that lets Microsoft off the hook then

[Thing 1]

Once a system has been rooted you have lost.

Exactly.

So, Windows should, out of the box, take measurements of every activity that it performs. When reading a file, save the checksum; also, save how long it took the file to read, and from where (in case it gets moved to a slower cylinder, or becomes fragmented).

Granted, I'm talking about saving a ton of data, which may not yet be feasible (but with today's quad-core CPUs, might be getting there -- they say "give a core to the antivirus" after all, and this is basically that).

Then, when an operation takes significantly longer than it is expected to, the computer can give an alert. (Of course, the alert process could be compromised as well; so, put this function in the hardware, and then the BIOS bloats and we get BIOS viruses; so, put it in the CPU, and I'll stop here.)

Re:Ah, well, that lets Microsoft off the hook then

[Opportunist]

Again, what keeps the rootkit from corrupting that data as well? It has access to ring0 privileges (or else no rootkit was possible), so any file you stored is at its mercy as well. Sure, it's another layer of protection but it's also one layer the rootkit can corrupt and, if that's what it takes, it will. As you said, today's processors make it trivial to hide such activity because the added time is measured in fractions of a second.

So, as you correctly identified, you have to cast that in silicon. Which is impossible because the CPU vendor does not know what read/seek times your hard drive will have or how much time your ram will actually need to process that information. The only thing you could do is run an independent program that bypasses all system calls and sniffs the hard drive directly. But only if you manage to hide that program and its activity from the rootkit or it will take countermeasures again... welcome to the malware arms race.

Re:Ah, well, that lets Microsoft off the hook then

[thejynxed]

Wrong. XP also has file protection. You can even add files to be covered. This is why when you try to delete something like CTFMon, it always comes back like a case of the herpes. It's automatically reinstalled into the proper directory by the OS after 30 seconds from a file/driver cache that is kept as a hidden directory in the Windows\System32 folder.

Re:Ah, well, that lets Microsoft off the hook then

[thejynxed]

Around here, it's actually a belief of some morons.

Disclaimer: Happy Windows User (Vista + Win7 64-Bit). Linux does not do what I need it to do, and I detest all things Apple.

Re:Ah, well, that lets Microsoft off the hook then

[Ol Olsoc]

Allmyfaultallmyfaultallmyfault!

This blame the victim business is so darn cute.

So I guess that you folks who blame the user also support that user going to a different system where he or she is not so "EFFING STUPID". I use XP/Vista, Mac OS X and Ubuntu.

One of the OS's I have to spend a LOT of time on just to keep safe, and the other two, I run mostly bareback.

Re:Ah, well, that lets Microsoft off the hook then

[TheLink]

Who's blaming the user?

It's not just Microsoft and the user in the world.

Re:Ah, well, that lets Microsoft off the hook then

[Ol Olsoc]

Half of the posts on this subject are blaming the user, did you not read them?

Re:Ah, well, that lets Microsoft off the hook then

[TheLink]

Go post that reply to those posts then.

I don't blame the user, because:

1) Trying to figure out whether something is safe to run (without the source code and the full inputs) is harder than solving the halting problem.
2) Only allowing the user to run Vendor Approved software is overly and unnecessarily restrictive.

As such I have proposed to the O/S makers to do something like the following:

https://bugs.launchpad.net/ubuntu/+bug/156693

Basically a program will have to declare upfront the limits of what it will be able to do (based on a set of templates). And then if the user approves, the O/S will then restrict the program to those limits.

Right now the Vista/Windows 7 UAC stuff is useless. So what if a program is signed or unsigned, it means little even to someone technically inclined- you still have no idea what the program will really do whether it's signed or not.

So I do partly blame the operating system bunch (Linux, Windows, Mac, etc) for still being stuck in the 1960s when it comes to security. After 50 years and how many billions of dollars of "R&D", and we're still stuck with primitive security systems, where if someone runs say a "tetris clone" their documents and private data end up at risk.

But most of the blame still goes to the people unleashing the malware on the users.

Re:Ah, well, that lets Microsoft off the hook then

[yuhong]

Yea, and MS has a list of what it removes.

SFC Find It?

[ircmaxell]

Will the windows SFC (System File Checker) tool find this altered file?

Re:SFC Find It?

[RayMarron]

Not if the rootkit responds to the request with the original values for the files it has replaced. That's the the thing about a rootkit - it gets to tell the OS whatever it wants.

Re:SFC Find It?

[ircmaxell]

Is that how SFC works? It calls a method in the DLL? I would think it would do an MD5 (or similar -- possibly stronger -- hash) on the file, and compare the hash and the size to the known values. The only way around that would be to alter what SFC has for the "original" values... But then wouldn't SFC launched from a bootable CD combat that issue?

Re:SFC Find It?

[omgwtfroflbbqwasd]

Generally, rootkits will modify function pointers in the kernel so that typical detection activities are trapped and handled so that the system appears unaltered. In the case of file access, the original file (in an alternate location, data stream, etc.) can be accessed in place of the trojaned one that was loaded on boot, thus preserving original the file size and contents.

Re:SFC Find It?

[shutdown -p now]

Is that how SFC works? It calls a method in the DLL? I would think it would do an MD5 (or similar -- possibly stronger -- hash) on the file, and compare the hash and the size to the known values. The only way around that would be to alter what SFC has for the "original" values...

The obvious other way around it would be to intercept file read/write calls (which trojan can do if it lives on kernel level, injected into some driver), and provide the original file contents to anyone who tries to read the file.

But then wouldn't SFC launched from a bootable CD combat that issue?

It would, but can you launch SFC from within one OS install on files belonging to another OS install?

Re:SFC Find It?

[RayMarron]

My comment applied only to running it in-place. Booting from CD is, AFAIK, the only way to see/get rid of rootkits. (My apologies if that's the way SFC is normally run)

Re:SFC Find It?

[maxume]

Examining the disk from an independent system (the software, so a boot cd works) is the only way to be sure that it is possible to see the rootkit, but most rootkits can be detected by several of the tools that exist for the purpose (from what I gather, the tools look for differences between what system file routines return and what lower level file system routines return).

Sure, a powerful enough rootkit will be hidden from both, but we (seemingly) haven't gotten to that point yet.

Re:SFC Find It?

[yuhong]

Yep, SSDT table hooking, which Windows x64 tries to prevent via PatchGuard. When Skywing that wrote the articles about bypassing it joined MS, I was wondering if anything changed about that in Windows 7. Anyone know?

Re:SFC Find It?

[jeff4747]

Is that how SFC works? It calls a method in the DLL? I would think it would do an MD5 (or similar -- possibly stronger -- hash) on the file, and compare the hash and the size to the known values. The only way around that would be to alter what SFC has for the "original" values... But then wouldn't SFC launched from a bootable CD combat that issue?

To quote the parent:

That's the the thing about a rootkit - it gets to tell the OS whatever it wants.

You need to think more about that last sentence, and these two points:
What, exactly, are you going to MD5?
The rootkit gets to tell the OS whatever it wants.

ATAPI.sys

[Anonymous Coward]

I have had to replace atapi.sys after doing offline scans of an infected systems' drives. Usually easy enough to copy it off a work system.

a driver used by Windows to connect hard drives

[BisexualPuppy]

ATAPI is an ATA driver for things that are NOT hard drive (think CDROM drives, floppy, etc).

Good

[Dan East]

The infected PC is unusable or it will be restored to a clean state. Either way it won't be spamming or participating DDOS attacks, etc.

No surprise if true

[al0ha]

I've performed a forensic analysis on numerous Windows machines and have discovered rootkits that have lived on machines undetected for up to two years even though they were up to date on patches and AntiVirus defs. In fact one of the rootkits was unknown until I discovered it and sent a copy to threatexpert and virustotal.

Re:No surprise if true

[JumpDrive]

Can you give us a little more information on how you discovered these rootkits?

Re:No surprise if true

[berashith]

It was named al0ha.trojan.jpg.exe and it was also sent to thousands of unsuspecting hotmail users at the same time as it was sent to threatexpert and virustotal ( they only got it as a secondary action) .

Re:No surprise if true

[The MAZZTer]

If you compare a file listing run from inside the machine to one run from a bootable CD OS where the rootkit can't load, different files are a dead giveaway that something is being hidden, and a rootkit can't work around this.

There are also lower level APIs one can use inside of an OS that are much harder for a rootkit to patch so such tools can also locate some rootkits without needing to boot from CD. See: RootkitRevealer

Re:No surprise if true

[lymond01]

If you run your XP box as root and allow items to be installed by clicking on an attachment or going to a website that runs an executable, no virus checker is going to stop you from hosing your machine. Vista's "cancel or allow" mechanism made fame by its annoying implementation (having to "cancel or allow" multiple times through a single process) but it was the best move Microsoft ever made towards their system's security. MacOS X and Linux have had "cancel or allow" mechanisms pretty much since their inception just implemented in a more user-friendly manner. Vista SP1 and Windows 7 makes the pop-up decidedly more tolerable.

Re:No surprise if true

[hoggoth]

No, he's suggesting a program that runs first under Windows to make a list of every file on the disk along with a checksum, then runs under Linux to make a list of every file on the disk along with a checksum. If the lists differ there is likely a root-kit hiding itself when running Windows.

Re:No surprise if true

[Lifyre]

Is there currently a set of programs that does this in some automated fashion that will generate a list of discrepencies to parse through?

Re:No surprise if true

[Skuld-Chan]

I had a machine with a rootkit on it (my parents laptop) file called srosa.sys - the only clue there was something wrong with the PC at all was it wouldn't run autocheck.exe and any file called chkdsk.exe was automatically deleted.

It also prevented the installation of any virus scan package - literally deleting and modifying files as they were installed.

Its like that hacker defender rootkit a lot of admins ran into a few years back (but didn't know about it) they were calling support about the information store crashing when you attached a file via the webmail interface. Here's the article in case anyone missed it:

http://blogs.msdn.com/jeremyk/archive/2004/07/19/187696.aspx

I think the scary thing is if anyone came along with a bug free rootkit that survived patching, didn't crash the OS or her applications/services and was undetectable most of us wouldn't think to look while the machine secretly sent all of our info to some machine in China.

Re:No surprise if true

[JumpDrive]

hopefully your question won't get washed out in the noise here on /. , because this is what I wanted to know. Because it really seems kind of silly that everybody would have to create this application.

Re:No surprise if true

[hoggoth]

Off the top of my head, without checking my syntax, do this:

find / -exec md5sum -b {} \; > filelist-win.txt
find / -exec md5sum -b {} \; > filelist-lin.txt

(find scans all the files from / down, running md5sum on each one)

Run each under Windows and Linux, respectively. On Windows you will need 'find' and 'md5sum' for Windows, or Cygwin for a full Linux subsystem.

diff filelist-win.txt filelist-lin.txt

Re:No surprise if true

[vmxeo]

Is there currently a set of programs that does this in some automated fashion that will generate a list of discrepencies to parse through?

I believe RootkitRevealer does, although it does it by comparing the files as shown through Windows to a raw read of the file table.

Re:No surprise if true

[Anonymous Coward]

Well, there's always md5deep and diff.

Re:No surprise if true

[al0ha]

Sure I can. We are generally alerted to the potential presence of malware on a system via a Snort alert. The help desk ran a boot scan of the system using a popular antivirus package updated with the latest defs and found nothing. I obtained the system and did a bit level copy of the hd. I then used some open source forensics tools (essentially the same tools that are the meat and potatoes of popular commercial forensics tools like encase) to examine the contents of the disk. I was able to locate the malware and pinpoint the original install date, details are too lengthy to go into in this forum. I generally submit anything I find to the two malware sites just to see what they come up with, especially if I find malware in a place heretofore unknown. Sometimes for fun I also run it on a test system so I can compare what happens on my system to what is reported by the two malware sites. Interestingly and often enough, there differences.

That must be why...

[tenco]

...my XP box didn't crash on reboot after applying these latest updates.

Re:That must be why...

[serialband]

I had been wondering about all those blue screen complaint posts too. Every systems I managed came up fine. I usually test patch one system first before I continue doing the rest.

Re:mirror please?

[n0tWorthy]

I just happen to have it open in another window:

Microsoft Update KB977165 triggering widespread BSOD One of Microsoft's "Patch Tuesday" security fixes is triggering a widespread "Blue Screen of Death" problem. The cause is not the update itself, but an existing infection. So far, reports suggest that this problem affects Windows XP and Windows Vista. Once the update is applied and the system rebooted, Windows will bluescreen at boot. When booted to Safe Mode, the system will freeze. Removing the update from the Windows Recovery Console or using live media will get the system booting again, at least until the update is reapplied. I have found that the root cause is an infection of %System32\drivers\atapi.sys, and that replacing this file with a clean version will get the system booting normally. This is not the first time that an infection hitting atapi.sys has caused updates to trigger bluescreens. If you are running Windows and have not yet applied this update, make sure you scan your computer thoroughly for infections before applying this update. If you are experiencing this problem, get your computer to a professional that can replace the infected atapi.sys and clean any other malware from your computer. References: http://isc.sans.org/diary.html?storyid=8209 http://social.answers.microsoft.com/Forums/en-US/vistawu/thread/73cea559-ebbd-4274-96bc-e292b69f2fd1 Detailed Repair Instructions Using the Windows XP Recovery Console 1. Boot from your Windows installation CD Insert your Windows installation CD and boot your computer. If your computer is not set to boot from CD first, you may need to reconfigure your BIOS or press a boot menu key (often F12, F8 or Esc). If you are unsure of how to do this, consult your favorite geek. As soon as the boot starts, you should see a message like "Press any key to boot from CD..." - press a key. 2. Start the Recovery Console After the CD loads (it may take a minute), you will be presented with a few choices. One of these options is to start a recovery by pressing "R". Press "R" to launch the Recovery Console. * You may be asked to choose a Windows installation. If so, choose the damaged installation (probably "1). * You may be prompted for the Administrator password. If you do not have one, press "Enter". 3. Identify your CD drive letter You should now be at the command prompt. Enter the following command: map Look for the drive letter for your CD drive. It may look something like this: D: \Device\CdRom0 In this case, your CD drive is "D:". 4. Replace ATAPI.SYS Enter the following, replacing "D:" with your CD drive: cd system32\drivers ren atapi.sys atapi.old expand D:\i386\atapi.sy_ You should see the message "1 file(s) expanded." - this indicates you have succeeded. 5. Reboot and scan for malware Reboot your computer. With a little luck, your computer will now boot normally. Because this problem is caused by malware, you should immediately scan your computer with up-to-date antivirus software. Tags: Malware, Security, Windows This entry was posted on Thursday, February 11th, 2010 at 17:22 and is filed under Security. You can follow any responses to this entry through the RSS 2.0 feed. You can skip to the end and leave a response. Pinging is currently not allowed.

had one yesterday

[Revek]

Scanned the drive in another machine and it detected atapi.sys as having a trojan. I restored it from /i386 and it came right up. I never thought it was connectd with the xp problems. Microsoft didn't do a evil thing who would have knew.

Re:had one yesterday

[Bobfrankly1]

Scanned the drive in another machine and it detected atapi.sys as having a trojan. I restored it from /i386 and it came right up. I never thought it was connectd with the xp problems. Microsoft didn't do a evil thing who would have knew.

You mean Microsoft didn't have evil intentions in this area of the patch. Bad idea to make a blanket statement based on one area of patch.

Re:had one yesterday

[Revek]

It wasn't a blanket statement about Microsoft. It was specific to this one incident.

oh and by evil I meant stupid,thoughtless and without responsibility .

Re:mirror please?

[n0tWorthy]

And some other salient responses:

Michael Bristow says:
2010-02-12 at 11:48
I had a machine come across my bench with this issue, first thing Wednesday morning. One of the first things I tried was running SFC form an ERD boot disk. it replaced several files including atapi.sys, but was still would not boot. only way to get the PC back up and running was to remove the patch.

Multiple scans, with no infection detected, and I tried re-installing the patch, only to get right back to Blue Screens.

In short, there is obviously more going on than just a problem with infected atapi.sys files.

  Jim Blizzard says:
2010-02-12 at 12:00
Very nice work Patrick,

We have seen this occur on a few machines at the FAA so I wrote a vbscript to loop through an .xls of machines and record the MD5 Checksum. Thought it may come in handy for yourself and some of your readers..

http://home.comcast.net/~jblizz/Atapi_MD5_Checker.zip

Inadequate regression testing

[Ralish]

Next time you might consider doing some backwards compatibility testing with popular rootkits, yes? Just a free tip Microsoft!

Re:Inadequate regression testing

[shutdown -p now]

Next time you might consider doing some backwards compatibility testing with popular rootkits, yes? Just a free tip Microsoft!

But if we do, the makers of less-popular rootkits could sue us in EU for monopolistic preferential treatment! ~

Re:Inadequate regression testing

[nschubach]

I'm sure the cases would be dropped like all the others. ;)

Bug-for-bug compatible

[Balial]

Does this mean Microsoft is going to have to support and test malware and remain bug-for-bug compatible to avoid bad press in future? That'd be awesome... "we can't accept this fix, it's not compatible with the great zombie bot of '10".

Re:Bug-for-bug compatible

[Sir_Lewk]

They could just have their update installer flip shit if checksums don't check out right, and refuse to take any actions. That would be the sane default anyways...

Re:Bug-for-bug compatible

[shutdown -p now]

Windows is already "bug for bug" compatible in many cases, though for the sake of real applications rather than trojans, of course. If you read The Old New Thing (Raymond Chen's blog), he often details some of the undocumented assumptions and accidental behavior that had to be supported for a long time just because some very popular software out there relied on it to work.

It's the unfortunate consequence of having backwards compatibility as a major feature - when it breaks for whatever reason when a new version of Windows is installed, users blame Windows, not the application. And MS cannot really handle this in the same way e.g. ext4 authors handled the major userland breaks they introduced by changing behavior (fully within the written spec), by saying, "well, you're all idiots and should have written proper code in the first place". Even when it's technically true...

Re:Bug-for-bug compatible

[gparent]

Yeah, because rootkits definitely don't hook to the kernel and can't patch the function that performs file reads. Right?

Re:Bug-for-bug compatible

[Sir_Lewk]

Well if I'm reading this right, this one at least didn't catch filesystem writes...

Re:Bug-for-bug compatible

[maxume]

The update isn't providing a new atapi.sys file, it is changing something that the rootkit (present in atapi.sys) depended on.

VirusTotal

[z4ns4stu]

Here's a link to the report from VirusTotal when you upload an infected atapi.sys.

http://www.virustotal.com/analisis/85aa49f587f69f30560f02151af2900f3dc71d39d1357727ab41b11ef828a7ff-1265925529

Re:VirusTotal

[tokul]

Here's a link to the report from VirusTotal

Half of most commons antiviruses don't think that is malware.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Sounds like a House-style diagnosis

[msbmsb]

Apply this patch to see if the machine is infected by some seemingly-unrelated rootkit.

Re:I'm in favor of requiring Internet User's Licen

[gyrogeerloose]

If you don't even have the strength of conviction to post with your name on it, I think that you should be denied issuance of your proposed Internet license.

And by the the way, "Internet" should be capitalized.

"It's not a bug, it's a feature"

[davidwr]

"Yes, our security update crashed your computer. We hope you enjoyed our anti-rootkit feature."

Re:mirror please?

[maxume]

The rollback fix and the possible malware link were both discussed in the story posted yesterday.

(I realize that getting a recovery console on a netbook with no optical drive is a bit of a chore)

Remove it with ComboFix

[cyprezzz]

I've seen this Tdss-rootkit on many machines. Usually it infects a disk driver like atapi.sys or iastor.sys. Typically an infected machine will boot in normal mode, but NOT in safe mode (blue screens). If Windows will boot, running ComboFix has removed the rootkit for me every time. The author of ComboFix is a genius.

Re:Remove it with ComboFix

[kaiser423]

Yes. ComboFix is the greatest thing ever. Whenever someone is having a problem, I tell them to go use ComboFix, and if that doesn't work, give me the computer. I've never had anyone give me their computer. It just works....flawlessly.

Went from fixing ~1 computer a month to none.

Re:Remove it with ComboFix

[sponga]

Theres a better patch out

http://www.microsoft.com/windows/windows-7/

Re:Remove it with ComboFix

[cyprezzz]

Yeah, you can load Windows 7 on this rooted Pentium 4 XP machine with 512M of RAM while Al Gore shovels my driveway.

Re:Remove it with ComboFix

[maxume]

Do note that it is simply a self extracting archive containing a batch file and some other tools (and it isn't clear that the tools have been licensed for redistribution).

WinRar and 7-Zip can both extract the file, the main program is 'C.bat'. It contains this entertaining text:

:: It's okay if you want to take a peek at the script but ...... :: please bear in mind that if you have to copy, that means you can't script it on your own. :: Copying means you don't understand enough. Also means you're not ready to make tools. :: Do yourself & everybody else a favor. Don't release anything that you dont fully understand. :: Chances of trashing a machine is high. Bide your time. If you work hard, your time shall come.

I've also seen it where the 'helpers' on malware sites say that they don't want to reveal how (their batch script) works, as it would help the malware writers (you know, the guys writing low level rootkits).

It also seems to use the 'probably won't break anything' approach to testing.

Definitely a buyer beware type of situation (but it has been used to help loads of people...).

Re:Remove it with ComboFix

[Kremit]

The TDSS rootkit (not sure how many variants do this...) installs itself as a Non-Plug-and-Play device driver. You can often remove the head of the rootkit by going to System Properties => Device Manager => View menu => Show hidden devices Then, click the + sign next to Non-Plug-and-Play devices. If there is a "TDSS*" device, you can delete it. I was able to recover a machine by doing this, then scanning for viruses. Obviously it's best to scan the hard disk externally or wipe the whole machine, but that might help someone in a pinch.

Re:Remove it with ComboFix

[karnal]

I had a set of machines infected with Virut. Combofix couldn't do much of anything - what this virus does is slowly infect all executable files on the system; of which most are in the c:\windows directory and below.

A total fresh install is the best option - unless you happen to have an identical clean machine nearby.....

That does not matter.

[khasim]

ANY company replacing files on your drive should be checking to make sure that those are the exact files that it wants to replace.

If there's any difference in the files the installer should exit with a nice error message AND LEAVE EVERYTHING THE FUCKING SAME WAY IT FOUND IT.

Yes, this was from a virus/trojan/worm/whatever. Who cares? It could just as easily have been a custom file for custom hardware.

Re:That does not matter.

[Anonymous Coward]

The issue appears to be the result of an infected driver relying on some internal bits of the kernel that were patched. It's actually the author of the software that infected the driver that's causing the problem.

The infected driver was _NOT_ part of the Windows update and the update had no dependency on that driver.

This is not Microsoft's fault.

While I'm all for free speech, I do prefer that the speaker have some soft of expertise on the topic.

Re:That does not matter.

[Cl1mh4224rd]

Yes, this was from a virus/trojan/worm/whatever. Who cares? It could just as easily have been a custom file for custom hardware.

You don't know how rootkits work, do you?

It may not be possible to detect differences in a compromised file on a rooted system, because the rootkit will respond to requests with the original file's information.

So, for all we know, Microsoft did check the file before replacing it, but the rootkit told the OS it was unmodified.

Re:That does not matter.

[anamin]

And what happens when the rootkit bypasses the operating system access to that file and returns the expected results? This is a rootkit after all.

Re:That does not matter.

[Opportunist]

And HOW exactly should they check if the system has been infected by a rootkit that shows the patcher a file that matches the checksum?

Re:That does not matter.

[V!NCENT]

Checksums, 'nuff said...

Apps: Calc this for me...

rootkit: errrrrr.... ?

Apps: Busted, fscker! *and warns user*.

Re:That does not matter.

[MarcQuadra]

Won't work. To take your analogy a bit farther...

The thief is the rootkit, you're the kernel, and the patch is the police.

The thief is already in, hiding behind the sofa with a gun pointed at your head. The officer knocks on your door and asks if you're being robbed. The answer is 'no'.

A rootkit can invade the lowest-level of the Virtual File System, so when a patcher running in user space asks for the checksum of the file it's about to patch, it gets a 'clean' result, even if the -real- file on the disk is something entirely different.

There are a lot of misconceptions about what rootkits really are. I encourage anyone to take a few hits of LSD and explain physics to me, or perform surgery on themselves while under the influence, that's about the closest thing I can compare to patching or rootkit detection on a system that's already compromised.

Re:That does not matter.

[Anonymous Coward]

It seems you don't really grasp the concept of a rootkit.
You are not asking the burglar, you are asking the owner and he'll state that the burglar is supposed to be running around in his house - because he is being controlled by a rootkit.

The rootkit intercepts system calls/api calls/etc and makes sure that e.g. calculating a checksum of the file will yield exactly the results you'd expect from the real file.

Re:That does not matter.

[KingMotley]

You fail at understanding rootkits.

Re:That does not matter.

[ZosX]

Indeed. A well conceived root can hide itself from pretty much everything. I owns your system. If it wants to return a proper checksum it can without issue. If it wants to copy the real file back in place so nothing looks suspicious after loading, then sure why not? Rootkits can be incredibly hard to detect.

Re:That does not matter.

[dissy]

You don't know how rootkits work, do you?

Yes. Rootkits return the checksum the verification app is expecting.

So?

There are other programs out there that modify files.
A file, even a core system file, could be modified by any number of things for any number of reasons.

Hell, pretend YOU modified it! Microsoft's patch would still have overwrote it despite it not being the correct file to replace. It would still cause problems with unknown states the software would then be in.

Pretending rootkits are the only programs in existence that edit files on the drive is silly.

Re:That does not matter.

[anthonyfk]

But if _I_ modified it, then the checksum would be different.

Re:That does not matter.

[bhtooefr]

Except the rootkit may even keep a copy of the uninfected file around, such that a filesystem call to the file will result in a copy of the correct file being handed over.

Re:That does not matter.

[Erinnys Tisiphone]

Actually, there was an infected version of the affected ATAPI.sys uploaded to SANS ISC, and its checksum is different than the legit ATAPI.sys. Here's the Virustotal of the atapi.sys file from a machine that blue-screened: http://www.virustotal.com/analisis/85aa49f587f69f30560f02151af2900f3dc71d39d1357727ab41b11ef828a7ff-1265925529 Here's the Virustotal of a clean and unpatched atapi.sys file: http://www.virustotal.com/analisis/0e6b23a80f171550575bebc56f7500cd87a5cf03b2b9fdc49bc3de96282cd69d-1265930822 However, there may be more than one rootkit involved in the debacle.

Re:That does not matter.

[dissy]

But if _I_ modified it, then the checksum would be different.

Exactly my point. If you modified the file, the checksum would be different, and thus when Microsofts patch doesn't bother to check that at all, it will overwrite your changes and if it is a system file, possibly bsod you.

So while this one specific case of a rootkit can't be blamed on the patch, because even if they verified the checksums, it would have matched and been replaced.

But Microsoft can be blamed for not verifying checksums.

Yes, doing so would not have prevented this specific case with the rootkit. That doesn't mean it isn't a problem.

Re:That does not matter.

[klui]

You don't know how rootkits work, do you?

Yes. Rootkits return the checksum the verification app is expecting.
So?

Apparently you don't understand what a rootkit does to evade detection.

Re:That does not matter.

[V!NCENT]

A rootkit can lie... It can say "It is 3MB and this is the signature" while it is not. But if you tell the rootkit "Oh realy? Well then... perform the following formula with this 'genuine' library for me". The rootkit will either cause an error like this BSOD, or return a correct awnser, but the awnser is not the same as the code that the original library would return.

So the checking app will get back a value, let's say 302,96 and compares that value to what the original lib would return and if these do not match it can warn the user. Simple as that.

Seems to me like you fail at computer security for not knowing how to manipulate...

Re:That does not matter.

[KingMotley]

Nothing worse than someone who proclaims they know something, and they don't. You obviously don't grasp the rootkit concept, so I suggest you go do some research before someone relies on what you say and they get burned.

Re:Question

[z4ns4stu]

I didn't grab the file myself. The link is from comments the original blog poster had made at isc.sans.org.

Removing known rootkits

[davidwr]

If you know the behavior of rootkit X version Y, it is usually possible to write a tool that specifically disables X version Y without resorting to a known-good-media boot.

However, it may be useless against rootkit X version anything-but-Y.

This is most useful for rootkits that either aren't stealthy enough or which are associated with non-stealthy viruses.

If the rootkit is sufficiently stealthy, the end user may never suspect he has a problem.

The moral of the story: If you are a malware writer and want your code to be undetected, stay below the radar and don't do anything to attract attention to yourself.

At rainbow's end: Win32/Alureon.A detected

[westlake]

After all, there's no way that their malware tool could have spotted it, or the update could have checksummed the files before patching them.

If they put half as much effort into their anti-malware activities as they do into their DRM regime, the world would be a better place. We'd all have unicorns, and a pot of gold.

Microsoft does detect it - and has since last October.

File atapi.sys received on 2010.02.11 21:58:49 (UTC)

Virus:Win32/Alureon.A
Updated: Dec 07, 2009

Aliases:

Win32/Olmarik!generic (CA) Rootkit.Win32.TDSS.u (Kaspersky)
W32/TDSS.drv.gen4.A (Norman)
Mal/TDSSPack-V (Sophos)

Encyclopedia entry

Updated: Dec 07, 2009 | Published: Dec 02, 2009

Aliases

Win32/Olmarik!generic (CA) Rootkit.Win32.TDSS.u (Kaspersky)
W32/TDSS.drv.gen4.A (Norman)
Mal/TDSSPack-V (Sophos)

Alert Level
Severe

Detection initially created:
Definition: 1.69.77.0
Released: Oct 23, 2009

There are no common symptoms associated with this threat. Alert notifications from installed antivirus software may be the only symptom(s). When the infecting trojan is run, it infects a system driver, usually 'atapi.sys'. It has also been observed to infect 'iastor.sys' but other system drivers may also be targeted. The system driver detected as Virus:Win32/Alureon.A is infected by the addition of code, whose function is to load a part of the Alureon rootkit. The Alureon rootkit is a component that gives Alureon the ability to avoid detection; it is created by the same Alureon trojan that infects the system driver. The rootkit loaded by Virus:Win32/Alureon.A has the ability to avoid behavior blockers, which allows it to perform its malicious routines uninterrupted. It can also hide files and disk sectors.

Manual removal is not recommended for this threat. To detect and remove this threat and other malicious software that may have been installed, run a full-system scan with an up-to-date antivirus product such as Microsoft Security Essentials... . Win32/Alureon may modify DNS settings on the host computer, thus the following steps may be required after the Win32/Alureon removal is complete:
If the computer has a network interface that does not receive a configuration using DHCP, reset the DNS configuration if necessary

Re:At rainbow's end: Win32/Alureon.A detected

[yuhong]

Yea, I'd suggest that MS add detection and removal for this rootkit to the MSRT.

Comment removed

[account_deleted]

Comment removed based on user account deletion

If this was a one-time-thing, then yes.

[khasim]

But when taken with Microsoft's entire approach, no.

Microsoft has always chosen "ease of use" over security. And then their licenses are constructed so that a large segment of the machines out there don't even have clean-bootable media to resolve issues like this.

In your pot hole analogy, Microsoft didn't build the road ... and then then pot holes appeared. Microsoft built the road with the holes ... and then even more appeared and they're doing nothing to mitigate the situation and they're still building the roads the same way.

Re:If this was a one-time-thing, then yes.

[jazman_777]

Points for not using a car analogy, but a road analogy is still too close for comfort.

ATAPI.SYS Infections

[nlewis]

I run a small computer repair shop, and we first started seeing this ATAPI.SYS virus a few weeks ago. When I would submit it to VirusTotal, it would always come back as clean on every single virus scanning engine - but I could tell it was infected. I even had a computer in here just yesterday which had the infected ATAPI.SYS file, yet it was not detected as such - even when the hard drive was mounted as a secondary drive in another system and scanned with several up-to-date antivirus programs.

The virus itself is actually quite a clever little beast. After infecting the file, it sets the file modification time back to the original date & time, which makes it hard to tell that it's been modified. Also, I've noticed that the byte counts between infected and non-infected versions of the file are almost always identical. But to do that, it appears to be injecting its code into the area normally used to store the file version information. The upshot is, if you check the file properties and there's no file version information (the Version tab under XP or the Details tab under Vista/Win7), there's a good chance the file is infected.

I have not had any computers come in to the shop with the BSOD mentioned in the articles yet, but I'm expecting them at any time...

"Rootkit May Be Behind Windows Blue Screen"

[thatskinnyguy]

Rootkit? I don't see it. Maybe it's because this damn blue screen is blocking my view.

mommy

[pydev]

Mommy, the root kit did it!

Re:I'm in favor of requiring Internet User's Licen

[Opportunist]

I have no idea why you get modded Flamebait, maybe because you dared to suggest something that "takes away freedoms".

Bluntly, if anything it might save our freedoms. Because, well, do you think our politicians will not use the rampart spreading infections to spin? "You cannot take care of your computer, therefore we have to limit your ability to install stuff. Only approved applications may run anymore and that way no spyware can infect your machines. And only machines that adhere to this standard may join the internet".

Watch the sheeple cheer. Yay! Finally safe and protected from those evil malware infections!

Re:M$ at root of problem...but wont admit

[e2d2]

Do you have any evidence or are you just spouting off bullshit? No need to answer, it's a rhetorical question.

Seriously though, guys/girls like yourself need to get a fucking grip. When you say "M$" you sound like a tool. When you cry foul when there is none you sound like a tool. When you make baseless accusations against someone because they are trying to inform people of a potential rootkit problem you sound like a tool.

Summary: You sound like a tool and people won't listen. So any future complaint or criticism, however legitimate, will simply be ignored.

checksummed what files?

[YesIAmAScript]

atapi.sys isn't the file that is patched, it's the file with the rootkit in it.

You're saying MS should have checked atapi.sys before replacing another file? How many files does it need to check before changing a system file? This rootkit is calling into other DLLs in a way that is designed to bypass safety measures, is it a wonder MS' safety measures don't prevent it?

If you learn one thing, learn this. MS doesn't patch files with their updates. They only replace them. So this can't be a case of a patch (offset or context) going awry.

MS does put a lot into their anti-malware activities. It's just it isn't in their 8 year old OS. When you redesign a system, sometimes you can't backpatch it into older stuff. If you ran the newest OS, you would have been protected from this particular malware.

How could one check for rootkits?

[trytoguess]

The comments here suggest ideally using a bootable CD to scan the drive, but what exactly should one use?

Re:How could one check for rootkits?

[arndawg]

Avira has an okay livecd you could use.

Good way to lose users

[DeadCatX2]

Several weeks ago, I worked on a PC that was probably infected after doing a few Google Image Searches or browsing DeviantArt or something of that nature. I tried multiple virus/malware programs (AVG, Avast, Adaware, MalwareBytes, Spybot). I thought I got rid of the infection...then a Windows Update caused her computer to blue screen on boot.

My solution?

http://www.ubuntu.com/GetUbuntu/download

Re:Good way to lose users

[DeadCatX2]

Fixed it is. Didn't have to delete the old Windows partitions. The data is still there. And it does everything it did before - stream videos through the S-Video output to the TV, view the TV tuner card, browse the Internet, play Flash games, read email/facebook, etc.

Sure, if it breaks she probably won't be able to fix it. But it hasn't broke yet, and after all I did have to come fix Windows, too. The computer can install security updates and it doesn't need to reboot. No more virus scanner. No more malware, trojans, or rootkits.

Re:Good way to lose users

[TrancePhreak]

Just apply some updates and it may break, especially if you're talking about Myth for the TV stuff.

Tell You What (Re:Ah, well, that lets Microsoft...

[EXTomar]

The problem isn't that Microsoft needs to insure compatibility with third party software. It is the fact that they allowed someone to modify their core OS system in this way to begin with. The world has the development and technology to make the OS at that level "tamper proof" but why hasn't been done yet?

I'll tell you what: If Microsoft wants to enforce WGA and other validation schemes then they should at least make sure there isn't something else running around the kernel. At this point too many users can't tell the difference between WGA and some kit where if they aren't going to provide some validation of the running software then what is the real difference between their "service" and malware?

Product idea for Microsoft support?

[oldenuf2knowbetter]

Why doesn't Microsoft Support make available a downloadable ISO (or a program that creates one) of a bootable CD. After burning, that CD would contain a minimal operating system, something like System File Checker, and the name, path, and hash of every current system file for the OS to be tested.

Users would boot from that Microsoft-provided CD and let it diagnose their system. Files failing the hash would be noted and reported to the user who might then be offered the opportunity to download known good copies directly from Microsoft. A simple installer would place the good files where they belong and then allow the user to re-boot from his now clean hard drive.

Does this already exist and I've just missed knowing about it? I know that I'd use it if I had one. And not just for infestations, as it would also be very useful for repairing file corruption from degrading disk drives.

Re:Product idea for Microsoft support?

[cdrguru]

Probably this would be pretty useless. Maybe not, but probably.

You see, there are some common Windows files, but there are a lot more that are type-dependent. So it would be dependent on the installation type (XP Pro, XP Home, Media Center Edition, etc.) I don't know how many there are for XP, but it is more than just a few.

Next, just checking what you would like to believe is "current" isn't going to work. There are hotfixes, optional updates and various dependencies in the updates. Therefore you are going to have to have a hash for nearly every patch level of every file. That would be the real killer for this - 1000 hashes for user32.exe, 25 for cdfs.sys, 2500 for ntdll.dll. You get the idea.

This is why they haven't done that already. Just running System File Checker would be OK, and I believe this can be done from the repair console.

Let's go a little further with that.

[khasim]

It is the fact that they allowed someone to modify their core OS system in this way to begin with. The world has the development and technology to make the OS at that level "tamper proof" but why hasn't been done yet?

Now look at what the ideal "best practices" would be for an OS.

Then look at Windows 2000 (all versions). How did that differ from the "best practices".

Now look at every version since. In theory, each version SHOULD be getting closer to "best practices".

In reality, Microsoft has done nothing to improve the security of their systems. Even though they've had 20+ years of real world data about how their systems are cracked.

Re:mirror please?

[PitaBred]

You know that an external USB DVD drive is what, $50 at Best Buy? Cheaper online?

It's not a bug, it's a feature.

[gimmebeer]

Your computer is more secure now. You're welcome. -Microsoft

Re:It's not a bug, it's a feature.

[HoboCop]

This. Seems like they fixed a vulnerability, and if your machine is infected then tough shit. I like this approach, personally. Infected machines get knocked off of the network = good thing.

Re:M$ at root of problem...but wont admit

[e2d2]

When you bitch about people having nicknames for MS, you sound like a tool.

ORLY? News to me.

Re:MOD PARENT UP

[nschubach]

AC's don't get mod points! ;)

Ways to alleviate this problem...

[madhatter256]

I have just repaired TWO computers with this rootkit infection. Both are XP Pro machines made by DELL.

What I did was simply do a repair installation onto the OS. This requires the XP Pro CD OEM (the kind where you can boot into recovery console).

I did the automatic repair install. Got into the desktop and managed to install Malware Bytes onto both machines. I also updated Malwarebytes. Then I did a full scan of the PC, and eventually the program managed to find numerous infected files on the PC. They all had the same trojan: Vundo, among other ones.

After removal, both PCs functioned normally and was able to run a full batch of Windows XP updates, including SP3.

Re:Ways to alleviate this problem...

[VTBlue]

//Microsoft Employee here//

Check out Microsoft Security Essentials if you work with customers computers.

http://www.microsoft.com/Security_Essentials/

It is 100% free and has gotten favorable reviews. It is also very minimalist in design and simple to understand by non-technical people.

http://www.pcmag.com/article2/0,2817,2353447,00.asp

Will reinstalling XPSP3 be a good starting point?

[KJSwartz]

I'm tossing in this idea reloading SP3 may be a proper starting point.

Re:So much for AV protection

[yuhong]

Actually it targets atapi.sys, which is not updated by this patch, not the kernel.

Re:M$ at root of problem...but wont admit

[hesaigo999ca]

>When you make baseless accusations
12 years of software development and tech support with windows,
what have you got under your belt???
>So any future complaint or criticism, however legitimate, will simply be ignored.
Maybe by an ignorant man such as yourself, but I know the vb.net community I am in,
regards what I have to say with a little more respect, but then again, they might just all be tools too.

Societal / National Security problem...

[lotho brandybuck]

At what point will it be decided that common rooting of a box that people are using for banking, health, etc in their house is Not Okay?

How much damage will have to occur before that point? I feel like we've been at Sept 10th for awhile in terms of information security.

What is going to happen after that damage occurs??

Re:What is pitiful

[adonoman]

When you've been rooted, all you can do is format and reinstall from trusted media. Uninstalling the patch at least lets you access your data and hopefully copy it off before formatting.

cache of related info

[bl8n8r]

(since TFA appears down at this time)..

http://isc.sans.org.nyud.net/diary.html?storyid=8209
http://forums.malwarebytes.org.nyud.net/index.php?showtopic=39655
http://www.wilderssecurity.com.nyud.net/showthread.php?p=1622432
http://www.prevx.com.nyud.net/blog/139/Tdss-rootkit-silently-owns-the-net.html

Re:I'm in favor of requiring Internet User's Licen

[hairyfeet]

Because ANY law WILL be abused, full stop. You make it so everyone has to have an "Internet License" and no longer can posts anon, you know what you will get? "Oh you posted something mean! don't you remember the Myspace suicide girl? No net for you!" "How dare you speak out against dear leader! Don't you support our troops? No net for you!"

If you passed crap like that pretty soon the entire net would be nothing but the Home Shopping network. "Gee isn't product X swell? It sure is Biff!" because you won't dare say anything that could get your driver's license revoked. The problem with comparing the Internet to IRL is that it isn't real folks. It is easy to show some guy had a BAC equal to falling down drunk and was doing 80 in a 30 and needs his license revoked.

But with the Internet the "rules" would end up getting written by politicians pandering to the PC police and every interest group with a checkbook. The "think of teh childrenz!" groups alone would try to turn everything into Mr. Rogers while the bible thumpers would want everything to be Jesusland, and of course the Scientology nuts would have your license for daring to even THINK the word Xenu. yeah, no thanks, I'll stick with what we got now, thanks anyway. I haven't seen a bug since 98, and working PC repair I can say you just can't fix stupid.

Re:mirror please?

[omnichad]

Well...please share. How do you activate a Dell machine with a standard installation CD?

TOLD YOU SO

[GameboyRMH]

http://slashdot.org/comments.pl?sid=1546966&cid=31115634

Re:Tell You What (Re:Ah, well, that lets Microsoft

[jeff4747]

The world has the development and technology to make the OS at that level "tamper proof" but why hasn't been done yet?

No, actually it doesn't. That's because it's impossible to make it "tamper proof".

Come up with any protection mechanism you'd like. As long as the computer still turns on, malware can infect it.

Malacious Software Removal Tool Win32/Alureon

[westlake]

Yea, I'd suggest that MS add detection and removal for this rootkit to the MSRT.

It's already there.

Malware Families Cleaned by the Malacious Software Removal Tool [June 05 to date], Win32/Alureon [Updated Jan 5]

The rootkit hasn't forgotten the old folks still on dial-up:

If a dial-up connection is sometimes used from the computer, reconfigure the dial-up settings in the rasphone.pbk file as necessary, as Win32/Alureon may set the fields "IpDnsAddress" and "IpDns2Address" in the rasphone.pbk file to the attacker's address. The Microsoft scanner code that automatically removes Win32/Alureon backs up the infected dial-up configuration file to:
%allusersprofile%\Application Data\Microsoft\Network\Connections\Pbk\rasphone.pbk.bak

The latest addition to the list is Pushbot [Jan 27]

Using backdoor functionality Win32/Pushbot can be ordered to spread via MSN Messenger by a remote attacker. It sends a message to all of the infected user's contacts. Some variants may also spread using other instant messaging programs, such as AIM.

The worm can be ordered to send messages, which can contain URLs pointing to a remotely hosted copy of itself. The message may be provided by the controller via the IRC backdoor. Some variants of Win32/Pushbot may also spread by copying themselves to removable drives (other than A: or B:, such as USB memory keys) Some variants may be ordered to spread by copying themselves to the shared directories of various peer-to-peer file sharing programs, using filenames such as the following: KEY-GEN Adobe PhotoShop CS3.exe.

Some variants instead may attach a zipped copy of themselves to the [IM] message and/or randomly choose messages from a provided list. As an example, some variants use the following messages:

WoW? is that really you... what the hell where you drinking :D
LOL, you look so ugly in this picture, no joke...
Should I put this on facebook/myspace?
Hey m8, who is this on the right, in this picture...
Sup, seen the pictures from the other night?

Manually removing TDSS

[nuckfuts]

The first time I came up against a TDSS infection it was incredibly hard to deal with. Then I learned a little trick to disable the thing:

• Start Device Manager
• Click View, Show Hidden Devices
• Scroll down to Non-Plug and Play Drivers
• Click + at left
• Right-click on TDSSserv.sys or TDSSxyz.sys where xyz are random characters, clbdriver.sys, gaopdxserv.sys, seneka or seneka.sys

This information is from about 1 year ago, however. I haven't looked at any current variants, so they might be quite different. Nevertheless, the technique of installing as a device driver was novel to me at the time, and may still be used. Just as with autorun entries, check your Non-Plug and Play devices. If you see something with a name that looks randomly generated or otherwise suspicious, you might want to disable it.

Re:Manually removing TDSS

[nuckfuts]

Oops, I didn't paste the final steps:

• Click Disable
• Click YES to confirm
• Reboot

Patrick Barnes may have been /.

[Neanderthal Ninny]

Or did Patrick Barnes server crash because of this bug?
I did access Patrick Barnes webpage earlier in this week, but today Friday February 12, 2010 there is no server and IP address to connect to. Any word from Patrick Barnes from other than his website? Did we /. his website out of existence?
I read his webpage and he did put a solution on his webapge to detect and fix this but now the webpage is gone and now I wonder what happened to it.

Caught that too...

[Aredridel]

Caught that myself yesterday. http://aria.blogs.theinternetco.net/2010/02/11/kb977165-causes-a-blue-screen/

Re:I'm in favor of requiring Internet User's Licen

[hairyfeet]

Because you are trying to think rationally dude, and the ones writing the laws don't actually do that anymore. if they did we wouldn't have eternal copyrights and you wouldn't be looking at PMITA prison for looking at Hentai or a Lisa Simpson cartoon.

Today is all about pandering or corruption, and since I can see many corps shelling out good money to write Internet Licenses legislation, that leaves pandering to the blue hairs, the bible thumpers, and the other fringe groups that make up the base. So you would have knee jerk politicians adding removal of your license for "cyber bullying" and the religious adding removal for defamation of their beliefs, and of course Scientology would ban Xenu once and for all.

I mean seriously dude, when was the last time you saw a law that wasn't either a blatant kickback or pandering bullshit? The Internet is one of the last places where you can speak your mind and be heard by a wide audience. There are too many jack boot lovers that would just love ANY excuse to stop those that are different from them or don't support their dogma. Let us not give them rope to hang us with, okay?

Basic security principles

[curryandbeer]

If you want a system thats totally locked down and doesn't let you do ANYTHING remotely useful then go buy an iPad. Else don't go live on the internet when logged on with Administrator privilages. Basic security principles! That way the bad boy dodgy software can't install itself.